A systematic review on insider threat detection using natural language processing

May combine two claims.

Trade-offs of hybrids involve increased complexity, raising computational demands and reducing explainability compared to traditional ML.

“Trade-offs involve increased complexity, raising computational demands and reducing explainability compared to traditional ML [28,39].”

• cites [28] Nasir, R., Afzal, M., Latif, R., Iqbal, W.: Behavioural-based insider threat detection using deep learning. IEEE Access. 9, 143266–143274 (2021) sourceDisputed

  The Comparative Study of Existing Techniques says some existing models are complex and processing- or memory-intensive, but describes this paper’s hybrid approach as having low processing and memory requirements. The Introduction likewise calls the proposed technique simple and not processing- or memory-intensive. The paper does not establish the claimed reduction in explainability relative to traditional ML. (LLM, conf=0.84)

  Checked by a reasoning model — may be wrong.

  Experimental — accuracy not yet measured
• cites [39] Saganowski, S.: A three-stage machine learning network security solution for public entities. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1097–1104. IEEE, (2020) sourceNot checked — no full text of the source

May combine two claims.

Hybrid pipelines combining NLP and DL offer a promising avenue for real-time log analysis, addressing static nature of datasets like CERT (17-month window) and delay in models like LSTM-RNN (93.85% accuracy).

“Hybrid pipelines combining NLP and DL offer a promising avenue for real-time log analysis, addressing the static nature of datasets like CERT (17-month window [7]) and the delay in models like LSTM-RNN (93.85% accuracy [21]).”

• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourceDisputed

  The citation [7] is attached to the CERT dataset’s claimed 17-month window, not the LSTM-RNN result. The paper’s “A. CERT insider threat dataset” section says that 18 months of data were extracted, contrary to the cited figure. The sentence’s proposal for a hybrid pipeline is not directly attributed to this source. (LLM, conf=0.89)

  Checked by a reasoning model — may be wrong.

  Experimental — accuracy not yet measured
• cites [21] Yilmaz, E., Can, O.: Unveiling shadows: Harnessing artificial intelligence for insider threat detection. Eng. Technol. Appl. Sci. Res. 14(2), 13341–13346 (2024) sourcePartly supported

  The paper’s comparative table (section D; page not provided) includes CERT datasets and identifies a high threat-detection delay for a graph-based approach. It does not give a 17-month CERT window or 93.85% LSTM-RNN accuracy, and it does not attribute that delay to an LSTM-RNN model. Its discussion of NLP and deep learning does not establish the proposed hybrid pipeline for real-time log analysis. (LLM, conf=0.82)

  Experimental — accuracy not yet measured

May combine two claims.

NLP can identify changes to communication norms, which is useful in identifying suspicious activities that require further scrutiny.

“Moreover, NLP can identify changes to communication norms, which is useful in identifying suspicious activities that require further scrutiny [19].”

• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourcePartly supported

  Section 4.1.3 (page not available) describes NLP being used to identify and monitor hate speech and to extract crime-related information from text. It does not say that NLP detects changes to communication norms or that such changes flag suspicious activity for further scrutiny. (LLM, conf=0.79)

  Experimental — accuracy not yet measured

May combine two claims.

CNNs are applied for spatial pattern recognition in text, such as in Multistate LSTM + CNN hybrids, yielding an 85% attack detection rate and 4% False Alarm Rate on training data with AUC of 0.9042.

“CNNs are applied for spatial pattern recognition in text, such as in Multistate LSTM + CNN hybrids, yielding an 85% attack detection rate and 4% False Alarm Rate (FAR) on training data with AUC of 0.9042 [24].”

• cites [24] Coyac-Torres, J.E., Sidorov, G., Aguirre-Anaya, E., Hernández-Oregón, G.: Cyberattack detection in social network messages based on convolutional neural networks and NLP techniques. Mach. Learn. Knowl. Extr. 5(3), 1132–1148 (2023) sourcePartly supported

  Section 3.4 describes a CNN that treats text as a matrix of words, supporting the general point about applying CNNs to text. The paper describes a CNN architecture, not a Multistate LSTM–CNN hybrid. Its Results (Section 5.1) report 0.91 detection accuracy on test data; the cited 85% detection rate, 4% false-alarm rate, and 0.9042 AUC on training data are not supported by the passages found. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

May combine two claims.

Challenges include high computational costs, as DL models require significant resources for training on large datasets like Los Alamos cybersecurity events, limiting real-time deployment.

