SITD: Insider Threat Detection Using Siamese Architecture on Imbalanced Data

Abstract

In the insider threat detection domain, data imbalance is a well-known problem. Most existing solutions, including rebalancing datasets and anomaly detection, have problems such as model overfitting, high cost, and high False Positive Rate (FPR). Therefore, how to effectively detect insider threats on an imbalanced dataset is a challenge. This paper proposes a new Siamese-architecture Insider Threat Detection (SITD) method, which detects insider threat by judging whether the input sample pairs belong to the same category instead of directly classifying a sample while avoiding the abovementioned problems. In addition, we improve the contrastive loss function to make the model pay more attention to the samples pairs of different categories, which significantly enhances the detection performance. Experimental results show that SITD outperforms other insider detection methods on the imbalanced CERT dataset. Moreover, SITD can achieve a good result no matter how imbalanced the dataset is.