Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams – Arxiv Vanity

Researchers have also applied neural network-based approaches to cybersecurity tasks. Ryan et al. \shortciteryan1998intrusion train a standard neural network with one hidden layer to predict the probabilities that each of a set of ten users created a distribution of Unix commands for a given day. They detect a network intrusion when the probability is less than 0.5 for all ten users of the network. Differing from our work, their input features are not structured, and they do not train the network in an online fashion. Early work on modeling normal user activity on a network using RNNs was performed by Debar et al. \shortcitedebar1992neural. They train an RNN to convergence on a representative sequence of Unix command line arguments (from login to logout) and predict network intrusion when the trained network for that user does poorly at predicting the login to logout sequence.