💬 NLP

DMFI: A Dual-Modality Log Analysis Framework for Insider Threat Detection with LoRA-Tuned Language Models

The paper proposes DMFI, a dual-modality framework that enhances insider threat detection by fusing semantic and behavioral log analyses through independently LoRA-tuned language models and a discriminative adaptation strategy, achieving superior accuracy on CERT datasets compared to state-of-the-art methods.

Original authors: Kaichuan Kong, Dongjie Liu, Xiaobo Jin, Guanggang Geng, Zhiying Li, Jian Weng

Published 2026-03-24

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Kaichuan Kong, Dongjie Liu, Xiaobo Jin, Guanggang Geng, Zhiying Li, Jian Weng

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, bustling office building. Every day, thousands of employees walk in, sit at their desks, send emails, browse the web, and log out. Most of them are just doing their jobs. But occasionally, one of them is a "wolf in sheep's clothing"—an insider threat trying to steal secrets or sabotage the company.

The problem is that these bad actors are smart. They don't look like hackers breaking down the front door; they look like normal employees, just doing things slightly out of order or at weird times. Traditional security guards (old computer programs) are like bouncers who only check IDs. If you have an ID, they let you in. They can't tell if you're acting suspiciously while you're inside.

This paper introduces DMFI, a new, super-smart security system designed to catch these tricky insiders. Think of DMFI as a two-person detective team working together, powered by a very advanced AI brain (a Large Language Model).

Here is how DMFI works, broken down into simple concepts:

1. The Two Detectives: "The Reader" and "The Observer"

Instead of looking at the whole picture at once, DMFI splits the investigation into two distinct views, like two detectives with different specialties.

Detective A: The Reader (Semantic View)
- What they do: This detective reads the actual content of what people are doing. They read the emails, the website titles, and the chat messages.
- The Analogy: Imagine a detective reading a suspect's diary. They aren't just checking when the person wrote; they are reading the words to see if the person is talking about stealing, phishing, or planning a heist.
- The Tech: It uses an AI trained to understand language nuances. If an email says, "Hey, can you send me the secret files?" the Reader spots the danger immediately.
Detective B: The Observer (Behavioral View)
- What they do: This detective ignores the words and focuses on the pattern of movement. They look at when someone logged in, where they were, what they clicked, and which files they touched.
- The Analogy: Imagine a detective watching a security camera. They don't care what the person is saying; they care that the person is sneaking into the server room at 3:00 AM, plugging in a USB drive, and then running to the exit.
- The Innovation (The "4W" Trick): Raw logs are messy and long. To make this easier, the authors invented a "4W" summarizer (When, Where, What, Which). It takes a messy list of 50 actions and compresses them into a short, clear sentence like: "After hours, on a personal laptop, accessed sensitive files and emailed them to an outsider." This makes the pattern obvious.

2. The Specialized Training (LoRA)

Usually, teaching a giant AI (like a super-intelligent robot) to do a specific job is expensive and slow. It's like hiring a famous chef to learn how to make a specific sandwich from scratch.

The authors used a clever shortcut called LoRA.

The Analogy: Instead of retraining the whole chef, they just gave the chef a specific "recipe card" (a small add-on) for this specific sandwich. The chef keeps all their existing cooking skills but learns the new recipe quickly and cheaply.
The Result: They trained two separate "chefs" (AI models). One became an expert at reading suspicious emails, and the other became an expert at spotting weird movement patterns.

3. The "Double-Check" Strategy (DMFI-B)

The paper introduces a special version called DMFI-B.

The Analogy: Imagine a security system that has two separate alarms.
- Alarm 1 is trained only on what "good guys" do.
- Alarm 2 is trained only on what "bad guys" do.
- When a new event happens, the system asks both alarms: "Does this look more like a good guy or a bad guy?"
Why it helps: If a bad guy tries to act like a good guy, the "Bad Guy Alarm" might still ring because the difference between the two alarms is huge. This makes the system much better at spotting rare, tricky threats that usually get missed.

4. The Final Decision (The Fusion)

Finally, the two detectives meet in a conference room (a small decision module).

The "Reader" says: "The words in that email were suspicious."
The "Observer" says: "The timing and file access were weird."
They combine their scores. If both agree, or if the combination is strong enough, the system sounds the alarm: "THREAT DETECTED."

Why is this a big deal?

It's Smarter: Old systems missed things because they only looked at numbers. This system understands meaning and context.
It's Efficient: It doesn't need a supercomputer the size of a building to run; it's lightweight enough for real companies to use.
It's Fair: It handles the fact that "bad guys" are rare (like finding a needle in a haystack) without crying wolf too often.

In summary: DMFI is like hiring a detective team that can read your mind (via your emails) and watch your footsteps (via your actions) simultaneously, using a smart, efficient AI to catch the bad guys before they steal the crown jewels.

1. Problem Statement

Insider Threat Detection (ITD) remains a critical challenge in cybersecurity due to the stealthy, long-term, and context-dependent nature of malicious insider behaviors. Unlike external attacks, insiders possess authorized credentials, making their actions difficult to distinguish from legitimate behavior.

