MV-Gate: Insider Threat Detection via Multi-View Behavioral Statistics and Semantic Modeling

TL;DR

MV-Gate is a novel framework that combines statistical behavioral patterns with semantic sequence modeling to improve insider threat detection, especially for subtle, progressive threats.

Contribution

It introduces a multi-view modeling approach with an anomaly-aware gating mechanism that enhances detection of low-visibility insider behaviors.

Findings

MV-Gate outperforms classical and deep-learning baselines.

It is particularly effective for progressive, weak-signal threats.

Experiments on multiple datasets validate its robustness.

Abstract

Insider threats often reveal early anomalies through disruptions in behavioral statistics-such as altered recurrence patterns or short-versus long-term frequency shifts-rather than changes in event semantics. Yet, as the field has shifted from statistical modeling to log tokenization and deep sequential encoders, these statistical cues are weakened or lost, leaving current models insensitive to gradual and low-visibility insider behaviors.We propose MV-Gate, a multi-view behavior modeling framework that explicitly integrates statistical regularities with sequence semantics. MV-Gate constructs three aligned behavioral sequences: activity tokens, multi-scale status signals capturing recurrence patterns, and frequency-deviation signals describing short- vs long-term intensity differences. An anomaly-aware gating mechanism injects these statistical views into the attention computation, guiding the encoder to emphasize statistically irregular events. Experiments on CERT r4.2, CERT r5.2, and ADFA-LD show that MV-Gate achieves notable gains over classical, deep-learning, and domain-specific baselines, particularly for progressive, weak-signal threats. These results highlight the necessity of jointly modeling statistical and sequential evidence for robust insider-threat detection.