LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection

arXiv:2403.09209v1 Announce Type: new
Abstract: Enterprises and organizations are faced with potential threats from insider employees that may lead to serious consequences. Previous studies on insider threat detection (ITD) mainly focus on detecting abnormal users or abnormal time periods (e.g., a week or a day). However, a user may have hundreds of thousands of activities in the log, and even within a day there may exist thousands of activities for a user, requiring a high investigation budget to verify abnormal …

abnormal arxiv consequences cs.ai cs.cr cs.lg detection employees enterprises focus insider insider threat insider threat detection lan may neighbors organizations potential threats real serious studies threat threat detection threats week