Reviewing Graph Construction Rules in Graph-Based Insider Threat Detection Models

Insider threats pose a growing risk to organizational security, intensified by the rise of hybrid work arrangements that increase opportunities for unauthorized access and data leaks. As such, robust insider threat detection (ITD) systems are essential to address these challenges. Recent advancements highlight the potential of graph-based deep learning model, which excel in detecting complex relational patterns. However, as graph-based ITD is still a novel and emerging field, efforts have primarily focused on developing new methodologies rather than refining foundational aspects like graph construction rules. This study investigates the impact of different graph construction rules on ITD model performance, representing users, assets, and activities as nodes and edges. By analyzing various rule sets, we assess their influence on detection accuracy and computational efficiency. The proposed framework aims to aid in identification of optimal rules that balance precision with resource use, contributing to the development of more effective and efficient ITD systems for modern workplace environments.