Attention-driven fusion of sequential and graph neural models for insider threat detection in UEBA - Nature

Abstract Insider threats remain among the most critical challenges in cybersecurity, as malicious or compromised employees can bypass traditional defences and cause disproportionate damage to organizations. Detecting such threats is difficult because anomalous behaviour is often subtle, context-dependent, and concealed within vast volumes of normal user activity. Conventional anomaly detection techniques suffer from high false positive rates and limited ability to capture both temporal and relational patterns of behavior, which constrains their operational utility in Security Operations Centers (SOCs). This study presents a hybrid User and Entity Behavior Analytics framework that integrates Transformer-based sequence modeling with graph neural networks (GNNs) to simultaneously capture temporal workflows and relational dependencies. Using the CERT Insider Threat Dataset, raw multi-source logs are sessionized and transformed into dense event representations combining categorical actions, resource identifiers, and normalized numerical attributes. A Transformer encoder models long-range event dependencies, while a GNN encodes user–resource interactions, their outputs are fused and evaluated via anomaly scoring, with explainability mechanisms providing interpretable SOC alerts. Experimental evaluation demonstrates that the proposed model achieves 97.9% accuracy, 0.88 F1-score, and 0.99 AUC, reducing false positives to 11 per 1000 sessions and lowering detection latency to 1.9 h. These results establish that fusing sequential and relational perspectives yields a robust, accurate, and interpretable solution for insider threat detection in enterprise environments. Similar content being viewed by others Daily insider threat detection with hybrid TCN transformer architecture Article Open access 05 August 2025 Sentiment classification for insider threat identification using metaheuristic optimized machine learning classifiers Article Open access 28 October 2024 A novel deep synthesis-based insider intrusion detection (DS-IID) model for malicious insiders and AI-generated threats Article Open access 02 January 2025 Introduction Cybersecurity refers to the collection of practices, technologies, processes, and organizational measures that protect information systems, networks, and digital assets from unauthorized access, attacks, damage, or disruption1. Cybersecurity has become extremely important, as organizations and individuals have come to rely on electronic networked systems and online repositories of critical data. Recent reports indicate that attacks such as ransomware, supply chain attacks, and zero-day attacks are on the rise in frequency and sophistication, resulting in massive financial costs2,3. The influence of artificial intelligence (AI) , on cybersecurity has been in the area of threat detection, response and prevention. AI is applied across detection, response, and assessment tasks to handle scale, speed, and pattern complexity that overwhelm manual methods. Surveys and reviews document widespread use for malware/botnet detection, behavior analytics, spam filtering, and access controls using ML and Deep Learning techniques4,5. Robust threat detection utilizes Artificial Intelligence (AI) and Machine Learning (ML) to enhance modern cybersecurity by helping to identify and locate threats quickly and accurately6. Due to their anomaly detection capabilities, AI and ML algorithms are very effective at detecting anomalies in the network traffic that represent security risks and therefore can assist in timely detection of zero-day vulnerabilities and advanced persistent threats (APTs)7,8. In addition, malware classification has benefited from the implementation of advanced machine learning models, such as deep learning techniques based on Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks, which have proven to achieve high accuracy in classifying malware, greatly exceeding traditional detection techniques9. In addition to this, AI-based IDS not only provide better analysis of network traffic as compared to traditional, rule-based systems, but also help with real-time detection and response to cyber attacks, thus decreasing false positives and overall improving the security posture of an organization10. Real-time data analysis and response is a method of cybersecurity that utilizes Artificial Intelligence (AI) and Machine Learning (ML) to proactively counteract threats by analyzing data as it comes in and responding immediately to such threats in a timely manner protective measure. Predictive analysis utilizes past and current data to predict possible breaches, allowing organizations to take a proactive approach before threats occur. In addition, incident response becomes automated by the fast containment and remediation of cyberattacks, cutting down detection and response times and reducing harm11,12. In addition to this, AI systems can also use behavioral analysis and user behavior analytics (UBA) to detect anomalies or behavior indicative of insider threats or compromised accounts, providing an overall bolstered cybersecurity infrastructure. User and Entity Behavior Analytics (UEBA) strengthens enterprise security by leveraging cutting edge anomaly detection and threat mitigation capabilities to identify a universe of threats to the organization from both internal and external actors. Through analysis of a variety of data, including user logins, file access, and network activity, UEBA is able to identify anomalies that often go unnoticed by other systems to find malicious insiders, compromised accounts, and advanced persistent threats (APTs)13,14. One of the most important strengths in UEBA is in the area of protecting against insider threats, where behavioral baselines are formed to identify behaviors that diverge from those established norms that could signal a risk that otherwise no one was aware of, and help safeguard critical assets of the organization15,16. UEBA also enhances security posture as part of a SIEM, which acts as a consolidated system for detecting and responding to threats, or in the