DTITD: An Intelligent Insider Threat Detection Framework Based on Digital Twin and Self-Attention Based Deep Learning Models

Latest statistics and studies shows that the loss generated by insider threats is much higher than the external attacks. More and more organizations are increasing invest or purchase insider threat detection system to prevent insider risks. However, accurately and timely detecting insider threat face huge challenges. In this paper, we proposed an intelligent insider threat detection framework based on Digital Twin and self-attentions based deep learning model. First, this paper introduced what the insider threats are and the challenges of detecting them. Then this paper showed related recent works on solving insider threat detection problems and their limitations. Next, this paper proposed our solutions to address these challenges: building the innovative intelligent insider threat detection framework based on Digital Twin (DT) and self-attention based deep learning models, performing insight analysis of users’ behavior and entities, adopting contextual word embedding techniques using Bidirectional Encoder Representations from Transformers (BERT) model and sentence embedding technique using Generative Pre-trained Transformer 2 (GPT-2) model to make data augmentation to overcome significant data imbalance, and adopting temporal semantic representation of users’ behaviors to build user behavior time sequence. After that, this paper built self-attention based deep learning models to quickly detect insider threat. This paper proposed a simplified transformer model named DistilledTrans and applied original transformer model, DistilledTrans, BERT + final layer, Robustly Optimized BERT Approach (RoBERTa) + final layer, and the hybrid method combining pre-trained (BERT, RoBERTa) with Convolutional Neural Network (CNN) or Long Short-term Memory (LSTM) network model to detect insider threats. Finally, this paper showed experiment results on dense dataset CERT r4.2 and augmented sporadic dataset CERT r6.2, evaluated their performance and made comparison analysis with the state-of-the-art models. Promising experimental results shows that 1) contextual word embedding insert and substitution predicted by BERT model, and context embedding sentence predicted by GPT-2 model are effective data augmentation approaches to address highly data imbalance 2) DistilledTrans trained with sporadic dataset CERT r6.2 augmented by contextual embedding sentence method predicted by GPT-2 outperforms the state-of-the-art models in term of all evaluation metrics including accuracy, precision, recall, F1-score, and AUC. Additionally, its structure is much simpler and thus training time and computing cost are much less than the recent models 3) When trained with the dense dataset CERT r4.2, Pre-trained models BERT plus a final layer or RoBERTa plus a final layer can get significantly higher performance than the current models with a very little sacrifice of precision. In compassion, complex hybrid methods may not be necessary.

Récupéré en direct depuis OpenAlex et désinversé. Les résumés ne sont pas conservés dans cette base de données : les index inversés représentent 8,6 Go des 9,3 Go de texte de la base, et le serveur dispose de 13 Go libres.