CLASSIFICATION OF VISITORS AND IDENTIFYING INTRUDERS IN A NETWORK

Abstract

In today's digital ecosystem, accurately identifying user intentions on commercial websites is essential for enhancing security and optimizing user experience. This research introduces a phased classification approach for distinguishing website users into distinct groups based on behavioral patterns, addressing the nuanced challenge of distinguishing between genuine customers, casual browsers, and potential intruders. The proposed two-phase classification framework first differentiates customers from browsers, followed by a second phase that classifies browsers into either normal or suspicious users. This staged approach improves accuracy by focusing on progressively finer distinctions between user types, capturing subtle behavioral nuances that might otherwise be overlooked in a single-step model. Due to limitations of existing datasets, we generated a synthetic dataset that simulates realistic user behaviors, incorporating diverse features such as session duration, pages viewed, VPN usage, and geolocation consistency. A CatBoost classifier was employed in each phase for its ability to handle categorical data effectively. Experimental results demonstrate that this two-phase model achieves high accuracy, underscoring its potential for precise, context-aware user segmentation in online environments. This work offers a significant contribution to cybersecurity and user segmentation, advancing strategies for dynamically distinguishing user groups in digital spaces.

Keywords

• Cybersecurity
• User classification
• Synthetic dataset generation
• User behavior analysis
• Anomaly detection
• Intruder detection
• Machine learning
• Threat detection
• Catboost classifier

References

1. Rakan A. Alsowail and Taher Al-Shehari. Empirical detection techniques of insider threat incidents. IEEE Access, 8:78385–78402, 2020.
2. Duc C. Le and Nur Zincir-Heywood. Exploring adversarial properties of insider threat detection. In 2020 IEEE Conference on Communications and Network Security (CNS), pages 1–9, 2020.
3. Fatima Rashed Alzaabi and Abid Mehmood. A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods. IEEE Access, 12:30907–30927, 2024.
4. Rafael Bruno Peccatiello, João José Costa Gondim, and Luís Paulo Faina Garcia. Applying one-class algorithms for data stream-based insider threat detection. IEEE Access, 11:70560–70573, 2023.
5. Yangyang Li and Yaping Su. The insider threat detection method of university website clusters based on machine learning. In 2023 6th International Conference on Artificial Intelligence and Big Data (ICAIBD), pages 560–565, 2023.
6. Anupam Mittal and Urvashi Garg. Prediction and detection of insider threat detection using emails: A comparision. In 2023 Second International Conference on Electrical, Electronics, Information and Communication Technologies (ICEEICT), pages 01–06, 2023.
7. Syed Khurram Jah Rizvi, Khawaja Faisal Javed, and Muhammad Moazam. Casattention based iso/iec 15408–2 compliant continuous audit system for insider threat detection. In 2023 3rd International Conference on Artificial Intelligence (ICAI), pages 153–157, 2023.
8. Samiha Besnaci, Mohamed Hafidi, and Mahnane Lamia. Dealing with extremly unbalanced data and detecting insider threats with deep neural networks. In 2023 International Conference on Advances in Electronics, Control and Communication Systems (ICAECCS), pages 1–6, 2023.

9. Muhammad Zunair Ahmed Khan, Muhammad Mubashir Khan, and Junaid Arshad. Anomaly detection and enterprise security using user and entity behavior analytics (ueba). In 2022 3rd International Conference on Innovations in Computer Science & Software Engineering (ICONICS), pages 1–9, 2022.
10. Kexiong Fei, Jiang Zhou, Lin Su, Weiping Wang, Yong Chen, and Fan Zhang. A graph convolution neural network based method for insider threat detection. In 2022 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking (ISPA/BDCloud/SocialCom/SustainCom), pages 66–73, 2022.
11. Gaole Lu, Huixiang Zhang, Tianluo Liu, Kaihua Liao, and Chun Feng. Experimental evaluation of insider threat detection methods based on temporal representation. In 2022 IEEE 10th International Conference on Information, Communication and Networks (ICICN), pages 682–688, 2022.
12. Junchao Xiao, Lin Yang, Fuli Zhong, Xiaolei Wang, Hongbo Chen, and Dongyang Li. Robust anomaly-based insider threat detection using graph neural network. IEEE Transactions on Network and Service Management, 20(3):3717–3733, 2023.
13. Manar Alohaly, Olusesi Balogun, and Daniel Takabi. Integrating cyber deception into attribute-based access control (abac) for insider threat detection. IEEE Access, 10:108965–108978, 2022.
14. Fangtao Zhang, Xiu Ma, and Weiqing Huang. Seqa-itd: User behavior sequence augmentation for insider threat detection at multiple time granularities. In 2022 International Joint Conference on Neural Networks (IJCNN), pages 1–7, 2022.
15. Shaolei Zhou, Liming Wang, Jing Yang, and Pengwei Zhan. Sitd: Insider threat detection using siamese architecture on imbalanced data. In 2022 IEEE 25th International Conference on Computer Supported Cooperative Work in Design (CSCWD), pages 245–250, 2022.
16. G. Padmavathi, D. Shanmugapriya, and S. Asha. A framework to detect the malicious insider threat in cloud environment using supervised learning methods. In 2022 9th International Conference on Computing for Sustainable Global Development (INDIACom), pages 354–358, 2022.
17. Sashi Kumar Mamidanna, C R K Reddy, and Akash Gujju. Detecting an insider threat and analysis of xgboost using hyperparameter tuning. In 2022 International Conference on Advances in Computing, Communication and Applied Informatics (ACCAI), pages 1–10, 2022.
18. Mohammad Mamun and Kevin Shi. Deeptaskapt: insider apt detection using task tree based deep learning. In 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 693 700. IEEE, 2021.
19. R G Gayathri, Atul Sajjanhar, Yong Xiang, and Xingjun Ma. Anomaly detection for scenario-based insider activities using cgan augmented data. In 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 718–725, 2021.
20. Li Lin, Shuang Li, Xuhui Lv, and Bo Li. Btdetect: An insider threats detection approach based on behavior traceability for iaas environments. In 2021 IEEE IntlConf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking (ISPA/BDCloud/SocialCom/SustainCom), pages 344–351, 2021.
21. Weiqing Huang, He Zhu, Ce Li, Qiujian Lv, Yan Wang, and Haitian Yang. Itdbert: Temporal-semantic representation for insider threat detection. In 2021 IEEE Symposium on Computers and Communications (ISCC), pages 1–7, 2021.
22. Oluwaseyi Ajayi and Tarek Saadawi. Detecting insider attacks in blockchain networks. In 2021 International Symposium on Networks, Computers and Communications (ISNCC), pages 1–7, 2021.
23. P. Varsha Suresh and Minu Lalitha Madhavu. Insider attack: Internal cyber attack detection using machine learning. In 2021 12th International Conference on Computing Communication and Networking Technologies (ICCCNT), pages 1–7, 2021.
24. Rida Nasir, Mehreen Afzal, Rabia Latif, and Waseem Iqbal. Behavioral basedinsider threat detection using deep learning. IEEE Access, 9:143266–143274, 2021.