Ensuring data security is a fundamental challenge in Internet of Things (IoT) deployments, where massive numbers of interconnected devices continuously transmit, process, and store sensitive information. Among the various security threats, insider threats have emerged as the most critical risk, as malicious insiders with authorized access can directly compromise data integrity and confidentiality. Existing detection approaches often focus solely on improving detection accuracy, while neglecting the structural information embedded in user-device interactions and the imperative need for privacy-preserving mechanisms in sensitive environments. To address these challenges, we proposed PrivGITD, a privacy-preserving insider threat detection framework based on local differential privacy and graph modularization. Specifically, PrivGITD introduces a PageRank-based Structural Reconstruction module that quantifies node importance and reconstructs topological embeddings to capture both local and global interaction patterns. Additionally, a Local Differential Privacy (LDP)-based Feature Encoding module perturbs and calibrates user features, ensuring privacy protection while maintaining statistical utility. Furthermore, a Label Perturbation and Denoising Learning strategy refines randomized labels via multi-hop aggregation and soft supervision. Extensive experiments demonstrate that PrivGITD outperforms state-of-the-art methods, achieving higher detection accuracy while effectively preserving privacy.

With the rapid proliferation of crowd mobility data produced by ubiquitous mobile devices equipped with spatial positioning modules, deep neural networks (DNNs) have become widely applied in spatio-temporal trajectory modeling. However, recent studies have shown that DNNs are vulnerable to adversarial examples with strong transferability, which are crafted by introducing small perturbations to original examples but can cause catastrophic mistakes. To mitigate this vulnerability and enhance model robustness, we propose a novel self-supervised collaborative learning framework named Auto-GAN that consists of a generator for automatically learning robust latent features and a discriminator for providing comprehensive guidance to the generator. By leveraging the collaboration between the generator and discriminator, our proposed method significantly improves the denoising performance. Moreover, we combine point-level and feature-level constraints into training processes between original example reconstruction and adversarial example denoising, thereby effectively suppressing the potential “error amplification effect". Extensive experiments conducted on two representative real-world mobility datasets show that our proposed method can significantly enhance the model’s robustness against various adversarial attacks, while preserving the model’s prediction accuracy on original examples.

Simulating human mobility realistically and generating large-scale, high-quality trajectories are crucial for various location-based applications such as traffic management, epidemic spreading analysis, and location privacy protection. While the most popular model-free methods succeed by directly learning distribution of real-world data, they struggle to produce high-quality mobility data without leveraging the domain knowledge of human mobility. Moreover, such model-free methods primarily rely on auto-regressive paradigms, usually accompanied by error accumulation problem. To address the issues, we propose a model-free Domain-Knowledge Enhanced Generative Adversarial Network (DKE-GAN), which efficiently combines domain knowledge of urban context with model-free learning paradigm to generate high-quality mobility data. In addition, we incorporate reinforcement learning into the training process, thereby effectively alleviating the error accumulation. Furthermore, we introduce Trajectory Representation Learning (TRL) to convert noise-carrying raw trajectories into low-dimensional representation vectors for fully mining human mobility patterns. Extensive experiments conducted on two representative real-world mobility datasets demonstrate that our proposed method outperforms six state-of-the-art baselines, significantly achieving performance improvements in simulating human mobility.

Insider threats represent a significant challenge in both corporate and governmental sectors. Most existing supervised learning based detection methods that rely on transforming user behavior into sequential data do not fully utilize structural information and require extensive labeled data. This reliance poses a challenge due to the scarcity of labeled data in real-world scenarios, leading to a few-shot learning situation. To address these limitations, we propose a novel Graph modularized-based Meta-learning Framework for Insider Threat Detection, named GMFITD. Specifically, GMFITD utilizes a structural reconstruction mechanism that combines a graph-based autoencoder with an attention mechanism to explore structural information and infer potential relationships between users. Additionally, we employ a graph prototype construction method coupling episodic meta-learning principle (MAML) to compute representative embeddings for few-shot learning scenarios. By leveraging MAML, the proposed method can capture prior knowledge of insider threat classification by training on similar few-shot learning tasks with few labeled samples. We further enhance the resilience of GMFITD to adversarial attacks through an edge importance estimation mechanism, which assigns higher weights to relevant edges. Extensive experiments demonstrate that our proposed GMFITD outperforms state-of-the-art methods in insider threat detection, achieving higher accuracy with fewer labeled samples and resisting adversarial attacks.

Insider threats present a formidable challenge to cybersecurity, as insiders possess the privileges and information necessary to execute diverse attacks. A comprehensive analysis of user behavior, including behavioral features, sequences, and inter-user relationships, is required for effective insider threat detection. However, few existing methods consider these features in an integrated manner, which could result in high false positives. To further improve the accuracy of insider threat detection, we propose a novel framework for insider threat detection based on a temporal graph convolutional network with data augmentation (referred to as TGCN-DA), which integrates the exploration of structural information among users and simultaneously captures the behavior temporal dependencies. In particular, we introduce an edge predictor to encode user structural information and strengthen intra-class edges among users based on the representation of users’ behavior. Additionally, the GCN with temporal feature mechanism is leveraged to learn dynamic changes in users’ behavior to capture behavior temporal dependence. Extensive experiments demonstrate that our proposed TGCN-DA outperforms other state-of-the-art methods and achieves higher accuracy in the task of insider threat detection.

Insider threat is destructive and concealable, making addressing it a challenging task in cybersecurity. Most existing methods transform user behavior into sequential information and analyze user behavior while neglecting structural information among users, resulting in high false positives. To solve this problem, in this paper, we propose Dual-Domain Graph Convolutional Network (referred to as DD-GCN), a graph-based modularized method for high accuracy and adaptive insider threat detection. The central idea is to convert user features and structural information into heterogeneous graphs in the light of various relationships and take user behavior and relationship into account together. To this end, a weighted feature similarity mechanism is applied to balance the feature similarity of users and original linkages among them so as to generate the fused structure. Next, specific graph embeddings are extracted from the original topology structure and fused structure simultaneously, which convert behavior information into high-level representations. Furthermore, an attention mechanism is applied to learn the adaptive importance weights of the user’s features in the corresponding embedding. The combination and difference constraints are proposed to enhance the learned embeddings’ commonality and the ability to capture different information. Extensive experiments on two real-world datasets clearly show that our proposed DD-GCN extracts the most correlated information from structural topology and feature information substantially, and achieves improved accuracy with a clear margin.