论文标题
通过长期记忆（LSTM）神经网络检测内幕威胁
Detecting the Insider Threat with Long Short Term Memory (LSTM) Neural Networks
论文作者
论文摘要
信息系统使每个行业的许多组织过程。信息技术使用的效率和有效性创造了意外的副产品：现有用户滥用或冒充它们的人 - 内部威胁。如果发生对电子日志（捕获用户行为）进行彻底分析，则可能会发现内部威胁。但是，日志通常非常大且非结构化，对组织面临重大挑战。在这项研究中，我们使用深度学习，最特别是长期记忆（LSTM）复发网络来启用检测。我们通过一个非常大的，匿名的数据集证明LSTM如何使用数据的测序性质来减少搜索空间并使安全分析师的工作更有效。
Information systems enable many organizational processes in every industry. The efficiencies and effectiveness in the use of information technologies create an unintended byproduct: misuse by existing users or somebody impersonating them - an insider threat. Detecting the insider threat may be possible if thorough analysis of electronic logs, capturing user behaviors, takes place. However, logs are usually very large and unstructured, posing significant challenges for organizations. In this study, we use deep learning, and most specifically Long Short Term Memory (LSTM) recurrent networks for enabling the detection. We demonstrate through a very large, anonymized dataset how LSTM uses the sequenced nature of the data for reducing the search space and making the work of a security analyst more effective.