case of cloud computing stores and safeguards the assets in the cloud through constant user and entity behavior monitoring17. In addition to detecting these types of attacks, UEBA uses advanced analytics like behavioral clustering to suggest access control policies that are based on how machines are used, thus minimizing potential points of failure18. UEBA systems are structured to be scalable and can ingest immense amounts of data – processing thousands of events a second – which means organizations don’t have to compromise their defenses because their data or userbase are growing, and since detection help in real-time, organizations can react quickly and prevent or reduce the risk of a breach19,20. AI-based UEBA solutions take these capabilities a step further by leveraging adaptive, intelligent analytics using ML and DL models. Compared to the traditional rule-based analysis, the AI-enabled UEBA employs algorithms that constantly observe and analyze data on a much larger scale to identify anomalies and potentially harmful behaviors that rule-based systems may not be able to identify methods like Singular Value Decomposition and Long Short-Term Memory models, able to consider temporal and spatial dependencies for better detection of irregularities, contribute to anomaly detection in real time13,16,21. Another aspect that can boost UEBA is predictive analytics, which can examine past and present behavior in order to predict future incidents, something that can be particularly useful in the cloud paradigm where sensitive assets are still exposed22,23. Isolation Forests and Deep Autoencoders among other advanced AI algorithms have shown to be resilient to detect nuances of newer and emerging attacks based on adaption to evolving vectors of attack. The incorporation of AI- powered UEBA into current SIEM architecture strengthens a centralized approach to threat management, yet it can further promote a collective defense by sharing threat intelligence among companies in order to grow the shared knowledge base24. To summarize, UEBA has become a critical component in today’s security arsenals in the fight against sophisticated attacks that include but are not limited to insider threats, account compromise, and data exfiltration. Through behavior profiles that set norms and analysis of significant shifts in various data sets, UEBA exposes more nuanced and previously impossible to detect types of malicious behavior to the organization. This is a strength in its applicability to advanced persistent threats, as well as insider risks. As a solution to these problems we present an AI-based UEBA framework that utilizes Deep Learning sequence models, namely Long Short-Term Memory (LSTM) networks and transformers, along with graph analytics to account for the relational nature of user and resource behavior in the establishment of a baseline of normal behavior. It combines temporal, sequential, and structural context to get the benefit from being able to identify complex attack patterns that are difficult to detect using solely anomaly detection techniques. Combining learning from sequences of events with graph-based knowledge, this system is expected to enable better performance in detection of account takeovers, insider threats, and data exfiltration, thus improving the robustness of organizational cybersecurity infrastructures. Literature survey Research on the deep learning models used for improving anomaly detection in User and Entity Behavior Analytics (UEBA) compared to traditional AI approaches has emerged as a critical area of inquiry due to the increasing complexity and volume of cyber threats in modern networked environments25,26. Over the past decade, the evolution from traditional machine learning algorithms to sophisticated deep learning architectures such as Long Short-Term Memory (LSTM), Convolutional Neural Networks (CNN), and Transformer models has significantly enhanced the capability to detect subtle and complex anomalies in user behavior and network traffic27,28,29. This progression is underscored by the growing reliance on UEBA systems to identify insider threats, advanced persistent threats, and zero-day attacks, which traditional methods often fail to detect effectively30,31. The practical significance is evident in the rising costs of cybercrime and the critical need for real-time, accurate anomaly detection to safeguard organizational assets32. Despite these advances, the specific problem of quantifying and understanding the technical depth—defined as the architectural complexity, feature extraction capacity, and temporal-spatial modeling capabilities—of deep learning models relative to traditional machine learning methods in UEBA remains insufficiently addressed33,34,35. Existing literature reveals a knowledge gap in systematically comparing these approaches, particularly regarding their ability to handle high-dimensional, multi-source data and temporal dependencies inherent in user behavior logs36,37,38. Controversies persist over the trade-offs between deep learning’s superior accuracy and its computational costs, interpretability challenges, and data requirements versus the efficiency and simplicity of traditional models39,40,41. The consequences of this gap include suboptimal deployment of anomaly detection systems and potential vulnerabilities in cybersecurity defenses42. Conceptually, builds on the framework that UEBA integrates user behavior modeling, anomaly detection, and cybersecurity threat mitigation through advanced analytics43. Deep learning models, characterized by hierarchical feature learning and temporal sequence modeling, are positioned as enhancements over traditional machine learning classifiers that rely on handcrafted features and static patterns44. The relationship between model complexity and detection performance forms the theoretical foundation guiding this investigation. This studies predominantly focus on cybersecurity applications, particularly insider threat detection and network intrusion, with a strong emphasis on leveraging temporal and spatial features inherent in user and entity behavior data. Comparative analyses between deep learning and traditional machine learning