“Challenges include high computational costs, as DL models require significant resources for training on large datasets like Los Alamos cybersecurity events [23,29], limiting real-time deployment [24,31].”

• cites [23] Wang, Z.Q., El Saddik, A.: DTITD: An intelligent insider threat detection framework based on digital twin and self-attention-based deep learning models. IEEE Access. (2023) sourcePartly supported

  The “Inefficient Modeling Method” section says existing models can be computationally expensive and time-consuming to train, preventing online training and accurate real-time detection. But the paper’s “B. DATASET” section describes experiments on CERT datasets, not Los Alamos cybersecurity events; it does not support that specific example. (LLM, conf=0.87)

  Experimental — accuracy not yet measured
• cites [29] Le, D.C., Zincir-Heywood, N., Heywood, M.I.: Analyzing data granularity levels for insider threat detection using machine learning. IEEE Trans. Netw. Serv. Manage. 17(1), 30–44 (2020) sourceNot checked — no full text of the source
• cites [24] Coyac-Torres, J.E., Sidorov, G., Aguirre-Anaya, E., Hernández-Oregón, G.: Cyberattack detection in social network messages based on convolutional neural networks and NLP techniques. Mach. Learn. Knowl. Extr. 5(3), 1132–1148 (2023) sourceCould not verify

  Section 4.1 (Dataset; page unavailable) describes training a CNN on 39,670 social-media and other messages, not Los Alamos cybersecurity events. Searches for Los Alamos, computational costs, training resources, and real-time deployment found no passage in our copy supporting the attributed challenge. (LLM, conf=0.76)

  Experimental — accuracy not yet measured
• cites [31] Liu, L., Chen, C., Zhang, J., De Vel, O., Xiang, Y.: Insider threat identification using the simultaneous neural learning of multi-source logs. IEEE Access. 7, 183162183176 (2019) sourcePartly supported

  The Related Work section says computational cost can be extremely high for machine/deep-learning approaches using many features on large datasets, and the Comparative Study reports that a deep autoencoder took about an hour to train. But the paper uses the CMU insider-threat dataset, not Los Alamos cybersecurity events. The cited passages also do not establish a limitation on real-time deployment. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

May combine two claims.

Traditional models often struggle with class imbalance in datasets like CERT, resulting in high false positive rates (e.g., up to 20% in some Doc2vec applications) and requiring extensive manual feature engineering.

“often struggle with class imbalance in datasets like CERT, resulting in high FPR (e.g., up to 20% in some Doc2vec applications [18]) and requiring extensive manual feature engineering [10].”

• cites [18] Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., Ochoa, M.: Insight into insiders and it: A survey of insider threat taxonomies, analysis, modelling, and countermeasures. ACM Comput. Surv. (CSUR). 52(2), 1–40 (2019) sourcePartly supported

  The citation to this paper is attached to the claim about manual feature engineering, not the Doc2vec false-positive rate cited to [18]. Section G.2 describes approaches using selected features, including one with over 200 features, but the paper does not establish that traditional models generally require extensive manual feature engineering. No page number was available in our copy. (LLM, conf=0.76)

  Experimental — accuracy not yet measured
• cites [10] Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. (2017)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Performance on insider logs and emails is strong, with high recall (e.g., 96% in UMD Wikipedia dataset using Contrastive Learning) but varies by data source, with temporal corpora yielding 84% TPR.

“Performance on insider logs and emails is strong, with high recall (e.g., 96% in UMD Wikipedia dataset using Contrastive Learning [16]) but varies by data source-temporal corpora yield 84% TPR [18].”

• cites [16] Michael, A.: A Machine Learning Approach to Detect Insider Threats in Emails Caused by Human Behaviour (Master’s thesis, University of Pretoria (South Africa)). (2020)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [18] Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., Ochoa, M.: Insight into insiders and it: A survey of insider threat taxonomies, analysis, modelling, and countermeasures. ACM Comput. Surv. (CSUR). 52(2), 1–40 (2019) sourceCould not verify

  The [18] citation is attached to the claim that temporal corpora yield 84% TPR. The passages in §5.2 (Datasets) and §G.2 (Operational Works) discuss datasets and detection methods, but none reports that result. Searches for “84%,” “true positive rate,” and temporal corpora found no supporting passage in our copy. (LLM, conf=0.74)

  Experimental — accuracy not yet measured

May combine two claims.

High false positive rates in some hybrids (e.g., 9% in LSTM-Autoencoder) require careful tuning, and ensemble overhead may hinder scalability in real-time scenarios.

