An Insider Threat Detection Approach Based on Mouse Dynamics and Deep Learning

Abstract

In the current intranet environment, information is becoming more readily accessed and replicated across a wide range of interconnected systems. Anyone using the intranet computer may access content that he does not have permission to access. For an insider attacker, it is relatively easy to steal a colleague’s password or use an unattended computer to launch an attack. A common one-time user authentication method may not work in this situation. In this paper, we propose a user authentication method based on mouse biobehavioral characteristics and deep learning, which can accurately and efficiently perform continuous identity authentication on current computer users, thus to address insider threats. We used an open-source dataset with ten users to carry out experiments, and the experimental results demonstrated the effectiveness of the approach. This approach can complete a user authentication task approximately every 7 seconds, with a false acceptance rate of 2.94% and a false rejection rate of 2.28%.

A Review of Insider Threat Detection Approaches With IoT Perspective

“…In the process of examining each article's reference list, materials that were frequently mentioned [18]- [24] were added to the final list even though they were not published recently. We also included three papers that attempted a novel approach [25]- [27], one article that investigated network-based detection in IoT environments [28], one article about insider threat detection in IoTs [29], and two articles of attack vectors considering IoTs [12], [16]. Deep-learning related ITD researches [30], [31] that show the excellent capabilities of detecting unseen behavior patterns have also been added.…”

“…The dataset fields include record timestamp, client timestamp, button, state, and x & y coordination. Hu et al [25] used this dataset in their study to show mouse biobehavioral features for ITD works.…”

Tracking the Insider Attacker: A Blockchain Traceability System for Insider Threats

“…Ref. [ 3 ] proposed an insider threat detection method based on mouse biometrics and CNN networks with good results. Ref.…”

“…The attacker is a legitimate user, and possibly administrators of the system. Thus, the security facilities of the internal network cannot monitor or block such attacks [ 3 ]. Even if there are security logs, the attacker may delete them through other means.…”

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…It can be observed that the proposed method perform better that the existing log based anomaly detection techniques. In [322], Teng et al have proposed a CNN based user authentication technique which uses the dynamic behaviour of the mouse. The proposed model learns from the dynamic behaviour pictures and can authenticate user continuously for every 7 seconds.…”