SiamEHGT: An Evolving Heterogeneous Graph Transformer for Insider Threat Detection based on Siamese Architecture

Insider threats have been a focal point in cyberse-curity, leading to severe data leakage and organization system crashes. Due to the low proportion of malicious samples, most methods establish the baseline of normal user behaviors and identify users deviating from this baseline as malicious insiders. However, these methods fail to capture the heterogeneity and temporal evolution of user behavior patterns effectively. This paper proposes an evolving heterogeneous graph transformer based on Siamese architecture (SiamEHGT) to detect malicious insiders. Firstly, SiamEHGT constructs behavior heterogeneous graph sequences for users based on a fixed-size time window. Secondly, SiamEHGT employs the proposed EHGT to explore the heterogeneity of user behaviors on these graphs, while continuously evolving model parameters to mine the dynamism of user behaviors over time. Finally, Siamese architecture is applied at the graph level to learn the similarity of user behavior patterns across any two time windows, effectively using the limited labeled malicious samples. We evaluate our method on CERT and LANL datasets, and the results demonstrate that our approach outperforms many state-of-the-art methods.