Limitations of Traditional Methods: Rule-based systems lack adaptability to evolving patterns, while statistical and deep learning models (e.g., SVM, LSTM, GNN) often treat behaviors as numerical features, failing to capture the semantic context of actions (e.g., the intent behind an email or HTTP request).
Limitations of Existing LLM Solutions:
- Prompt-based methods (e.g., LogGPT) offer interpretability but suffer from sensitivity to prompt design and lack dynamic behavioral awareness.
- Fine-tuning-based methods often focus on either semantic content or behavioral sequences in isolation, failing to integrate both modalities cohesively. They also struggle with severe class imbalance (few anomalies vs. many normal events) and often discard textual richness.

2. Methodology: The DMFI Framework

The authors propose DMFI (Dual-Modality Fine-tuned Inference), a unified framework that integrates semantic reasoning with behavioral abstraction using Large Language Models (LLMs) enhanced by LoRA (Low-Rank Adaptation).

A. Dual-Modality Preprocessing

Raw audit logs are parsed into structured tuples and decomposed into two complementary views:

Semantic View: Extracts content-rich artifacts (e.g., email bodies, HTTP URL text) to detect intent inconsistencies, phishing, or data exfiltration.
Behavioral View: Uses a novel 4W-Guided Abstraction (When, Where, What, Which) to transform verbose action sequences into concise, interpretable natural language summaries.
- Mechanism: This compression reduces token length (e.g., from 49 to 31 tokens in examples) while preserving critical temporal and contextual cues (e.g., "off-hours access," "device switching").

B. LoRA-Enhanced Fine-Tuning Strategies

Two instruction-tuned LLM branches are independently fine-tuned using LoRA to adapt to the specific modality:

DMFI-A (Unified Strategy): A single model is fine-tuned on a mixed dataset of normal and abnormal sessions.
DMFI-B (Discriminative Dual-Branch Strategy): Two separate models are fine-tuned—one on normal data ( $M_{norm}$ $M_{n or m}$ ) and one on abnormal data ( $M_{abn}$ $M_{abn}$ ).
- Innovation: The final anomaly score is calculated using a margin-based formulation: $\alpha = \sigma(M_{abn}(x) - M_{norm}(x))$ . This explicitly separates normal and abnormal representations, enhancing sensitivity to rare threats under class imbalance.

C. Inference and Decision Integration

The framework fuses outputs from both branches via a lightweight Multi-Layer Perceptron (MLP):

Semantic Scoring: Individual content scores are aggregated using descriptive statistics (mean, max, std, min) to create a fixed-size vector representing the session's semantic risk distribution.
Behavioral Scoring: The behavioral branch outputs a single session-level risk score.
Fusion: The semantic vector and behavioral score are concatenated and passed through an MLP to produce a calibrated final anomaly probability ( $\alpha_{joint}$ ).

3. Key Contributions

Dual-Modality Framework: DMFI is the first to unify prompt-driven semantic analysis and fine-tuned behavioral profiling within a single architecture, addressing the gap between content understanding and temporal behavior modeling.
4W-Guided Abstraction: A novel method to compress structured logs into natural language narratives, balancing expressiveness with token efficiency while retaining key behavioral semantics.
Discriminative Fine-Tuning (DMFI-B): A strategy that separates normal and abnormal model training, utilizing contrastive scoring to improve anomaly separability and robustness against class imbalance.
Multi-Statistic Fusion: A mechanism to aggregate variable-length semantic predictions into a distribution-aware representation, improving the calibration of final risk estimates.

4. Experimental Results

The framework was evaluated on the CERT Insider Threat Datasets (r4.2 and r5.2), which contain millions of user activity records with labeled anomalies.

Performance: DMFI-B outperformed all baselines, including traditional ML (XGBoost, SVM), Deep Learning (LAN, CATE), and other LLM-based methods (LogGPT, Audit-LLM).
- Precision: 0.953 (r4.2) and 0.945 (r5.2).
- Detection Rate (Recall): 0.929 (r4.2) and 0.938 (r5.2).
- False Positive Rate (FPR): Significantly reduced to 0.009 (r4.2) and 0.011 (r5.2), representing a >40% improvement over the second-best LLM baseline.
Ablation Studies:
- Dual-Modality: Removing either the semantic or behavioral view resulted in a 2–4% drop in accuracy, confirming their complementary nature.
- Strategy: DMFI-B consistently outperformed the unified DMFI-A, validating the benefit of discriminative training.
- Aggregation: The "FullStats" aggregation method (using mean, max, std, min) yielded the best results compared to simple max or mean pooling.
Efficiency: The 4W-guided compression reduced token counts by ~36%, improving inference speed. While DMFI-B requires more GPU memory than DMFI-A, it offers superior detection fidelity.

5. Significance and Impact

Interpretability: Unlike "black-box" deep learning models, DMFI provides natural language explanations and interpretable behavioral summaries, aiding security analysts in understanding why a session was flagged.
Scalability: By using LoRA, the framework achieves high performance with parameter-efficient fine-tuning, making it feasible for resource-constrained environments compared to full fine-tuning.
Robustness: The discriminative dual-branch approach effectively addresses the critical challenge of class imbalance in insider threat detection, reducing false alarms while maintaining high detection rates.
Practical Deployment: The framework offers a flexible trade-off between accuracy and computational cost (via DMFI-A vs. DMFI-B), making it suitable for diverse enterprise security operations.

In conclusion, DMFI represents a significant advancement in ITD by leveraging the semantic reasoning power of LLMs while rigorously modeling temporal behavioral dynamics, offering a scalable and highly accurate solution for detecting sophisticated insider threats.