As the cybersecurity landscape becomes increasingly challenging, insider threat detection has emerged as a critical research area. Traditional methods for detecting insider threats, such as Random Forest and Isolation Forest, suffer from high computational resource consumption, poor feature representation, and sensitivity to noise. While machine learning methods offer certain advantages, they still face challenges in complex data scenarios. This study focuses on the application of Federated Learning in insider threat detection. As a distributed machine learning framework, FL enables collaborative model building and analysis while safeguarding data privacy. It encompasses various types, including horizontal, vertical, and federated transfer learning. However, its application in insider threat detection remains limited. This research proposes an innovative solution to address the shortcomings of existing Federated Learning-based detection methods (e.g., FedAT), such as insufficient feature extraction and high resource consumption. Drawing on the DeepInsight concept, we convert different data types into image formats for use with Convolutional Neural Networks (CNNs) to train insider threat detection models. This approach leverages the advantages of FL’s privacy protection and multi-source data integration while harnessing the powerful feature learning capabilities of CNNs. It improves key metrics such as accuracy and recall in insider threat detection. The proposed method offers a more efficient and precise approach to detecting insider threats in cybersecurity, advancing the development and practical application of relevant technologies in this field with significant theoretical and practical implications.

Internal threats are becoming more common in today’s cybersecurity landscape. This is mainly because internal personnel often have privileged access, which can be exploited for malicious purposes. Traditional detection methods frequently fail due to data imbalance and the difficulty of detecting hidden malicious activities, especially when attackers conceal their intentions over extended periods. Most existing internal threat detection systems are designed to identify malicious users after they have acted. They model the behavior of normal employees to spot anomalies. However, detection should shift from targeting users to focusing on discrete work sessions. Relying on post hoc identification is unacceptable for businesses and organizations, as it detects malicious users only after completing their activities and leaving. Detecting threats based on daily sessions has two main advantages: it enables timely intervention before damage escalates and captures context-relevant risk factors. Our research introduces a novel detection framework for single-day employee behavior detection to address these issues. This framework combines the strengths of Temporal Convolutional Networks (TCNs) and the Transformer architecture. The integrated model uses sliding window technology to segment user logs into time series for model input. The TCN component employs causal and dilated convolutions to maintain temporal order and expand the receptive field, enhancing the detection of long-term patterns. The Transformer models global dependencies in sequences, improving the detection of complex long-term behaviors. The model detects anomalies at each time step and achieves a recall rate of \(95\%\) with a sequence length of 30 days. Experimental results show that this method can accurately detect malicious behavior daily, promptly identify such actions, and effectively mitigate internal threats in complex environments.

Purpose: By using a new feature extraction method on the Cert data set and using a hidden Markov model (HMM) to model and analyze the behavior of users to distinguish whether the behavior is normal within a continuous period. Design/methodology/approach: Feature extraction of five parts of the time series by rules and sorting in chronological order. Use the obtained features to calculate the probability parameters required by the HMM model and establish a behavior model for each user. When the user has abnormal behavior, the model will return a very low probability value to distinguish between normal and abnormal information. Findings: Generally, HMM parameters are obtained by supervised learning and unsupervised learning, but the hidden state cannot be clearly defined. When the hidden state is determined according to the data set, the accuracy of the model will be improved. Originality/value: This paper proposes a new feature extraction method and analysis mode, which determines the shape of the hidden state according to the situation of the data set, making subsequent HMM modeling simple and efficient and in turn improving the accuracy of user behavior detection.

In the past, most Hidden Markov models based on time series only used the original HMM model. The single-layer models (HMMs) structure has a big problem, and it isn’t straightforward to play its due role when it is necessary to make fine adjustments to the scene. So it was impossible to entirely and flexibly perform user behavior. This paper performs feature extraction and analysis of user behavior data of time series. The data labels should be added after the parameters obtained by statistical methods for clustering to obtain the first hidden state, and the layers are further layered according to working hours and outside working hours. The experimental results show that the method has strong applicability and flexibility, and can quickly detect abnormal behavior.

This paper examines the adaptive control of high-order nonlinear systems with strict-feedback form. An adaptive fixed-time control scheme is designed for nonlinear systems with unknown uncertainties. In the design process of a backstepping controller, the Lyapunov function, an effective controller, and adaptive law are constructed. Combined with the fixed-time Lyapunov stability criterion, it is proved that the proposed control scheme can ensure the stability of the error system in finite time, and the convergence time is independent of the initial condition. Finally, simulation results verify the effectiveness of the proposed control strategy.