用Transformer建模用户行为序列，精准识别内鬼攻击
User-Based Sequential Modeling with Transformer Encoders for Insider Threat Detection
- 将用户操作转为时间序列，用Transformer捕捉长期依赖
- 在多版本CERT数据集上达96.61%准确率，99.43%召回率
- 适合安全团队做高精度内鬼检测，尤其关注低漏报场景
内鬼威胁检测因攻击者权限合法、行为隐蔽而极具挑战。现有机器学习方法常将用户行为视为孤立事件，忽略其时序关联。本文提出用户级序列化（UBS）方法，将CERT内鬼数据集转化为适合深度时序建模的结构化序列。采用Transformer编码器建模正常用户行为，并以重构误差作为异常得分，再结合三种无监督异常检测算法（OCSVM、LOF、iForest）进行评估。在四个精心设计的测试集上，该方法表现优异：准确率96.61%，召回率99.43%，F1分数96.38%，AUROC 95.00%，误报率仅0.0571，漏报率低至0.0057。对比分析表明，本方法显著优于传统表格模型和自编码器基线，验证了时序建模与先进异常检测在内鬼检测中的有效性。
原文摘要 · Abstract (English)
Insider threat detection presents unique challenges due to the authorized status of malicious actors and the subtlety of anomalous behaviors. Existing machine learning methods often treat user activity as isolated events, thereby failing to leverage sequential dependencies in user behavior. In this study, we propose a User-Based Sequencing (UBS) methodology, transforming the CERT insider threat dataset into structured temporal sequences suitable for deep sequential modeling. We deploy a Transformer Encoder architecture to model benign user activity and employ its reconstruction errors as anomaly scores. These scores are subsequently evaluated using three unsupervised outlier detection algorithms: One-Class SVM (OCSVM), Local Outlier Factor (LOF), and Isolation Forest (iForest). Across four rigorously designed test sets, including combinations of multiple CERT dataset releases, our UBS-Transformer pipeline consistently achieves state-of-the-art performance - notably 96.61% accuracy, 99.43% recall, 96.38% F1-score, 95.00% AUROC, and exceptionally low false negative (0.0057) and false positive (0.0571) rates. Comparative analyses demonstrate that our approach substantially outperforms tabular and conventional autoencoder baselines, underscoring the efficacy of sequential user modeling and advanced anomaly detection in the insider threat domain.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。