标题： TabSec：一种新型内部威胁检测的协作框架 显示英文标题

标题： TabSec: A Collaborative Framework for Novel Insider Threat Detection

摘要： 在物联网（IoT）和数据共享的时代，用户经常将个人信息上传到企业数据库，以享受各种在线服务提供的增强服务体验。 然而，系统漏洞、远程网络入侵和内部威胁的广泛存在显著增加了企业私有数据在互联网上的暴露风险。 如果这些数据被攻击者窃取或泄露，可能会导致严重的资产损失和业务运营中断。 为应对这些挑战，本文提出了一种新的威胁检测框架，TabITD。 该框架将入侵检测系统（IDS）与用户和实体行为分析（UEBA）策略相结合，形成一个协作检测系统，弥补现有系统能力的不足。 它有效解决了由于攻击方法多样化而导致的外部和内部威胁边界模糊问题，从而提高了模型的学习能力和整体检测性能。 此外，所提出的方法利用了TabNet架构，该架构采用稀疏注意力特征选择机制，使TabNet能够在每个决策步骤中选择最相关的特征，从而提高对罕见类别攻击的检测能力。 我们在两个不同的数据集上评估了我们提出的方法，分别达到了96.71%和97.25%的平均准确率。 结果表明，这种方法可以有效检测伪装攻击和外部威胁等恶意行为，显著增强了网络安全防御能力和网络攻击检测效率。 显示英文摘要

摘要： In the era of the Internet of Things (IoT) and data sharing, users frequently upload their personal information to enterprise databases to enjoy enhanced service experiences provided by various online services. However, the widespread presence of system vulnerabilities, remote network intrusions, and insider threats significantly increases the exposure of private enterprise data on the internet. If such data is stolen or leaked by attackers, it can result in severe asset losses and business operation disruptions. To address these challenges, this paper proposes a novel threat detection framework, TabITD. This framework integrates Intrusion Detection Systems (IDS) with User and Entity Behavior Analytics (UEBA) strategies to form a collaborative detection system that bridges the gaps in existing systems' capabilities. It effectively addresses the blurred boundaries between external and insider threats caused by the diversification of attack methods, thereby enhancing the model's learning ability and overall detection performance. Moreover, the proposed method leverages the TabNet architecture, which employs a sparse attention feature selection mechanism that allows TabNet to select the most relevant features at each decision step, thereby improving the detection of rare-class attacks. We evaluated our proposed solution on two different datasets, achieving average accuracies of 96.71% and 97.25%, respectively. The results demonstrate that this approach can effectively detect malicious behaviors such as masquerade attacks and external threats, significantly enhancing network security defenses and the efficiency of network attack detection.