Few-shot Insider Threat Detection
Abstract
Insiders cause significant cyber-security threats to organizations. Due to a very limited number of insiders, most of the current studies adopt unsupervised learning approaches to detect insiders by analyzing the audit data that record information about employees' activities. However, in practice, we do observe a small number of insiders. How to make full use of these few observed insiders to improve a classifier for insider threat detection is a key challenge. In this work, we propose a novel framework combining the idea of self-supervised pre-training and metric-based few-shot learning to detect insiders. Experimental results on insider threat datasets demonstrate that our model outperforms the existing anomaly detection approaches by only using a few insiders.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Without the need for labeled malicious instances, the F1 score of BRITD can still exceed the two classification-based schemes (Yuan et al. 2020, Chunhui Wu et al. 2021).
“Without the need for labeled malicious instances, the F1 score of our scheme can still exceed the above two classification-based schemes.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Yuan et al. 2020
Sequence models such as LSTM, Transformer, etc., or heterogeneous graphs mainly focus on relative time information of user activity and do not establish a direct connection with the specific timing of user activities.
“However, these methods mainly focus on relative time information of user activity and do not establish a direct connection with the specific timing of user activities.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Yuan et al. (2020)
Yuan et al. (2020) perform supervised finetuning: they treat the first vector of the encoded result as the representation vector of the entire behavior token sequence and then use a fully connected network to perform binary classification on this representation vector.
“Subsequently, the scheme performs supervised finetuning of the model: it treats the first vector of the encoded result as the representation vector of the entire behavior token sequence and then uses a fully connected network to perform binary classification on this representation vector.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Yuan et al. (2020)
Yuan et al. (2020) treat behavior token sequences as sentences, behavior tokens as words, and use the Transformer to encode the behavior token sequence.
“Shuhan Yuan et al. treat the behavior token sequences as sentences, treat the behavior tokens as words, and use the Transformer to encode the behavior token sequence.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Yuan et al. (2020)
Yuan et al. (2020) obtain behavioral time information by replacing the original position encoding of the Transformer with time encoding.
“The scheme obtains behavioral time information by replacing the original position encoding of the Transformer with time encoding.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Yuan et al. (2020)
Yuan et al. (2020) first use a method similar to the masked language model (MLM) to pre-train the Transformer model.
“During training, referring to the training method of BERT, the scheme first uses a method similar to the masked language model (MLM) to pre-train the Transformer model.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Yuan et al. (2020)
BRITD achieves a recall of 1.0000 and F1 of 0.8540, with precision 0.8072, in comparison with Yuan et al. (2020) and Wu and Li (2021) in Table 5.
“BRITD* | 0 | | 0.8072 | 1.0000 | 0.8540”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Yuan et al. (2020)
The citation lists haven’t been fetched yet
References 7 · Cited by 36
- Authors
- Yuan, S., Zheng, P., Wu, X., & Tong, H.
- Affiliations
- Utah State University (US)
- University of Arkansas at Fayetteville (US)
- University of Illinois Urbana-Champaign (US)
- Venue
- Proceedings of the 29th ACM International Conference on Information & Knowledge Management
- Publisher
- ACM
- Published
- 2020-10-19
- Pages
- 2289-2292
- ISSN
- 2155-0751 (ISSN-L)
- OpenAlex
- W3093545390
- Cited by
- 36
- References
- 7
- Citations by year
- 2026: 3 · 2025: 11 · 2024: 9 · 2023: 3 · 2022: 8 · 2021: 2
- FWCI
- 2.73
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM International Conference on Information and Knowledge Management (CIKM) (publishedVersion)
- Funders
- U.S. Department of Energy (DE-OE0000779)
- National Science Foundation (1564250, 1946391)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Keywords
- insider threat detection, few-shot learning, self-supervised pre-training, audit data, anomaly detection, employee behavior, cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
