Attention to Patterns is all you need for Insider threat detection

원문 초록

Insider threats pose a significant and often underestimated risk to organizations. Traditional anomaly detection methods relying on simplistic patterns and lacking temporal awareness struggle to capture the nuances of user behavior, leading to missed detections and false alarms. This research proposes a novel approach that leverages the power of deep learning models to capture complex, hierarchical patterns in user behavior, enabling the early detection of malicious insider activity. The proposed approach introduces two distinct architectures: Time-Distributed Deep Learning Architecture (TD-CNN-LSTM) and Contextually Aware Attention-Based Architecture (TD-CNN-Attention). These architectures combine CNNs with LSTMs or attention mechanisms to extract both spatial and temporal features from user access data, capturing intricate patterns across different timescales. Additionally, they incorporate user information such as psychometrics and organizational data, providing a holistic view of user behavior and context. Through extensive evaluation, both architectures demonstrate significant improvements in accuracy and F1 score compared to existing insider threat detection solutions. The attention-based model in particular emerges as a state-of-the-art approach with superior performance capabilities. This research marks a significant step forward in the field of insider threat detection, paving the way for organizations to better secure their critical assets and safeguard their future in the ever-changing cybersecurity landscape.