Application of machine learning methods to counter insider threat to information security

Strizhkov Vladislav Alexandrovich Postgraduate student, Information Security Department, Financial University under the Government of the Russian Federation 125167, Russia, Moscow, 49/2 Leningradsky Ave. 218668@edu.fa.ru

1. Introduction

In the modern world, insiders can be a serious threat to the organization in which they work, so preventing malicious actions by insiders in the organizational system is an important task for cybersecurity. Organizational security measures are well known to an experienced insider, and he can easily find loopholes, and existing security policies in organizations are focused more on external threats, sometimes ignoring the possibility of internal threats. If the necessary security measures are not implemented in the company, the insider gets space to steal important data without specific obstacles, which causes irreparable damage to the organization, both direct material and indirect image ^[1]. In this regard, in the current realities, when the perimeter of protection against hacker and other external threats has already been built at a sufficiently high and technological level, it is worthwhile to shift the focus from external threats to internal ones for a while, give importance to this problem and find new solutions. However, difficulties are often associated with the fact that there is little real statistical data on the insider threat and the corresponding damage ^[2].

The insider threat can be roughly divided into three main categories that companies regularly have to deal with: a malicious insider, a "careless" insider and a compromised insider. A malicious insider is a type of insider who intentionally wants to steal protected data, disclose information, or use any other means to harm an organization. An insider threat "due to negligence" or an unintended insider occurs when employees do not know security rules or do not follow security procedures, exposing the company to the risk of infection with malicious software and data disclosure, thus becoming unintentional internal violators. Finally, a compromised insider threat is a malicious insider whose credentials have been compromised by a hacker through social engineering, credential collection, phishing email messages, or methods that exploit the vulnerability to steal data or through illegal financial transactions.

Along with the cybernetic and technical scenario, one of the most important tasks is the identification and implementation of behavioral (sociotechnical) indicators of insider threat risk. When we look at the data available to verify the behavior of an insider threat, we often ignore the human side of the issue ^[3]. This problem has been investigated by experts for many years, and there are already noticeable successes in the process of finding a solution. One of them is text analysis using machine learning algorithms. In addition, there is evidence that learning algorithms with a teacher provide better memorization compared to semi-supervised and unsupervised methods when they get more details ^[4].

In this article, special attention is paid to the categorization of e–mail from a special dataset (hereinafter referred to as ND), which contains realistic examples of insider threats based on gamified competition obtained using various machine learning technologies. First, preprocessing techniques such as stemming, stopword removal, and tokenization are used to clean up the data. After that, Adaboost learning algorithms, as well as Bayes algorithm, logistic and linear regression, and the support vector machine method are applied to the dataset to obtain information. The results obtained using these algorithms are compared and analyzed.

The study is divided into several sections. The existing approaches related to this study are presented in section 2. Information about the dataset and methodology is discussed in section 3. The results of the study are presented in section 4. Upcoming work and concluding observations are discussed in the fifth section.

2. Existing approaches

The scientific community is faced with the fundamental problem of detecting an insider threat. The public sector and cybersecurity services refer to the same problem, calling for effective strategies to be found. The available works of scientists devoted to the issue are presented below. Of course, there are many of them, in this case, those that involve machine learning technologies have been selected, and therefore they deserve special attention, since they can be further used to contrast the results of the current study.

Diop Abdoulaye et al. ^[5] proposed a model for detecting behavior anomalies, which is a step towards building a custom behavior verification system. This method combines the machine learning classification method and graph-based methods based on linear algebra and parallel computing procedures. The accuracy of their model is 99% on a representative set of access control data.

Duke Lee et al. ^[6] proposed an intelligent user-oriented system based on machine learning. In order to closely monitor the insider, malicious user behavior was tracked using detailed machine learning analysis in real-world conditions. To provide an actual approximation of system performance, a comprehensive analysis of popular internal threat scenarios with multiple performance indicators is provided. The results of the study indicate that an artificial intelligence (AI)-based monitoring and detection system can detect new internal threats based on unmarked data with high accuracy, since it can be trained very effectively. The study says that approximately 85% of such insider threats have been successfully identified with a false positive rate of only 0.78%.

