Enterprises and organizations are faced with potential threats from insider
employees that may lead to serious consequences. Previous studies on insider
threat detection (ITD) mainly focus on detecting abnormal users or abnormal
time periods (e.g., a week or a day). However, a user may have hundreds of
thousands of activities in the log, and even within a day there may exist
thousands of activities for a user, requiring a high investigation budget to
verify abnormal users or activities given the detection results. On the other
hand, existing works are mainly post-hoc methods rather than real-time
detection, which can not report insider threats in time before they cause loss.
In this paper, we conduct the first study towards real-time ITD at activity
level, and present a fine-grained and efficient framework LAN. Specifically,
LAN simultaneously learns the temporal dependencies within an activity sequence
and the relationships between activities across sequences with graph structure
learning. Moreover, to mitigate the data imbalance problem in ITD, we propose a
novel hybrid prediction loss, which integrates self-supervision signals {from
normal activities} and supervision signals from abnormal activities into a
unified loss for anomaly detection. We evaluate the performance of LAN on two
widely used datasets, i.e., CERT r4.2 and CERT r5.2. Extensive and comparative
experiments demonstrate the superiority of LAN, outperforming 9
state-of-the-art baselines by at least 9.92% and 6.35% in AUC for real-time ITD
on CERT r4.2 and r5.2, respectively. Moreover, LAN can be also applied to
post-hoc ITD, surpassing 8 competitive baselines by at least 7.70% and 4.03% in
AUC on two datasets. Finally, the ablation study, parameter analysis, and
compatibility analysis evaluate the impact of each module and hyper-parameter
in LAN.

本文针对员工内部威胁检测进行研究，提出了一种实时活动层面的细粒度高效 LAN 框架，通过图结构学习同时学习活动序列内的时间依赖性和序列间的活动关系，采用混合预测损失来解决数据不平衡问题，实验表明 LAN 在实时和事后内部威胁检测中的性能优于其他基线方法。