面向内部用户行为异常检测的图掩码对比学习方法

袁璐; 张斌; 姜迎畅; 房礼国; 孙剑文; 李红宇; 马骏

doi:10.11959/j.issn.1000-436x.TXXB260100

Chinese

您当前的位置：

首页 >

文章列表页 >

面向内部用户行为异常检测的图掩码对比学习方法

学术论文 | 更新时间：2026-07-16

- 面向内部用户行为异常检测的图掩码对比学习方法
- Graph masked contrastive learning method for insider user behavior anomaly detection
- 通信学报 2026年47卷第6期页码：79-92
- 作者机构：
  
  1.信息工程大学密码工程学院，河南郑州 450001
  2.32708部队，北京 102300
- 作者简介：
  
  袁璐（2000- ），女，信息工程大学博士生，主要研究方向为网络信息防御、异常行为检测。
  张斌（1969- ），男，博士，信息工程大学教授、博士生导师，主要研究方向为信息系统安全。
  姜迎畅（2000- ），男，信息工程大学博士生，主要研究方向为威胁情报分析、大模型应用。
  房礼国（1981- ），男，博士，信息工程大学副教授、硕士生导师，主要研究方向为信息安全、网络信息防御、视觉密码。
  孙剑文（1988- ），女，博士，32708部队工程师，主要研究方向为异常检测、深度学习。
  李红宇（2001- ），男，信息工程大学博士生，主要研究方向为源代码漏洞检测、机器学习算法。
  马骏（1981- ），男，博士，信息工程大学副教授、硕士生导师，主要研究方向为态势感知、网络攻防。
- 基金信息：
  
  国家自然科学基金资助项目(62477020);河南省科技攻关计划基金资助项目(252102211040)
- DOI：10.11959/j.issn.1000-436x.TXXB260100
  中图分类号： TP393.08
- 收稿：2026-02-21，
  
  修回：2026-04-23，
  
  录用：2026-04-23，
  
  纸质出版：2026-06-20
- 稿件说明：
移动端阅览
袁璐,张斌,姜迎畅等.面向内部用户行为异常检测的图掩码对比学习方法[J].通信学报,2026,47(06):79-92.

Yuan Lu,Zhang Bin,Jiang Yingchang,et al.Graph masked contrastive learning method for insider user behavior anomaly detection[J].Journal on Communications,2026,47(06):79-92.
袁璐,张斌,姜迎畅等.面向内部用户行为异常检测的图掩码对比学习方法[J].通信学报,2026,47(06):79-92. DOI： 10.11959/j.issn.1000-436x.TXXB260100.

Yuan Lu,Zhang Bin,Jiang Yingchang,et al.Graph masked contrastive learning method for insider user behavior anomaly detection[J].Journal on Communications,2026,47(06):79-92. DOI： 10.11959/j.issn.1000-436x.TXXB260100.

摘要

针对现有内部用户行为异常检测方法在时空关联表征能力较弱、隐蔽异常行为难以识别以及对正常业务波动鲁棒性较差的问题，提出一种面向内部用户行为异常检测的图掩码对比学习（TGMC）方法。首先，将多源异构日志按时间窗口构建为异构图序列，刻画用户与业务资源实体间的交互关系。然后，设计由图注意力网络与门控循环单元构成的混合编码器，分别提取空间拓扑特征与时序变化特征，实现时空维度的深度耦合。同时，引入掩码重建机制，通过邻域上下文恢复被掩码节点的特征与边结构，挖掘邻域关联模式以提升隐蔽异常行为的检测能力。最后，设计多视图对比学习机制，通过构造增强视图约束同一用户跨视图表示的语义一致性，并增大不同用户间的表示距离，学习稳定的行为表征以提升识别鲁棒性。在CERT r4.2与CERT r5.2数据集上的实验结果表明，与基线方法相比，TGMC方法的真阳性率（TPR）分别提升了3.59%和1.59%，FPR分别降低了5.45%和2.49%。

Abstract

To address the limitations of existing insider user behavior anomaly detection methods

including weak spatiotemporal correlation representation

difficulty in identifying stealthy anomalous behaviors

and poor robustness to normal business fluctuations

a graph masked contrastive learning method named TGMC for insider user behavior anomaly detection was proposed. Firstly

multi-source heterogeneous logs were organized into a sequence of heterogeneous graphs using time windows to characterize interaction relationships between users and business resource entities. Then

a hybrid encoder composed of a graph attention network and a gated recurrent unit was designed to extract spatial topological features and temporal evolution features

respectively

enabling deep coupling across spatiotemporal dimensions. A masked reconstruction mechanism was introduced to recover the features and edge structures of masked nodes from the neighborhood context

mining neighborhood correlation patterns to enhance the detection capability for stealthy anomalous behaviors. Finally

a multi-view contrastive learning mechanism was devised: by constructing augmented views

it enforced semantic consistency of the same user’s representations across views while enlarging the representation distance between different users

thereby learning stable behavior representations and improving recognition robustness. Experiments on the CERT r4.2 and CERT r5.2 datasets demonstrate that

compared with baseline methods

TGMC improves true positive rate (TPR) by 3.59% and 1.59%

and reduces FPR by 5.45% and 2.49%.

