Temporal Semantic Parsing for Insider Threat Activity Modeling and Detection

Insider attacks have become increasingly frequent and more difficult to detect. Modeling user activities to capture the temporal features and connections between activities can enhance the detection of insider threats. In this work, we present a novel insider activity modeling approach that uses effective representations of user activities to enhance the detection performance. The proposed activity modeling and detection system has been evaluated using log files from the CMU CERT r4.2 insider dataset that provides the activities of employees for eighteen working months. Our results have shown that the proposed system achieves high malicious activity identification performance with the proposed data modeling techniques.