Pith. sign in

REVIEW 3 major objections 5 minor 31 references

MambaITD: An Efficient Cross-Modal Mamba Network for Insider Threat Detection

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MambaITD claims a Mamba state-space encoder plus gated fusion of behavior, interval, and statistical features outperforms Transformer-based insider threat detectors on CERT r4.2 and r5.2 while running faster.

desk verdict The architecture is a sensible Mamba-plus-gating system for insider threat detection, but the reported SOTA F1 is not credible because the Otsu threshold is fitted to the test set itself. read the letter →

arxiv 2508.05695 v1 pith:NRDJJS2K submitted 2025-08-06 cs.CR cs.LG

Kaichuan Kong , Dongjie Liu , Xiaobo Jin , Zhiying Li , Guanggang Geng , Jian Weng This is my paper
classification cs.CRcs.LG
keywords insiderthreatdetectionMambastatespacemodelgatedfeaturefusionadaptivethresholdOtsumethodCERTdatasetbehaviorintervalmodeling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a Mamba-based state space architecture can detect insider threats more accurately and more efficiently than Transformer-based sequence models. It argues that modeling not just the order of user actions but the time gaps between them, and fusing those two views with statistical session features, gives a fuller picture of malicious behavior. On the CERT r4.2 and r5.2 datasets, the proposed MambaITD reports higher F1 scores than all compared baselines, and its encoder runs faster and uses less GPU memory than a Transformer encoder. The paper also introduces an adaptive threshold derived from Otsu's method to turn anomaly scores into per-user classifications, which it says handles class imbalance and concept drift.

What carries the argument

The load-bearing pieces are (1) the Mamba encoder, a selective state space model that processes sequences in linear time and carries long-range dependencies; (2) the gated feature fusion mechanism, which uses a statistical-feature-derived gate G to interpolate between behavior-state and interval-state channels before residual addition and layer normalization; and (3) the adaptive threshold module, which builds a 100-bin histogram of a user's anomaly probabilities and selects the split that maximizes inter-class variance, giving a per-user cutoff.

What would settle it

Re-run the CERT evaluation with each user's Otsu threshold computed only from training-day probability histograms (or a validation fold) and then applied to test days. If MambaITD's F1 falls below that of the best Transformer baseline, the reported advantage depends on test-time threshold adaptation rather than on the Mamba encoder or fusion design.

Watch

Extended reading notes

Core claim

MambaITD reports F1-scores of 91.31 on CERT r4.2 and 91.83 on CERT r5.2, outperforming all baselines including Transformer (77.22, 81.53), CATE (88.43, 91.11), and ITDBERT (77.95, 82.11), while keeping false positive rates of 7.89 and 6.05. In a direct encoder comparison, Mamba matches Transformer accuracy at 1.14x speed and roughly 13% lower GPU memory. The system encodes each action as a behavior-device-time-segment ID, smooths inter-action intervals with an exponential moving average, passes both behavior and interval sequences through a Mamba encoder, fuses the two latent sequences with a gating vector derived from statistical session features, and finally applies Otsu's threshold to eac

Load-bearing premise

The central performance figures assume that choosing each user's cutoff from the very same test-day scores that are then labeled does not bias the reported precision and recall.

Editorial extensions

If this is right

  • If correct, replacing quadratic-attention backbones with Mamba in log-based detection can cut latency and memory costs for large-scale deployments while improving F1.
  • Explicit interval encoding gives detectors a signal they currently miss: bursts of actions or gaps between actions, not just ordering.
  • Per-user Otsu thresholds produce personalized decision boundaries, so the same model can serve users with very different activity rhythms.
  • The gating fusion from session statistics means the model can emphasize behavior versus timing depending on context, reducing false alarms.
  • The 1.14x speedup and lower GPU footprint make the approach more plausible for real-time streaming log analysis.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same dual-channel (event + interval) gating recipe could transfer to other time-event domains such as network intrusion or fraud, where irregular timing is informative.
  • Because the paper's Otsu threshold is computed on the test session itself, the reported F1 may partly reflect tuning on the test set; an out-of-sample threshold would show how much of the gain is real.
  • The ablation shows GFF matters most among the three modules; one could test whether fusing intervals into a Transformer backbone yields similar gains, isolating the contribution of Mamba versus the fusion design.
  • The paper acknowledges synthetic CERT data; real-world user logs with noise and missing events are a stricter test of whether interval smoothing and Mamba's selectivity survive.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes MambaITD, an insider threat detection framework built on Mamba state-space encoders. It encodes a user session as a behavior sequence, an EWMA-smoothed interval sequence, and statistical features; feeds behavior and interval embeddings through Mamba blocks; fuses them with a gated mechanism conditioned on session statistics; and classifies each session with an Otsu-based per-user adaptive threshold. Experiments on CERT r4.2 and r5.2 report F1 scores of 91.31 and 91.83, claiming superiority over Transformer, LSTM, DIF, deep log methods, and other baselines, together with lower inference cost.