approaches highlight advancements in detection accuracy and robustness, while also addressing challenges such as interpretability and computational demands. This comprehensive comparison informs the understanding of how deep learning’s technical depth contributes to enhanced anomaly detection in UEBA systems. The reviewed literature demonstrates substantial progress in anomaly detection within User and Entity Behavior Analytics (UEBA) using advanced deep learning models such as LSTM, CNN, Autoencoders, GANs, and Transformer architectures as shown in Table 1. These models outperform traditional machine learning approaches in accuracy, robustness, and feature extraction by automatically learning complex, nonlinear relationships in high-dimensional user behavior data. Hybrid and generative models further improve detection by capturing temporal and spatial dependencies while addressing challenges such as data imbalance and unsupervised learning. Table 1 Comparative analysis of existing insider threat detection. Full size table However, despite these advancements, most existing approaches fail to effectively model both short-term and long-term temporal patterns in user activity sequences. Traditional recurrent networks (e.g., LSTM) excel at learning localized, short-range dependencies but often lose context over extended sessions, whereas Transformer-based architectures capture long-range dependencies at the expense of computational efficiency and fine-grained temporal sensitivity. This limitation leads to reduced accuracy when detecting multi-stage attacks where malicious behaviors evolve gradually across time (e.g., login → data access → delayed exfiltration). Furthermore, many existing studies focus on single-modality data or isolated architectures, neglecting the joint temporal–relational context that characterizes real-world insider threats. The three key research gaps are. 1. Absence of unified modeling for short- and long-term temporal dependencies Most existing UEBA frameworks focus narrowly on either short-term temporal dependencies using RNN/LSTM-based models or long-term dependencies using Transformer-based architectures. 2. Inadequate temporal–relational fusion for contextual anomaly detection The graph-based methods have emerged recently, most lack effective integration with temporal sequence modeling, resulting in reduced contextual accuracy and incomplete anomaly representation. 3. Limited explainability in deep learning-based UEBA models The absence of transparency in anomaly scoring and feature attribution undermines operational trust and hinders the deployment of these models in real-world Security Operations Centers (SOCs). To address these gaps, the proposed Attention-Based Fusion Framework combines Transformer and LSTM sequence encoders to jointly capture short-term user activity transitions and long-term behavioral dependencies, while Graph Neural Networks (GNNs) model relational interactions between users and resources. This dual temporal–relational representation enhances anomaly detection accuracy across diverse behavioral timescales. Materials and methods Materials Dataset The CERT Insider Threat Dataset, published by Carnegie Mellon University’s Software Engineering Institute (SEI), is a widely recognized benchmark for insider threat research. The dataset is organized into five primary CSV files, each corresponding to a different source of user activity. The authentication logs (logon.csv) record user login and logout events, including remote and VPN sessions, with attributes. The file access logs (file.csv) document operations like read, write, delete, and copy, along with file names, sizes, and the machine from which they were accessed. The email logs (email.csv) contain metadata about communications, including sender, recipient(s), subject line, message size, attachment presence, and timestamps, allowing the distinction between internal and external communications. The removable media logs (device.csv) track USB insertions, removals, and file transfers, identifying device IDs and associated files. Finally, the web browsing logs (http.csv) capture visited URLs, domains, and content types, which are useful for monitoring abnormal browsing behavior or access to suspicious sites as shown in Fig. 1. Fig. 1 Full size image Overview of activity source types in the CERT insider threat dataset. Before applying advanced AI models, the raw CERT logs require substantial preprocessing. First, timestamps must be standardized into a uniform format, while file paths, email addresses, and URLs are normalized to extract canonical identifiers such as filenames or domains. Missing or incomplete values (e.g., email size or attachment fields) need to be imputed or encoded appropriately. For behavioral modeling, the logs are grouped into sessions, typically defined as fixed time windows (e.g., 30 min) or activity-driven segments, enabling sequence modeling. Categorical attributes such as activity type, machine ID, file name, and URL are encoded into embeddings, while continuous attributes such as file size or email size are normalized. Additional binary indicators (e.g., external email vs. internal email, first-time device use) are derived to enhance feature richness. To support graph-based analysis, the logs are further transformed into a user–resource interaction graph, where users are connected to files, devices, domains, and email recipients they interact with. Edge weights can reflect frequency or bytes transferred, while node features include both raw attributes and aggregated session embeddings. Ground-truth labels for malicious scenarios are provided at the user level and are propagated to relevant sessions, enabling supervised or semi-supervised evaluation. Methods System architecture The proposed Attention-Based Sequence–Graph Fusion Framework for UEBA integrates both temporal and relational modeling to enhance insider threat detection architecture as shown in Figure 2. The system begins with dataset preprocessing using the CERT dataset, performing cleaning, normalization, and pseudonymization. Through sessionization strategies—including fixed window (30 min) and activity gap (idle > 15 min)—multi-source