Cloud Insider Threat Detection using Deep Learning Models

Insider attacks are a major threat to cloud security since they can harm organizational assets and have overlapping security mechanisms. Therefore, insider threat detection in the cloud environment is necessary to compromise such attacks. Past research applied machine learning and Deep Learning (DL) techniques for recognizing insider threats in the cloud. The self-learning capabilities in network layers of deep learning could enhance and handle class imbalance problems in detecting and recognizing cloud insider threats. In this paper, the pre-processed insider threat data is obtained by applying various data preprocessing techniques, including data integrity, data transformation, and data sampling using Synthetic-Minority Over-sampling Technique (SMOTE) to deal with the issue of the imbalanced dataset. The balanced data obtained from preprocessing algorithms are classified using DL algorithms, including Conventional Neural networks (CNN) and Long Short-Term Memory (LSTM) for cloud Insider Threat Detection. The experimental result shows that the performance of CNN with SMOTE-based balanced data outperforms LSTM with SMOTE regarding the accuracy, f-score, precision, and recall for detecting cloud insider threats.