SaTC: CORE: Small: Deep Learning for Insider Threat Detection

内部人员是组织内的恶意人员，他们滥用授权访问权限，从而危及信息系统的机密性、完整性或可用性。来自内部人员的攻击很难被发现，可能会给组织造成重大损失。内部威胁检测问题已经研究了很长时间，但由于内部威胁的动态性和自适应性，传统的基于机器学习的检测方法严重依赖于特征工程，难以准确捕捉内部用户和普通用户之间的行为差异。先进的深度学习技术提供了一种新的范式，可以从复杂的用户行为数据中学习端到端的内部威胁检测模型。该项目开发了一个用于内部威胁检测的深度学习框架。该项目的创新之处在于开发了自监督用户行为表示学习、用于恶意会话检测的少量学习、用于自适应行为检测的强化学习以及基于反事实解释的恶意活动检测。该项目更广泛的意义和重要性在于提供一种用于检测和减轻内部安全风险的新工具集，这可以使经常受到恶意内部人员攻击的行业和政府受益。该项目开发了新的深度学习方法来检测恶意会话，方法是：a）开发一种自监督表示学习方法，将用户会话编码到低维嵌入空间中，而不使用任何手动标记的数据，B）通过分解表示学习来推进一个少量学习框架，以检测具有细微活动变化的恶意会话，c）采用强化学习框架来识别动态演变的内部攻击，以及d）提出反事实解释方法来检测恶意会话中的恶意活动。该框架有可能扩展到不同类型的欺诈检测。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估。

Insiders are malicious people within organizations who abuse their authorized access in a manner that compromises the confidentiality, integrity, or availability of information systems. Attacks from insiders are hard to detect and can cause significant loss to organizations. While the problem of insider threat detection has been studied for a long time, the traditional machine learning-based detection approaches, which heavily rely on feature engineering, are hard to accurately capture the behavior difference between insiders and normal users due to the dynamic and adaptive nature of insider threats. Advanced deep learning techniques provide a new paradigm to learn end-to-end insider threat detection models from complex user behavior data. This project develops a deep learning framework for insider threat detection. The project’s novelties are the development of self-supervised user behavior representation learning, few-shot learning for malicious session detection, reinforcement learning for adaptive behavior detection, and counterfactual explanations based malicious activity detection. The project’s broader significance and importance are to provide a novel toolset for detecting and mitigating internal security risks, which can be benefit industries and governments who are frequently under attacks from malicious insiders. This project develops novel deep learning approaches to detect malicious sessions through a) developing a self-supervised representation learning approach to encode user sessions into a low-dimensional embedding space without using any manually labeled data, b) advancing a few-shot learning framework via disentangled representation learning to detect malicious sessions with subtle activity changes, c) adapting reinforcement learning framework to identify dynamically evolving insider attacks, and d) proposing a counterfactual explanation approach to detect malicious activities in malicious sessions. The framework has the potential to extend to different types of fraud detection.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.