logs are unified into coherent user sessions. Next, feature vector construction transforms each session into structured inputs via event representation, event vector formation, and aggregated session-level statistics. The sequence encoder (LSTM + Transformer) captures both short- and long-term temporal dependencies, while the graph encoder models user–resource relationships. These embeddings are combined through attention-based fusion, and anomalies are scored using a hybrid of reconstruction and likelihood measures. Finally, explainability and SOC integration provide interpretable results via attention, supporting transparent and actionable threat analysis. Fig. 2 Full size image Architecture of the proposed attention-based sequence–graph fusion framework for UEBA. System model A. Sessionization The CERT Insider Threat Dataset is fundamentally event-based, with each row representing a single atomic action such as a user login, file access, or email activity. However, malicious insider behavior rarely occurs through isolated events; instead, it typically unfolds as a sequence of related actions. For example, a data exfiltration attempt may involve logging in at an unusual time, accessing confidential files, copying them to a USB device, and subsequently sending an external email with attachments. When events are treated independently, the temporal context necessary for detecting such malicious patterns is lost. Sessionization addresses this challenge by grouping related events into coherent sessions that represent user workflows, thereby preserving temporal relationships essential for effective insider threat detection. A session for a user \(u\) is defined as a set of events within a bounded time window \(W\) as shown in (1): $${S}_{u}^{(i)}=\left\{{e}_{1},{e}_{2},\dots ,{e}_{T}\mid {e}_{j}=\left(u,{t}_{j},{\tau }_{j},{r}_{j},{x}_{j}^{num}\right),{t}_{1}\le {t}_{j}<{t}_{1}+W\right\}$$ (1) where: \(u\) : user ID (from user column in CERT logs). \({t}_{j}\) : timestamp (from date column). \({\tau }_{j}\) : event type (e.g., Logon, File Read, Email Send). \({r}_{j}\) : resource accessed (file name, URL, email, or device ID). \({x}_{j}^{num}\) : numerical attributes (bytes transferred, email size, etc.). \(W\) : window size (e.g., 30 min). Thus, a session represents all events performed by a user \(u\) in a time window W. There are two principal strategies for constructing sessions from the raw CERT event logs: fixed-window sessionization and activity-gap sessionization. i. Fixed-window sessionization In the fixed-window approach, the timeline of user activity is divided into consecutive intervals of equal duration, typically 30 minutes or one hour, and all events within each window are grouped into a session. For example, a window from 09:00–09:30 may include a logon, a file read, and an email send, while the subsequent window from 09:30–10:00 may contain a file copy and a USB insertion. This method provides consistency and ensures uniform session lengths, which simplifies downstream modeling; however, it may sometimes split a single coherent activity into two windows if the behavior crosses a boundary. Formally equation (2), $${S}_{u}^{(i)}=\left\{e:t\in [{t}_{i},{t}_{i}+W)\right\}$$ (2) ii. Activity-gap sessionization The second approach, known as activity-gap sessionization, defines sessions dynamically based on user inactivity thresholds. A new session begins when a user resumes activity after being idle for longer than a predefined period, such as 15 minutes. This technique captures more “natural” work sessions that better reflect the flow of human behavior, since activities that occur close in time are grouped together regardless of fixed clock intervals. For instance, if a user logs in, accesses files, and sends emails within ten minutes, these will belong to the same session; if the user then remains idle for half an hour before resuming activity, a new session will be initiated. Compared to fixed windows, this strategy produces variable-length sessions but is often more representative of actual workflows, especially for detecting insider threat scenarios where malicious sequences may occur in short bursts of activity. Formally in equation (3), $${S}_{u}^{(i)}=\left\{{e}_{j}:\left({t}_{j}-{t}_{j-1}\right)\le {\tau }_{gap}\right\}$$ (3) Define a gap threshold \({\tau }_{gap}\) (e.g., 15 min). Suppose user U123 has the following raw logs (simplified) shown in Table 2: Table 2 Activity logs of user U123. Full size table Using a 30-min window in (4): $${S}_{U123}^{(09:00-09:30)}=[ Logon, File Read, File Copy, Email Send]$$ (4) This single session now reflects the workflow of suspicious insider behavior. (a) Handling multi-source logs The CERT Insider Threat Dataset consists of multiple heterogeneous CSV files (logon, file, email, device, and http), each recording different types of user activity. In order to construct coherent behavioral sessions, these sources must first be merged into a unified chronological event stream for each user. This requires parsing all files by the \(user\) attribute, extracting key fields, and mapping them into a standardized schema of the form. $$e=(user,date,activity,resource,bytes)$$ (5) where user is the employee identifier, date is the timestamp of the event, activity represents the action type (e.g., logon, file copy, email send), resource is the entity being accessed (such as a file name, URL, email address, or device ID), and bytes is the numerical attribute representing data size (e.g., transferred file size, email size, or zero if not applicable). After transforming each log type into this common schema in (5), the events are merged and sorted by timestamp to produce a single, chronological activity sequence per user. Once this unified sequence is constructed, sessionization methods—either fixed window or activity-gap based—can be applied to segment the stream into meaningful sessions that combine heterogeneous event types. This process ensures that a single session can capture complex, multi-step behaviors such as logon → file copy → USB insert → external email, which would otherwise be scattered across different files. B. Feature vector construction The output of