Significance. If the reported numbers are valid, the paper makes a useful point: a linear-complexity state-space model can match or exceed Transformer-based detection on public insider-threat benchmarks while reducing runtime and GPU memory. The design is transparent, the ablations are informative, and the public CERT datasets make the claims checkable; no code release is provided, which limits reproducibility. However, the central empirical claims depend on an evaluation protocol in which the threshold is derived from the test scores being classified; this must be corrected before the SOTA and efficiency claims can be accepted.

major comments (3)
  1. [§IV-D3, Eqs. (24)–(26)] The adaptive threshold τ_u^* is computed from the histogram of the test-session probability sequence P and then used to label those same test points. This is transductive threshold fitting: Otsu selects the split that maximizes between-class variance on the test distribution itself, so the reported F1 can be optimistically biased relative to any method whose threshold is fixed or chosen on a validation set. The paper gives no evidence that the baselines in Table I were granted the same per-user test-set threshold optimization, and no held-out-threshold variant is reported. Since the headline F1 values in Table I are the basis for the claim of outperforming Transformer, the evaluation must be redone with thresholds derived from training/validation data, or with all baselines allowed the same adaptive procedure.
  2. [§V-A and §VI-C] Mamba layer count (2) and MLP depth (3) are selected using Fig. 3, which appears to evaluate configurations on the same CERT test sets used for Table I; no held-out validation set is described. The 8:2 split is only stated as 'training and testing' without specifying whether it is temporal or random and whether sessions from the same user can appear in both partitions. Hyperparameter selection on test data can inflate all reported metrics. Please provide a clear split protocol and either nested validation or performance on an untouched test set.
  3. [§VI-A and §VI-D, Table III] All comparisons are based on a single split with no standard deviations, error bars, or significance tests. The compatibility analysis in Table III is run on only two users ('AAF0535' and 'BYO1846'); the conclusions that Mamba runs 1.36×/1.14× faster and uses 13% less GPU memory than Transformer cannot be generalized from n=2. Additional seeds, confidence intervals, and paired statistical tests are needed to support the efficiency and accuracy claims.
minor comments (5)
  1. [Tables I and II] The full-model F1 differs between Table I (91.31, 91.83) and Table II (91.28, 91.88). Please clarify whether this is due to different runs, seeds, or a typo.
  2. [Table III] The user identifier 'BYO1846' appears with an unmatched quotation mark. Also, the table caption says 'Encoder Model' but the comparison includes LSTM and GRU, which are not Mamba-based encoders; consider renaming.
  3. [Appendix A, Eq. (27)] The variables ND, NTS, and TS are used in the encoding formula but are not formally defined. B_i, D_i, and TS_i should be stated as category indices with their ranges, otherwise the formula is ambiguous.
  4. [References] The reference list has formatting inconsistencies, e.g., Ref. [17] contains a stray 'mber 3-6, 2024', Ref. [18] is not in the same style as the other entries, and the SMOTE citation [24] appears mismatched with the original SMOTE paper. Please clean up.
  5. [Throughout] The term 'Cross-Model' is used in the heading of §IV-C while the abstract and introduction use 'Cross-Modal'. Use one consistent term.

Circularity Check

1 steps flagged · score 6.0 of 10

Test-set Otsu thresholding makes the reported F1 a transductive fit rather than a held-out prediction.