“High FPR in some hybrids (e.g., 9% in LSTM-Autoencoder [13]) requires careful tuning, and ensemble overhead may hinder scalability in real-time scenarios [24,31].”

• cites [13] Liang, N., Biros, D.P., Luse, A.: An empirical validation of malicious insider characteristics. J. Manage. Inform. Syst. 33(2), 361–392 (2016) sourceNot checked — no full text of the source
• cites [24] Coyac-Torres, J.E., Sidorov, G., Aguirre-Anaya, E., Hernández-Oregón, G.: Cyberattack detection in social network messages based on convolutional neural networks and NLP techniques. Mach. Learn. Knowl. Extr. 5(3), 1132–1148 (2023) sourceCould not verify

  The citation to this paper is attached to the claim that ensemble overhead may hinder real-time scalability, not to the 9% LSTM-Autoencoder figure cited separately. Section 2 (Related Works; page unavailable) describes an ensemble combining five CNN models and a feature-based model, but does not discuss its overhead or scalability. Searches for ensemble, computational cost, and real-time limitations found no passage addressing that point. (LLM, conf=0.73)

  Experimental — accuracy not yet measured
• cites [31] Liu, L., Chen, C., Zhang, J., De Vel, O., Xiang, Y.: Insider threat identification using the simultaneous neural learning of multi-source logs. IEEE Access. 7, 183162183176 (2019) sourcePartly supported

  The Introduction and Related Work (pages unavailable) say that deploying multiple sub-detectors raises engineering costs and design complexity, supporting the concern about overhead. They do not say that this overhead hinders scalability in real-time scenarios. The 9% LSTM-Autoencoder example is attached to a different citation, [13], and is not assessed here. (LLM, conf=0.82)

  Experimental — accuracy not yet measured

May combine two claims.

Dual-Domain Graph Convolutional Networks ensemble graph-based ML with DL, achieving 96.26%-96.70% accuracy on CERT datasets by fusing behavioral and log features.

“For instance, Dual-Domain Graph Convolutional Networks (DD-GCN) ensemble graph-based ML with DL, achieving 96.26%-96.70%accuracy on CERT datasets by fusing behavioral and log features [7].”

• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourceCould not verify

  The Learning algorithms section describes self-organizing maps, hidden Markov models, and decision trees—not DD-GCN. Table I reports accuracy results on the CERT dataset, but not 96.26%–96.70%. Searches for DD-GCN and those figures found no passage addressing the claimed method or result. (LLM, conf=0.76)

  Experimental — accuracy not yet measured

May combine two claims.

Studies justify preprocessing as essential for reducing noise, normalizing data variations, and enhancing model performance.

“Studies justify preprocessing as essential for reducing noise, normalizing data variations, and enhancing model performance, addressing QA1 by providing clear lower metrics [28,39].”

• cites [28] Nasir, R., Afzal, M., Latif, R., Iqbal, W.: Behavioural-based insider threat detection using deep learning. IEEE Access. 9, 143266–143274 (2021) sourcePartly supported

  The Data Pre-processing section (page unavailable) says missing values were replaced because the algorithms could not work with them, and Feature Extraction says text-valued features needed encoding for prediction. These passages support the importance of preprocessing, but do not establish noise reduction, normalization, improved model performance, or lower metrics. (LLM, conf=0.84)

  Experimental — accuracy not yet measured
• cites [39] Saganowski, S.: A three-stage machine learning network security solution for public entities. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1097–1104. IEEE, (2020) sourceNot checked — no full text of the source

May combine two claims.

Chat and social media analysis extends NLP to non-traditional sources, with Doc2vec detecting disloyalty in conversations for 84% TPR on temporal corpora.

“Chat and social media analysis extends NLP to non-traditional sources, with Doc2vec detecting disloyalty in conversations for 84% TPR on temporal corpora [11,18].”

• cites [11] Paxton-Fear, K.: Understanding Insider Threats Using Natural Language Processing (Doctoral dissertation). (2021)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [18] Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., Ochoa, M.: Insight into insiders and it: A survey of insider threat taxonomies, analysis, modelling, and countermeasures. ACM Comput. Surv. (CSUR). 52(2), 1–40 (2019) sourcePartly supported

  Section 8.2 discusses NLP applied to social media and conversations, and describes analysis of YouTube comments. But neither that section nor the other passages found reports Doc2vec detecting disloyalty or an 84% true-positive rate on temporal corpora. (LLM, conf=0.86)

  Experimental — accuracy not yet measured

May combine two claims.

