Insider Attack Detection Using GAN Images and User Context

The patent uses Generative Adversarial Networks (GANs) to generate synthetic copies of insider attack data. The generator creates realistic synthetic attack samples that mimic real attack patterns, while the discriminator evaluates their authenticity. This copying approach multiplies the available training data volume without requiring additional real attack samples, directly resolving the contradiction between limited training data and detection accuracy.

The patent transforms the training data by applying parameter changes through data augmentation techniques. Synthetic attack data is generated with varied parameters including different attack vectors, user behaviors, and contextual features. This parameter transformation creates diverse training samples from limited real data, improving model generalization and detection accuracy while overcoming the insufficient training data volume.

The patent merges multiple data sources into a unified dual-input classification framework. It combines dynamic behavioral data (user actions, network activities) with non-dynamic contextual data (job role, psychometric profiles, access privileges) into a single model architecture. This merging allows the system to leverage both real-time behaviors and static user characteristics, significantly improving classification accuracy while managing complexity through integrated processing.

The patent creates a composite data structure that integrates heterogeneous information types. The classification model processes a composite input consisting of behavioral vectors and contextual attributes, analogous to composite materials combining different properties. This composite approach enables the system to utilize diverse data characteristics simultaneously, enhancing detection precision without requiring separate processing systems.

The patent performs preliminary data preparation by pre-processing and storing contextual information in structured formats before actual detection operations. User profiles, psychometric data, and access rights are pre-computed and organized into easily queryable structures. This preliminary action reduces the computational burden during real-time detection, allowing the system to process synthetic and real data efficiently without sacrificing detection precision.

The GAN-based synthetic data generation creates realistic training samples that capture the essential patterns of insider attacks. By generating high-quality synthetic copies, the system achieves sufficient training data volume without collecting and processing an equivalent amount of real attack data, thereby reducing the time and resources required for data acquisition and processing while maintaining detection precision.