ROLE-AWARE ANOMALY DETECTION FOR INSIDER THREAT IDENTIFICATION IN HEALTHCARE EHR SYSTEMS

Overall, the results confirm that role-aware anomaly detection provides a practical and effective improvement over role-agnostic approaches for insider threat detection in healthcare EHR systems. The proposed method enhances detection reliability while maintaining a lightweight and scalable implementation, making it suitable for real-world healthcare deployment.

[1] A. Cappelli, A. Moore, and R. Trzeciak, The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes, Addison-Wesley, 2012. [2] M. Bishop, C. Gates, S. Engle, and S. Whalen, “Insider threat detection: A framework,” Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 1, no. 1, pp. 1–14, 2010. [3] C. Liu, J. Wang, and J. Zhao, “Insider threat detection using machine learning: A survey,” IEEE Access, vol. 8, pp. 152914–152939, 2020. [4] Y. Yuan, Y. Li, and Z. Tian, “Deep learning for insider threat detection: A review,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 2102–2118, 2021. [5] A. Tuor, S. Kaplan, B. Hutchinson, N. Nichols, and S. Robinson, “Deep learning for unsupervised insider threat detection in structured cybersecurity data streams,” in Proc. AI for Cybersecurity Workshop, 2017. [6] U.S. Department of Health and Human Services, “Security and privacy of electronic health records,” Health IT Security Guidelines, 2022. [7] S. Alneyadi, E. Sithirasenan, and V. Muthukkumarasamy, “A survey on insider threat detection using machine learning,” IEEE Communications Surveys & Tutorials, vol. 20, no. 1, pp. 317–353, 2018. [8] M. E. Johnson, “Data hemorrhages in the healthcare sector,” in Financial Cryptography and Data Security, Springer, pp. 71–89, 2009. [9] B. Scholkopf et al., “Estimating the support of a high-dimensional distribution,” Neural Computation, vol. 13, no. 7, pp. 1443–1471, 2001. (One-Class SVM reference) [10] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation Forest,” in Proc. IEEE ICDM, pp. 413–422, 2008.