Cross-domain data flows are commonplace in regulated inter-organizational environments, where durable audit evidence must be retained without publicly exposing sensitive flow metadata. This paper presents a privacy-preserving on-chain attestation framework for recorded cross-domain data transfers in a permissioned setting. Its core data structure, termed GBFPlus, extends the Garbled Bloom Filter (GBF) with explicit occupancy indicators, constrained payloads that encode a consistency prefix and an adjacent-domain identifier, and distinct pairing-derived positions. Each domain administrator records observed inbound and outbound transfers in directional GBFPlus instances and periodically commits signed filter attestations to an append-only ledger. An authorized regulator can reconstruct candidate transfer edges from available bilateral attestations, while light clients verify ledger inclusion through Merkle proofs. A traceable anonymous attestation signature conceals the uploader’s cryptographic identity from ordinary ledger observers while retaining regulator-assisted accountability. The security analysis establishes integrity, conditional anonymity, traceability, and metadata-privacy properties for committed attestations under the stated trust assumptions, and the prototype evaluation reports the measured costs of GBFPlus and the signature operations.
Sihang Qin, Yang Zhou, Weiqi Dai et al.· Entropy· 0 citations
Insider threats have become a critical cybersecurity risk for enterprises and institutions due to their covert nature, authorized access privileges, and deceptive behavior. Traditional rule‐based or statistical anomaly detection methods struggle with the dynamic complexity of insider activities. Deep learning methods offer superior feature extraction but often suffer from imbalanced data and coarse‐grained detection granularity. Meanwhile, large language models (LLMs) present new possibilities for insider threat detection but face challenges such as high detection latency and limited multidimensional analysis capabilities. To address these issues, we propose MARS‐ITD (Multi‐Agent Real‐time System for Insider Threat Detection), which consists of a detection framework and an investigation framework. The detection framework performs preliminary screening of anomalous logs through parallelized multi‐agent processing, while the investigation framework reconstructs the complete threat scenario by collaboratively correlating multiple types of logs, thereby reducing the false positive rate. We evaluated MARS‐ITD on the widely used CERT r4.2 insider threat dataset at the user‐session granularity. Compared with state‐of‐the‐art graph neural network baselines and the recent LLM fine‐tuning method ITDLM, MARS‐ITD achieves the highest recall of 94.44% while maintaining an accuracy of 95.42% and an FPR of 4.58%, which is substantially lower than GNN baselines (8.25%–14.88%). This demonstrates that its detection‐investigation pipeline can effectively prioritize the discovery of coordinated insider threats while suppressing isolated false positives. Ablation studies further highlight the investigation framework's effectiveness in reducing false positives while improving recall. Overall, this work not only improves real‐time detection performance and interpretability but also provides a scalable, collaborative architecture for LLM‐based security analysis systems.
Kai Cheng, Dongkun Li, Weidong Tang et al.· Security and Privacy· 0 citations