[ISBA 2019] MSLSTM + CNN: Rethinking Insider Threat Detection through Identity-Aware Behavioral Profiling

TL;DR

The most dangerous cyber threats often come from within. This paper introduces an ensemble deep learning approach that treats user behavior like a language. By using a Multi-State LSTM (MSLSTM) to track individual user history and a CNN to detect anomalies in those patterns, the researchers achieved a 90.4% AUC and an 85% detection rate, effectively outperforming traditional SVM and Naive Bayes baselines.

Background: The Invisible Enemy

Traditional security measures (like Firewalls or SIEM) are designed to keep outsiders out. However, they are often "blind" to the Insider Threat—a legitimate user with malicious intent. The challenge lies in the subtlety: how do you distinguish between a developer working late and a disgruntled employee stealing data?

The authors argue that the answer lies in User Behavior Profiling. Instead of looking for specific "attack signatures," we should look for deviations from a user's unique baseline.

The Core Innovation: Why "Multi-State"?

Standard LSTMs treat all incoming data as a single stream. In a large organization, this "muddies" the behavior of individual users. This paper proposes a Multistate LSTM, which maintains a dedicated state for each user-id.

How it Works:

1. Temporal Encoding: The MSLSTM processes sequences of actions (User Behavior Features like logons, process starts, and data transfer volumes).
2. State Lookup: When a new action is recorded, the model "looks up" the specific hidden state for that user, updates it, and predicts the next likely action.
3. Spatial-Temporal Classification: The LSTM output is converted into a daily feature matrix. A CNN then scans this matrix to detect "additive outliers"—patterns that don't fit the spatial-temporal norm of that user's history.

Figure 1: The Multistate LSTM cell tracks individual user behavior sequences independently.

Experiments & Results

The model was validated on the CMU-CERT v6.2 dataset, one of the most comprehensive synthetic datasets for insider threats, containing over 110 million Kerberos authentication events.

Performance Gains:

• Detection Rate: 85% (Superior to RBF-Kernel SVM's 80.1%).
• False Alarm Rate: Kept at 4%, which is lower than many traditional unsupervised methods.
• AUC Score: 0.9047, demonstrating high reliability across different thresholds.

Table 1: Comparison of the proposed MSLSTM+CNN against traditional Machine Learning baselines.

The ROC curves for both training and testing data showed strong stability, suggesting that the model avoids the common pitfall of overfitting to specific users in the training set.

Figure 2: The model maintains a high True Positive Rate with low False Positives.

Critical Insight

The brilliance of this work is the marriage of Memory (LSTM) and Pattern Recognition (CNN). While LSTMs are excellent at following the "thread" of a user's day, CNNs are masterful at spotting "visual" irregularities in the resulting data matrices. By removing the need for manual feature engineering, this approach makes insider threat detection scalable to modern, high-velocity data streams.

Limitations & Future Outlook

While the results are impressive, the computational overhead of maintaining thousands of individual LSTM states can be significant for massive enterprises. Future research could investigate Parameter-Efficient Tuning or Clustering users into groups (e.g., by department) to balance granularity with performance.

Ultimately, this paper shifts the focus of cybersecurity from "What is happening?" to "Who is doing this, and is it normal for them?"