Insider threats are the cyber attacks from within the trusted entities of an organization. Lack of real-world data and issue of data imbalance leave insider threat analysis an understudied research area. To mitigate the effect of skewed class distribution and prove the potential of multinomial classification algorithms for insider threat detection, we propose an approach that combines generative model with supervised learning to perform multi-class classification using deep learning. The generative adversarial network (GAN) based insider detection model introduces Conditional Generative Adversarial Network (CGAN) to enrich minority class samples to provide data for multi-class anomaly detection. The comprehensive experiments performed on the benchmark dataset demonstrates the effectiveness of introducing GAN derived synthetic data and the capability of multi-class anomaly detection in insider activity analysis. Moreover, the method is compared with other existing methods against different parameters and performance metrics.

翻译：缺乏真实世界数据和数据不平衡的内存威胁分析问题,这是一个研究领域。为了减轻偏斜等级分布的影响,并证明内存威胁探测多等级分类算法的潜力,我们提议采用一种方法,将基因模型与监督学习相结合,以便利用深层学习进行多级分类。基于内存检测的基因对抗网络(GAN)基于内存检测模型引入了条件性基因反向网络(CGAN),以丰富少数类样本,为多级异常检测提供数据。在基准数据集上进行的全面实验表明,在内部活动分析中采用GAN衍生合成数据和多级异常检测能力是有效的。此外,该方法与其他现有方法对照不同的参数和性能衡量标准进行了比较。