Insider Threat Detection Using GCN and Bi-LSTM With Explicit and Implicit Graph Representations

Summary

This article presents a post-hoc insider threat detection framework that combines an explicit graph built from predefined rules with an implicit graph derived from feature similarities via the Gumbel softmax trick. Both graphs feed separate GCNs, then an attention mechanism and a Bi-LSTM model user behavior over time. On the CERT r5.2 dataset it reports an AUC of 98.62, a 100% detection rate and a 0.05 false positive rate, and on the harder r6.2 dataset an AUC of 88.48, an 80.15% detection rate and a 0.15 false positive rate.