Decision Trees and Random Forests

Casarin, Rui Donizete; Facchinetti, R.; Sorice, Domenico; Tonellato, S.

doi:10.1142/9789811205675_0011

Cited by 6 publications

(1 citation statement)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The creation of forests that may be retained for later use is one of the numerous benefits of the RF algorithm [35]. Additionally, RF resolves the overfitting problem [36], and automatically generates the variable importance [37]. The same procedure is used to construct a large number of decision trees.…”

Section: ) Supervised Learningmentioning

confidence: 99%

Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm

Al-Shehari,

Al-Razgan,

Alfakih

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Insider attacks may inflict far greater damage to an organization than outsider threats since insiders are authorized users who are acquainted with the business's system, making detection harder. Many techniques to detecting insider threats have been developed, but they are neither flexible nor resilient owing to different obstacles (e.g., lack of real-world dataset and highly skewed class distribution of the available dataset), making insider threat detection an understudied research field. Previous techniques attempted to solve the dataset's imbalance issue by increasing or lowering the observations of the dataset's classes, however this might lead to underfitting and overfitting problems. We present an insider threat detection model that addresses the class imbalance problem at the algorithm level using anomaly-based techniques, as an enhancement over previous approaches. To limit the effect of skewed class distribution on insider threat detection, the Isolation Forest (IF) technique is used. The model is verified using the benchmarked CERT's insider threat dataset, which is significantly unbalanced, with a small number of malicious cases vs a large number of non-malicious instances. Several contamination ratios of IF's parameters are used to verify the model's performance throughout a range of anomaly scores. The experimental findings reveal that the suggested model handles the dataset class imbalance problem with an accuracy score of 98%. The findings are compared to the baseline technique to demonstrate how the proposed model enhances detection performance and addresses the problem of data imbalance. The findings indicate the usefulness of the suggested approach for identifying insider threats when compared to previous studies.

show abstract

Section: ) Supervised Learningmentioning

confidence: 99%