# Insider Threat Detection via Hierarchical Neural Temporal Point Processes

arXiv: https://arxiv.org/abs/1910.03171 · HTML: https://mlsanity.com/paper/1910.03171/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Oct 2019.

## Built on by (most cited first, 6 of 6)

- [Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection](https://mlsanity.com/paper/2408.08902/) (2024)
- [LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection](https://mlsanity.com/paper/2403.09209/) (2024)
- [Insider Detection using Deep Autoencoder and Variational Autoencoder Neural Networks](https://mlsanity.com/paper/2109.02568/) (2021)
- [RuDi: Explaining Behavior Sequence Models by Automatic Statistics Generation and Rule Distillation](https://mlsanity.com/paper/2208.07211/) (2022)
- [Leveraging large language models for SQL behavior-based database intrusion detection](https://mlsanity.com/paper/2508.05690/) (2025)
- [Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection](https://mlsanity.com/paper/2603.13246/) (2026)

## Abstract (arXiv)

Insiders usually cause significant losses to organizations and are hard to detect. Currently, various approaches have been proposed to achieve insider threat detection based on analyzing the audit data that record information of the employee's activity type and time. However, the existing approaches usually focus on modeling the users' activity types but do not consider the activity time information. In this paper, we propose a hierarchical neural temporal point process model by combining the temporal point processes and recurrent neural networks for insider threat detection. Our model is capable of capturing a general nonlinear dependency over the history of all activities by the two-level structure that effectively models activity times, activity types, session durations, and session intervals information. Experimental results on two datasets demonstrate that our model outperforms the models that only consider information of the activity types or time alone.