This work presents a consensus-based Bayesian framework to detect malicious user behavior in enterprise directory access graphs. By modeling directories as topics and users as agents within a multi-level interaction graph, we simulate access evolution using influence-weighted opinion dynamics. Logical dependencies between users are encoded in dynamic matrices Ci, and directory similarity is captured via a shared influence matrix W. Malicious behavior is injected as cross-component logical perturbations that violate structural norms of strongly connected components(SCCs). We apply theoretical guarantees from opinion dynamics literature to determine topic convergence and detect anomaly via scaled opinion variance. To quantify uncertainty, we introduce a Bayesian anomaly scoring mechanism that evolves over time, using both static and online priors. Simulations over synthetic access graphs validate our method, demonstrating its sensitivity to logical inconsistencies and robustness under dynamic perturbation.

翻译：本研究提出一种基于共识的贝叶斯框架，用于检测企业目录访问图中的恶意用户行为。通过将目录建模为话题、用户建模为多层交互图中的智能体，我们采用影响力加权的观点动力学模拟访问演化过程。用户间的逻辑依赖关系通过动态矩阵Ci进行编码，目录相似性则通过共享影响力矩阵W进行捕捉。恶意行为被注入为跨组件的逻辑扰动，这些扰动违反了强连通分量（SCCs）的结构规范。我们应用观点动力学文献中的理论保证来确定话题收敛性，并通过缩放观点方差检测异常。为量化不确定性，我们引入了一种随时间演化的贝叶斯异常评分机制，该机制同时采用静态先验与在线先验。在合成访问图上的仿真验证了本方法的有效性，证明了其对逻辑不一致性的敏感性以及在动态扰动下的鲁棒性。