MV-Gate: Insider Threat Detection via Multi-View Behavioral Statistics and Semantic Modeling

• URL: http://arxiv.org/abs/2605.17761v1
• Date: Mon, 18 May 2026 02:29:03 GMT
• Title: MV-Gate: Insider Threat Detection via Multi-View Behavioral Statistics and Semantic Modeling
• Abstract summary: We propose MV-Gate, a behavior modeling framework that integrates statistical regularities with sequence semantics.<n>An anomaly-aware computation gating mechanism injects these statistical views into the attention, guiding the encoder to emphasize statistically irregular events.
• Score: 9.029887829076866
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Insider threats often reveal early anomalies through disruptions in behavioral statistics-such as altered recurrence patterns or short-versus long-term frequency shifts-rather than changes in event semantics. Yet, as the field has shifted from statistical modeling to log tokenization and deep sequential encoders, these statistical cues are weakened or lost, leaving current models insensitive to gradual and low-visibility insider behaviors.We propose MV-Gate, a multi-view behavior modeling framework that explicitly integrates statistical regularities with sequence semantics. MV-Gate constructs three aligned behavioral sequences: activity tokens, multi-scale status signals capturing recurrence patterns, and frequency-deviation signals describing short- vs long-term intensity differences. An anomaly-aware gating mechanism injects these statistical views into the attention computation, guiding the encoder to emphasize statistically irregular events. Experiments on CERT r4.2, CERT r5.2, and ADFA-LD show that MV-Gate achieves notable gains over classical, deep-learning, and domain-specific baselines, particularly for progressive, weak-signal threats. These results highlight the necessity of jointly modeling statistical and sequential evidence for robust insider-threat detection.

Related papers

• Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection [1.8995711908407733]
  This study introduces a causally-constrained probabilistic forecasting framework for anomaly detection.<n>It integrates an explicit time-lagged causal graph prior with deep sequence modeling.<n>Experiments indicate that the proposed method achieves state-of-the-art detection performance.
  arXiv  Detail & Related papers  (2026-04-20T09:24:28Z)
• Real-Time Proactive Anomaly Detection via Forward and Backward Forecast Modeling [0.0]
  We introduce two proactive anomaly detection frameworks: the Forward Forecasting Model (FFM) and the Backward Reconstruction Model (BRM)<n>FFM forecasts future sequences to anticipate disruptions, while BRM reconstructs recent history from future context to uncover early precursors.<n>Our models support both continuous and discrete multivariate features, enabling robust performance in real-world settings.
  arXiv  Detail & Related papers  (2026-02-12T03:57:41Z)
• Contextual and Seasonal LSTMs for Time Series Anomaly Detection [49.50689313712684]
  We propose a novel prediction-based framework named Contextual and Seasonal LSTMs (CS-LSTMs)<n>CS-LSTMs are built upon a noise decomposition strategy and jointly leverage contextual dependencies and seasonal patterns.<n>They consistently outperform state-of-the-art methods, highlighting their effectiveness and practical value in robust time series anomaly detection.
  arXiv  Detail & Related papers  (2026-02-10T11:46:15Z)
• Labels Matter More Than Models: Quantifying the Benefit of Supervised Time Series Anomaly Detection [56.302586730134806]
  Time series anomaly detection (TSAD) is a critical data mining task often constrained by label scarcity.<n>Current research predominantly focuses on Unsupervised Time-series Anomaly Detection.<n>This paper challenges the premise that architectural complexity is the optimal path for TSAD.
  arXiv  Detail & Related papers  (2025-11-20T08:32:49Z)
• PLanTS: Periodicity-aware Latent-state Representation Learning for Multivariate Time Series [10.332959619473652]
  We propose PLanTS, a periodicity-aware self-supervised learning framework that explicitly models irregular latent states and their transitions.<n> PLanTS consistently improves the representation quality over existing SSL methods and demonstrates superior runtime efficiency compared to DTW-based methods.
  arXiv  Detail & Related papers  (2025-09-05T20:10:09Z)
• Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition [6.945554245486656]
  Insider threat detection presents a significant challenge due to the deceptive nature of malicious behaviors.<n>We propose Log2Sig, a robust anomaly detection framework that transforms user logs into behavioral frequency signals.<n>We show that Log2Sig significantly outperforms state-of-the-art baselines in both accuracy and F1 score.
  arXiv  Detail & Related papers  (2025-08-06T18:47:26Z)
• HCL-MTSAD: Hierarchical Contrastive Consistency Learning for Accurate Detection of Industrial Multivariate Time Series Anomalies [4.806959791183183]
  We propose a novel self-supervised hierarchical contrastive consistency learning method for detecting anomalies in industrial MTS. By developing a multi-layer contrastive loss, HCL-MTSAD can extensively mine data consistency and timestamp-temporal association. Experiments conducted on six diverse MTS retrieved from real cyber-physical systems and server machines, indicate that HCL-MTSAD's anomaly detection capability outperforms the state-of-the-art benchmark models by an average of 1.8% in terms of F1 score.
  arXiv  Detail & Related papers  (2024-04-12T03:39:33Z)
• A Poisson-Gamma Dynamic Factor Model with Time-Varying Transition Dynamics [51.147876395589925]
  A non-stationary PGDS is proposed to allow the underlying transition matrices to evolve over time. A fully-conjugate and efficient Gibbs sampler is developed to perform posterior simulation. Experiments show that, in comparison with related models, the proposed non-stationary PGDS achieves improved predictive performance.
  arXiv  Detail & Related papers  (2024-02-26T04:39:01Z)
• Graph Spatiotemporal Process for Multivariate Time Series Anomaly Detection with Missing Values [67.76168547245237]
  We introduce a novel framework called GST-Pro, which utilizes a graphtemporal process and anomaly scorer to detect anomalies. Our experimental results show that the GST-Pro method can effectively detect anomalies in time series data and outperforms state-of-the-art methods.
  arXiv  Detail & Related papers  (2024-01-11T10:10:16Z)
• CARLA: Self-supervised Contrastive Representation Learning for Time Series Anomaly Detection [53.83593870825628]
  One main challenge in time series anomaly detection (TSAD) is the lack of labelled data in many real-life scenarios. Most of the existing anomaly detection methods focus on learning the normal behaviour of unlabelled time series in an unsupervised manner. We introduce a novel end-to-end self-supervised ContrAstive Representation Learning approach for time series anomaly detection.
  arXiv  Detail & Related papers  (2023-08-18T04:45:56Z)
• Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection [63.825781848587376]
  We propose OC4Seq, a one-class recurrent neural network for detecting anomalies in discrete event sequences. Specifically, OC4Seq embeds the discrete event sequences into latent spaces, where anomalies can be easily detected.
  arXiv  Detail & Related papers  (2020-08-31T04:48:22Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.