关键词

Keywords

references

孙德刚 , 刘美辰 , 李梅梅 , 等 . 内部威胁分析与防御综述 [J ] . 信息安全学报 , 2025 , 10 ( 1 ): 176 - 193 .

Sun D G , Liu M C , Li M M , et al . A survey of insider threat analysis and defense solutions [J ] . Journal of Cyber Security , 2025 , 10 ( 1 ): 176 - 193 .

Ponemon Institute . 2025 cost of insider risks global report [R ] . Traverse City : Ponemon Institute , 2025 .

郭渊博 , 刘春辉 , 孔菁 , 等 . 内部威胁检测中用户行为模式画像方法研究 [J ] . 通信学报 , 2018 , 39 ( 12 ): 141 - 150 .

Guo Y B , Liu C H , Kong J , et al . Study on user behavior profiling in insider threat detection [J ] . Journal on Communications , 2018 , 39 ( 12 ): 141 - 150 .

Le D C , Zincir-Heywood N , Heywood M I . Analyzing data granularity levels for insider threat detection using machine learning [J ] . IEEE Transactions on Network and Service Management , 2020 , 17 ( 1 ): 30 - 44 .

Randive K , Mohan R , Sivakrishna A M . An efficient pattern-based approach for insider threat classification using the image-based feature representation [J ] . Journal of Information Security and Applications , 2023 , 73 : 103434 .

Duan S M , Yuan J T , Wang B . Contextual feature representation for image-based insider threat classification [J ] . Computers Security , 2024 , 140 : 103779 .

Yuan L P , Choo E , Yu T , et al . Time-window based group-behavior supported method for accurate detection of anomalous users [C ] // Proceedings of the 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2021 : 250 - 262 .

Kan X , Fan Y X , Zheng J J , et al . Data adjusting strategy and optimized XGBoost algorithm for novel insider threat detection model [J ] . Journal of the Franklin Institute , 2023 , 360 ( 16 ): 11414 - 11443 .

李涛 , 毕悦 , 胡爱群 . 面向智能系统的内部威胁多源日志分析与检测方法 [J ] . 信息网络安全 , 2025 , 25 ( 4 ): 509 - 523 .

Li T , Bi Y , Hu A Q . Insider threat multi-source log analysis and detection method for intelligent systems [J ] . Netinfo Security , 2025 , 25 ( 4 ): 509 - 523 .

胡向东 , 张琴 . 基于特征组合优化的工业互联网恶意行为实时检测方法 [J ] . 电子学报 , 2024 , 52 ( 9 ): 3075 - 3085 .

Hu X D , Zhang Q . Real-time detection method of malicious behaviors in industrial Internet based on feature combination optimization [J ] . Acta Electronica Sinica , 2024 , 52 ( 9 ): 3075 - 3085 .

Tuor A , Kaplan S , Hutchinson B , et al . Deep learning for unsupervised insider threat detection in structured cybersecurity data streams [C ] // Proceedings of the AAAI Workshop on Artificial Intelligence for Cyber Security . Palo Alto : AAAI Press , 2017 : 224 - 231 .

Du M , Li F F , Zheng G N , et al . DeepLog: anomaly detection and diagnosis from system logs through deep learning [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2017 : 1285 - 1298 .

Villarreal-Vasquez M , Modelo-Howard G , Dube S , et al . Hunting for insider threats using LSTM-based anomaly detection [J ] . IEEE Transactions on Dependable and Secure Computing , 2023 , 20 ( 1 ): 451 - 462 .

Paul S , Mishra S . LAC: LSTM autoencoder with community for insider threat detection [C ] // Proceedings of the 4th International Conference on Big Data Research . New York : ACM Press , 2021 : 71 - 77 .

Manoharan P , Hong W , Yin J , et al . Optimising insider threat prediction: exploring BiLSTM networks and sequential features [J ] . Data Science and Engineering , 2024 , 9 ( 4 ): 393 - 408 .

Chen Q W , Zhao H , Li W , et al . Behavior sequence transformer for e-commerce recommendation in Alibaba [C ] // Proceedings of the 1st International Workshop on Deep Learning Practice for High-Dimensional Sparse Data . New York : ACM Press , 2019 : 1 - 4 .

