{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,16]],"date-time":"2026-06-16T01:05:24Z","timestamp":1781571924296,"version":"3.54.5"},"reference-count":28,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2023,11,23]],"date-time":"2023-11-23T00:00:00Z","timestamp":1700697600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The COVID-19 pandemic made all organizations and enterprises work on cloud platforms from home, which greatly facilitates cyberattacks. Employees who work remotely and use cloud-based platforms are chosen as targets for cyberattacks. For that reason, cyber security is a more concerning issue and is now incorporated into almost every smart gadget and has become a prerequisite in every software product and service. There are various mitigations for external cyber security attacks, but hardly any for insider security threats, as they are difficult to detect and mitigate. Thus, insider cyber security threat detection has become a serious concern in recent years. Hence, this paper proposes an unsupervised deep learning approach that employs an artificial neural network (ANN)-based autoencoder to detect anomalies in an insider cyber security attack scenario. The proposed approach analyzes the behavior of the patterns of users and machines for anomalies and sends an alert based on a set security threshold. The threshold value set for security detection is calculated based on reconstruction errors that are obtained through testing the normal data. When the proposed model reconstructs the user behavior without generating sufficient reconstruction errors, i.e., no more than the threshold, the user is flagged as normal; otherwise, it is flagged as a security intruder. The proposed approach performed well, with an accuracy of 94.3% for security threat detection, a false positive rate of 11.1%, and a precision of 89.1%. From the obtained experimental results, it was found that the proposed method for insider security threat detection outperforms the existing methods in terms of performance reliability, due to implementation of ANN-based autoencoder which uses a larger number of features in the process of security threat detection.<\/jats:p>","DOI":"10.3390\/fi15120373","type":"journal-article","created":{"date-parts":[[2023,11,23]],"date-time":"2023-11-23T03:45:18Z","timestamp":1700711118000},"page":"373","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":29,"title":["An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2540-5752","authenticated-orcid":false,"given":"Karthikeyan","family":"Saminathan","sequence":"first","affiliation":[{"name":"Computer Science and Engineering (AIML), KPR Institute of Engineering and Technology, Coimbatore 641407, Tamil Nadu, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6369-1625","authenticated-orcid":false,"given":"Sai Tharun Reddy","family":"Mulka","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, VIT-AP University, Amaravati 522241, Andhra Pradesh, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sangeetha","family":"Damodharan","sequence":"additional","affiliation":[{"name":"Information Technology, Madras Institute of Technology, Anna University, Chennai 600044, Tamil Nadu, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7977-4751","authenticated-orcid":false,"given":"Rajagopal","family":"Maheswar","sequence":"additional","affiliation":[{"name":"Department of ECE, Centre for IoT and AI (CITI), KPR Institute of Engineering and Technology, Coimbatore 641407, Tamil Nadu, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7691-582X","authenticated-orcid":false,"given":"Josip","family":"Lorincz","sequence":"additional","affiliation":[{"name":"Faculty of Electrical Engineering, Mechanical Engineering and Naval Architecture (FESB), University of Split, Rudjera Boskovca 32, 21000 Split, Croatia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,11,23]]},"reference":[{"key":"ref_1","unstructured":"IBM (2023, September 08). What Is a Zero-Day Exploit?. Available online: https:\/\/www.ibm.com\/topics\/zero-day."},{"key":"ref_2","unstructured":"BBC News (2023, June 08). Russian Nuclear Scientists Arrested for \u2018Bitcoin Mining Plot\u2019. Available online: https:\/\/www.bbc.com\/news\/world-europe-43003740."},{"key":"ref_3","unstructured":"Ikeda, S. (2023, June 08). 250 Million Microsoft Customer Service Records Exposed; Exactly How Bad Was It?, CPO Magazine, Available online: https:\/\/www.cpomagazine.com\/cyber-security\/250-million-microsoft-customer-service-records-exposed-exactly-how-bad-was-it\/."},{"key":"ref_4","unstructured":"Thompson, N., and Barrett, B. (2023, June 08). How Twitter Survived Its Biggest Hack\u2014And Plans to Stop the Next One, WIRED, Available online: https:\/\/news.hitb.org\/content\/how-twitter-survived-its-biggest-hack-and-plans-stop-next-one."},{"key":"ref_5","unstructured":"Petters, J. (2023, June 08). What Is SIEM? A Beginner\u2019s Guide. Available online: https:\/\/www.varonis.com\/blog\/what-is-siem."},{"key":"ref_6","unstructured":"Cassetto, O. (2023, June 08). What Is UBA, UEBA, & SIEM? Security Management Terms Defined, Exabeam, Available online: https:\/\/www.exabeam.com\/siem\/uba-ueba-siem-security-management-terms-defined-exabeam\/."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Rajasekaran, A.S., Maria, A., Rajagopal, M., and Lorincz, J. (2022). Blockchain Enabled Anonymous Privacy-Preserving Authentication Scheme for Internet of Health Things. Sensors, 23.","DOI":"10.3390\/s23010240"},{"key":"ref_8","unstructured":"Warner, J. (2023, June 08). User Behavior Analytics (UBA\/UEBA): The Key to Uncovering Insider and Unknown Security Threats. Available online: https:\/\/www.exabeam.com\/ueba\/user-behavior-analytics\/#:~:text=Unknown%20Security%20Threats-,User%20Behavior%20Analytics%20(UBA%2FUEBA)%3A%20The%20Key%20to%20Uncovering,Insider%20and%20Unknown%20Security%20Threats&text=User%20Behavior%20Analytics%20was%20defined,detect%20anomalies%20and%20malicious%20behavior."