This paper proposes Robust Multi-sphere Learning (RMSL), a novel framework for internal threat detection. Existing internal threat detection methods struggle to detect specific behavioral anomalies due to a lack of granular behavioral annotations. Unsupervised learning methods suffer from high false positive and miss rates due to the ambiguity between normal and anomalous behaviors. RMSL uses sequence-level weak labels instead of behavioral ones, learning discriminative features from inexpensive annotations to improve behavioral anomaly detection performance. It uses multiple hyperspheres to represent normal behavioral patterns and, based on a one-class classifier, improves the hypersphere and feature representations through multi-instance learning and adaptive behavioral-level self-learning. Experimental results demonstrate that RMSL significantly improves behavioral-level internal threat detection performance.