杨梦华 , 易军凯 , 朱贺军 . 基于CNN-LSTM算法的内部威胁检测方法 [J ] . 信息网络安全 , 2025 , 25 ( 2 ): 327 - 336 .

Yang M H , Yi J K , Zhu H J . CNN-LSTM algorithm-based insider threat detection model [J ] . Netinfo Security , 2025 , 25 ( 2 ): 327 - 336 .

Jiang J G , Chen J M , Gu T B , et al . Anomaly detection with graph convolutional networks for insider threat and fraud detection [C ] // Proceedings of the MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM) . Piscataway : IEEE Press , 2019 : 109 - 114 .

Fei K X , Zhou J , Su L , et al . A graph convolution neural network based method for insider threat detection [C ] // Proceedings of the 2022 IEEE International Conference on Parallel Distributed Processing with Applications , Big Data Cloud Computing, Sustainable Computing Communications, Social Computing Networking (ISPA/BDCloud/SocialCom/SustainCom) . Piscataway : IEEE Press , 2022 : 66 - 73 .

Liu F C , Wen Y , Zhang D X , et al . Log2Vec: a heterogeneous graph embedding based approach for detecting cyber threats within enterprise [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2019 : 1777 - 1794 .

Li X M , Li X Y , Jia J , et al . A high accuracy and adaptive anomaly detection model with dual-domain graph convolutional network for insider threat detection [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 1638 - 1652 .

Li X M , Li L H , Li X Y , et al . GMFITD: graph meta-learning for effective few-shot insider threat detection [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 7161 - 7175 .

Kong K C , Jin X B , Liu D J , et al . DPI-ITD: a dual-perspective information-driven framework for insider threat detection in IoT systems [J ] . IEEE Internet of Things Journal , 2025 , 12 ( 19 ): 40731 - 40749 .

严莉 , 张凯 , 徐浩 , 等 . 基于图注意力机制和Transformer的异常检测 [J ] . 电子学报 , 2022 , 50 ( 4 ): 900 - 908 .

Yan L , Zhang K , Xu H , et al . Abnormal detection based on graph attention mechanisms and transformer [J ] . Acta Electronica Sinica , 2022 , 50 ( 4 ): 900 - 908 .

Qi Y H , Yan C Y , Wang Z H , et al . ATHITD: attention-based temporal heterogeneous graph neural network for insider threat detection [J ] . Computers Security , 2025 , 157 : 104587 .

LYU B , Wang D , Wang Y , et al . A hybrid model based on multi-dimensional features for insider threat detection [C ] // International Conference on Wireless Algorithms, Systems, and Applications (WASA 2018) . Berlin : Springer , 2018 : 333 - 344 .

冯冠云 , 付才 , 吕建强 , 等 . 基于操作注意力和数据增强的内部威胁检测 [J ] . 网络与信息安全学报 , 2023 , 9 ( 3 ): 102 - 112 .

Feng G Y , Fu C , Lyu J Q , et al . Insider threat detection based on operational attention and data augmentation [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 3 ): 102 - 112 .

Pal P , Chattopadhyay P , Swarnkar M . Temporal feature aggregation with attention for insider threat detection from activity logs [J ] . Expert Systems with Applications , 2023 , 224 : 119925 .

Vaswani A , Shazeer N , Parmar N , et al . Attention is all you need [C ] // Proceedings of the 31st International Conference on Neural Information Processing Systems . Massachusetts : MIT Press , 2017 : 5998 - 6008 .

Zhou K , Yu H , Zhao W X , et al . Filter-enhanced MLP is all you need for sequential recommendation [C ] // Proceedings of the ACM Web Conference 2022 . New York : ACM Press , 2022 : 2388 - 2399 .

Gong Y R , Cui S S , Liu S , et al . Graph-based insider threat detection: a survey [J ] . Computer Networks , 2024 , 254 : 110757 .

Cai X R , Wang Y , Xu S H , et al . LAN: learning adaptive neighbors for real-time insider threat detection [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 10157 - 10172 .

Hou Z Y , Liu X , Cen Y K , et al . GraphMAE: self-supervised masked graph autoencoders [C ] // Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . New York : ACM Press , 2022 : 594 - 604 .

Lindauer B . Insider threat test dataset [D ] . Pittsburgh : Carnegie Mellon University , 2020 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于对比学习的图神经网络后门攻击防御方法

面向威胁情报的小样本文档级事件抽取方法

面向指纹室内定位的高鲁棒性集成对抗训练方法

基于对比学习和预训练Transformer的流量隐匿数据检测方法

面向毫米波混合阵列上行感知的鲁棒异步张量估计架构