💻 computer science

Signal Decomposition Reveals Structure in Insider Threat Detection under Sparse Temporal Data

This paper proposes a dual-channel autoencoder that decomposes audit data into binary activity masks and intensity values to effectively detect insider threats in sparse temporal settings, demonstrating that aligning model objectives with the inherent structure of sparse data yields robust detection without requiring complex sequence modeling.

Original authors: Hayden Beadles, Jericho Cain

Published 2026-05-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hayden Beadles, Jericho Cain

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard watching a massive, 24-hour surveillance feed of a giant office building. Most of the time, the hallways are empty, the lights are off, and nothing happens. This is the "normal" state.

Suddenly, a thief sneaks in. But they don't just walk through the front door; they might hide in a closet for an hour, then steal a file for 10 minutes, then disappear again. Their actions are rare, short, and buried in hours of "nothing happening."

This paper tackles the problem of teaching a computer to spot these thieves in a sea of empty hallways. Here is the simple breakdown of what the authors did and found:

The Problem: The "Silence" Trap

Most computer security systems work like a student trying to memorize a textbook. They look at the data and try to recreate it perfectly. If the computer sees 99% of the data is "silence" (no activity), it gets really good at predicting silence.

The problem is that when the thief does show up, the computer is so focused on being perfect at predicting "silence" that it ignores the thief. It's like a teacher who gives an A+ to a student who sits quietly for 50 minutes, but fails to notice the student who sneezed once in the middle of class. The computer thinks, "Well, the silence is perfect, so everything is fine," and misses the actual threat.

The Solution: Two Separate Cameras

The authors realized they needed to stop treating "silence" and "action" as the same thing. They invented a new way to look at the data using two separate channels, like having two different cameras:

The "Is Someone There?" Camera (The Mask): This camera only answers one question: Is there any activity at all? It ignores how loud or busy the activity is. It just sees a binary "Yes" or "No."
The "How Busy Are They?" Camera (The Value): This camera only looks at the moments when the first camera says "Yes." It measures the intensity or volume of the activity.

By splitting the data this way, the computer stops wasting its brainpower trying to predict "silence." Instead, it focuses entirely on the moments when something actually happens.

What They Discovered: It Depends on the Thief's Style

The researchers tested their system using a simulated dataset of office workers and thieves. They found that the "best" way to catch a thief depends entirely on how long the thief stays and how noisy the office is.

The "Flash" Thief (Short Attacks): If a thief comes in, steals something quickly, and leaves in 10 minutes, the "How Busy" camera is useless. The signal is too short. The system catches them almost entirely by noticing that someone was there at all (the "Is Someone There?" camera).

**The "Sleeper" Thief (Long Attacks):** If a thief stays for days, moving slowly and steadily, the "How Busy" camera becomes very important. The system can now see *how* they are behaving, not just that they are there.

**The "Noisy" Office:** When they added "noise" (simulating a busy office with lots of normal, unrelated activity), the "How Busy" camera got confused. The system smartly switched back to relying mostly on the "Is Someone There?" camera because it was more reliable in the chaos.

The Big Takeaway: The computer didn't need to be told which camera to use. The system naturally figured out which camera was more important based on the situation. It's like a detective who instinctively knows when to look for footprints (presence) and when to look at the size of the footprints (magnitude).

The Final Step: Connecting the Dots

Finally, the paper looked at how to catch a whole "campaign" (a long-term theft operation). They found that you don't need a complex AI to track the thief's every move over weeks.

Because the thief's actions are usually concentrated in just a few specific moments, you can simply look for the top 2 or 3 most suspicious moments in a week. If those few moments are highly suspicious, you flag the whole week as a threat. It's like saying, "We don't need to watch the whole movie to know it's a thriller; if there are two huge explosions, we know the plot."

Summary

The paper argues that to catch rare threats in a noisy world, you shouldn't just build a "smarter" or "bigger" computer model. Instead, you should change how you look at the data.

By separating "presence" (is something happening?) from "magnitude" (how much is happening?), the system becomes much better at spotting the needle in the haystack. It adapts automatically: if the threat is quick, it looks for presence; if the threat is slow, it looks at the details; and if the world is noisy, it sticks to what it knows works best.

1. Problem Statement

Insider threat detection faces a fundamental challenge due to the nature of enterprise audit data:

Extreme Sparsity: Most time windows contain little to no user activity. Malicious behavior is rare, intermittent, and embedded within long stretches of inactivity.
Temporal Heterogeneity: Attacks vary significantly in duration, ranging from brief, localized events to sustained campaigns lasting days or weeks.
Limitations of Standard Models: Traditional reconstruction-based models (e.g., standard autoencoders) optimize reconstruction error over all input entries. In sparse data, the loss is dominated by inactive regions (zeros). Consequently, these models learn to reconstruct "inactivity" rather than the structure of meaningful deviations, leading to poor detection of rare events and a high volume of false positives.

