由于安全事件频发和数据泄露风险增加，内部威胁检测引起了学术界和工业界的广泛关注。现有方法通过分析用户操作日志以识别异常行为，但容易忽略用户间的关系和行为模式随时间的演变，且普遍存在数据不均衡问题，影响了模型的性能。针对这些挑战，该文提出了基于动态自注意力深度神经网络(dynamic self-attention deep neural network)的内部威胁检测模型(DySAT_DNN模型)，该模型采用结构自注意层和时序自注意层，在结构自注意层中，利用注意力机制对单一时间点的相邻信息进行聚合；在时序自注意层中，跨越多个时间点捕获用户行为的动态变化。基于CERT R4.2数据集开展验证实验，证明了该模型在内部威胁检测任务上的性能优于传统分类器模型。为了应对数据不均衡问题，该文探索并找到有效的采样策略以平衡正负样本比例。实验结果显示，与当前基线模型相比，DySAT_DNN模型在召回率和曲线下面积(AUC)等关键指标上表现出色，以此验证了其在内部威胁检测中的有效性和优越性。

Objective: Modern information systems have become an essential part of enterprise operations. However, these systems are often vulnerable to insider attacks, resulting in frequent security incidents and a heightened risk of data breaches. This has sparked significant interest in insider threat detection among researchers and industry professionals. Existing studies mainly focus on analyzing user activity logs but often overlook the evolving relationships and behavioral patterns among users over time. Furthermore, the common issue of data imbalance affects model performance. Methods: To address these challenges, this study proposes an insider threat detection model called the DySAT_DNN model, which leverages a dynamic self-attention deep neural network. First, the model uses the CERT R4.2 user behavior log dataset, comprising user behavior logs and organization information. Second, the multisource data is preprocessed by aggregating it on a weekly level to extract numerical features of user behaviors, supported by three key rules designed to construct graph structures. Dynamic graph feature representation is achieved through structural and temporal self-attention layers within the DySAT model. The structural self-attention layer uses an attention mechanism to aggregate neighbor information at individual time points, while the temporal self-attention layer captures evolving behavioral patterns over multiple time points. Finally, a fully connected neural network is used as a classifier, trained to be able to distinguish between normal and abnormal behaviors based on the learned representations. Results: In this paper, we design four stages to carry out the experimental evaluation: 1) We compare the performance of the DySAT_DNN model with existing classifier models. The detection performance of the DySAT_DNN model in P_macro, R_macro, and F1_macro are 0.81, 0.80, and 0.81, respectively, which are higher than those of other classifier models; 2) Ablation experiments demonstrated the significant impact of the graph construction rules, with P_macro improving from 0.65 to 0.81 and R_macro from 0.67 to 0.80 when all rules were combined, underscoring their importance in enhancing detection performance. Furthermore, the model demonstrated its efficiency and generalizability across datasets, with a computational cost of 235.96 min and P_macro of 0.89 on the CERT R5.2 validation set; 3) To address the data imbalance issue, an effective sampling strategy was developed to balance the proportion of positive and negative samples; 4) When compared to baseline models, DySAT_DNN achieved a superior AUC of 99.7%, confirming its ability to surpass existing methods. Conclusions: To tackle the two shortcomings of current insider threat detection research, namely the lack of attention to dynamic user relationships and behavioral patterns, as well as issues of data imbalance, this study proposes an insider threat detection model (DySAT_DNN). Built on a self-attention mechanism, the model dynamically aggregates information from neighboring nodes and captures changes in user behavior over time. The model proposed in this study achieves high detection accuracy, effectively identifying a bnormal user activities and enhancing the security of enterprise information systems.