sessionization phase provides, for each user, a set of sessions where each session is represented as a sequence of events of the form (6). $${e}_{j}=\left(u,{t}_{j},{\tau }_{j},{r}_{j},{x}_{j}^{num}\right)$$ (6) Here, \(u\) denotes the user identifier, \(t_{j}\) is the event timestamp, \(\tau_{j}\) is the event type (e.g., logon, file copy, email send), \(r_{j}\) represents the accessed resource (such as a file name, email address, URL, or device ID), and \(x_{j}^{num}\) captures numerical attributes such as file size, bytes transferred, or email size. To make these sessionized events suitable for AI models, they are transformed into dense feature vectors through a combination of categorical embeddings and normalized numerical attributes. (a) Event representation Each event type \({\tau }_{j}\) is mapped into an embedding vector \(Em{b}_{\tau }\left({\tau }_{j}\right)\), while resources \({r}_{j}\) are also embedded using low-dimensional vectors \(Em{b}_{r}\left({r}_{j}\right)\), which helps reduce the sparsity associated with high-cardinality resource identifiers. Numerical attributes are normalized, typically through z-score or min–max scaling, producing \(\tilde{x}_{j}^{num}\) .The final event representation is then obtained by concatenating these components into a single dense vector (7): $$x_{j} = \left[ {Emb_{\tau } \left( {\tau_{j} } \right)\left\| {Emb_{r} \left( {r_{j} } \right)} \right\|\tilde{x}_{j}^{num} } \right]$$ (7) where || denotes vector concatenation. (b) Event vector As a result, each session becomes a sequence of event vectors (8), $${S}_{u}^{(i)}=\left[{x}_{1},{x}_{2},\dots ,{x}_{T}\right], {x}_{j}\in {R}^{d}$$ (8) Example for event File Copy Payrollxls, 150 KB (9): $${x}_{filecopy }=\left[{Emb}_{\tau }( FileCopy ),{Emb}_{r}( Payroll.xls ),150000/{\sigma }_{bytes}\right]$$ (9) So Session 1 becomes (10): $${S}_{U123}^{(1)}=\left[{x}_{logon },{x}_{fileread },{x}_{filecopy },{x}_{emailsend}\right]$$ (10) which forms the direct input to temporal sequence encoders in the next phase. (c) Aggregated session features In addition to event-level representations, session-level aggregate features are also derived to capture statistical summaries of user activity. These include the number of files accessed, the number of emails sent, the volume of bytes transferred, and the diversity of unique resources visited within a session. Formally (11), $$\varnothing \left({S}_{u}^{(i)}\right)=[num\_files,num\_emails,total\_bytes,num\_resources,\dots ]$$ (11) a session \({S}_{u}^{(i)}\) is associated with an aggregate feature vector \(\varnothing \left({S}_{u}^{(i)}\right)\), which provides high-level context complementary to the fine-grained event sequence. Thus, the output of this phase consists of two components: (i) a sequence of dense event vectors capturing categorical and numerical features of each action, and (ii) a session-level statistical vector summarizing aggregate behaviors. Together, these outputs form the structured input to next phase—Sequence Encoder (LSTM/Transformer), where temporal dependencies across events are modeled. C. Sequence encoder (LSTM/Transformer) In this step, the sequence of feature vectors obtained from each session is processed using sequence encoders to capture temporal dependencies across events. Given a session \({S}_{u}^{(i)}=\left[{x}_{1},{x}_{2},\dots ,{x}_{T}\right]\), where each \({x}_{j}\) is a dense representation of an event, the objective is to map this sequence into a fixed-dimensional embedding that summarizes the behavioral pattern of the session. Two architectures are considered: recurrent neural networks (LSTM) and Transformer encoders. (a) Short-term dependency modeling using LSTM encoder The LSTM-based sequence encoder is employed to capture short-term and bursty user activity patterns by maintaining a gated memory that selectively preserves or forgets past information as events arrive over time. At each time step, the model regulates information flow through input, forget, and output gates, allowing it to update an internal cell state that encodes long-term context while producing a hidden state that reflects the current behavioral dynamics. This gating mechanism enables the LSTM to model rapid changes in user behavior, such as sudden privilege escalation or abnormal access bursts, which are common indicators of insider threats. After processing a session of length \(T\), the final hidden state is used as the short-term session representation in (12): $${s}_{u}^{short}={h}_{T}^{LSTM}$$ (12) , and the final hidden state \({h}_{T}\) is taken as the session embedding \({s}_{u}^{(i)}\). This representation captures sequential dependencies while handling long-term context through gated memory mechanisms. (b) Long-term dependency modeling using transformer encoder In parallel to the LSTM, a Transformer encoder is employed to capture long-range and non-local temporal dependencies across all events within a session. Given an event sequence \(\left\{{x}_{1},{x}_{2},\dots ,{x}_{T}\right\}\), the inputs are first stacked into a matrix \(X\in {R}^{T\times d}\) and augmented with positional encodings to preserve temporal order. Each Transformer layer applies multi-head self-attention, allowing every event to attend to all others irrespective of temporal distance. The self-attention operation is computed as (13) $$Attention(Q,K,V)=softmax\hspace{0.17em}\left(\frac{Q{K}^{\top }}{\sqrt{{d}_{k}}}\right)V,$$ (13) where queries, keys, and values are linear projections of the input representations. After stacking \(L\) Transformer layers, each event obtains a globally contextualized embedding. A fixed-length long-term session representation is then obtained via temporal pooling in (14) $${s}_{u}^{long}=\frac{1}{T}{\sum }_{t=1}^{T}{h}_{t}^{Trans}.