Abstract: Information system not only faces the threat of external attack, but also faces the threat from the internal system. In this paper, aiming at the internal attacks of the system, the internal threats and internal attacks of the information system are briefly described and analyzed. Based on the general rules of user’s operation behavior, this paper proposes several detection models, and finds out a good detection model by comparing the detection results. Based on SEA open data set, feature extraction uses several methods, such as word bag, TF-IDF, vocabulary and N-Gram, and uses different machine learning algorithms to build detection model, including XGBoost algorithm, implicit Markov and multi-layer perceptron (MLP). The results show that the accuracy and recall rate of the test samples using the word bag+N-Gram feature model and XGBoost learning algorithm are high, and the detection effect is the best.

Key words: internal attack detection, XGBoost(extreme gradient boosting), MLP(multi-layer perceptron), implicit Markov