Hybrid VAE-GAN Generative Oversampling for Extreme Class Imbalance in Insider Threat Detection

Abstract

Insider threat detection works on data where malicious days are very rare. In the CERT r4.2 corpus used here, 1,364 malicious user-days stand against 328,921 benign ones, a ratio of 241 to 1. Interpolation based oversamplers such as SMOTE copy rather than create, and treat count data as if it were continuous. This paper presents Hybrid Generative Oversampling. A conditional variational autoencoder and a conditional Wasserstein generative adversarial network are fitted on the minority rows of each training fold, samples are drawn from both, and the pool is then reduced by a boundary test and a novelty test. Every column receives the head that suits it: a softmax over observed counts, a gate for zero inflated columns, a value head for the rest. Under employee disjoint five fold cross validation, with synthetic rows confined to the training folds, the method raises the Random Forest F1 score from 0.369 to 0.409 and the Matthews correlation from 0.392 to 0.440, and it improves on SMOTE in precision recall area in five folds out of five. Its rows also lie 1.82 times the real spacing away from the closest real record, against 0.32 for SMOTE.