  1. fitted input called prediction [Section IV-D3, Eqs. (24)-(26)]
    "For each user u, we collect a daily sequence of anomaly scores P = [P1, P2, ..., PT ]. We first construct a normalized histogram H(k) with 100 bins to approximate the empirical distribution of P ... We then apply the Otsu criterion to this histogram to derive the optimal bin-level threshold τ ∗, and map it back to the probability space via: τ ∗ u = τ ∗ 100 · (max(P) − min(P)) + min(P). ... The final classification decision is given by: yt = 1, P t ≥ τ ∗ u (Anomaly), 0, P t < τ∗ u (Normal)."

    The threshold τ_u is computed directly from the same score vector P that it subsequently labels (Eqs. 24-26). Thus the decision boundary is a function of the test-set score distribution; no held-out or validation threshold is used. The reported F1 is therefore not produced by a fixed decision rule applied to new data, but by a transductive fit to the scores being evaluated. Baselines are not described as receiving the same test-data-tuned threshold, so the SOTA comparison in Table I is partially a comparison of threshold-fitting protocols rather than of learned representations. The ablation 'w/o AT vs full' in Table II confirms that this self-derived threshold contributes about 6 F1 points, so the central 'outperforms Transformer' claim is materially affected.

full rationale

The core architecture (Mamba encoder, gated fusion) is not circular: it is trained with BCE loss on labeled training sessions, and the cited Mamba and Otsu results are external. However, the evaluation protocol introduces a genuine self-referential step. In Section IV-D3, the Otsu threshold is estimated from the same per-user anomaly probabilities that it then classifies, so the final labels are a function of the test scores themselves. This is transductive threshold fitting and can inflate F1 relative to baselines using fixed or validation-selected thresholds. The paper does not report a held-out threshold variant, nor does it state that all baselines were granted the same test-data threshold tuning. Additionally, the parameter selection in Section VI-C appears to compare Mamba and MLP layer configurations using the same test split, further using test information to choose the reported model. These issues do not make the whole framework circular—the neural network still learns from labeled training data—but they make the headline F1 numbers partially self-referential. Hence score 6.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard machine learning components (Mamba, gating, Otsu) plus several hand-chosen hyperparameters. No new physical or conceptual entities are introduced. The most consequential premise is that test-set thresholding is unbiased, which is not supported.

free parameters (6)
  • EWMA smoothing factor alpha = 0.2
    Chosen by hand in Eq. (6) for interval sequence smoothing.
  • Gating regularization weight lambda = 0.01
    Chosen by hand in Eq. (21) to balance BCE and gating regularization.
  • Number of Mamba layers = 2
    Selected via parameter analysis in Section VI-C on the same datasets.
  • Number of MLP layers = 3
    Selected via parameter analysis in Section VI-C on the same datasets.
  • Otsu histogram bins = 100
    Hand-chosen in Eq. (24) for constructing the probability histogram.
  • Behavior encoding constants ND, NTS, TS
    Design choices in Eq. (27) that define the mapping ID space for behavior encoding.
assumptions (5)
  • standard math The state space model equations (2)-(3) accurately model user behavior sequences.
    Mamba SSM is used as the backbone encoder, with its linear-time recurrence accepted as given.
  • standard math Otsu's criterion (Eq. 4) is a valid method for separating normal and anomalous probability modes.
    Adapted to per-user probability sequences in Section IV-D3.
  • domain assumption CERT r4.2 and r5.2 are representative insider threat datasets, and daily session units with an 8:2 split are a valid evaluation setup.
    Section V-A describes the datasets and split without justifying that the split is user-disjoint or time-based.
  • domain assumption SMOTE applied to the training set does not introduce leakage and improves class imbalance.
    Over-sampling on the training set may create synthetic points that do not respect temporal autocorrelation, potentially biasing the learned model.
  • domain assumption The MLP's per-time-step anomaly probabilities can be pooled into a daily sequence and thresholded to classify user behavior without additional supervision.
    Section IV-D assumes that the Otsu-derived threshold yields meaningful classification despite being computed from the same test distribution.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MambaITD: An Efficient Cross-Modal Mamba Network for Insider Threat Detection." pith.science (2026). https://pith.science/paper/NRDJJS2K

