École Nationale Supérieure de
Techniques Avancées

Abstract

Insider threats are dangerous for any organization as they come from a supposedly trusted user. It is a big challenge in cyber-security to detect and prevent them. It is difficult to get real and complete data from a company, therefore it is necessary to use a synthetic data set which provides a simulation of the activity logs for users. This work used Evolutionary Algorithms to generate insider threat data in the form of sequences and feature vectors from a synthetic data set. The individuals created through Genetic Algorithm and Genetic Programming were evaluated using distances measurements, and notably the Damerau-Levenshtein distance. The results show that depending on the optimization method, we get a diverse range of anomalous behavior, but they still need to be validated as insider attacks.