# Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection

arXiv: https://arxiv.org/abs/2603.13246 · HTML: https://mlsanity.com/paper/2603.13246/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 21 references that are in the map.
- First posted on arXiv 20 Feb 2026.

## Builds on (most cited first, 5 of 5)

- [Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams](https://mlsanity.com/paper/1710.00811/) (2017)
- [Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities](https://mlsanity.com/paper/2005.12433/) (2020)
- [Maintainable Log Datasets for Evaluation of Intrusion Detection Systems](https://mlsanity.com/paper/2203.08580/) (2022)
- [Insider Threat Detection via Hierarchical Neural Temporal Point Processes](https://mlsanity.com/paper/1910.03171/) (2019)
- [Insider Threat Detection Using GCN and Bi-LSTM with Explicit and Implicit Graph Representations](https://mlsanity.com/paper/2512.18483/) (2025)

## Abstract (arXiv)

This paper proposes a Hadith-inspired multi-axis trust modeling framework, motivated by a structurally analogous problem in classical Hadith scholarship: assessing the trustworthiness of information sources using interpretable, multidimensional criteria rather than a single anomaly score. We translate five trust axes - long-term integrity (adalah), behavioral precision (dabt), contextual continuity (isnad), cumulative reputation, and anomaly evidence - into a compact set of 26 semantically meaningful behavioral features for user accounts. In addition, we introduce lightweight temporal features that capture short-horizon changes in these trust signals across consecutive activity windows. We evaluate the framework on the CLUE-LDS cloud activity dataset with injected account hijacking scenarios. On 23,094 sliding windows, a Random Forest trained on the trust features achieves near-perfect detection performance, substantially outperforming models based on raw event counts, minimal statistical baselines, and unsupervised anomaly detection. Temporal features provide modest but consistent gains on CLUE-LDS, confirming their compatibility with the static trust representation. To assess robustness under more challenging conditions, we further evaluate the approach on the CERT Insider Threat Test Dataset r6.2, which exhibits extreme class imbalance and sparse malicious behavior. On a 500-user CERT subset, temporal features improve ROC-AUC from 0.776 to 0.844. On a leakage-controlled 4,000-user configuration, temporal modeling yields a substantial and consistent improvement over static trust features alone (ROC-AUC 0.627 to 0.715; PR-AUC 0.072 to 0.264).