Fan Jia, Yong Wang, Chun Dong, Fuming Cheng, and Longchuan Li
Operation and Maintenance Center, State Grid Digital Technology Holding Co., Ltd., Xiong’an New Area, Hebei Province 071708, P. R. China
Received: July 21, 2026
Accepted: August 18, 2026
Publication Date: October 09, 2026
Scalability and throughput under different edge-node counts
Copyright The Author(s). This is an open access article distributed under the terms of the Creative Commons Attribution License (CC BY 4.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are cited.
Download Citation: BibTeX | http://dx.doi.org/10.6180/jase.202701_36.003
In cloud-edge collaborative environments, intelligent O&M logs are multi-source, heterogeneous, highly concurrent, cross-node correlated, and temporally evolving, challenging traditional centralized auditing for detecting progressive data leakage risks like abnormal logins, unauthorized access, batch exports, and external uploads. We propose BA-CESADL, a behavior-analysis framework for cloud-edge collaborative security auditing and data leakage prevention. Its five-layer architecture (data acquisition, edge analysis, cloud correlation, leakage tracing, response control) unifies login, command, database, API, and network-traffic logs with work-order context: the edge extracts lightweight features and detects local anomalies, uploading behavior summaries to the cloud, where a cross-node correlation graph identifies multi-stage leakage chains (e.g., abnormal login → permission change → sensitive access → batch export → external transmission) and triggers risk-level responses including alarms, secondary authentication, export restrictions, and session blocking. Simulations yield precision 0.936, recall 0.914, F1 0.925, and AUC 0.962, surpassing rule-based audit, Isolation Forest, LSTM-AE, graph-based audit, cloud-only, and edge-only methods, with a complete leakage-chain detection rate of 90.8% (6.4% false positives) and per-stage rates of 95.1%, 94.6%, and 94.3% for sensitive access, abnormal login, and external transmission. As edge nodes scale from 10 to 200, throughput rises from 1,850 to 18,420 log s/s while F1 drops only from 0.929 to 0.921, showing that BA-CESADL balances detection accuracy, chain tracing, and scalability for large-scale intelligent O&M security. These results are simulation-validated; they demonstrate the mechanism’s scalability under controlled, rule-generated conditions and are not yet evidence of full-scale industrial deployment.
Keywords: cloud-edge collaboration, behavior analysis, intelligent operation and maintenance, security auditing, data leakage prevention, scalable information systems, attention heatmap
- [1] P. Ranaweera, A. D. Jurcut, and M. Liyanage, (2021) “Survey on Multi-Access Edge Computing Security and Privacy” IEEE Communications Surveys & Tutorials 23(2): 1078-1124. DOI: https://doi.org/10.1109/COMST.2021.3062546.
- [2] A. Alwarafy, K. A. Al-Thelaya, M. Abdallah, J. Schneider, and M. Hamdi, (2021) “A Survey on Security and Privacy Issues in Edge-Computing-Assisted Internet of Things” IEEE Internet of Things Journal 8(6): 4004-4022. DOI: https://doi.org/10.1109/JIOT.2020.3015432.
- [3] M. Landauer, S. Onder, F. Skopik, and M. Wurzenberger, (2023) “Deep Learning for Anomaly Detection in Log Data: A Survey” Machine Learning with Applications 12: 100470. DOI: https://doi.org/10.1016/j.mlwa.2023.100470.
- [4] B. Bin Sarhan and N. Altwaijry, (2022) “Insider Threat Detection Using Machine Learning Approach” Applied Sciences 13(1): 259. DOI: https://doi.org/10.3390/app13010259.
- [5] P. Manoharan, J. Yin, H. Wang, Y. Zhang, and W. Ye, (2024) “Insider Threat Detection Using Supervised Machine Learning Algorithms” Telecommunication Systems 87(4): 899-915. DOI: https://doi.org/10.1007/s11235-023-01085-3.
- [6] D. C. Le and N. Zincir-Heywood, (2021) “Anomaly Detection for Insider Threats Using Unsupervised Ensembles” IEEE Transactions on Network and Service Management 18(2): 1152-1164. DOI: https://doi.org/10.1109/TNSM.2021.3071928.
- [7] J. Wang, Q. Sun, and C. Zhou, (2023) “Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events” Applied Sciences 13(24): 13021. DOI: https://doi.org/10.3390/app132413021.
- [8] F. Charmet, H. C. Tanuwidjaja, S. Ayoubi, P.-F. Gimenez, Y. Han, H. Jmila, G. Blanc, T. Takahashi, and Z. Zhang, (2022) “Explainable Artificial Intelligence for Cybersecurity: A Literature Survey” Annals of Telecommunications 77(11-12): 789-812. DOI: https://doi.org/10.1007/s12243-022-00926-7.
- [9] Z. Z. Darban, G. I. Webb, S. Pan, C. C. Aggarwal, and M. Salehi, (2024) “Deep Learning for Time Series Anomaly Detection: A Survey” ACM Computing Surveys 57(1): 1-42. DOI: https://doi.org/10.1145/3691338.
- [10] L. Nie, Y. Wu, X. Wang, L. Guo, G. Wang, X. Gao, and S. Li, (2022) “Intrusion Detection for Secure Social Internet of Things Based on Collaborative Edge Computing: A Generative Adversarial Network-Based Approach” IEEE Transactions on Computational Social Systems 9(1): 134-145. DOI: https://doi.org/10.1109/TCSS.2021.3063538.
- [11] N. F. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, and R. Doss, (2022) “Zero Trust Architecture (ZTA): A Comprehensive Survey” IEEE Access 10: 57143-57179. DOI: https://doi.org/10.1109/ACCESS.2022.3174679.
- [12] W. Hong, J. Yin, M. You, H. Wang, J. Cao, J. Li, M. Liu, and C. Man, (2023) “A Graph Empowered Insider Threat Detection Framework Based on Daily Activities” ISA Transactions 141: 84-92. DOI: https://doi.org/10.1016/j.isatra.2023.06.030.
- [13] X. Li, X. Li, J. Jia, L. Li, J. Yuan, and Y. Gao, (2023) “A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection” IEEE Transactions on Information Forensics and Security 18: 1638-1652. DOI: https://doi.org/10.1109/TIFS.2023.3245413.