RMSL: Weakly-Supervised Insider Threat Detection with Robust Multi-sphere Learning

TL;DR

This paper introduces RMSL, a weakly-supervised learning framework that uses multiple hyper-spheres and adaptive self-training to improve insider threat detection from sequence-level labels, reducing annotation costs and enhancing detection accuracy.

Contribution

The paper proposes a novel RMSL framework that leverages weak sequence-level labels and multiple hyper-spheres to effectively detect behavior-level insider threats, addressing annotation and ambiguity challenges.

Findings

Significant performance improvement over existing methods.

Effective use of weak labels for behavior-level anomaly detection.

Robust hyper-sphere representation enhances detection accuracy.

Abstract

Insider threat detection aims to identify malicious user behavior by analyzing logs that record user interactions. Due to the lack of fine-grained behavior-level annotations, detecting specific behavior-level anomalies within user behavior sequences is challenging. Unsupervised methods face high false positive rates and miss rates due to the inherent ambiguity between normal and anomalous behaviors. In this work, we instead introduce weak labels of behavior sequences, which have lower annotation costs, i.e., the training labels (anomalous or normal) are at sequence-level instead of behavior-level, to enhance the detection capability for behavior-level anomalies by learning discriminative features. To achieve this, we propose a novel framework called Robust Multi-sphere Learning (RMSL). RMSL uses multiple hyper-spheres to represent the normal patterns of behaviors. Initially, a one-class classifier is constructed as a good anomaly-supervision-free starting point. Building on this, using multiple instance learning and adaptive behavior-level self-training debiasing based on model prediction confidence, the framework further refines hyper-spheres and feature representations using weak sequence-level labels. This approach enhances the model's ability to distinguish between normal and anomalous behaviors. Extensive experiments demonstrate that RMSL significantly improves the performance of behavior-level insider threat detection.