Image-Based Insider Threat Detection via Geometric Transformation

Figure 6

Trends of anomaly scores of different users (“mal” or “nor”) in r4.2 under different approaches. (a) IGT in malicious user EDB0714. (b) IGT in normal user TCD0009. (c) AutoEncoder in malicious user EDB0714. (d) AutoEncoder in normal user TCD0009.

(a)

(b)

(c)

(d)