TF-IDF is effective for extracting features from emails and logs, and in ensemble models on CERT r4.2 it emphasizes rare phrases indicative of threats, achieving AUC scores up to 99.2%.

“TF-IDF (Term Frequency-Inverse Document Frequency) weights terms based on their frequency and rarity, proving effective for extracting features from emails and logs.”

• Also stated in: § 5.3 Applications · plain

  “For instance, TF-IDF in ensemble models on CERT r4.2 datasets emphasizes rare phrases indicative of threats, achieving AUC scores up to 99.2% [33,41].”

• cites [33] Meng, F., Lou, F., Fu, Y., Tian, Z.: Deep learning-based attribute classification for insider threat detection for data security. In 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) (pp. 576–581). IEEE. (2018, June) sourceNot checked — no full text of the source
• cites [41] Silvestri, S., Islam, S., Amelin, D., Weiler, G., Papastergiou, S., Ciampi, M.: Cyber threat assessment and management for securing healthcare ecosystems using natural language processing. Int. J. Inf. Secur. 23(1), 31–50 (2024) sourceCould not verify

  The proposed approach (Section 3.2) uses BERT-based named-entity recognition to extract threats and assets from natural-language sources, which may include log files. Searches for TF-IDF and for CERT r4.2, ensemble models, and a 99.2% AUC found no passage supporting the attributed feature-extraction method or performance result. (LLM, conf=0.77)

  Experimental — accuracy not yet measured

May combine two claims.

Overreliance on domain-specific features limits generalizability, a gap highlighted in reviews of ML methods.

“However, overreliance on domain-specific features limits generalizability, a gap highlighted in reviews of ML methods [19,34].”

• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourceCould not verify

  The Discussion (section 6; page unavailable) reviews ML applications in smart policing, and Addressing RQ2 (section 4.2; page unavailable) discusses biases arising from data coverage, report quality, and training data. Neither passage says that overreliance on domain-specific features limits generalizability; searches for that phrase, “generalizability,” and “domain-specific” did not locate the claimed link. (LLM, conf=0.72)

  Experimental — accuracy not yet measured
• cites [34] Alzaabi, F.R., Mehmood, A.: A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods. IEEE Access. 12, 30907–30927 (2024) sourceCould not verify

  The review discusses ML challenges such as data scarcity and interpretability in “3) Anomaly Detection Methods” (page unavailable), and mentions improved generalization for one approach in “D. Learning-Based Insider Detection Techniques” (page unavailable). Neither passage identifies overreliance on domain-specific features as a limit on generalizability; searches for domain-specific features and related generalization terms did not find that link. (LLM, conf=0.72)

  Experimental — accuracy not yet measured

May combine two claims.

NLP techniques are applied across multiple domains for insider threat detection, processing unstructured data from emails, chats, access logs, and metadata to enable proactive identification.

“NLP techniques are applied across multiple domains for insider threat detection, processing unstructured data from emails, chats, access logs, and metadata to enable proactive identification, addressing RQ1's focus on diverse data sources.”

• cites [9] Sanzgiri, A., Dasgupta, D.: Classification of insider threat detection techniques. In Proceedings of the 11th annual Cyber and Information Security Research Conference (pp. 1–4). (2016, April) sourceNot checked — no full text of the source
• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourcePartly supported

  Section 4.1.3 (page unavailable) describes NLP applied to police free-text reports and tweets to extract crime information and predict incidents. It does not address insider-threat detection or the claimed use of emails, chats, access logs, and metadata for that purpose. (LLM, conf=0.80)

  Experimental — accuracy not yet measured

May combine two claims.

Marinho et al. (2023) introduced an automated cyber threat identification and profiling framework that processes Twitter messages using NLP, achieving an F1 score of 77% in correctly profiling discovered threats and maintaining a false alert rate of 15%.

“Marinho et al. (2023) [47] introduced an automated cyber threat identification and profiling framework that processes Twitter messages using NLP to identify threats, profile them based on intentions or goals, and generate alarms, achieving an F1 score of 77% in correctly profiling discovered threats and maintaining a false alert rate of 15%.”

• cites [47] Marinho, R., Holanda, R.: Automated emerging cyber threat identification and profiling based on natural language processing. IEEE Access. 11, 58915–58936 (2023) sourcePartly supported

  Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  Experimental — accuracy not yet measured

May combine two claims.

Preprocessing is vital for scalability, reducing computational overhead while preserving threat indicators.

