GATE-X: A Graph and Transformer-Based Framework for Proactive Data Exfiltration Detection via User-Entity Behavior Analysis

DOI

10.2991/978-94-6239-768-2_7How to use a DOI?

Keywords

Data exfiltration; UEBA; Graph Neural Networks; Isolation Forest; Transformer; BERT; Anomaly detection; Cybersecurity

Abstract

Due to the modern world’s development, protecting sensitive information from sophisticated threats such as data exfiltration has emerged as a critical concern. This paper presents GATE-X (Graph and Transformer-based Exfiltration Detection), a novel algorithm for the proactive detection of potential data exfiltration attacks through smart analysis of User Entity Behaviour Analysis (UEBA). The approach creates a dynamic bipartite graph where users and devices are linked, and behavioural patterns are described by computing graph features such as degree centrality and clustering coefficients. A Graph Neural Network (GNN) is trained in an unsupervised fashion to reconstruct graph features and identify refined anomalies. The neural network is combined with an Isolation Forest to compute anomaly scores of user-device interactions, and adaptive thresholding techniques improve the precision of distinguishing normal from suspicious interactions. A transformer-based BERT model further classifies labelled anomaly context as malicious or benign. The model was tested on 100 users and 50 devices, producing 1000 synthetic logs and attaining over 91% accuracy. The proposed strategy presents a scalable, intelligent, and effective method for early identification and mitigation of data exfiltration threats.

Copyright

© 2026 The Author(s)

Open Access

Open Access This chapter is licensed under the terms of the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License (http://creativecommons.org/licenses/by-nc-nd/4.0/), which permits any noncommercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if you modified the licensed material. You do not have permission under this license to share adapted material derived from this chapter or parts of it.

Download article (PDF)

TY  - CONF
AU  - L. Lanuwabang
AU  - S. Suprakash
PY  - 2026
DA  - 2026/09/07
TI  - GATE-X: A Graph and Transformer-Based Framework for Proactive Data Exfiltration Detection via User-Entity Behavior Analysis
BT  - Proceedings of the Third International Conference on Recent Advances in Computing Sciences (RACS 2025)
PB  - Atlantis Press
SP  - 56
EP  - 66
SN  - 1951-6851
UR  - https://doi.org/10.2991/978-94-6239-768-2_7
DO  - 10.2991/978-94-6239-768-2_7
ID  - Lanuwabang2026
ER  -