Insider Risk Detection of EMS in Energy Storage Systems Based on Random Walks and Heterogeneous Graph Embedding

Insider attacks pose a covert and complex risk within energy storage companies, potentially compromising sensitive or confidential data. To proactively detect and address such internal risks, this article introduces a novel detection approach utilizing random walks and graph embedding techniques. Initially, the interconnectivity of logs is thoroughly analyzed, transforming log entries into a heterogeneous graph. Subsequently, a graph embedding technique is employed to represent each log entry as a compact feature vector. Clustering algorithms are then applied to segregate normal and malicious logs into distinct groups, pinpointing the malevolent entries. The method's efficacy and superiority are corroborated through experiments conducted on the CERT dataset, with results indicating a higher detection precision compared to other baseline methods.