An Insider Threat Detection Approach Based on Mouse Dynamics and Deep Learning

Figure 2

The click action is actually made up of two actions: Pressed and Released. So a “click” action is actually done by a Pressed and a Released. Two consecutive times on the same coordinate (x, y) becomes a “double click” action. In addition, the mapping method also needs to distinguish the left and right buttons of the mouse, that is, “click” and “double-click” of the left mouse button and “click” and “double-click” of the right mouse button. It can reflect the features of the number of clicks, frequencies, and other features.