TabSec: A Collaborative Framework for Novel Insider Threat Detection

TL;DR

TabSec introduces a collaborative threat detection framework combining IDS and UEBA with TabNet architecture, significantly improving detection accuracy for insider and external threats in enterprise networks.

Contribution

The paper presents a novel integrated detection framework, TabITD, that enhances threat detection by combining IDS, UEBA, and TabNet's feature selection for better accuracy and rare attack detection.

Findings

Achieved average detection accuracies of 96.71% and 97.25%.

Effectively detects masquerade and external threats.

Enhances network security and attack detection efficiency.

Abstract

In the era of the Internet of Things (IoT) and data sharing, users frequently upload their personal information to enterprise databases to enjoy enhanced service experiences provided by various online services. However, the widespread presence of system vulnerabilities, remote network intrusions, and insider threats significantly increases the exposure of private enterprise data on the internet. If such data is stolen or leaked by attackers, it can result in severe asset losses and business operation disruptions. To address these challenges, this paper proposes a novel threat detection framework, TabITD. This framework integrates Intrusion Detection Systems (IDS) with User and Entity Behavior Analytics (UEBA) strategies to form a collaborative detection system that bridges the gaps in existing systems' capabilities. It effectively addresses the blurred boundaries between external and insider threats caused by the diversification of attack methods, thereby enhancing the model's learning ability and overall detection performance. Moreover, the proposed method leverages the TabNet architecture, which employs a sparse attention feature selection mechanism that allows TabNet to select the most relevant features at each decision step, thereby improving the detection of rare-class attacks. We evaluated our proposed solution on two different datasets, achieving average accuracies of 96.71% and 97.25%, respectively. The results demonstrate that this approach can effectively detect malicious behaviors such as masquerade attacks and external threats, significantly enhancing network security defenses and the efficiency of network attack detection.