$$ (14) This representation effectively captures delayed and distributed behaviors, such as multi-stage insider activities where correlated actions occur hours apart (e.g., login → USB insertion → external email). Complementarity of LSTM and transformer encoders. The LSTM and Transformer encoders provide complementary temporal perspectives of the same session: the LSTM focuses on short-term, local dynamics and is computationally efficient for near real-time detection, while the Transformer excels at modeling global, long-range dependencies critical for identifying slow and stealthy insider threats. Their outputs, \({s}_{u}^{short}\) and \({s}_{u}^{long}\), are forwarded to the fusion module, where they are adaptively combined with relational graph embeddings. Consequently, the sequence encoder produces a fixed-length session embedding \({s}_{u}^{\left(i\right)}\in {R}^{m}\) that encapsulates both short- and long-term temporal activity patterns and serves as input to the subsequent fusion and anomaly scoring stages. D. Graph encoder (user–resource graph) In parallel, the Graph Encoder constructs a user–resource interaction graph from the Feature Vector Construction. The sequence encoder and graph encoder run in parallel. In Step 5, the temporal embeddings derived from the sequence encoder are enriched with relational information through a graph-based representation of user-resource interactions. The CERT dataset provides natural structure for this representation, as users interact with files, email addresses, websites, and devices, all of which can be modeled as nodes in a bipartite graph. Formally, the graph is defined as (15) $$G=\left({V}_{U}\cup {V}_{R},E\right)$$ (15) where. \({V}_{U}\) is the set of user nodes \({V}_{R}\) is the set of resource nodes An edge \((u,v)\in E\) exists if user \(u\) has interacted with resource \(v\) within the observation window. Edge weights are defined based on contextual attributes such as frequency of access, bytes transferred, or temporal recency, allowing the graph to reflect not just binary connectivity but also behavioral intensity. To encode recency and interaction intensity, each edge is assigned a nonnegative weight \({w}_{uv}\) computed as the sum of exponentially decayed contributions from individual events e of type \(u\to v\) (16): $${w}_{uv}=\sum_{e\in {\mathcal{E}}_{u\to v}} \text{exp}\left(-\lambda \left({t}_{{\text{now}} \, }-{t}_{e}\right)\right)$$ (16) where. \({t}_{e}\) is the timestamp of event \(e,\) \({t}_{now}\) is the reference time (e.g., session end or detection time), and \(\lambda >0\) controls decay speed (larger \(\lambda\) places more emphasis on recent activity). This weighting scheme ensures that frequent recent interactions contribute strongly to the graph signal while older interactions attenuate smoothly. Node features are initialized from session summaries and embedding lookups: for a resource node \(v\), we use a learned resource embedding \({Emb}_{r}(v)\) (optionally concatenated with resource metadata); for a user node \(u\), we initialize with an aggregate of that user’s recent session embeddings \({s}_{u}^{(i)}\) or a learnable vector. The weighted adjacency may be normalized (e.g., symmetric or row normalization) before message passing. We apply a Graph Encoder-style message-passing encoder to produce node representations. Let \({h}_{v}^{(l)}\) denote the embedding of node \(v\) at layer \(l\) (with \({h}_{v}^{(0)}\) the initial node feature). The Graph Encoder update with neighborhood mean aggregation is (17): $${h}_{u}^{(l+1)}=\sigma \left({W}^{(l)}\cdot concat\left({h}_{u}^{(l)},mean\left\{{h}_{v}^{(l)}:v\in N(u)\right\}\right)\right),$$ (17) where. \(N\left(u\right)\) is the (weighted) neighbor set of \(u,\) \({W}^{(l)}\) is a learned linear transform at layer \(l\), concat \((\cdot ,\cdot )\) denotes vector concatenation, and \(\sigma (\cdot )\) is a nonlinearity (e.g., ReLU). When using edge weights we replace the simple mean by a weighted mean (18): $${\text{mean}}_{w}\left\{{h}_{v}\right\}=\frac{1}{\sum_{v\in \mathcal{N}(u)} {w}_{uv}}\sum_{v\in \mathcal{N}(u)} {w}_{uv}{h}_{v}^{(l)}.$$ (18) After \(L\) layers, the final user node embedding \({g}_{u}\equiv {h}_{u}^{(L)}\) encodes the user’s relational context with respect to the resources and their recent interaction patterns. Because edges incorporate recency via exponential decay, the user embedding \({g}_{u}\) is highly sensitive to recent changes in behavior. For example, a sudden access to previously inseen resource types (e.g., unusual file extensions, external email recipients, or unfamiliar hosts) creates new or strengthened edges to resource nodes whose embeddings differ from the user’s historical neighborhood. Through Graph Encoder aggregation these novel neighbor vectors contribute to the weighted nean and, after the learned linear + nonlinear transform, produce a measurable shift in \({g}_{u}\). This shift is then exposed to the fusion module (Step 6) and can increase the session anomaly score-thus enabling detection of contextual anomalies such as lateral movement or exfiltration that are not apparent from sequence batterns alone. The graph encoder outputs per-user embeddings \(\left\{{g}_{u}\right\}\). These embeddings are projected to a common fusion dimension and input to the attention-guided fusion module together with sequence embedding\(s\). For online operation, we maintain a rolling graph snapshot updated periodically (or incrementally) so \({g}_{u}\) reflects the most recent interactions at inference time. This embedding is then forwarded to Fusion phase, where it is combined with the sequence embedding to form a comprehensive session representation. E. Fusion In this phase, the session embeddings derived from temporal sequence modeling and the graph embeddings derived from user-resource interactions are combined into a single, unified representation. The motivation is that temporal encoders such as LSTMs or Transformers excel at modeling the sequential flow of user actions, while graph neural networks capture relational dependencies across users and resources. A robust insider threat detection system requires both views simultaneously, since an anomaly may arise from unusual event ordering, novel resource usage, or the combination of the two. Formally, given a session embedding \({s}_{u}^{(i)}\in {R}^{m}\) from Step 4 and a graph-based embedding \({g}_{u}^{(i)}\in {R}^{p}\) from Step 5, we construct a fused vector \({h}_{u}^{(i)}\in {R}^{d}\). (19) $${h}_{u}^{(i)}=\left[{s}_{u}^{(i)}\| {g}_{u}^{(i)}\right]$$ (19) The simplest approach is concatenation, where the embeddings are directly joined into