},{"key":"ref_9","unstructured":"(2023, October 23). What Is SIEM? Microsoft Security, Microsoft 2023. Available online: https:\/\/www.microsoft.com\/en-us\/security\/business\/security-101\/what-is-siem."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Shashanka, M., Shen, M.-Y., and Wang, J. (2016, January 5\u20138). User and entity behavior analytics for enterprise security. Proceedings of the 2016 IEEE International Conference on Big Data (Big Data), Washington, DC, USA.","DOI":"10.1109\/BigData.2016.7840805"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1080\/19361610.2011.529413","article-title":"Insider Threat Detection Using a Graph-Based Approach","volume":"6","author":"Eberle","year":"2010","journal-title":"J. Appl. Secur. Res."},{"key":"ref_12","first-page":"47","article-title":"Supervised and Unsupervised methods to detect Insider Threat from Enterprise Social and Online Activity Data","volume":"6","author":"Gavai","year":"2015","journal-title":"JoWUA"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Kim, J., Park, M., Kim, H., Cho, S., and Kang, P. (2019). Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms. Appl. Sci., 9.","DOI":"10.3390\/app9194018"},{"key":"ref_14","unstructured":"de Andrade, D.C. (2023, June 16). Recognizing Speech Commands Using Recurrent Neural Networks with Attention, Towards Data Science, Available online: https:\/\/towardsdatascience.com\/recognizing-speech-commands-using-recurrent-neural-networks-with-attention-c2b2ba17c837."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Lu, J., and Wong, R.K. (2019, January 29\u201331). Insider Threat Detection with Long Short-Term Memory. Proceedings of the Australasian Computer Science Week Multiconference, New York, NY, USA.","DOI":"10.1145\/3290688.3290692"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"143266","DOI":"10.1109\/ACCESS.2021.3118297","article-title":"Behavioral Based Insider Threat Detection Using Deep Learning","volume":"9","author":"Nasir","year":"2021","journal-title":"IEEE Access"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Veeramachaneni, K., Arnaldo, I., Korrapati, V., Bassias, C., and Li, K. (2016, January 9\u201310). AI^2: Training a Big Data Machine to Defend. Proceedings of the 2016 IEEE 2nd International Conference on Big Data Security on Cloud (Big Data Security), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS), New York, NY, USA.","DOI":"10.1109\/BigDataSecurity-HPSC-IDS.2016.79"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Rashid, T., Agrafiotis, I., and Nurse, J.R.C. (2016, January 24\u201328). A New Take on Detecting Insider Threats. Proceedings of the 8th ACMCCS International Workshop on Managing Insider Security Threats, Vienna, Austria.","DOI":"10.1145\/2995959.2995964"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Sharma, B., Pokharel, P., and Joshi, B. (2020, January 1\u20133). User Behavior Analytics for Anomaly Detection Using LSTM Autoencoder\u2014Insider Threat Detection. Proceedings of the 11th International Conference on Advances in Information Technology (IAIT2020), Bangkok, Thailand.","DOI":"10.1145\/3406601.3406610"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Killourhy, K.S., and Maxion, R.A. (July, January 29). Comparing anomaly-detection algorithms for keystroke dynamics. Proceedings of the 2009 IEEE\/IFIP International Conference on Dependable Systems & Networks, Lisbon, Portugal.","DOI":"10.1109\/DSN.2009.5270346"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Park, Y., Molloy, I.M., Chari, S.N., Xu, Z., Gates, C., and Li, N. (2015). Learning from Others: User Anomaly Detection Using Anomalous Samples from Other Users, Springer.","DOI":"10.1007\/978-3-319-24177-7_20"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Wang, X., Tan, Q., Shi, J., Su, S., and Wang, M. (2018, January 18\u201321). Insider Threat Detection Using Characterizing User Behavior. Proceedings of the 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC), Guangzhou, China.","DOI":"10.1109\/DSC.2018.00077"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1698","DOI":"10.3906\/elk-1711-410","article-title":"Anomaly detection through keystroke and tap dynamics implemented via machine learning algorithms","volume":"26","author":"Jawed","year":"2018","journal-title":"Turk. J. Electr. Eng. Comput. Sci."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"332","DOI":"10.1109\/TDSC.2012.11","article-title":"Detecting Anomalous Insiders in Collaborative Information Systems","volume":"9","author":"Chen","year":"2012","journal-title":"IEEE Trans Dependable Secur. Comput."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Parveen, K.H.P., Weger, Z.R., Thuraisingham, B., and Khan, L. (2011, January 7\u20139). Supervised Learning for Insider Threat Detection Using Stream Mining. Proceedings of the 2011 IEEE 23rd International Conference on Tools with Artificial Intelligence, Boca Raton, FL, USA.","DOI":"10.1109\/ICTAI.2011.176"},{"key":"ref_26","unstructured":"Pierini, A., and Trotta, G. (2023, June 23). Juicy-Potato. Available online: https:\/\/github.com\/ohpe\/juicy-potato."},{"key":"ref_27","unstructured":"Thisisnzed (2023, June 23). Anywhere. Available online: https:\/\/github.com\/thisisnzed\/Anywhere."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"105767","DOI":"10.1016\/j.dib.2020.105767","article-title":"BEHACOM\u2014A dataset modelling users\u2019 behaviour in computers","volume":"31","author":"Valero","year":"2020","journal-title":"Data Brief"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/12\/373\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T21:28:04Z","timestamp":1760131684000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/12\/373"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,23]]},"references-count":28,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["fi15120373"],"URL":"https:\/\/doi.org\/10.3390\/fi15120373","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,11,23]]}}}