English(EN) A Hybrid Insider Threat Detection Framework Combining Multi-Agent Simulation, Layered SIEM Correlation, and Theory-of-Mind Reasoning

新的混合框架利用AI和SIEM增强内部威胁检测

作者 PulseAugur 编辑部 · [1 个来源] · 2026-09-02 04:00

研究人员开发了一种新颖的混合框架，用于检测企业环境中的内部威胁。该系统集成了多智能体仿真与分层SIEM关联，并纳入了信任自适应阈值和行为取证。该框架在四个变体上进行了评估，其中证据门控SIEM (EG-SIEM) 在使用Enron电子邮件数据校准时，达到了0.944的高参与者级别F1分数。这种方法显著减少了误报，但以增加确认时间为代价，并在CERT r4.2数据集上展示了稳健的性能。 AI

影响该框架通过实现对恶意内部活动的更准确、更高效的检测，可以显著提高企业安全性。

排序理由该集群包含一篇详细介绍新技术框架的学术论文。[lever_c_demoted from research: ic=1 ai=1.0]

在 arXiv cs.AI 阅读 →

AI 生成摘要 · Google Gemini · 来自 1 个来源。我们如何撰写摘要 →

本文如何被排名

Signal score: 25 / 100; Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket: Tool; 该集群包含一篇详细介绍新技术框架的学术论文。[lever_c_demoted from research: ic=1 ai=1.0]
Source corroboration: Single-source cluster; Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics: paper, safety; Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance: High; Clearly on-topic for AI-industry coverage.
Story freshness: Breaking (< 6h); Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

完整方法见我们的编辑标准。

报道来源 [1]

arXiv cs.AI TIER_1 English(EN) · Firdous Kausar, Asmah Muallem, Naw Safrin Sattar, Mohamed Zakaria Kurdi · 2026-09-02 04:00

结合多智能体仿真、分层SIEM关联和心智理论推理的混合内部威胁检测框架

arXiv:2601.04243v2 Announce Type: replace-cross Abstract: This paper presents a hybrid insider threat detection framework for enterprise environments, integrating multi-agent simulation, layered SIEM correlation, trust-adaptive thresholds, behavioral and communication forensics, …

本文如何被排名

报道来源 [1]

结合多智能体仿真、分层SIEM关联和心智理论推理的混合内部威胁检测框架

相关实体

相关话题