Robust Anomaly-Based Insider Threat Detection Using Graph Neural Network

In recent years, data security incidents caused by insider threats in distributed file systems have attracted the attention of academia and industry. The most common way to detect insider threats is based on user profiles. Through analysis, we realize that based on existing user profiles are not efficient enough, and there are many false positives when a stable user profile has not yet been formed. In this work, we propose personalized user profiles and design an insider threat detection framework, which can intelligently detect insider threats for securing distributed file systems in real-time. To generate personalized user profiles, we come up with a time window-based clustering algorithm and a weighted kernel density estimation algorithm. Compared with non-personalized user profiles, both the Recall and Precision of insider threat detection based on personalized user profiles have been improved, resulting in their harmonic mean F1 increased to 96.52%. Meanwhile, to reduce the false positives of insider threat detection, we put forward operation recommendations based on user similarity to predict new operations that users will produce in the future, which can reduce the false positive rate (FPR). The FPR is reduced to 1.54% and the false positive identification rate (FPIR) is as high as 92.62%. Furthermore, to mitigate the risks caused by inaccurate authorization for users, we present user tags based on operation content and permission. The experimental results show that our proposed framework can detect insider threats more effectively and precisely, with lower FPR and high FPIR.

A new intelligent multilayer framework for insider threat detection

Insider threats pose significant risks to enterprise systems, with malicious or negligent actions by authorized users leading to data breaches and financial losses. Traditional detection methods, such as rule-based systems and anomaly detection, struggle to capture the complex relationships and dynamic behaviors in enterprise networks. This research explores Graph Neural Networks (GNNs) to model enterprise systems as graphs, leveraging their ability to capture structural and relational patterns for enhanced insider threat detection. Using the CERT Insider Threat Dataset (r6.2), a comprehensive dataset simulating enterprise activities, this research develops a GNN-based framework to identify anomalous behaviors. The proposed model achieves superior performance compared to traditional machine learning approaches, with an accuracy of 96.8%, precision of 0.94, and recall of 0.93. Visualizations, including bar graphs and confusion matrices, illustrate the model’s effectiveness. This research contributes to enterprise security by providing a scalable, interpretable, and efficient solution for insider threat detection, with implications for real-time monitoring and forensic analysis.

The concealment and confusion nature of insider threat makes it a challenging task for security analysts to identify insider threat from log data. To detect insider threat, we propose a novel gated recurrent unit (GRU) and multi-autoencoder based insider threat detection method, which is an unsupervised anomaly detection method. It takes advantage of the extremely unbalanced characteristic of insider threat data and constructs a normal behavior autoencoder with low reconfiguration error through multi-level filter behavior learning, and identifies the behavior data with high reconfiguration error as abnormal behavior. In order to achieve the high efficiency of calculation and detection, GRU and multi-head attention are introduced into the autoencoder. Use dataset v6.2 of the CERT insider threat as validation data and threat detection recall as evaluation metric. The experimental results show that the effect of the proposed method is obviously better than that of Isolation Forest, LSTM autoencoder and multi-channel autoencoders based insider threat detection methods, and it's an effective insider threat detection technology.

Insider threat represents a major cybersecurity challenge to companies, organizations, and government agencies. Insider threat detection involves many challenges, including unbalanced data, limited ground truth, and possible user behavior changes. This research presents an unsupervised learning based anomaly detection approach for insider threat detection. We employ four unsupervised learning methods with different working principles, and explore various representations of data with temporal information. Furthermore, different computational intelligence schemes are explored to combine these models to create anomaly detection ensembles for improving the detection performance. Evaluation results show that the approach allows learning from unlabelled data under challenging conditions for insider threat detection. Insider threats are detected with high detection and low false positive rates. For example, 60% of malicious insiders are detected under 0.1% investigation budget, and all malicious insiders are detected at less than 5% investigation budget. Furthermore, we explore the ability of the proposed approach to generalize for detecting new anomalous behaviors in different datasets, i.e., robustness. Finally, results demonstrate that a voting-based ensemble of anomaly detection can be used to improve detection performance as well as the robustness. Comparisons with the state-of-the-art confirm the effectiveness of the proposed approach.