“Preprocessing is vital for scalability, reducing computational overhead while preserving threat indicators, though challenges like handling multilingual insider jargon or abbreviated text in chats remain underexplored [19,69].”

• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourceCould not verify

  Section 4.1.2 describes preprocessing that extracts essential features from images, and section 4.1.3 lists preprocessing steps for crime-related text. Neither section says preprocessing reduces computational overhead for scalability while preserving threat indicators; searches for those effects found no supporting passage. Page numbers were not available in our copy. (LLM, conf=0.73)

  Experimental — accuracy not yet measured
• cites [69] Lopez, E., Sartipi, K.: Detecting the insider threat with long short term memory (LSTM) neural networks. arXiv preprint arXiv:2007.11956 (2020) sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Yilmaz et al. (2024) explored AI and insider threat detection, highlighting potential of AI techniques such as user behaviour analytics, NLP, LLMs, and Graph-based approaches.

“Yilmaz et al. (2024) [52] explored the intersection of AI and insider threat detection, addressing the limitations of traditional methods and highlighting the potential of AI techniques such as user behaviour analytics, NLP, Large Language Models (LLMs), and Graph-based approaches.”

• cites [52] Yilmaz, E.: Unveiling shadows: Harnessing artificial intelligence for insider threat detection. Eng. Technol. Appl. Sci. Res. 14(2), 13341–13346 (2024) sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Applications in healthcare and smart policing demonstrate NLP's versatility, with BERT analyzing vulnerabilities for 88.45% accuracy.

“Applications in healthcare and smart policing demonstrate NLP's versatility, with BERT analyzing vulnerabilities for 88.45% accuracy [22,73].”

• cites [22] Silvestri, S., Islam, S., Papastergiou, S., Tzagkarakis, C., Ciampi, M.: A machine learning approach for the NLP-based analysis of cyber threats and vulnerabilities of the healthcare ecosystem. Sensors. 23(2), 651 (2023) sourcePartly supported

  Sections 3.2 and 4.4 describe a BERT-based model used to identify cyber threats and assets in text, supporting the healthcare-cybersecurity application. The paper does not report 88.45% accuracy for BERT analyzing vulnerabilities; Section 4.5 instead describes logistic regression and XGBoost for vulnerability assessment. The cited passages also do not address smart policing. (LLM, conf=0.86)

  Experimental — accuracy not yet measured
• cites [73] Zhang, C., et al.: Detecting insider threat from behavioral logs based on ensemble and self-supervised learning. Secur. Communication Networks. 2021, 1–11 (2021) sourceCould not verify

  The Conclusion (page not provided) describes using TF-IDF from NLP to detect insider threats in behavioral logs, not applications in healthcare or smart policing. Searches for BERT, vulnerability analysis, and 88.45% accuracy found no supporting passage in our copy. (LLM, conf=0.76)

  Experimental — accuracy not yet measured

May combine two claims.

Georgescu et al. (2020) used an NLP model with a domain ontology and outperformed competing models with F1 scores of 0.58 for relation extraction and 0.81 for NER.

“Georgescu et al. (2020) [50]used anNLP model to cognitively analyze cybersecurity-related materials based on a domain ontology and outperformed competing models with F1 scores of 0.58 for relation extraction and 0.81 for NER”

• cites [50] Georgescu, T.-M.: Natural language processing model for automatic analysis of cybersecurity-related documents. Symmetry. 12(3), 354 (2020) sourceSupported

May combine two claims.

Comparing CERT 4.1 and 4.2, the latter's increased malicious activity (7% vs. lower rates in 4.1) and expanded feature set make it more suitable for dense threat detection.

“Comparing 4.1 and 4.2, the latter's increased malicious activity (7% vs. lower rates in 4.1) and expanded feature set make it more suitable for dense threat detection, as evidenced by higher accuracy in recent models [6,7].”

• cites [6] Rashid, T., Agrafiotis, I., Nurse, J.R.: A new take on detecting insider threats: exploring the use of hidden markov models. In Proceedings of the 8th ACM CCS International Workshop on managing insider security threats (pp. 47–56). (2016), October sourceNot checked — no full text of the source
• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourcePartly supported

  The CERT insider threat dataset section says release 4.2 has significantly more insider-threat incidents than other releases, allowing tests across more diverse scenarios. It does not give a 7% malicious-activity rate, identify an expanded feature set relative to 4.1, or compare model accuracy across the two releases. The Conclusion instead reports that malicious instances comprise 0.39% of weekly and 0.29% of daily preprocessed data in 4.2. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

May combine two claims.

