Developing Novel Deep Learning Models to Detect Insider Threats and Comparing the Models from Different Perspectives

Basit Öğe Kaydı
dc.contributor.authorGörmez, Yasin
dc.contributor.authorArslan, Halil
dc.contributor.authorIşık, Yunus Emre
dc.contributor.authorGündüz, Veysel
dc.date.accessioned2024-10-26T17:33:55Z
dc.date.available2024-10-26T17:33:55Z
dc.date.issued2024
dc.departmentSivas Cumhuriyet Üniversitesi
dc.description.abstractCybersecurity has become an increasingly vital concern for numerous institutions, organizations, and governments. Many studies have been carried out to prevent external attacks, but there are not enough studies to detect insider malicious actions. Given the damage inflicted by attacks from internal threats on corporate reputations and financial situations, the absence of work in this field is considered a significant disadvantage. In this study, several deep learning models using fully connected layer, convolutional neural network and long short-term memory were developed for user and entity behavior analysis. The hyper-parameters of the models were optimized using Bayesian optimization techniques. Experiments analysis were performed using the version 4.2 of Computer Emergency and Response Team Dataset. Two types of features, which are personal information and numerical features, were extracted with respect to daily activities of users. Dataset was divided with respect to user or role and experiment results showed that user based models have better performance than the role based models. In addition to this, the models that developed using long short-term memory were more accurate than the others. Accuracy, detection rate, f1-score, false discovery rate and negative predictive value were used as metrics to compare model performance fairly with state-of-the-art models. According the results of these metrics, our model obtained better scores than the state-of-the-art models and the performance improvements were statistically significant according to the two-tailed Z test. The study is anticipated to significantly contribute to the literature, as the deep learning approaches developed within its scope have not been previously employed in internal threat detection. Moreover, these approaches have demonstrated superior performance compared to previous studies.
dc.identifier.doi10.17671/gazibtd.1386734
dc.identifier.endpage43
dc.identifier.issn1307-9697
dc.identifier.issn2147-0715
dc.identifier.issue1
dc.identifier.startpage31
dc.identifier.trdizinid1224167
dc.identifier.urihttps://doi.org/10.17671/gazibtd.1386734
dc.identifier.urihttps://search.trdizin.gov.tr/tr/yayin/detay/1224167
dc.identifier.urihttps://hdl.handle.net/20.500.12418/23388
dc.identifier.volume17
dc.indekslendigikaynakTR-Dizin
dc.language.isoen
dc.relation.ispartofBilişim Teknolojileri Dergisi
dc.relation.publicationcategoryMakale - Ulusal Hakemli Dergi - Kurum Öğretim Elemanı
dc.rightsinfo:eu-repo/semantics/openAccess
dc.subjectMachine Learning
dc.subjectDeep Learning
dc.subjectCyber Security
dc.subjectUser and Entity Behavior Analysis
dc.subjectInsider Threat
dc.titleDeveloping Novel Deep Learning Models to Detect Insider Threats and Comparing the Models from Different Perspectives
dc.typeArticle

Dosyalar

Koleksiyon

TR-Dizin İndeksli Yayınlar Koleksiyonu