Insider Threat Detection Using Machine Learning

This project has presented a machine learning-based framework for insider threat detection that analyses user activity logs to distinguish normal behaviour from potentially malicious activity. By combining structured data preprocessing, behavioural feature engineering, and classical supervised classifiers such as Random Forest, Logistic Regression, and Decision Tree, the system is able to identify deviations from established behavioural norms with a level of adaptability that static, rule-based monitoring cannot easily match.   The accompanying web-based dashboard makes the system practically usable, allowing an administrator to upload activity data, review classification results, and export flagged records for further investigation, all without requiring specialized technical expertise. In doing so, the proposed approach reduces reliance on manual monitoring, supports more timely identification of suspicious activity, and offers organizations a proactive tool for strengthening internal security.   At the same time, the system's reliance on a single, Kaggle-sourced dataset means that its behaviour on real-world organizational logs, which may differ considerably in scale, diversity, and labelling quality, has not yet been established, and its use of classical machine learning models, while interpretable, may ultimately be limited in capturing more subtle or evolving behavioural patterns than deep learning-based alternatives could. Addressing these limitations, along with the extensions outlined in the future scope, represents a natural next step for continued development of the system.

[1]   R. V, "Insider Threat Detection Using AI-Based Behaviour Analytics," International Journal of Innovative Research in Technology (IJIRT), 2025. [2]   J. Muzaffar and N. Mazher, "AI-Powered Behavioral Analysis for Insider Threat Detection in Enterprise Networks," BJMR Journal, 2023. [3] A. Falana, "AI-Driven Anomaly Detection for Financial Fraud: A Hybrid Approach Using Graph Neural Networks and Time-Series Analysis," JOSTER Journal, 2024. [4]   S. A. Qawasmeh and A. A. S. AlQahtani, "Beyond Firewall: Leveraging Machine Learning for Real-Time Insider Threat Identification and User Profiling," Future Internet, vol. 17, no. 2, 2025. [5]   X. Ye et al., "Research on Insider Threat Detection Based on Personalized Federated Learning and Behavior Log Analysis," Scientific Reports, vol. 15, 2025. [6] S. S. P. Pennada, S. K. Nayak, and V. K. M., "Insider Threat Detection Using Behavioural Analysis through Machine Learning and Deep Learning Techniques," International Research Journal of Multidisciplinary Technovation, vol. 7, no. 2, 2025. [7] R. Yumlembam et al., "Insider Threat Detection Using GCN and Bi-LSTM with Graph-Based Behavioral Modeling," arXiv preprint, 2025. [8] A. Uzaki, "Insider Threat Dataset for Corporate Environments,"  Kaggle, 2023.    [Online]. Available: https://www.kaggle.com/datasets/ahmeduzaki/ insider-threat-dataset-for-corporate-environments [9] M. Bishop and C. Gates, "Defining the Insider Threat," Proceedings of the 4th Annual Workshop on Cyber Security and Information Intelligence Research, Oak Ridge, TN, USA, 2008. [10]   E. M. Hutchins, M. J. Cloppert, and R. M. Amin, "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains," Leading Issues in Information Warfare & Security Research, vol. 1, no. 1, pp. 80–106, 2011.