# A Consensus-Bayesian Framework for Detecting Malicious Activity in Enterprise Directory Access Graphs

arXiv: https://arxiv.org/abs/2602.04027 · HTML: https://mlsanity.com/paper/2602.04027/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 1 of its 11 references that are in the map.
- First posted on arXiv 3 Feb 2026.

## Builds on (most cited first, 1 of 1)

- [Consensus and Disagreement of Heterogeneous Belief Systems in Influence Networks](https://mlsanity.com/paper/1812.05138/) (2018)

## Abstract (arXiv)

This work presents a consensus-based Bayesian framework to detect malicious user behavior in enterprise directory access graphs. By modeling directories as topics and users as agents within a multi-level interaction graph, we simulate access evolution using influence-weighted opinion dynamics. Logical dependencies between users are encoded in dynamic matrices Ci, and directory similarity is captured via a shared influence matrix W. Malicious behavior is injected as cross-component logical perturbations that violate structural norms of strongly connected components(SCCs). We apply theoretical guarantees from opinion dynamics literature to determine topic convergence and detect anomaly via scaled opinion variance. To quantify uncertainty, we introduce a Bayesian anomaly scoring mechanism that evolves over time, using both static and online priors. Simulations over synthetic access graphs validate our method, demonstrating its sensitivity to logical inconsistencies and robustness under dynamic perturbation.