Abstract:

In the field of intelligent system security, the anomaly detection domain, especially the identification of insider threats, is a challenging task. Existing methods usually rely on predefined rules or temporal modelling learning, but are prone to limitations when facing unknown threat patterns, and it is difficult to fully explore the deep features of log data. To address this problem, this paper proposed an insider threat detection method based on the fusion of Transformer Encoder (Trans-Encoder) and Long Short-Term Memory (LSTM) networks, aiming to achieve efficient identification of hidden anomalies in logs by using only normal class data for training. Firstly, the method proposed in this paper enhanced the ability to extract features from multi-source log data by improving the Transformer encoder structure and adding a masking mechanism. Then LSTM was applied for time series modelling to capture the temporal correlation between the extracted features, which improved the model’s ability to analyze sequential dependencies. Finally, the degree of difference between the predicted value and the corresponding feature value was calculated and compared with the threshold value to determine whether the operation was anomalous or not. The experimental results show that the method outperforms the existing state-of-the-art methods on the insider threat detection task, with a 1.5% improvement in Precision, a 4.8% improvement in Recall, a 1.3% improvement in F1-score, and a stable performance with only 10% training data. In addition, the computational efficiency is higher than that of MTSAD in both the training and testing phases, which verifies its potential application in intelligent system security and provides an efficient and reliable solution for improving system protection.

Key words: insider threat detection, user behavior analysis, semantic analysis, temporal analysis