An efficient pattern-based approach for insider threat classification using the image-based feature representation

Organizations’ own personnel now have a greater ability than ever before to misuse their access to critical organizational assets. Insider threat detection is a key component in identifying rare anomalies in context, which is a growing concern for many organizations. Existing perimeter security mechanisms are proving to be ineffective against insider threats. As a prospective filter for the human analysts, a new deep learning based insider threat detection method that uses the Dempster-Shafer theory is proposed to handle both accidental as well as intentional insider threats via organization’s channels of communication in real time. The long short-term memory (LSTM) architecture together with multi-head attention mechanism is applied in this work to detect anomalous network behavior patterns. Furthermore, belief is updated with Dempster’s conditional rule and utilized to fuse evidence to achieve enhanced prediction. The CERT Insider Threat Dataset v6.2 is used to train the behavior model. Through performance evaluation, our proposed method is proven to be effective as an insider threat detection technique.

The rapid expansion of cyber-physical systems (CPSs) has introduced new security challenges, leading to the emergence of various threats, attacks, and controls aimed at addressing security concerns in this evolving CPS landscape. However, a noticeable gap exists in the literature, particularly in the field of insider threat detection, which lacks a systematic review of CPS security. This study aims to comprehensively review and analyse relevant studies on insider threat detection in CPS. Employing a systematic protocol, we conducted an extensive search for pertinent articles across five prominent online databases: IEEE Xplore, Web of Science, Scopus, ACM, and ScienceDirect. The selection of these indices was based on their comprehensive coverage and the distinct relevance of their contents to our research topic. The results, guided by defined inclusion and exclusion criteria, yielded a final set of 69 included articles. Notably, 39.1 % of these articles focused on insider threat detection using specification-based methods, while 27.5 % addressed cryptography methods. Machine learning methods constituted 13.04 %, and the remaining 14.5 % included review and survey studies. Insider threats pose significant challenges in global cybersecurity, necessitating effective detection systems, methods, and tools for accurate and rapid identification. This study contributes distinct observations on the insider threat detection research topic in CPS, providing valuable insights for researchers and practitioners to expedite improvements and draw significant guidelines based on this comprehensive systematic review.

Insider threats are a continuous and dynamic issue in the field of organizational security that may take various forms, such as an abuse of authorized access to critical information systems and physical infrastructure. The traditional methods of isolating system log analysis, behavioural monitoring, or physical access control often do not have the ability to identify multi-layered and subtle patterns of threats. Multimodal data integration predictive analytics is a holistic approach since it integrates heterogeneous data volumes into coherent threat models that are able to pre-empt any possible threats before they escalate. The paper discusses the effectiveness of predictive analytics in insider threat detection through analysis of the connection between log records, behavioural indicators and physical security data. Instead, the focus is made on designing integrative frameworks, using advanced machine learning algorithms, and the applied implications on operational resilience. Issues like scalability, transparency of algorithms, and even ethical considerations are also critical issues that are considered to provide a sound deployment in the modern security environment. The paper highlights the need to embrace multimodal predictive approaches as a tactical defence mechanism and developing theoretical arguments and practical interventions in cybersecurity risk management.

: Malicious insiders pose serious threat to organizations, institutions, and governments’ critical infrastructure because of their access to confidential data, systems, and resources. This threat, often referred to as the insider threat, is most of the time regarded as a human factor problemoften driven by motivation, opportunity, and capability. As long as the insider problem is treated as a technology problem, the natural recourse for detection and mitigation is to the use of technical and procedural controls. Such an approach is not advisable when confronting strategic human adversaries, since it may fail to account for the dynamic nature of the conflict between the contending parties who happen to be self-interested and intelligent agents. Game theory, with its rich analytical and modelling techniques, offers mathematical tools and procedures that capture the dynamic interplay between the security apparatus of an organization and the malicious insider. This paper presents a literature review of previous works on insider threat detection and mitigation using game theoretic principles

The insider threat has consistently been identified as a key threat to organizations and governments. Understanding the nature of insider threats and the related threat landscape can help in forming mitigation strategies, including non-technical means. In this paper, we survey and highlight challenges associated with the identification and detection of insider threats in both public and private sector organizations, especially those part of a nation’s critical infrastructure. We explore the utility of the cyber kill chain to understand insider threats, as well as understanding the underpinning human behavior and psychological factors. The existing defense techniques are discussed and critically analyzed, and improvements are suggested, in line with the current state-of-the-art cyber security requirements. Finally, open problems related to the insider threat are identified and future research directions are discussed.