@misc{pith2026250805695,
  author       = {Pith},
  title        = {Pith review of: MambaITD: An Efficient Cross-Modal Mamba Network for Insider Threat Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NRDJJS2K}},
  note         = {Machine review of arXiv:2508.05695}
}
read the original abstract

Enterprises are facing increasing risks of insider threats, while existing detection methods are unable to effectively address these challenges due to reasons such as insufficient temporal dynamic feature modeling, computational efficiency and real-time bottlenecks and cross-modal information island problem. This paper proposes a new insider threat detection framework MambaITD based on the Mamba state space model and cross-modal adaptive fusion. First, the multi-source log preprocessing module aligns heterogeneous data through behavioral sequence encoding, interval smoothing, and statistical feature extraction. Second, the Mamba encoder models long-range dependencies in behavioral and interval sequences, and combines the sequence and statistical information dynamically in combination with the gated feature fusion mechanism. Finally, we propose an adaptive threshold optimization method based on maximizing inter-class variance, which dynamically adjusts the decision threshold by analyzing the probability distribution, effectively identifies anomalies, and alleviates class imbalance and concept drift. Compared with traditional methods, MambaITD shows significant advantages in modeling efficiency and feature fusion capabilities, outperforming Transformer-based methods, and provides a more effective solution for insider threat detection.

Figures

Figures reproduced from arXiv: 2508.05695 by the authors.

Figure 1
Figure 1. The overview of MambaITD architecture. It uses the Mamba encoder to capture complex patterns in both behavioral and temporal features, which are [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Gated Feature Fusion mechanism. which integrates behavioral and [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Impact of Mamba and MLP Layer Variations on Model Performance. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

31 extracted references · 28 canonical work pages

  1. [1]

    LAN: Learning adaptive neighbors for real-time insider threat detection,

    X. Cai, Y . Wang, S. Xu, H. Li, Y . Zhang, Z. Liu, and X. Yuan, “LAN: Learning adaptive neighbors for real-time insider threat detection,” IEEE Transactions on Information Forensics and Security , 2024

    work page 2024

  2. [2]

    Two- stream isolation forest based on deep features for hyperspectral anomaly detection,

    X. Cheng, M. Zhang, S. Lin, K. Zhou, S. Zhao, and H. Wang, “Two- stream isolation forest based on deep features for hyperspectral anomaly detection,” IEEE Geoscience and Remote Sensing Letters , vol. 20, pp. 1–5, 2023

    work page 2023

  3. [3]

    Empirical evaluation of gated recurrent neural networks on sequence modeling,

    J. Chung, C. Gulcehre, K. Cho, and Y . Bengio, “Empirical evaluation of gated recurrent neural networks on sequence modeling,” arXiv preprint arXiv:1412.3555, 2014

    arXiv 2014

  4. [4]

    DeepLog: Anomaly detection and diagnosis from system logs through deep learning,

    M. Du, F. Li, G. Zheng, and V . Srikumar, “DeepLog: Anomaly detection and diagnosis from system logs through deep learning,” in Proc. ACM SIGSAC Conf. Comput. Commun. Security (CCS) , Dallas, TX, USA, Oct. 2017, pp. 1285–1298

    work page 2017

  5. [5]

    Unsupervised anomaly detection with LSTM neural networks,

    T. Ergen and S. S. Kozat, “Unsupervised anomaly detection with LSTM neural networks,” IEEE Trans. Neural Netw. Learn. Syst. , vol. 31, no. 8, pp. 3127–3141, Aug. 2020

    work page 2020

  6. [6]

    2024 Insider Threat Report,

    Gurucul and Cybersecurity Insiders, “2024 Insider Threat Report,” Gurucul, 2024. [Online]. Available: https://gurucul.com/ 2024-insider-threat-report/

    work page 2024

  7. [7]

    Graph-based insider threat detection: A survey,

    Y . Gong, S. Cui, S. Liu, B. Jiang, C. Dong, and Z. Lu, “Graph-based insider threat detection: A survey,” Comput. Netw., vol. 254, Art. no. 110757, 2024

    work page 2024

  8. [8]

    Cybersecurity forecast: Insider threat landscape,

    Gartner Inc., “Cybersecurity forecast: Insider threat landscape,” Re- search Report, 2023. [Online]. Available: https://www.gartner.com/en/ documents/4567890

    work page arXiv 2023

Show all 31 references
  1. [9]

