An Insider Threat Detection Approach Based on Mouse Dynamics and Deep Learning

Figure 5

Usually, researchers think of mouse movements and clicks as mouse operations. They do not pay attention to the interval between two mouse operations. In fact, this interval is also an “operation” of the mouse, and we call it the “Stay” operation. When there is no other operation on the mouse in one coordinate or the interval between two operations of the mouse, it can be defined as the “operation,” which is represented by a semitransparent square on the two-dimensional image. The size of the square is used to indicate the length of stay.