Fig. 1

Insider threat detection schemes that attempt to include user behavior time elements. a Illustrates the schemes that focus only on absolute time information (taking Ye et al. work (Ye et al. 2020) as an example); b illustrates another type of schemes that focus only on absolute time information (taking Tuor et al.’s work (Tuor et al. 2017) as an example); c illustrates the general pattern of schemes that focus only on relative time information; d illustrates our scheme, where G refers to the time granularity, b refers to the starting bias, t is the index of the time period, and the \(<G,b>\) pair represents the construction scheme of the behavioral feature sequence