MV-Gate: Insider Threat Detection via Multi-View Behavioral Statistics and Semantic Modeling

Technical Summary: MV-Gate for Insider Threat Detection

Problem Statement
Insider threats are characterized by malicious actors who are legitimate users, making their actions difficult to distinguish from normal operations. These attacks often progress slowly, generating weak and temporally sparse signals. A critical observation is that early anomalies frequently stem not from the semantics of individual events (e.g., a specific command being malicious), but from disruptions in behavioral statistics. These include altered recurrence patterns (e.g., an action resurfacing after inactivity) and shifts in short- versus long-term frequencies.

Current deep learning approaches for Insider Threat Detection (ITD) have largely shifted toward tokenizing logs and processing them with sequential encoders (LSTMs, GRUs, Transformers). While effective at capturing semantic context, these "token-only" models often discard explicit statistical regularities. Consequently, they remain insensitive to the gradual, low-visibility behavioral deviations that typically precede insider incidents.

Methodology: MV-Gate
To bridge the gap between statistical cues and sequential modeling, the authors propose MV-Gate (Multi-View Gated Attention), a lightweight framework that explicitly integrates statistical behavioral regularities with sequence semantics. The architecture operates in three stages:

1. Multi-View Behavior Representation:
   The model constructs three synchronized behavioral sequences from raw audit logs:

   • Activity-Token View ($Z$): Discrete tokens encoding event semantics and coarse temporal context.
   • Status View ($S$): A multi-scale signal capturing recurrence patterns. It quantifies how "rare" or "new" an action is by checking its absence across multiple historical windows (e.g., 1, 3, and 7 steps).
   • Frequency-Deviation View ($F$): A signal quantifying intensity shifts by comparing short-term frequency against long-term frequency (e.g., bursts or suppressed behaviors).

   These views are projected into a shared embedding space via view-specific linear projections or lookup tables.

2. Anomaly-Aware Gating Mechanism:
   The core innovation lies in a dynamic gating mechanism that injects statistical cues into the attention computation of a Transformer encoder.

   • A Risk Gate ($g_t$) is computed for each timestep based on the status and frequency embeddings. This scalar value represents the abnormality level of the event.
   • This gate modulates the Key vectors in the self-attention mechanism ($K'_t = g_t \cdot K_t$).
   • By scaling the keys, the model dynamically adjusts attention weights to emphasize events with high statistical irregularity without altering the underlying Transformer structure.

3. Anomaly Detection:
   The gated token representations are fused with aggregated statistics (via mean pooling of status and frequency embeddings) and passed through a Multi-Layer Perceptron (MLP) classifier to output a sequence-level anomaly score.

Key Contributions

• Multi-View Activity Representation: A unified framework that jointly optimizes semantic tokens with two statistical views (status and frequency), avoiding reliance on manual feature engineering while preserving statistical cues lost in tokenization.
• Anomaly-Aware Gating: A novel mechanism that uses statistical anomaly scores to dynamically modulate attention weights, enabling the model to focus on statistically irregular events that traditional attention mechanisms might overlook.
• End-to-End Framework: A complete pipeline integrating multi-view fusion and gated attention for sequence-level classification.
• Comprehensive Evaluation: Extensive experiments demonstrating the framework's efficacy across diverse datasets.

Experimental Results
The authors evaluated MV-Gate on three public datasets: CERT r4.2, CERT r5.2, and ADFA-LD.

• Performance: MV-Gate achieved state-of-the-art results across all metrics (Recall, Precision, Accuracy, F1-score) compared to classical machine learning baselines (LR, RF, XGBoost), generic deep learning models (CNN, Transformer), and domain-specific approaches (ITDBERT, CATE, ITDLM, LogGPT).
• Specific Gains: On the CERT r5.2 dataset, MV-Gate achieved an F1-score of 0.957, outperforming the next best domain-specific model (CATE at 0.926) and significantly surpassing generic Transformers (0.805).
• Ablation Studies: Removing the status view, frequency view, or the gated attention mechanism resulted in notable performance degradation, confirming that both the multi-view representation and the gating mechanism are essential for detecting weak-signal threats.
• Efficiency: The study found that a compact 2-layer Transformer encoder offers the best balance between performance and memory usage, as deeper stacks provided marginal gains for the typically short and sparse ITD sequences.

Significance and Claims
The paper argues that robust insider threat detection requires the joint modeling of statistical and sequential evidence. While deep learning models excel at semantic reasoning, they often fail to detect threats that manifest as statistical anomalies (e.g., a sudden change in frequency or recurrence) rather than semantic shifts.

MV-Gate demonstrates that explicitly integrating statistical priors—specifically recurrence patterns and frequency deviations—into the attention mechanism allows models to detect "weak-signal" and progressive threats that are often missed by token-only approaches. The authors conclude that this approach provides a more reliable representation of insider-threat patterns, particularly for gradual attacks that evolve over time, without incurring the high computational costs associated with Large Language Models (LLMs). Future work suggested by the authors includes fusing multimodal logs (e.g., network traffic with file operations) and potentially integrating LLMs for semantic interpretation alongside MV-Gate's statistical evidence.