Insider attacks have become increasingly frequent and more difficult to detect. Modeling user activities to capture the temporal features and connections between activities can enhance the detection of insider threats. In this work, we present a novel insider activity modeling approach that uses effective representations of user activities to enhance the detection performance. The proposed activity modeling and detection system has been evaluated using log files from the CMU CERT r4.2 insider dataset that provides the activities of employees for eighteen working months. Our results have shown that the proposed system achieves high malicious activity identification performance with the proposed data modeling techniques.
Temporal Semantic Parsing for Insider Threat Activity Modeling and Detection
2024-07-15
983784 byte
Conference paper
Electronic Resource
English
Grammar-Constrained Neural Semantic Parsing with LR Parsers
German Aerospace Center (DLR) | 2021
|A new breed of anti-fraud software aims to curb the insider threat
British Library Online Contents | 2009
Online Contents | 2002