LSTM-Diff: A Data Generation Method for Imbalanced Insider Threat Detection

Insider threats pose a significant risk to organizational security due to their covert nature and potential to cause substantial harm, often leading to severe operational losses. A key challenge in detecting insider threats is the scarcity of abnormal behavior samples, which leads to a significant imbalance between normal and abnormal data in training sets. This imbalance distorts the model’s learning process, making it more likely to recognize normal behavior while overlooking or misclassifying anomalies. To address this issue, we propose a novel data generation method based on the Diffusion-TS model, named LSTM-Diff. Our approach begins with a multi-layer LSTM network that deeply analyzes user behavior sequences, capturing multi-scale features that include both short-term variations and long-term trends. Subsequently, based on Diffusion-TS, the model generates data by systematically introducing and then reducing noise to produce diverse abnormal behavior data. Additionally, by incorporating Fourier transform, the model simulates the periodic patterns in user behavior, producing realistic abnormal user data that effectively balances the ratio between normal and abnormal samples. Finally, we employed an LSTM model with a cross-entropy loss function for insider threat detection. Validation on the CERT 4.2 dataset demonstrated that the LSTM-Diff method significantly improved the detection capability for insider threats, achieving an accuracy of 0.91 and an F1 score of 0.92.