  Previous works on the CERT insider threat detection case have neglected graph
and text features despite their relevance to describe user behavior.
Additionally, existing systems heavily rely on feature engineering and audit
data aggregation to detect malicious activities. This is time consuming,
requires expert knowledge and prevents tracing back alerts to precise user
actions. To address these issues we introduce ADSAGE to detect anomalies in
audit log events modeled as graph edges. Our general method is the first to
perform anomaly detection at edge level while supporting both edge sequences
and attributes, which can be numeric, categorical or even text. We describe how
ADSAGE can be used for fine-grained, event level insider threat detection in
different audit logs from the CERT use case. Remarking that there is no
standard benchmark for the CERT problem, we use a previously proposed
evaluation setting based on realistic recall-based metrics. We evaluate ADSAGE
on authentication, email traffic and web browsing logs from the CERT insider
threat datasets, as well as on real-world authentication events. ADSAGE is
effective to detect anomalies in authentications, modeled as user to computer
interactions, and in email communications. Simple baselines give surprisingly
strong results as well. We also report performance split by malicious scenarios
present in the CERT datasets: interestingly, several detectors are
complementary and could be combined to improve detection. Overall, our results
show that graph features are informative to characterize malicious insider
activities, and that detection at fine-grained level is possible.