    Mamba: Linear-time sequence modeling with selective state spaces,

    A. Gu and T. Dao, “Mamba: Linear-time sequence modeling with selective state spaces,” inProc. Adv. Neural Inf. Process. Syst. (NeurIPS), New Orleans, LA, USA, Dec. 2023, pp. 28742–28761

    2023

  2. [10]

    LogBERT: Log anomaly detection via BERT,

    H. Guo, S. Yang, and M. Yuan, “LogBERT: Log anomaly detection via BERT,” in Proc. ACM SIGKDD Int. Conf. Knowl. Discov. Data Min. , Washington, DC, USA, Aug. 2022, pp. 3729–3739

    2022

  3. [11]

    Perfor- mance analysis of image thresholding: Otsu technique,

    T. Y . Goh, S. N. Basah, H. Yazid, M. J. A. Safar, and F. A. Saad, “Perfor- mance analysis of image thresholding: Otsu technique,” Measurement, vol. 114, pp. 298–307, 2018

    2018

  4. [12]

    MambaAD: Exploring state space models for multi-class unsupervised anomaly detection,

    H. He, Y . Bai, J. Zhang, Q. He, H. Chen, Z. Gan, C. Wang, X. Li, G. Tian, and L. Xie, “MambaAD: Exploring state space models for multi-class unsupervised anomaly detection,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS) , Vancouver, BC, Canada, Dec. 2024

    2024

  5. [13]

    ITDBERT: Temporal-semantic representation for insider threat detection,

    W. Huang, H. Zhu, C. Li, Q. Lv, Y . Wang, and H. Yang, “ITDBERT: Temporal-semantic representation for insider threat detection,” in Proc. IEEE Symp. Comput. Commun. (ISCC) , Athens, Greece, Sep. 2021, pp. 1–7

    2021

  6. [14]

    Insider threat mitigation: Systematic literature review,

    U. Inayat, M. Farzan, S. Mahmood, M. F. Zia, S. Hussain, and F. Pallonetto, “Insider threat mitigation: Systematic literature review,” Ain Shams Eng. J. , vol. 15, no. 12, Art. no. 103068, 2024

    2024

  7. [15]

    MambaAD: A novel approach for anomaly detection using state space models,

    Z. Lei, Y . Xu, H. Wang, J. Chen, Y . Zhang, Y . Liu, J. Zhang, X. Li, Y . Wang, and Z. Wang, “MambaAD: A novel approach for anomaly detection using state space models,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2024, pp. 71162–71187

    2024

  8. [16]

    VideoMamba: State space model for efficient video understanding,

    K. Li, X. Li, Y . Wang, Y . He, Y . Wang, L. Wang, and Y . Qiao, “VideoMamba: State space model for efficient video understanding,” in Proc. Eur. Conf. Comput. Vis. (ECCV) , Milan, Italy, Sep.–Oct. 2024, Lecture Notes in Computer Science, vol. 15084, pp. 237–255, Springer

    2024

  9. [17]

    MDDMamba: A model for multi- modal depression detection with a memory-saving cross-modal attention mechanism based on Mamba,

    M. Liu, Z. Wang, and F. Liu, “MDDMamba: A model for multi- modal depression detection with a memory-saving cross-modal attention mechanism based on Mamba,” in Proc. IEEE Int. Conf. Bioinformatics Biomed. (BIBM) , Lisbon, Portugal, Dec. 2024, pp. 1600–1605. mber 3-6, 2024, pp. ...

    2024

  10. [18]

    In: IEEE Trans

    Li, X., Li, X., Jia, J., Li, L., Yuan, J., Gao, Y ., Yu, S.: A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection. In: IEEE Trans. Inf. Forensics Secur., vol. 18, pp. 1638–1652 (2023)

    2023

  11. [19]

    Insider threat test dataset,

    B. Lindauer, “Insider threat test dataset,” Dataset, CERT Division, Exact- Data, LLC, sponsored by DARPA I2O, 2020. [Online]. Available: https: //kilthub.cmu.edu/articles/dataset/Insider-Threat-Test-Dataset/12841247

    2020

  12. [20]