a higher-dimensional representation. More sophisticated strategies include gating mechanisms, in which a learnable sigmoid gate determines the relative contribution of each source (20), $$m=\sigma \left({W}_{m}\left[{s}_{u}^{(i)}\| {g}_{u}^{(i)}\right]+{b}_{m}\right) {h}_{u}^{(i)}=m\odot {s}_{u}^{(i)}+(1-m)\odot {g}_{u}^{(i)}$$ (20) where \(m\in [\text{0,1}{]}^{d}\) is learned during training and \(\odot\) denotes element-wise multiplication. In practice, gated or attention-based fusion yields superior performance by allowing the model to emphasize sequential patterns when workflows deviate abnormally, and relational features when a user interacts with unusual peers or resources. The output of this phase is a fused embedding vector \({h}_{u}^{(i)}\) that encapsulates both sequential patterns (capturing workflow anomalies) and graph context (capturing relational anomalies). This comprehensive representation is then passed into Anomaly Scoring phase, where it is evaluated for deviation from normal user behavior. F. Anomaly scoring In this anomaly Scoring phase, the unified embeddings produced by the fusion stage are evaluated for anomalousness using anomaly scoring techniques. The objective is to quantify the degree to which a session deviates from typical user behavior and to flag sessions that may represent insider threats. Formally, given a fused session representation \(h_{u}^{\left( i \right)} \in R^{d}\), an anomaly score \(\alpha \left( {h_{u}^{\left( i \right)} } \right)\) is computed. Several approaches can be employed for this purpose. One common method is reconstruction-based scoring, in which an autoencoder is trained on normal sessions to learn a compressed latent representation. For a given session, its embedding is reconstructed as \(\hat{h}_{u}^{\left( i \right)}\), and the reconstruction error serves as the anomaly score (21). $$\alpha \left( {h_{u}^{\left( i \right)} } \right) = \left\| {h_{u}^{\left( i \right)} - \hat{h}_{u}^{\left( i \right)} } \right\|^{2}$$ (21) High error indicates that the session pattern is not well-represented by normal behavior. Alternatively, likelihood-based methods employ probabilistic models such as Gaussian mixture models or variational autoencoders to compute the negative log-likelihood of a session embedding, with lower probability corresponding to greater anomalousness. Another option is one-class classification, where a decision boundary is trained to enclose normal embeddings, and anomalies are identified by their distance from this boundary. To convert continuous anomaly scores into actionable decisions, a detection threshold \(\tau\) is applied. Sessions with \(\alpha \left({h}_{u}^{(i)}\right)>\tau\) are flagged as anomalous and forwarded to the security operations center (SOC). The choice of threshold can be guided by ROC or precision-recall curves, or calibrated to achieve a target false positive rate. The output of this step is therefore both a quantitative anomaly score and a binary classification (normal vs. anomalous), which form the basis for explainability and analyst triage in explainability and SOC Integration phase. Eg: Reconstruction Error (Autoencoder) (22): $$\alpha (H)=\| H-\widehat{H}{\| }^{2}=4.91$$ (22) THRESHOLD \(\tau =1.2\). $$\alpha =4.91\gg \tau \Rightarrow ALERT!$$ When session-level labels \({y}_{u}^{\left(i\right)}\in \{\text{0,1}\}\) are available, the model is trained using binary cross-entropy loss (23): $${\mathcal{L}}_{\text{BCE}}=-\frac{1}{N}\sum_{i=1}^{N}\left[{y}_{u}^{\left(i\right)}\text{log}{a}_{u}^{\left(i\right)}+(1-{y}_{u}^{\left(i\right)})\text{log}(1-{a}_{u}^{\left(i\right)})\right]$$ (23) This loss encourages high anomaly scores for malicious sessions while suppressing false positives on benign activity. To prevent overfitting and encourage generalization, \({l}_{2}\)-regularization is applied to all trainable parameters (24): $${L}_{reg}=\lambda \parallel \Theta {\parallel }_{2}^{2}$$ (24) The final training objective is (25): $${L}_{total}={L}_{BCE}+{L}_{reg}$$ (25) G. Explainability and SOC integration Step 8 introduces an explainability layer that transforms anomaly scores \(\alpha \left({h}_{u}^{(i)}\right)\) into actionable insights for security operations center (SOC) analysts. While anomaly detection models can effectively assign scores to user sessions, raw scores alone are insufficient for operational decision-making, as analysts need to understand which specific actions caused the alert. Therefore, explainability mechanisms are integrated into the framework. Provide explainable insights for SOC analysts to understand why a session was flagged anomalous, reducing alert fatigue and enabling faster triage. For Transformer- or LSTM-based sequence encoders, attention weights are used to highlight the most influential events within a session. If \({a}_{t}\) is the attention weight for event \({x}_{t}\) (26): $$Importance \left({e}_{t}\right)={a}_{t}$$ (26) Example: Unusual login time (weight 0.12), large file copy (weight 0.28), external email (weight 0.35). For example, a late-night login, a large file transfer, or an external email may receive disproportionately high attention scores, indicating their importance in triggering the anomaly. Similarly, feature attribution techniques such as SHAP or Integrated Gradients are applied to quantify the contribution of individual features (e.g., bytes transferred, external domain flag) to the final anomaly score (27). SHAP value \({\phi }_{j}\) : $$\alpha \left( h \right) = \phi_{1} + \phi_{2} + \cdots + \phi_{d} + \phi_{0}$$ (27) On the graph side, methods such as GNNExplainer reveal which edges or resource connections were critical, such as a first-time communication link between a user and an external email domain. The explainability outputs are then structured into SOC alerts shown in Fig. 3. Each alert includes the session identifier, the anomaly score, the decision (normal or anomalous), and a ranked list of contributing events or resources, along with suggested remediation actions. This design ensures that alerts are not black-box signals but instead provide meaningful context that aids triage. By presenting interpretable evidence, the system reduces analyst