Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams

Understand

Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations.

• Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst.
• As a prospective filter for the human analyst, we present an online unsupervised deep learning approach to detect anomalous network activity from system logs in real time.
• Our models decompose anomaly scores into the contributions of individual user behavior features for increased interpretability to aid analysts reviewing potential cases of insider threat.