2. Methodology

The authors propose a Dual-Channel Masked Autoencoder that aligns the learning objective with the structural properties of sparse temporal data.

A. Data Representation

Windowing: Raw event logs are aggregated into fixed-length time windows ( $W$ ), subdivided into buckets ( $\Delta t$ ).
Mask-Value Decomposition: Instead of treating the input as a single dense matrix, each window is decomposed into two distinct channels:
1. Mask Channel ( $M$ ): A binary matrix indicating the presence of activity ($1$ if activity exists, $0$ otherwise).
2. Value Channel ( $V$ ): A matrix capturing the magnitude (count/statistic) of the activity.
Input Tensor: These are stacked to form a 2-channel input tensor $X^{(2)} = [M, V]$ .

B. Model Architecture

Dual-Channel Convolutional Autoencoder: The model uses a shared encoder to map the dual-channel input to a latent space and a decoder to reconstruct both channels.
Specialized Loss Function: The training objective is designed to prevent the model from wasting capacity on inactive regions:
- Mask Loss ( $L_{mask}$ ): Weighted Binary Cross-Entropy to accurately reconstruct the presence/absence of activity.
- Value Loss ( $L_{value}$ ): Mean Squared Error (MSE) applied only where the mask indicates activity ( $M=1$ ). This ensures the model focuses on modeling the intensity of behavior only when behavior exists.
- Temporal Regularization ( $L_{temp}$ ): An optional term to enforce smoothness in latent representations between consecutive normal windows.

C. Anomaly Scoring

Anomaly scores are derived from the reconstruction errors of both channels.
The final score is a weighted sum of the standardized mask error and value error ( $S = \alpha_{mask} \cdot \hat{L}_{mask} + \alpha_{value} \cdot \hat{L}_{value}$ ).
Weights ( $\alpha$ ) are determined via grid search to maximize Precision-Recall Area Under the Curve (PR-AUC), allowing the model to adaptively rely on the most informative signal component.

D. Experimental Setup

Dataset: CERT r5.2 insider threat dataset (synthetic but behaviorally structured).
Variables: The study varies window duration ( $\Delta w$ ), bucket resolution ( $\Delta b$ ), and introduces noise (by adding benign user data) to simulate real-world conditions.
Metrics: Primary metric is PR-AUC (due to extreme class imbalance), supplemented by ROC-AUC.

3. Key Contributions

Structural Decomposition: Introduced a presence-magnitude decomposition that addresses the "zero-dominance" problem in sparse reconstruction-based anomaly detection.
Signal Characterization: Demonstrated that the relative importance of "presence" vs. "magnitude" is not a fixed hyperparameter but emerges from the data structure:
- Short-duration attacks: Detected primarily via the presence (mask) channel.
- Long-duration attacks: Benefit from the magnitude (value) channel as sustained activity provides redundant signal.
- High Noise: Magnitude becomes unreliable, forcing the model to revert to presence-dominated detection.
Campaign-Level Aggregation: Showed that complex sequence modeling is unnecessary for campaign detection. Simple aggregation strategies (specifically Top-k selection of the highest-scoring windows) are sufficient to recover extended attack campaigns from sparse window-level signals.

4. Key Results

Adaptive Signal Reliance: In short-duration scenarios (e.g., Scenario 3), the optimal weight for the value channel ( $\alpha_{value}$ ) approaches zero, confirming that magnitude acts as noise. In long-duration scenarios, $\alpha_{value}$ increases, showing that magnitude adds discriminative power.
Robustness to Noise:
- Short-duration attacks are highly sensitive to noise; adding noise significantly degrades performance.
- Long-duration attacks are more robust due to signal redundancy across windows.
- Under noise, the model consistently shifts weight toward the mask channel.
Temporal Resolution: Performance is highly dependent on matching the window size ( $\Delta w$ ) to the attack duration. Mismatched windows (e.g., a 96-hour window for a 24-hour attack) dilute the signal.
Campaign Detection: Using a Top-2 window aggregation strategy on 6-day sequences yielded the highest PR-AUC (0.8357) and ROC-AUC (0.9388), outperforming uniform averaging. This confirms that insider threats are concentrated in a small number of highly anomalous windows.

5. Significance and Conclusion

Paradigm Shift: The paper argues that effective insider threat detection relies less on increasing model complexity (e.g., adding RNNs/Transformers) and more on aligning representation and objectives with the inherent sparsity and temporal structure of the data.
Operational Insight: The findings suggest a two-stage operational approach:
1. Window-Level: Use the dual-channel model to identify high-confidence anomalous windows based on the specific temporal regime (short vs. long).
2. Campaign-Level: Aggregate these sparse, high-confidence signals using simple "Top-k" logic to identify extended campaigns, avoiding the need for complex temporal sequence modeling.
Generalizability: While tested on synthetic CERT data, the principles of sparsity, temporal heterogeneity, and localized anomaly signals apply to real-world enterprise telemetry, offering a scalable foundation for unsupervised detection systems.