INSIDER THREAT DETECTION USING MACHINE LEARNING AND BEHAVIORAL ANALYTICS IN ENTERPRISE ENVIRONMENTS

Abstract

Insider threats remain a major cybersecurity challenge in enterprise environments because authorized users can intentionally or unintentionally compromise organizational information assets, often evading traditional security mechanisms. The increasing complexity of insider attacks necessitates intelligent detection approaches capable of identifying abnormal user behavior. This study examined insider threat detection using machine learning and behavioral analytics in enterprise environments. An experimental research design was adopted using the CERT Insider Threat Dataset, comprising enterprise user activity logs such as login records, file access, email communications, device usage, and web activities. Data preprocessing, feature engineering, and behavioral analytics were conducted before implementing six machine learning algorithms: Logistic Regression, Random Forest, XGBoost, Long Short-Term Memory (LSTM), GNN, and Transformer Encoder. Model performance was assessed using precision, recall, F1-score, and ROC-AUC. The results revealed that the Transformer Encoder model achieved the highest detection metric (F1 = 0.959, AUC-ROC = 0.976, FPR = 0.012), followed closely by the GNN hybrid and the LSTM. The findings indicate that integrating machine learning with User and Entity Behavior Analytics (UEBA) enhances early insider threat detection, reduces false positives, and strengthens enterprise environments. The study recommends integrating ML-driven behavioral analytics with SIEM and UEBA platforms, periodically retraining detection models, and implementing continuous cybersecurity awareness training alongside least-privilege access control to improve organizational cyber resilience.