Scalability issues arise from computational demands of processing vast datasets with Transformers, limiting real-time deployment with FAR up to 8%.

“Scalability issues arise from the computational demands of processing vast datasets with Transformers, limiting realtime deployment with FAR up to 8% [21,27].”

• cites [21] Yilmaz, E., Can, O.: Unveiling shadows: Harnessing artificial intelligence for insider threat detection. Eng. Technol. Appl. Sci. Res. 14(2), 13341–13346 (2024) sourcePartly supported

  The LLMs section describes transformer-based models trained on massive datasets, and the paper’s discussion of challenges says training accurate insider-threat models can be expensive and time-consuming. Neither passage connects that cost to transformer scalability or limits on real-time deployment, and no passage found reports a false-alarm rate of up to 8%. (LLM, conf=0.82)

  Experimental — accuracy not yet measured
• cites [27] Le, D.C., Zincir-Heywood, N.: Anomaly detection for insider threats using unsupervised ensembles. IEEE Trans. Netw. Serv. Manage. 18(2), 1152–1164 (2021) sourceNot checked — no full text of the source

May combine two claims.

Silva et al. (2020) evaluated NER to identify and monitor PII, with Stanford CoreNLP and SpaCy achieving classification accuracy rates of 0.84 and 0.86.

“Silva et al. (2020) [56] evaluated the use of NER to identify and monitor Personally Identifiable Information (PII), with Stanford CoreNLP and SpaCy achieving high classification accuracy rates of 0.84 and 0.86, respectively.”

• cites [56] Silva, P., Gonçalves, C., Godinho, C., Antunes, N., and Marilia Curado:. Using NLPmachine learning to detect data privacy violations. In IEEE INFOCOM 2020-IEEE conference on computer communications workshops (INFOCOM WKSHPS), pp. 972–977. IEEE, (2020) sourcePartly supported

  The Experimental Approach and Data section says the authors evaluated NER tools for detecting PII, including Stanford CoreNLP and spaCy. The Generic Data results report 0.84 and 0.86, respectively, but identify these as F1 scores on the full generic dataset—not classification accuracy rates or results specifically from the PII-containing contracts. (LLM, conf=0.90)

  Experimental — accuracy not yet measured

May combine two claims.

Studies using CERT 4.2 (7% malicious activity) and Contrastive Learning (100% precision on CERT) predominantly frame detection as a two-class problem, achieving high metrics but overlooking diversity of insider threat types.

“The manuscript's studies, such as those using CERT 4.2 (7% malicious activity [7]) and Contrastive Learning (100% precision on CERT [16]), predominantly frame detection as a two-class problem, achieving high metrics but overlooking the diversity of insider threat types.”

• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourcePartly supported

  The CERT insider threat dataset section says the study used release 4.2. But the passage labeled V. Conclusion reports that insider-threat instances were 0.39% of weekly and 0.29% of daily preprocessed data, not 7%. The contrastive-learning result is attached to a different citation, and the broader characterization is the citing authors’ framing. (LLM, conf=0.89)

  Experimental — accuracy not yet measured
• cites [16] Michael, A.: A Machine Learning Approach to Detect Insider Threats in Emails Caused by Human Behaviour (Master’s thesis, University of Pretoria (South Africa)). (2020)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Models like LSTM with multi-head attention (95.47% accuracy) require significant preprocessing and training time, which may delay detection in live systems.

“For instance, the manuscript notes that models like LSTM with multi-head attention (95.47% accuracy [31]) require significant preprocessing and training time, which may delay detection in live systems [14].”

• cites [31] Liu, L., Chen, C., Zhang, J., De Vel, O., Xiang, Y.: Insider threat identification using the simultaneous neural learning of multi-source logs. IEEE Access. 7, 183162183176 (2019) sourcePartly supported

  The Comparative Study (page unavailable in our copy) reports that a deep-autoencoder approach required feature-vector preparation and about one hour of training, supporting a general concern about processing and training costs. It does not establish those costs for LSTM with multi-head attention or say that they delay detection in live systems. The 95.47% accuracy figure is attached to a different citation, [31], so it is not assessed here. (LLM, conf=0.83)

  Experimental — accuracy not yet measured
• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source

May combine two claims.

CERT Dataset is best suited for log-based and behavioral analysis due to comprehensive coverage of user activities, supporting NER and graph-based models with 93.97% accuracy.