fatigue, fosters trust in AI-driven detection, and facilitates rapid containment of potential insider threats. Fig. 3 Full size image The explainability layer outputs a structured alert for SOC. Experimentation, result and analysis. Experimental setup The experimental setup for evaluating the proposed Attention-Based Sequence–Graph Fusion Framework for User and Entity Behavior Analytics (UEBA) was designed to ensure computational efficiency, scalability, and experimental reproducibility under enterprise-grade hardware conditions. All experiments were conducted on a high-performance computing server equipped with dual Intel Xeon Platinum 8358 processors (32 cores / 64 threads each, 2.60 GHz base clock, 48 MB cache), providing substantial multi-threaded parallelism for data preprocessing and model training. The system was further accelerated with four NVIDIA A100 PCIe GPUs, each with 80 GB of VRAM, enabling distributed training and parallel graph computations essential for handling large-scale user–resource interaction graphs. The server was provisioned with 512 GB ECC DDR4 3200 MHz memory, ensuring high memory bandwidth and fault-tolerant performance during graph sampling and Transformer batch processing. Additionally, a 960 GB enterprise-grade SATA SSD was utilized for system and model storage, complemented by a 1.92 TB enterprise SATA SSD dedicated to scratch data operations and temporary caching during high-volume I/O tasks. The experimental environment integrated PyTorch Geometric for efficient Graph Neural Network (GNN) processing and HuggingFace Transformers for sequence encoding, ensuring optimized GPU utilization and modular extensibility of both temporal and relational modeling components. Baseline models included the Isolation Forest, Autoencoder (tabular), LSTM-only, and GNN-only architectures, allowing for a comparative performance assessment of the proposed hybrid fusion model. Data from the CERT Insider Threat Dataset was chronologically partitioned to emulate real-world deployment, where models are trained on past behavior and evaluated on future events. The first 60% of the timeline was allocated for training (normal and benign sessions), the next 20% for validation (hyperparameter optimization), and the final 20% for testing (including injected malicious scenarios). User events were sessionized using a 30-min sliding window, grouping temporally contiguous activities such as logon events, file operations, device usage, and email transactions into coherent behavioral sequences. Experimental parameters Performance analysis The performance of the proposed Transformer–Graph Neural Network framework was evaluated using standard classification and anomaly detection metrics. These parameters quantify detection accuracy, error trade-offs, and operational efficiency in Security Operations Center (SOC) settings. The model was tested on 10,000 total sessions (a common benchmark scale) shown in Table 3. Table 3 Evaluation metrics of proposed method. Full size table (i) Accuracy Accuracy measures the proportion of correctly classified sessions (normal + anomalous) over the total number of sessions using (28). $$ACC=\frac{TP+TN}{TP+TN+FP+FN}= 97.9\%$$ (28) TP: True Positives (malicious sessions correctly detected) TN: True Negatives (benign sessions correctly classified) FP: False Positives (benign sessions misclassified as malicious) FN: False Negatives (malicious sessions missed) (ii) Precision Precision quantifies the fraction of detected anomalies that are truly malicious using (29). $$Precision = \frac{TP}{{TP + FP}} = 0.87$$ (29) This indicates that 87% of flagged alerts corresponded to real insider threats. (iii) Recall Recall (or Detection Rate) measures the proportion of malicious sessions correctly detected using (30). $$Recall = \frac{TP}{{TP + FN}} = 0.89$$ (30) This shows that 89% of all insider threat cases were successfully detected. (iv) F1-score The F1-score is the harmonic mean of Precision and Recall, balancing false positives and false negatives using (31). $$F1 = 2 \cdot \frac{ Precision \cdot Recall }{{ Precision + Recall }} = 0.88$$ (31) This result indicates balanced detection capability. v Area under ROC curve The ROC-AUC measures the model’s discrimination ability across varying thresholds using (32). The result indicates excellent separation between normal and anomalous sessions. $$AUC={\int }_{0}^{1} TPR\left(FPR\right)dFPR=0.999$$ (32) where TPR and FPR using (33), $$TPR = \frac{TP}{{TP + FN}}, FPR = \frac{FP}{{FP + TN}}$$ (33) The ROC Curve for the proposed Transformer–GNN model shows an AUC of 0.99 shown in Fig. 4(a), which indicates that the model can reliably separate normal user behavior from insider threat activities. This high discrimination ability directly addresses the difficulty of distinguishing subtle malicious actions embedded within large volumes of normal activity. Fig. 4 Full size image Proposed Transformer–GNN Model Performance: (a) ROC Curve, (b) PR Curve. The Precision–Recall Curve further demonstrates the model’s robustness under class imbalance, achieving an average precision of 0.959 shown in Fig. 4(b). High precision ensures that most flagged alerts are truly malicious, reducing analyst workload, while high recall confirms that the system does not miss a significant proportion of threats. Together, these curves validate that the proposed framework effectively mitigates the dual challenges outlined in the problem statement: low detectability of insider threats and high false positive burden on SOCs. (vi) False positive rate False positives per 1000 sessions are operationally critical for SOC analysts. The FPR calculates using (34). The result of FPR is 11 per 1,000 sessions. This is significantly lower than baseline models. $$FPR = \frac{FP}{{FP + TN}}, FPR per 1000 = FPR \times 1000 = 0.011 \times 1000 = 11$$ (34) (vii) Detection latency Detection latency measures the average time (in hours) from the first malicious action in a session until the session is flagged using (35). $$DL = \frac{1}{{N_{pos } }}\sum\limits_{i = 1}^{{N_{pos } }} {\left( {t_{\det ect }^{\left( i \right)} - t_{attack\_start }^{\left( i \right)} } \right)} = 1.9 hours$$ (35) \(t_{attack\_start