Insight-LLM: LLM-enhanced Multi-view Fusion in Insider Threat Detection

2025/09/01 by Chengyu Song, Song, Chengyu, Jianming Zheng +1
Computer Science · Engineering · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Fire Detection and Safety Systems

paper · pdf · doi:10.48550/arxiv.2509.01509

openalex publication_date 2025/09/01 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Insider threat detection (ITD) requires analyzing sparse, heterogeneous user behavior. Existing ITD methods predominantly rely on single-view modeling, resulting in limited coverage and missed anomalies. While multi-view learning has shown promise in other domains, its direct application to ITD introduces significant challenges: scalability bottlenecks from independently trained sub-models, semantic misalignment across disparate feature spaces, and view imbalance that causes high-signal modalities to overshadow weaker ones. In this work, we present Insight-LLM, the first modular multi-view fusion framework specifically tailored for insider threat detection. Insight-LLM employs frozen, pre-nes, achieving state-of-the-art detection with low latency and parameter overhead.

Citations

• Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection
• Uni-MoE: Scaling Unified Multimodal LLMs with Mixture of Experts
• LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection
• LLaMA: Open and Efficient Foundation Language Models
• BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Models
• TweetNLP: Cutting-Edge Natural Language Processing for Social Media
• TS2Vec: Towards Universal Representation of Time Series
• LoRA: Low-Rank Adaptation of Large Language Models
• Learning Transferable Visual Models From Natural Language Supervision
• TweetEval: Unified Benchmark and Comparative Evaluation for Tweet\n Classification
• Insider Threat Detection via Hierarchical Neural Temporal Point Processes
• RoBERTa: A Robustly Optimized BERT Pretraining Approach
• HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows
• Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams
• node2vec: Scalable Feature Learning for Networks
• Convolutional Two-Stream Network Fusion for Video Action Recognition
• Multi-view Convolutional Neural Networks for 3D Shape Recognition
• Sequence to Sequence -- Video to Text
• Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling
• Deep Visual-Semantic Alignments for Generating Image Descriptions
• Learning a Recurrent Visual Representation for Image Caption Generation
• Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation
• Multimodal Deep Learning

Related

• DMFI: Dual-Modality Fine-Tuning and Inference Framework for LLM-Based Insider Threat Detection
• An Ethically Grounded LLM-Based Approach to Insider Threat Synthesis and Detection
• Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection
• Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities
• MambaITD: An Efficient Cross-Modal Mamba Network for Insider Threat Detection