Part III

Stream Data Analytics for Insider Threat Detection

Introduction to Part III

Part III, consisting of nine chapters, describes big data analytics techniques for insider threat detection. In particular, both supervised and unsupervised learning methods for insider threat detection are discussed.

Chapter 14 provides a discussion of the problem addressed and the solutions provided by big data analysis. In particular, stream data mining that addresses the big data issues for insider threat detection is discussed. Chapter 15 describes related work. Both insider threat detection and stream mining aspects are discussed. In addition, issues on handling big data techniques are also discussed. Chapter 16 describes ensemble-based classification and details both unsupervised and supervised learning techniques for insider threat detection. Chapter 17 describes supervised and unsupervised learning methods for nonsequence data. Chapter 18 describes our experiments and testing methodology and presents our results and findings on insider threat detection for nonsequence data. Chapter 19 describes both supervised and unsupervised learning algorithms for insider threat detection for sequence data. Chapter 20 presents our experiments and results on insider threat detection for sequence data. Chapter 21 describes scalability issues using the Hadoop/MapReduce framework and solutions for quantized dictionary construction. Finally, Chapter 22 concludes with an assessment of the viability of stream mining for real-world insider threat detection and the relevance to big data aspects.