Malvika Singh et al. ^[7] carried out insider threat detection by working on another approach – profiling user behavior to observe and study the sequence of actions of user behavior. The researchers presented a hybrid machine learning model consisting of "ultra-precise neural networks (CNN)" to identify stabilizing outliers in behavioral patterns, achieving detection accuracy of 0.9042 and 0.9047 on training and test data, respectively.

Following this, Ju Ming Lu et al. ^[8] proposed a system based on a deep neural network with long short-term memory (LSTM), called the "Insider Catcher", for learning system file entries that act as a natural structured sequence. To distinguish normal behavior from malicious behavior, their system uses patterns that define user behavior. Experiments and results showed that the proposed method demonstrated better performance than the ubiquitous log-based anomaly detection system. The performance of this system is sufficient for real-time online scenarios.

Finally, we can note the approach of Hawai et al. ^[9], which uses the "Isolation Forest" - an unsupervised learning algorithm to detect anomalies and identify insider threats from logs taken from the network.

3. Research methodology

In this section, we will implement some of the methods that have been adapted for data analysis. This includes defining a dataset, methodologies such as machine learning techniques, and detecting abnormal emails. Figure 1 shows a brief description of our system, which consists of four blocks: a block of data collection and preprocessing, a block of data transformation, a block of supervised learning and a block of classification, respectively. Each block is described in detail in the following subsections.

Fig. 1. Vector representation of text data

3.1. Data set

The dataset (ND) was collected based on the actual user interaction with the host machine, which contains both legitimate user data and malicious insider instances (masqueraders and traitors) ^[10]. The ND contains data obtained from six data sources (keystrokes, mouse, host monitor, network traffic, email, and login), as well as additional results from the psychological personality questionnaire. The ND contains the behavior of 24 users that were collected within 5 days. It contains twelve copies of the masquerade, each lasting 90 minutes, and five potential copies of the traitor, each lasting 120 minutes. Emails have been found to be an important attribute for detecting internal threats. In the order in which users send emails, the activity of all users is contained in a single file. It includes information such as timestamp, header, sender, recipient, functions extracted from the body of the email.

3.2. Machine Learning

This method allows you to identify patterns of dangerous behavior of internal violators. The article discusses the following learning algorithms:

1) Supervised learning – can be fruitful when a confirmatory answer is known. All emails from the dataset are classified as "Regular Email" or "Abnormal Email". The tasks of teaching with a teacher are divided into two categories: "Classification" and "Regression".

2) Classification – the results are predicted in a discrete output. The input variables are divided into discrete categories. Classification algorithms:

· The K-nearest neighbor algorithm examines the entire dataset for the k number of most homogeneous or adjacent cases that point to the same model as the row with the lost data. The element is discarded by the majority of votes of its neighbors, the element is assigned to the most common class among the nearest neighbors k ^[11].

· The Bayes algorithm is a simple learning algorithm that uses the Bayes rule simultaneously with the strict assumption that attributes are self–sufficient for a given class. Despite the fact that this presumption of freedom is often abused in everyday life, nevertheless, Bayes still provides accuracy for competitive classification ^{[12, 13]}.

·      The support vector machine is a linear model for classification. The algorithm creates a line or hyperplane that divides the data into classes. ^[14].

3) Regression – the results are predicted in a continuous output. Input variables are mapped to a continuous function. Regression algorithms:

· Linear regression – consists in finding the most effective straight line across the lines. The line that fits best is called the regression line. The linear regression algorithm studies the linear function f(x,w), which is a mapping of f :?x ? y. It is a linear combination of a fixed set of linear or nonlinear functions of the input variable, denoted as ?i(x) and called basic functions. The form f (x, w) is equal to:

where w is a weight vector or matrix w = (w1, ..., w D)T , and ? = ?(1, ... ,D)T .