    A hybrid model based on multi-dimensional features for insider threat detection,

    B. Lv, D. Wang, Y . Wang, Q. Lv, and D. Lu, “A hybrid model based on multi-dimensional features for insider threat detection,” in Proc. 13th Int. Conf. Wireless Algorithms, Systems, and Applications (WASA) , Tianjin, China, 2018, Lecture Notes in Computer Science, vol. 10874, pp. 333–

    2018

  13. [21]

    Optimising insider threat prediction: Exploring BiLSTM networks and sequential features,

    P. Manoharan, W. Hong, J. Yin, H. Wang, Y . Zhang, and W. Ye, “Optimising insider threat prediction: Exploring BiLSTM networks and sequential features,” Data Sci. Eng. , vol. 9, no. 4, pp. 393–408, 2024

    2024

  14. [22]

    Evolving techniques in cyber threat hunting: A systematic review,

    A. Mahboubi et al. , “Evolving techniques in cyber threat hunting: A systematic review,” J. Netw. Comput. Appl. , vol. 232, p. 104004, 2024

    2024

  15. [23]

    Enhancing industrial anomaly detection with Mamba-inspired feature fusion,

    M. Pei, X. Zhou, Y . Huang, F. Zhang, M. Pei, Y . Yang, S. Zheng, and M. Xin, “Enhancing industrial anomaly detection with Mamba-inspired feature fusion,” J. Vis. Commun. Image Represent., vol. 107, p. 104368, 2025

    2025

  16. [24]

    Temporal feature aggrega- tion with attention for insider threat detection from activity logs,

    P. Pal, P. Chattopadhyay, and M. Swarnkar, “Temporal feature aggrega- tion with attention for insider threat detection from activity logs,” Expert Syst. Appl., vol. 224, p. 119925, 2023

    2023

  17. [25]

    A survey of Mamba,

    H. Qu, L. Ning, R. An, W. Fan, T. Derr, H. Liu, X. Xu, and Q. Li, “A survey of Mamba,” arXiv preprint arXiv:2408.01129 , 2024

    2024 arXiv

  18. [26]

    A new take on detecting insider threats: Exploring the use of hidden Markov models,

    T. Rashid, I. Agrafiotis, and J. R. C. Nurse, “A new take on detecting insider threats: Exploring the use of hidden Markov models,” inProc. 8th ACM Workshop on Managing Insider Security Threats (MIST) , Vienna, Austria, Oct. 2016, pp. 47–56

    2016

  19. [27]

    An LSTM- autoencoder based online side channel monitoring approach for cyber- physical attack detection in additive manufacturing,

    Z. Shi, A. Al Mamun, C. Kan, W. Tian, and C. Liu, “An LSTM- autoencoder based online side channel monitoring approach for cyber- physical attack detection in additive manufacturing,” J. Intell. Manuf. , vol. 34, no. 4, pp. 1815–1831, 2023

    2023

  20. [28]

    Hunting for insider threats using LSTM-based anomaly detec- tion,

    M. Villarreal-Vasquez, G. Modelo-Howard, S. Dube, and B. K. Bhar- gava, “Hunting for insider threats using LSTM-based anomaly detec- tion,” IEEE Trans. Dependable Secur. Comput., vol. 20, no. 1, pp. 451– 462, 2021

    2021

  21. [29]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention is all you need,” arXiv preprint arXiv:1706.03762, 2017

    2017 arXiv

  22. [30]

    Unveiling shadows: A comprehensive framework for insider threat detection based on statistical and sequential analysis,

    H. Xiao, Y . Zhu, B. Zhang, Z. Lu, D. Du, and Y . Liu, “Unveiling shadows: A comprehensive framework for insider threat detection based on statistical and sequential analysis,” Comput. Secur. , vol. 138, p. 103665, 2024

    2024

  23. [31]

    Filter-enhanced MLP is all you need for sequential recommendation,

    K. Zhou, H. Yu, W. X. Zhao, and J.-R. Wen, “Filter-enhanced MLP is all you need for sequential recommendation,” in Proc. ACM Web Conf. (WWW), Virtual Event, Lyon, France, Apr. 2022, pp. 2388–2399. APPENDIX A. Behavior Sequence Encoding Strategy To ensure consistent representat...

    2022

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.