Insider Threat Detection Using Time Series Foundation Models
Open Access DepositedA Transformer Based Behavioral Analytics Approach
PR-AUC = 0.97, ROC-AUC = 0.999, and up to 93-97% in recall, while maintaining 83-93% in precision, depending on which operational mode was at test. In attempts to simulate a real-world SOC scenario, we test the model accuracy with a 160-alerts-per-day constraint, which resulted in an F1-score of 91.6%, demonstrating both technical and operational practicality. Compared to prior research, such as auto encoders, Isolation Forest, One-Class SVM, and UBS-Transformer models, Patch TST managed to achieve competitive and in some cases superior results without the need for complex user-session reconstruction. The research demonstrates that transformer-based time-series modeling can detect insider threats through their behavioral, temporal patterns and account for realistic workloads for analysts. Through showing scalable preprocessing, supervised learning on high-dimensional behavioral tensors, and evaluation modeled after SOC capacity, this framework creates a reproducible model for future insider-threat research. Clearly, the results validate that TSFMs (i.e. PatchTST) can enhance detection accuracy, interpretability, and trust—bridging the gap between the advanced research into Artificial Intelligence (AI) and operational deployment of cybersecurity.
Insider threats remain one of the most difficult challenges in cybersecurity. Unlike external attacks, insider threats operate within your environment and are not faced by the external security challenges an external entity would typically face. In addition, an insider threat could be at any hierarchical level of your environment. From an end user to your CEO. This praxis aims to highlight the deficiencies of current traditional security controls, which are often simply rule or anomaly based. We dive deep into current emerging transformer-based behavioral detection models, with a deep focus on Time Series Foundation Models (TSFMs), specifically, the Patch Time Series Transformer (PatchTST) architecture. The Carnegie Mellon University (CMU) Computer Emergency Response Team (CERT) r4.2 dataset was used to mimic realistic enterprise user behaviors across multiple (logons, file operations, device usage, email, and web activity). User-day activity logs were aggregated and converted to multivariate time series tensors. Temporal and statistical features were engineered (e.g., rolling z-scores, department-based deviations, and interactions across modalities) to capture both short-term and long-term behavioral characteristics. Dimension reduction (100% variance retained) was accomplished with Principal Component Analysis for stability and improved training efficiency. Due to the high levels of class imbalance in CERT 4.2, a supervised PatchTST model was trained using weighted sampling, focal loss, and negative-only pretraining to aid mitigation of severe class imbalance, which, in our case, insider threat activity encompasses 2% of the entire dataset. Model performance was evaluated across multiple operational scenarios. A default, precision-oriented, fixed daily alert budget, and calibrated probabilities in attempts to emulate a real Security Operations Center (SOC). The results demonstrated a strong and balanced detection capability. The model achieved the following scores
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.