Insider Threat Detection and Response System

This research introduced the Insider Threat Detection and Response System (ITDRS), a novel architecture engineered to ensure persistent operational capability and high-fidelity threat classification in environments plagued by intermittent network connectivity. By coupling a high-resolution, kernel-level Endpoint Telemetry Acquisition Engine (ETAE) with a cryptographically secured local log persistence module (SLPM) and a deep learning-based Sequential Intent Classifier (SIC), ITDRS addresses the principal limitations of traditional EDR and UBA systems. The experimental evaluation confirms that ITDRS achieves superior detection metrics (F1-score of 96.90%) and, most importantly, reduces the Time-to-Detect (TTD) to less than one minute, enabling immediate, localized containment that effectively neutralizes the primary operational risk posed by offline insider activity.

[1]     Homoliak, I., Toffalini, F., Guarnizo, J. D., Elovici, Y., and Ochoa, M., “Insight into Insiders and IT: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures,” ACM Computing Surveys (CSUR), vol. 52, no. 2, pp. 1–40, 2019. [2]     Khan, R. A., Foley, S., and O’Sullivan, D., “Database Intrusion Detection Systems: Behavioural-based Approaches,” IEEE Access, vol.  9,      pp.   36410–36425,       2021.  [3]    Eberle, W., and Holder, L., “Graph-based Anomaly Detection of Insider Threats,” IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 206–208, 2009.