Unsupervised Learning for Insider Threat Prediction: A Behavioral Analysis Approach

Abstract—Most devastating cyber-attacks are caused by insiders with access privileges inside an organization. The main reason of insider attacks being that effective is that they don’t have many security barriers before they get into the critical resources of the system. Different machine learning techniques have been previously utilized to predict and identify insider threats within cybersecurity data, but such kind of models face a critical limitation as they require training on labeled datasets, rendering them less effective for real-time data streams which lack threat presence indicators. This work presents an unsupervised machine learning approach that predicts insider threat using behavior analysis for real-time threat data. Patterns are identified in user behavior, to make predictions about benign and malicious insiders. Features are selected by analyzing activities performed. Selected features are utilized to feed machine learning model which extracts anomalous behavior among users, using anomalies in