IDU-Detector: A Synergistic Framework for Robust Masquerader Attack Detection

In the current digital age, users store their personal information in corporate databases to access services, making data security and sensitive information protection central to enterprise security management. Given the extensive attack surface, system assets continuously face cyber security challenges such as weak authentication, exploitation of system vulnerabilities, and malicious software. Through specific vulnerabilities, attackers may gain unauthorized system access, masquerading as legitimate users, and remaining hidden. Successful attacks can lead to the leakage of user privacy, disruption of business operations, significant financial losses, and damage to corporate reputation. The increasing complexity of attack vectors is blurring the boundaries between insider and external threats. To address this issue, this paper introduces the IDU-Detector, an innovative threat detection framework that strategically integrates Intrusion Detection Systems (IDS) with User and Entity Behavior Analytics (UEBA). This integration aims to monitor unauthorized access and malicious attacks within systems, bridging functional gaps between existing systems, ensuring continuous monitoring and real-time response of the network environment, and enhancing their collective effectiveness in identifying security threats. Additionally, the existing insider threat datasets exhibit significant deficiencies in both depth and comprehensiveness, lacking sufficient coverage of diverse attack vectors. This limitation hinders the ability of insider threat detection technologies to effectively address the growing complexity and expanding scope of sophisticated attack surfaces. To address these gaps, we propose new, more enriched and diverse datasets that includes a wider range of attack scenarios, thereby enhancing the adaptability and effectiveness of detection technologies in complex threat environments. We tested our framework on different datasets, the IDU-Detector achieved average accuracy rates of 98.96% and 99.12%. These results demonstrate the method’s effectiveness in detecting masquerader attacks and other malicious activities, significantly improving security protection and incident response speed, and providing a higher level of security assurance for asset safety.