MV-Gate: Insider Threat Detection via Multi-View Behavioral Statistics and Semantic Modeling
For insider threat detection, MV-Gate addresses the loss of statistical cues in current deep learning models, improving detection of gradual and low-visibility anomalies.
MV-Gate integrates statistical behavioral regularities with sequence semantics to detect insider threats, achieving notable gains over baselines on CERT r4.2, CERT r5.2, and ADFA-LD, especially for progressive, weak-signal threats.
Insider threats often reveal early anomalies through disruptions in behavioral statistics-such as altered recurrence patterns or short-versus long-term frequency shifts-rather than changes in event semantics. Yet, as the field has shifted from statistical modeling to log tokenization and deep sequential encoders, these statistical cues are weakened or lost, leaving current models insensitive to gradual and low-visibility insider behaviors.We propose MV-Gate, a multi-view behavior modeling framework that explicitly integrates statistical regularities with sequence semantics. MV-Gate constructs three aligned behavioral sequences: activity tokens, multi-scale status signals capturing recurrence patterns, and frequency-deviation signals describing short- vs long-term intensity differences. An anomaly-aware gating mechanism injects these statistical views into the attention computation, guiding the encoder to emphasize statistically irregular events. Experiments on CERT r4.2, CERT r5.2, and ADFA-LD show that MV-Gate achieves notable gains over classical, deep-learning, and domain-specific baselines, particularly for progressive, weak-signal threats. These results highlight the necessity of jointly modeling statistical and sequential evidence for robust insider-threat detection.