# Using Color To Identify Insider Threats

arXiv: https://arxiv.org/abs/2111.13176 · HTML: https://mlsanity.com/paper/2111.13176/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 105 references that are in the map.
- First posted on arXiv 25 Nov 2021.

## Builds on (most cited first, 12 of 12)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift](https://mlsanity.com/paper/1502.03167/) (2015)
- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Explaining by Removing: A Unified Framework for Model Explanation](https://mlsanity.com/paper/2011.14878/) (2020)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams](https://mlsanity.com/paper/1710.00811/) (2017)
- [Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities](https://mlsanity.com/paper/2005.12433/) (2020)
- [Image-Based Feature Representation for Insider Threat Classification](https://mlsanity.com/paper/1911.05879/) (2019)
- [A Review of Computer Vision Methods in Network Security](https://mlsanity.com/paper/2005.03318/) (2020)
- [Classifier Suites for Insider Threat Detection](https://mlsanity.com/paper/1901.10948/) (2019)

## Abstract (arXiv)

Insider threats are costly, hard to detect, and unfortunately rising in occurrence. Seeking to improve detection of such threats, we develop novel techniques to enable us to extract powerful features and augment attack vectors for greater classification power. Most importantly, we generate high quality color image encodings of user behavior that do not have the downsides of traditional greyscale image encodings. Combined, they form Computer Vision User and Entity Behavior Analytics, a detection system designed from the ground up to improve upon advancements in academia and mitigate the issues that prevent the usage of advanced models in industry. The proposed system beats state-of-art methods used in academia and as well as in industry on a gold standard benchmarking dataset.