“The CERT Dataset is best suited for log-based and behavioral analysis due to its comprehensive coverage of user activities, supporting techniques like NER and graph-based models with 93.97% accuracy [7,39].”

• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourcePartly supported

  The CERT insider threat dataset section describes records of logins, email, web, file, and device activity, supporting its use for log-based behavioral analysis. The paper evaluates hidden Markov models, self-organizing maps, and decision trees; it does not support the attributed NER or graph-based models, a 93.97% accuracy for them, or the claim that CERT is 'best suited' for this analysis. Page numbers are unavailable in our copy. (LLM, conf=0.88)

  Experimental — accuracy not yet measured
• cites [39] Saganowski, S.: A three-stage machine learning network security solution for public entities. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1097–1104. IEEE, (2020) sourceNot checked — no full text of the source

May combine two claims.

Advanced models such as BERT, RoBERTa, and DD-GCN achieve high accuracies (e.g., >94% on CERT 4.2 and 96.26%-96.70% on CERT 6.2), leveraging deep learning to capture intricate patterns in textual data like emails and logs.

“Advanced models such as BERT, RoBERTa, and Dual-Domain Graph Convolutional Networks (DD-GCN) achieve high accuracies (e.g., >94% on CERT 4.2 [25] and 96.26%-96.70% on CERT 6.2 [7]), leveraging deep learning to capture intricate patterns in textual data like emails and logs.”

• cites [25] Jones, R., Omar, M.: Detecting IoT malware with knowledge distillation technique. In: 2023, Congress in Computer Science, Computer Engineering, & Applied Computing (CSCE), pp. 131–135. IEEE (2023, July) sourceNot checked — no full text of the source
• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourcePartly supported

  The CERT insider threat dataset section says the study used release 4.2, and Table I reports accuracies above 94% for its C4.5 decision tree. Those figures do not establish the attributed performance of BERT, RoBERTa, or DD-GCN: the paper evaluates HMM, SOM, and decision-tree methods, not those deep-learning models. The CERT 6.2 figure is attached to a different citation in the citing sentence and is not assessed here. (LLM, conf=0.87)

  Experimental — accuracy not yet measured

May combine two claims.

The trade-off between model complexity and real-time use is acknowledged in studies, which highlight the need for lightweight, scalable architectures, yet few propose viable solutions, leaving a gap in real-time optimization.

“This trade-off is acknowledged in studies [19], which highlight the need for lightweight, scalable architectures, yet few propose viable solutions, leaving a gap in real-time optimization.”

• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourceCould not verify

  Section 4.1.2 (page unavailable) discusses real-time weapon detection and improvements in YOLO accuracy and speed, but does not identify a trade-off between model complexity and real-time use. Searches for lightweight or scalable architectures and a gap in real-time optimization found no passage supporting those claims. (LLM, conf=0.76)

  Experimental — accuracy not yet measured

May combine two claims.

The binary approach, while effective for controlled experiments (e.g., 99.2% AUC with TF-IDF Ensemble), fails to address complexity of real-world threats where multiple malicious intents coexist.

“This binary approach, while effective for controlled experiments (e.g., 99.2% AUC with TF-IDF Ensemble [41]), fails to address the complexity of real-world threats where multiple malicious intents coexist, as noted in research gaps [12].”

• cites [41] Silvestri, S., Islam, S., Amelin, D., Weiler, G., Papastergiou, S., Ciampi, M.: Cyber threat assessment and management for securing healthcare ecosystems using natural language processing. Int. J. Inf. Secur. 23(1), 31–50 (2024) sourcePartly supported

  The Introduction (page unavailable) says that extracting threat information from real-world, unstructured cybersecurity text is challenging. It does not identify binary classification as the problem or say that multiple malicious intents coexist in a way binary methods cannot handle. The 99.2% AUC figure is attached to a different citation in the citing sentence, so it is not assessed here. (LLM, conf=0.78)

  Experimental — accuracy not yet measured
• cites [12] Huang, R., Riloff, E.: Inducing domain-specific semantic class taggers from (almost) nothing. In Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics (pp. 275–285). (2010, July)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Privacy issues arise with Enron Dataset, as it includes sensitive personal data, raising ethical concerns and limiting its use without anonymization.

“Privacy issues arise with the Enron Dataset, as it includes sensitive personal data, raising ethical concerns and limiting its use without anonymization, a gap noted in reviews [4,19].”

