An Internal Threat Detection Model Based on Denoising Autoencoders

Abstract

Internal user threat detection is an important research problem in the field of system security. Recently, the analysis of abnormal behaviors of users is divided into supervised learning method (SID) and unsupervised learning method (AD). However, supervised learning method relies on domain knowledge and user background, which means it cannot detect previously unknown attacks and is not suitable for multi-detection domain scenarios. Most existing AD methods use the clustering algorithm directly. But for threat detection on internal users’ behavior, mostly for high-dimensional cross-domain log files, as far as we know, there are few methods of multi-domain audit log data with effective feature extraction. An effective feature extraction method which can not only reduce testing cost greatly, but also detect the abnormal behavior of users more accurately. We propose a new unsupervised log abnormal behavior detection method which is based on the denoising autoencoders to encode the user log file, and adopts the integrated method to detect the abnormal data after encoding. Compared with the traditional detection method, it can analyze the abnormal information in the user behavior more effectively, thus playing a preventive role against internal threats. In addition, the method is completely data driven and does not rely on relevant domain knowledge and user’s background attributes. Experimental results verify the effectiveness of the integrated anomaly detection method under the multi-domain detection scenario of user log files.