BRITD: behavior rhythm insider threat detection with time awareness and user adaptation

Cybersecurity

Table 3 Comparison experiment results of BRITD and 9 baselines

Model	Scen. 1		Scen. 2		Scen. 3		Scen. 4		Scen. 5		Overall
Model	AUC	P	AUC	P	AUC	P	AUC	P	AUC	P	AUC	P
BRITD*	0.9957	0.9333	0.8707	0.2629	1.0000	1.0000	0.9999	0.9900	0.9985	0.8500	0.9730	0.8072
HMM-BRITD	0.9152	0.4267	0.6310	0.1861	1.0000	1.0000	1.0000	1.0000	0.9049	0.0504	0.8902	0.5326
IF-6h-129\(\times \)4	0.8970	0.5129	0.5224	0.1839	0.9100	0.7333	0.9668	0.3023	0.4439	0.0152	0.7480	0.3495
OCSVM-6h-129\(\times \)4	0.9394	0.6000	0.6725	0.1758	1.0000	1.0000	0.8009	0.0763	0.4780	0.0093	0.7782	0.3723
FNN-6h-129\(\times \)4	0.9197	0.4771	0.6240	0.2074	1.0000	1.0000	0.9917	0.7020	0.9288	0.0654	0.8928	0.4904
BiLSTM-6h-129\(\times \)4	0.7000	0.2050	0.5753	0.1873	1.0000	1.0000	0.9474	0.3227	0.6180	0.0130	0.7681	0.3456
IF-24h	0.8545	0.3976	0.6737	0.2241	0.8800	0.6400	0.9999	0.9900	0.7541	0.0228	0.8325	0.4549
OCSVM-24h	0.8030	0.2308	0.6159	0.1758	0.8000	0.5000	0.9566	0.2813	0.9024	0.0476	0.8156	0.2471
FNN-24h	0.7561	0.2688	0.6384	0.1891	0.8600	0.6667	0.9983	0.9274	0.9298	0.2759	0.8365	0.4656
BiLSTM-24h	0.8942	0.3750	0.6628	0.2194	0.6998	0.4000	0.9958	0.7366	0.7026	0.0193	0.7910	0.3501