This work presents a consensus-based Bayesian framework to detect malicious user behavior in enterprise directory access graphs. By modeling directories as topics and users as agents within a multi-level interaction graph, we simulate access evolution using influence-weighted opinion dynamics. Logical dependencies between users are encoded in dynamic matrices Ci, and directory similarity is captured via a shared influence matrix W. Malicious behavior is injected as cross-component logical perturbations that violate structural norms of strongly connected components(SCCs). We apply theoretical guarantees from opinion dynamics literature to determine topic convergence and detect anomaly via scaled opinion variance. To quantify uncertainty, we introduce a Bayesian anomaly scoring mechanism that evolves over time, using both static and online priors. Simulations over synthetic access graphs validate our method, demonstrating its sensitivity to logical inconsistencies and robustness under dynamic perturbation.

翻译：本研究提出一种基于共识的贝叶斯框架，用于检测企业目录访问图中的恶意用户行为。通过将目录建模为主题、将用户建模为多层交互图中的智能体，我们采用影响力加权的观点动力学模拟访问演化过程。用户间的逻辑依赖关系被编码于动态矩阵Ci中，目录相似性则通过共享影响力矩阵W进行捕捉。恶意行为被注入为跨组件的逻辑扰动，这些扰动违反了强连通分量（SCCs）的结构规范。我们运用观点动力学文献中的理论保证来确定主题收敛性，并通过缩放观点方差检测异常。为量化不确定性，我们引入了一种随时间演化的贝叶斯异常评分机制，该机制同时使用静态先验与在线先验。在合成访问图上的仿真验证了本方法的有效性，结果表明其对逻辑不一致性具有敏感性，且在动态扰动下保持鲁棒性。