This paper comprehensively examines the multifaceted motivations behind insider threats within organizations, elucidating driving forces such as financial gain, revenge, personal aspirations, ideological beliefs, coercion, and negligence. Understanding this spectrum is fundamental for crafting effective Counterintelligence strategies. The study delves into behavioral indicators crucial for identifying potential threats, emphasizing the significance of recognizing warning signs like unusual data access, unsanctioned software usage, escalated privilege requests, poor performance, disagreement with policies, and more. Furthermore, the role of Human Intelligence (HUMINT) in Counterintelligence (CI) and insider threat detection is explored, highlighting its qualitative contribution to understanding human behavior. Plus, through a hypothetical case study in the Shipping industry, the paper illustrates the direct application of HUMINT principles in fortifying security against insider threats, considering the unique challenges of this dynamic sector. The case study strategically employs employee interviews, psychological assessments, social network analysis, and trust-building initiatives to proactively identify and mitigate potential threats, in an industry reliant on seamless global supply chain operations.

The rapid evolution of insider threats presents a significant challenge for cybersecurity systems, necessitating the development of advanced detection models capable of adapting to dynamic and sophisticated attack patterns. This chapter explores the integration of Hybrid Artificial Intelligence (AI) architectures combining Machine Learning (ML) and Deep Learning (DL) with emerging techniques such as Reinforcement Learning (RL) to enhance insider threat detection. The combination of ML and DL methodologies offers distinct advantages in handling large, complex datasets, while RL introduces the capability for real-time adaptation to evolving threat behaviors. By leveraging hybrid models, organizations can better detect subtle insider threats that traditional systems often fail to identify, improving accuracy and response times. Despite the promise, challenges such as model interpretability, data privacy, and the exploration-exploitation trade-off in RL systems must be addressed. The chapter discusses these hurdles and provides insights into how hybrid architectures can be optimized to overcome them, with a focus on scalability, security, and the ability to continuously learn from new data. Through a comprehensive review of the current research and methodologies, this chapter aims to highlight the potential of hybrid AI models in revolutionizing the way insider threats are detected and mitigated in real-time, offering a path toward more resilient and adaptive cybersecurity systems.

Insider threat is one of the most stimulating security threats in an organization that possesses sensitive information. In an organization, detecting malicious insider threats is more challenging due to the behavioral changes of malicious insider. To avoid the sensitive information leakage that causes enormous loss, detecting the malicious insider within an organization is necessary. The principal focus of this paper is to find the user’s unauthorized activity by analyzing their behavior on website i.e., websearch analysis. To find the user’s unauthorized activity by analyzing each user’s behaviour, such as the website activity of each individual. The user is classified as a genuine user or malicious userbased on user’s websearch behavior. This paper proposes an insider threat detection framework to analyze and detect the malicious insider threat within an organization using user’s statistical behavior analysis.

Insider threat represents a major cybersecurity challenge to companies and government agencies. The challenges in insider threat detection include unbalanced data, limited ground truth, and possible user behaviour changes. This research presents an unsupervised machine learning (ML) based anomaly detection approach for insider threat detection. We employ two ML methods with different working principles, specifically auto-encoder and isolation forest, and explore various representations of data with temporal information. Evaluation results show that the approach allows learning from unlabelled data under adversarial conditions for insider threat detection with a high detection and a low false positive rate. For example, 60% of malicious insiders are detected under 0.1% investigation budget. Furthermore, we explore the ability of the proposed approach to generalize for detecting unseen anomalous behaviours in different datasets, i.e. robustness. Comparisons with other work in the literature confirm the effectiveness of the proposed approach.