  Insiders usually cause significant losses to organizations and are hard to
detect. Currently, various approaches have been proposed to achieve insider
threat detection based on analyzing the audit data that record information of
the employee's activity type and time. However, the existing approaches usually
focus on modeling the users' activity types but do not consider the activity
time information. In this paper, we propose a hierarchical neural temporal
point process model by combining the temporal point processes and recurrent
neural networks for insider threat detection. Our model is capable of capturing
a general nonlinear dependency over the history of all activities by the
two-level structure that effectively models activity times, activity types,
session durations, and session intervals information. Experimental results on
two datasets demonstrate that our model outperforms the models that only
consider information of the activity types or time alone.
