2024 | Shuang Song¹,²,³, Neng Gao¹,²*, Yifei Zhang¹,² and Cunqing Ma¹,²
This paper proposes a novel insider threat detection method called BRITD, which integrates time awareness and user adaptation to improve the detection of insider threats. The method involves a feature extraction process that implicitly encodes absolute time information and uses a feature sequence construction method that considers covariance to adapt to users. BRITD is a deep learning-based model that uses Stacked Bidirectional LSTM and Feedforward Neural Network to detect insider threats. The model is universally applicable to various insider threat scenarios and achieves high detection performance, with an AUC of 0.9730 and a precision of 0.8072 on the CMU CERT dataset, outperforming all baselines. The method captures both absolute and relative time information of user behavior, mines user behavior rhythm, and is user adaptive. The model is suitable for multiple insider threat scenarios and can be applied in conjunction with trust management and access control mechanisms to jointly secure organizational systems. The method is evaluated on the CMU CERT dataset and shows superior performance compared to existing methods. The results demonstrate that the proposed method is effective in detecting insider threats and can adapt to different user behaviors and time information. The method is also efficient in terms of accuracy and running time, making it suitable for practical applications.This paper proposes a novel insider threat detection method called BRITD, which integrates time awareness and user adaptation to improve the detection of insider threats. The method involves a feature extraction process that implicitly encodes absolute time information and uses a feature sequence construction method that considers covariance to adapt to users. BRITD is a deep learning-based model that uses Stacked Bidirectional LSTM and Feedforward Neural Network to detect insider threats. The model is universally applicable to various insider threat scenarios and achieves high detection performance, with an AUC of 0.9730 and a precision of 0.8072 on the CMU CERT dataset, outperforming all baselines. The method captures both absolute and relative time information of user behavior, mines user behavior rhythm, and is user adaptive. The model is suitable for multiple insider threat scenarios and can be applied in conjunction with trust management and access control mechanisms to jointly secure organizational systems. The method is evaluated on the CMU CERT dataset and shows superior performance compared to existing methods. The results demonstrate that the proposed method is effective in detecting insider threats and can adapt to different user behaviors and time information. The method is also efficient in terms of accuracy and running time, making it suitable for practical applications.