DMHP: Using Dirichlet Marked Hawkes Processes for Insider Threat Detection

In this paper, we present a DirichletMarked Hawkes Process (DMHP) to detect malicious activities frominsiders in real-time. DMHP combines the Dirichlet process andmarked Hawkes processes to model the sequence of user activities.

Running Environment

Python 3.7.3

DateSet

We evaluate DMHP on two kinds of datasets: CERT Insider Threat Dataset and Wikipidia dataset.

Model Evaluation

Run the model on the Insider Threat Dataset by the following command

    python DMHP.py

Authors

• Panpan Zheng

  • personal website
  • google scholar

Citation

I am very glad that you could visit this github and check my research work. If it benefits your work, please refer this work by

Acknowledgments

Appreciate it greatly for every labmate in SAIL lab