Insider Threat Detection Through Attributed Graph Clustering

TL;DR

This paper presents an insider threat detection framework that leverages attributed graph clustering and outlier ranking to identify malicious insiders within organizations, demonstrating promising empirical results.

Contribution

It introduces a novel framework combining attributed graph clustering with outlier ranking specifically for insider threat detection, addressing high-dimensional, heterogeneous data challenges.

Findings

Achieved an AUC of 0.7648 in detection performance.

Effectively isolates suspicious users using graph clustering.

Demonstrates the method's potential in real organizational scenarios.

Abstract

While most organizations continue to invest in traditional network defences, a formidable security challenge has been brewing within their own boundaries. Malicious insiders with privileged access in the guise of a trusted source have carried out many attacks causing far-reaching damage to financial stability, national security and brand reputation for both public and private sector organizations. Growing exposure and impact of the whistleblower community and concerns about job security with changing organizational dynamics has further aggravated this situation. The unpredictability of malicious attackers, as well as the complexity of malicious actions, necessitates the careful analysis of network, system and user parameters correlated with the insider threat problem. Thus it creates a high dimensional, heterogeneous data analysis problem in isolating suspicious users. This research work proposes an insider threat detection framework, which utilizes the attributed graph clustering techniques and outlier ranking mechanism for enterprise users. Empirical results also confirm the effectiveness of the method by achieving the best area under the curve value of 0.7648 for the receiver operating characteristic curve.