LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection

arXiv:2403.09209v1 Announce Type: cross
Abstract: Enterprises and organizations are faced with potential threats from insider employees that may lead to serious consequences. Previous studies on insider threat detection (ITD) mainly focus on detecting abnormal users or abnormal time periods (e.g., a week or a day). However, a user may have hundreds of thousands of activities in the log, and even within a day there may exist thousands of activities for a user, requiring a high investigation budget to verify abnormal …

abstract arxiv consequences cs.ai cs.cr cs.lg detection employees enterprises focus however insider neighbors organizations real-time studies threat threat detection threats type