Insider Threat Detection Using Vector Retrieval and LLM Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting insider threats are inadequate due to their reliance on rule-based or supervised machine learning approaches that fail to adapt to the evolving nature of insider threats, leading to inaccurate prediction and classification.
Innovation Solution
A method utilizing a vector database of near-real-time insider threat incidents and a contextually-trained large language model (LLM) for risk determination, employing Retrieval-Augmented Generation (RAG) and Retrieval-Augmented Fine-Tuning (RAFT) techniques to continuously update and fine-tune the model with the latest Tactics, Techniques, and Procedures (TTPs) used by threat actors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If supervised machine learning models are trained on previous incidents for insider threat detection, then the system can classify events into malicious/non-malicious groups, but the system fails to adapt to the evolving nature of insider threats leading to inaccurate prediction
Solution Approach 1:
The system transitions from static supervised machine learning models to a dynamic retrieval-based approach using vector databases and large language models. The system continuously retrieves updated threat patterns and TTPs from the vector database, enabling adaptive detection that evolves with emerging threats without requiring periodic retraining. This dynamic retrieval mechanism allows the system to maintain high accuracy while adapting to changing threat landscapes.
Solution Approach 2:
The system incorporates feedback loops where detection results and new threat incidents are continuously fed back into the vector database. This feedback mechanism ensures the system learns from both confirmed threats and false positives, progressively improving prediction accuracy. The large language model uses retrieved information from the vector database to refine its classifications, creating a self-improving system that adapts to evolving insider threats.
2Ease of manufacture
If rule-based systems are used for insider threat detection, then the system is simple to implement, but the system cannot accurately detect evolving insider threats
Solution Approach 1:
The system replaces traditional rule-based mechanical detection logic with a retrieval-based semantic search mechanism using vector databases and large language models. Instead of relying on pre-defined rules, the system converts threat patterns into vector representations and performs semantic similarity searches. This substitution maintains relative simplicity through standardized vector operations while dramatically improving detection accuracy by capturing nuanced threat patterns that rule-based systems miss.
Solution Approach 2:
The system transforms the detection approach by changing the parameter representation from discrete rule conditions to continuous vector embeddings. By representing threats, behaviors, and events as high-dimensional vectors, the system enables gradient-based optimization and semantic similarity measurements. This parameter transformation allows the system to detect evolving threats through continuous space comparisons rather than discrete rule matching, significantly improving accuracy while maintaining computational efficiency.
3Quantity of substance
If conventional supervised machine learning techniques are used, then the model can be trained on historical data, but the system does not suffice for accurate prediction of evolving insider threats
Solution Approach 1:
The system introduces a vector database as an intermediary layer between historical training data and the large language model. Instead of directly training the model on historical data, the system converts historical incidents into vector representations stored in the database. The LLM then retrieves relevant vectors during inference, acting as a mediator that bridges historical patterns and current predictions. This intermediary approach allows the system to leverage extensive historical data without the limitations of traditional supervised learning, improving prediction accuracy for evolving threats.
Solution Approach 2:
The system performs preliminary transformation of historical threat data into vector representations and stores them in the vector database before they are needed for detection. This pre-processing step converts unstructured historical incidents into structured, searchable vector formats that the large language model can efficiently retrieve and utilize. By performing this transformation in advance, the system maximizes the utility of historical data for detecting future evolving threats without requiring retraining.
Data Source
AI summary
Methods, systems, and techniques for detecting insider threat incidents are disclosed, comprising: receiving event data from a computing device of an event to be analyzed for an insider threat; accessing a vector database storing vector representations of known insider threat incidents; and determining a risk that the event is an insider threat incident based on the event data and the vector representations of the known insider threat incidents.