Insider threat detection approach for tobacco industry based on heterogeneous graph embedding

• Published in: 高技术通讯（英文版） Vol. 30; no. 2; pp. 199 - 210
• Main Authors: JI Qi, LI Wei, PAN Bailin, XUE Hongkai, QIU Xiang
• Format: Journal Article
• Language: English
• Published: Information Center,China Tobacco Zhejiang Industrial Co.,Ltd.,Hangzhou 310024,P.R.China%Hangzhou Cigarette Factory,China Tobacco Zhejiang Industrial Co.,Ltd.,Hangzhou 310024,P.R.China%College of Information Engineering,Zhejiang University of Technology,Hangzhou 310014,P.R.China 01.06.2024
• Subjects: hetero-geneous graph embedding; insider threat detection; advanced persistent threats; graph construction
• ISSN: 1006-6748
• DOI: 10.3772/j.issn.1006-6748.2024.02.011

In the tobacco industry,insider employee attack is a thorny problem that is difficult to detect.To solve this issue,this paper proposes an insider threat detection method based on heterogeneous graph embedding.First,the interrelationships between logs are fully considered,and log entries are converted into heterogeneous graphs based on these relationships.Second,the heterogeneous graph embedding is adopted and each log entry is represented as a low-dimensional feature vector.Then,normal logs and malicious logs are classified into different clusters by clustering algorithm to identify malicious logs.Finally,the effectiveness and superiority of the method is verified through experi-ments on the CERT dataset.The experimental results show that this method has better performance compared to some baseline methods.