Abstract
In the tobacco industry,insider employee attack is a thorny problem that is difficult to detect.To solve this issue,this paper proposes an insider threat detection method based on heterogeneous graph embedding.First,the interrelationships between logs are fully considered,and log entries are converted into heterogeneous graphs based on these relationships.Second,the heterogeneous graph embedding is adopted and each log entry is represented as a low-dimensional feature vector.Then,normal logs and malicious logs are classified into different clusters by clustering algorithm to identify malicious logs.Finally,the effectiveness and superiority of the method is verified through experi-ments on the CERT dataset.The experimental results show that this method has better performance compared to some baseline methods.
基金项目
国家自然科学基金(62203390)
Science and Technology Project of China Tobacco Zhejiang Industrial Co.,Ltd(ZJZY2022E004)
国家科技期刊平台
NSTL
万方数据