·      Logistic regression is an analytical method similar to linear regression that discovers an equation to predict the outcome for a binary variable Y from one or more response variables, X. Response variables can be categorical or continuous, unlike linear regression, since the model does not require continuous data. To predict group membership and finite type placement, an iterative maximum likelihood method is used instead of the least squares method, using a logarithmic ratio of chances rather than probabilities ^[15].

4) Adaboost, known as "Adaptive Enhancement", is a meta-learning algorithm that combines weak classifiers into a unique strong classifier. AdaBoost allows you to classify instances, giving more weight to complex ones and less to those that have already been processed well. AdaBoost is designed to solve classification and regression problems ^[16].

3.3. Detection of abnormal emails

Insiders can cause huge damage in the current IT environment, and we cannot completely prevent the damage from this. Existing information security tools and systems often need to be improved to mitigate the possible consequences of insider exposure. This is expressed in an appropriate request from specialized specialists in the field of information technology and information security, for whom research on new ways to detect abnormal activity is especially valuable ^{[17, 18]}. To determine the compliance limit for information security automation, the human factor should also be studied. For this purpose, e-mail is excellent as a medium for detecting insider threats ^[19]. Finally, in order to get an idea of the real applicability of the described machine learning methods and algorithms, let's proceed to the experimental part of the study. 

4. Experiments and results

Implemented a Python system with Tensorflow as a backend. Anaconda IDE was used for development. To evaluate possible abnormal emails, you need to follow five steps. At the first stage, data is collected from the ND repository. The preprocessing steps include detecting missing values, removing stop words, stemming, and tokenization. This is followed by data transformation, in which the text data is converted to a vector form. After preprocessing, machine learning algorithms were applied to classify emails. These steps are described in stages in the following sections, which is done for the convenience of readers and, first of all, researchers in the considered and related scientific fields, in particular, for Data Science specialists and data analysts. The separation allows you to determine the place and role of work in the overall sequence of actions for each of them in accordance with their profile. Attracting the attention of various kinds of specialists to the subject under consideration is especially important, including for reasons of the need for further research.

4.1. Data Cleaning

Combining the entire dataset and analyzing it for consistency and any inconsistencies that need to be corrected. In addition, all lines containing null values of the message text are deleted or filled in, as suggested in a certain scheme.

4.2. Pre-processing of data

The dataset consists of .csv files that are sent by email from different users. All email files are combined into one file. It has a user ID, email content, tweets, and an email tag in the file. After that, the data set is preprocessed, consisting of the following steps.

1) Removing stop words – that is, words that have no effect in the same sentence. You can easily ignore them without losing the context of the sentence.

2) Stemming is a method of minimizing a word to its base, which is attached to suffixes and prefixes or to the roots of words, known as a lemma, called stemming. Stemming is vital for processing and understanding natural language.

3) Tokenization is a method of dividing text into parts called tokens. Tokens can be individual words, phrases, or even whole sentences. In the tokenization method, you can discard some characters, such as punctuation marks. Tokens are usually used as input data for processes such as vectorization.

4.3. Data Conversion

Data conversion is a method of converting data from one format to another. Email data consists of text data that is converted to a vector format, as shown in Figure 2. After converting text data to vector form, TF-IDF vectorization changes the raw directory cluster to a TF-IDF function matrix, as shown in Figure 3.

Fig. 2. Vector representation of text data

Fig. 3. Encoding data via TF-IDF

4.4. Machine Learning methods

The algorithm for the proposed Python framework with tensor flow in the backend is shown in Table 1.

Table 1

The algorithm of supervised learning

Several separate classifiers were run on the dataset. Namely, AdaBoost, k nearest neighbor, support vector machine, logistic regression, linear regression and Bayes algorithm. Single classifiers give satisfactory performance, with a maximum value of 0.983. The performance of the model was measured using performance indicators such as accuracy (Accuracy) and memorization (Zap). The results obtained using the models are presented in the Table. 2 and in Figure 4.

Here,

where:

N = positive (correctly defined normal emails);

O = negative (correctly identified malicious emails);

LP = false positive (malicious emails mistaken for normal);

LO = false negative (normal emails mistaken for malicious).

