SENTINEL: Insider Threat Detection Based on Multi-Timescale User Behavior Interaction Graph Learning

Abstract

Insider threats have become a prominent driver behind a myriad of cybersecurity incidents in recent years. Since the threats take place within intranet, traditional security devices located at the network perimeter can hardly detect them. The trust management methods employed within the organization are likewise incapable of intercepting access actions already authenticated with valid credentials. In this paper, we propose a novel insider threat detection method named SENTINEL, which identifies abnormal behavior of insiders and provides fine-grained threat intelligence. We devise a dynamic user behavior interaction graph (BIG), which jointly considers the spatial distribution of user behavioral trajectories among the network topology and the temporal variations of user behavioral profiles. By incorporating a spatio-temporal graph neural network, SENTINEL is able to learn the operation regularities of users at specific times and respective positions in BIG. In order to perceive both the abrupt and persistent threats simultaneously, we conceive a multi-timescale fusion mechanism for detecting users' activities at different timescales. SENTINEL implements a log-entry-level detection without requiring any attack samples during model training. The experiments conducted on widely-used public datasets demonstrate that SENTINEL achieves superior performance while maintaining a relatively low computational overhead compared to the state-of-the-art methods.