Insider threat detection (ITD) poses a persistent and high-impact challenge in cybersecurity due to the subtle, long-term, and context-dependent nature of malicious insider behaviors. Traditional models often struggle to capture semantic intent and complex behavior dynamics, while existing LLM-based solutions face limitations in prompt adaptability and modality coverage. To bridge this gap, we propose DMFI, a dual-modality framework that integrates semantic inference with behavior-aware fine-tuning. DMFI converts raw logs into two structured views: (1) a semantic view that processes content-rich artifacts (e.g., emails, https) using instruction-formatted prompts; and (2) a behavioral abstraction, constructed via a 4W-guided (When-Where-What-Which) transformation to encode contextual action sequences. Two LoRA-enhanced LLMs are fine-tuned independently, and their outputs are fused via a lightweight MLP-based decision module. We further introduce DMFI-B, a discriminative adaptation strategy that separates normal and abnormal behavior representations, improving robustness under severe class imbalance. Experiments on CERT r4.2 and r5.2 datasets demonstrate that DMFI outperforms state-of-the-art methods in detection accuracy. Our approach combines the semantic reasoning power of LLMs with structured behavior modeling, offering a scalable and effective solution for real-world insider threat detection.

翻译：内部威胁检测（ITD）因恶意内部人员行为的隐蔽性、长期依赖性及情境依赖性，成为网络安全领域持续存在且影响重大的挑战。传统模型难以捕捉语义意图与复杂行为动态，而现有基于大语言模型的方案在提示自适应性与模态覆盖范围方面存在局限。为弥合这一差距，我们提出双模态框架DMFI，该框架将语义推理与行为感知微调相结合。DMFI将原始日志转化为两种结构化视图：（1）语义视图——采用指令格式化提示处理富含内容的工件（如电子邮件、HTTPS）；（2）行为抽象视图——通过4W引导（时间-地点-行为-对象）变换编码上下文动作序列。两个经LoRA增强的语言模型被独立微调，其输出通过轻量级基于多层感知机的决策模块进行融合。我们进一步提出判别式适配策略DMFI-B，可分离正常与异常行为表征，提升严重类别不平衡下的鲁棒性。在CERT r4.2与r5.2数据集上的实验表明，DMFI在检测准确率上优于现有最佳方法。本方法将大语言模型的语义推理能力与结构化行为建模相结合，为实际内部威胁检测提供了可扩展且有效的解决方案。