Table 2

 The results of single classifiers on the test set

Figure 4. A graph representing the results of learning algorithms with a teacher

After studying the results obtained, we come to the conclusion that among the proposed algorithms, the best is the method of "adaptive enhancement" (AdaBoost), since it allows us to obtain the highest value of accuracy and memorization. The first indicator characterizes the possibility of correct identification of both normal and malicious objects from their entire number, demonstrating the real practical applicability of the method within the framework of the task of searching for abnormal behavior in information systems of organizations. The second indicator is a reference to the machine learning capabilities theoretically presented in Section 3.2. Only now it is an empirically obtained assessment of their capabilities, it can also be considered as an indirect characteristic of the depth of learning of the algorithm itself, coupled with its applicability to such a problem statement. Literally, this can be described as the ability to identify objects that do not contain anomalies based on their reproduction from memory from among normal objects.

It is also worth mentioning that with the complex use of several algorithms at the same time, the results in the form of accuracy and memorization characteristics do not add up and do not increase, and the resulting efficiency coincides with the results of the method with maximum efficiency among the selected in each case. For example, a complex consisting of the classifiers "support vector machine" and "logistic regression" show an efficiency equal to 95% in both indicators, as well as a single classifier "support vector machine".

5. Conclusion

The article examines methods for identifying abnormal employee emails. Based on experiments, it can be concluded that it is possible to achieve better classification accuracy of mail messages using a combination of preprocessing methods such as TF-IDF and the AdaBoost model, which correctly classifies 98.3% of malicious emails. A publicly available dataset based on realistic examples of insider threats was used for experiments using various machine learning technologies, the result of which surpassed existing methods applied to this dataset. The results obtained can be extremely useful to specialists in the field of information technology and information security, in particular, data analysts, Data Science specialists, scientific researchers in the considered and related fields, as well as for technical specialists of law enforcement agencies.

Comparing the obtained values of the accuracy of identifying insider threats with the results of the approaches proposed earlier by foreign researchers, we find that they were surpassed in a number of indicators. For example, the accuracy of anomaly detection obtained in the work of Duke Lee et al. ^[6], as already indicated earlier in section 2, was approximately 85%, whereas we achieved an accuracy of 98.3%. The machine learning model proposed by Malvika Singh et al. ^[7] consists of "ultra-precise neural networks", demonstrated an accuracy of about 90%, which was also surpassed with the help of five of the six tested classifiers. Serious opponents in this field can rightfully be considered Diop Abdoulaye et al. ^[5], who combined machine learning methods and methods based on linear algebra and parallel computing procedures, while achieving accuracy, in some cases reaching 99%. Contrasting the results obtained, it should be noted that our proposed approach allows, using only the methods of controlled machine learning, to obtain indicators that are less than one percent inferior, which varies within the margin of error with a relatively small array of input data used. At the same time, the demonstrated approach is an attractive alternative for the end developer of a software solution, since it allows you to simplify it by limiting yourself to machine learning algorithms and not heaping up the program code with redundant algebraic calculations.

A potential direction for future research is the adaptation of this model to specific technical means and solutions that are widely known and widely used as the main components of an information security system. In addition, do not forget that the experiment involves an array limited to a thousand records. This limitation is dictated by the capacities of the equipment used on the test bench. Of great importance are further experiments in the format of the proposed model on a larger set of input data, close to the real volume that circulates in the information systems of organizations, using appropriate hardware and software, the resources of which are sufficient to carry out the necessary calculations and emulations in larger quantities. This will allow you to adjust the percentage of accuracy of anomaly detection by various classifiers, and probably even identify the inexpediency of using some of them. But not only quantitative, but also qualitative improvement of the described methods is appropriate in the further development of the affected issues. So, if we focus on deeper machine learning, then there is a high probability of increasing the effectiveness of the proposed methods without resorting to the help of resource-intensive equipment, this area of research is more the prerogative of Data Science specialists.