• cites [4] Costa, D.L., Albrethsen, M.J., Collins, M.L., Perl, S.J., Silowash, G.J., Spooner, D.L.: An insider threat indicator ontology. Technical Report CMU/SEI-2016-TR-007. (2016)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourceCould not verify

  Section 4.2 discusses ethical risks of AI in smart policing generally, but does not address the Enron Dataset. Searches for Enron, sensitive personal data, privacy, and anonymization found no passage supporting the claimed restriction on its use. (LLM, conf=0.75)

  Experimental — accuracy not yet measured

May combine two claims.

CERT's simulated logs (32 million actions) enable high accuracies (e.g., 96.70%) but fail to capture dynamic real-world behaviors, with accuracy dropping to 73.4% when applied to live data.

“For instance, CERT's simulated logs (32 million actions [7]) enable high accuracies (e.g., 96.70% [7]) but fail to capture dynamic real-world behaviors, with accuracy dropping to 73.4% when applied to live data [3].”

• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourcePartly supported

  The CERT dataset and decision-tree results sections report shifts and drifts in user behavior and say a conventional supervised model may not adapt well. They evaluate simulated CERT data, however, not live data; the reported accuracy values do not include a drop to 73.4%. The paper also does not establish that CERT logs fail to capture dynamic real-world behavior. (LLM, conf=0.82)

  Experimental — accuracy not yet measured
• cites [3] Yuan, S., Wu, X.: Deep learning for insider threat detection: Review, challenges, and opportunities. Computers Secur. 104, 102221 (2021) sourceNot checked — no full text of the source

May combine two claims.

Real-time log streaming is underexplored, with models like LSTM-RNN (93.85% accuracy) trained on static datasets, missing dynamic nature of live logs.

“Real-time log streaming, critical for timely detection, is underexplored, with models like LSTM-RNN (93.85% accuracy [21]) trained on static datasets, missing the dynamic nature of live logs [14].”

• cites [21] Yilmaz, E., Can, O.: Unveiling shadows: Harnessing artificial intelligence for insider threat detection. Eng. Technol. Appl. Sci. Res. 14(2), 13341–13346 (2024) sourcePartly supported

  Table I in the Graph-based Approaches section identifies difficulty detecting anomalies in dynamic data and high detection delay as limitations of some insider-threat approaches. It does not establish that real-time log streaming is underexplored or that the cited LSTM-RNN model was trained on static data. The 93.85% accuracy figure is attached to a different citation in the citing sentence. (LLM, conf=0.78)

  Experimental — accuracy not yet measured
• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source

May combine two claims.

Integration gaps are acknowledged, with calls for federated datasets to enhance privacy and realism, yet practical implementations remain scarce.

“Integration gaps are acknowledged in research gaps [12], with calls for federated datasets [22] to enhance privacy and realism, yet practical implementations remain scarce.”

• cites [12] Huang, R., Riloff, E.: Inducing domain-specific semantic class taggers from (almost) nothing. In Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics (pp. 275–285). (2010, July)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [22] Silvestri, S., Islam, S., Papastergiou, S., Tzagkarakis, C., Ciampi, M.: A machine learning approach for the NLP-based analysis of cyber threats and vulnerabilities of the healthcare ecosystem. Sensors. 23(2), 651 (2023) sourcePartly supported

  The Introduction acknowledges difficulty integrating ML technologies into existing healthcare ICT systems, supporting the integration-gap portion attributed to this source. The Conclusions and Future Work say this paper’s method was still to be tested in real environments, but do not establish that practical implementations are generally scarce. The call for federated datasets is attached to a different citation [22], not this source. (LLM, conf=0.80)

  Experimental — accuracy not yet measured

May combine two claims.

Models like LSTM-Autoencoder (90% accuracy) and MEWRGNN (93.97% accuracy) provide robust detection but offer limited insight into why certain behaviors are flagged as threats.

“The manuscript indicates that models like LSTM-Autoencoder (90% accuracy [13]) and MEWRGNN (93.97% accuracy [39]) provide robust detection but offer limited insight into why certain behaviors are flagged as threats, a concern echoed in reviews [19].”

• cites [13] Liang, N., Biros, D.P., Luse, A.: An empirical validation of malicious insider characteristics. J. Manage. Inform. Syst. 33(2), 361–392 (2016) sourceNot checked — no full text of the source
• cites [39] Saganowski, S.: A three-stage machine learning network security solution for public entities. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1097–1104. IEEE, (2020) sourceNot checked — no full text of the source
• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourceSupported

May combine two claims.

The CERT dataset's 17-month static window exemplifies limitation, as real-time anomalies require continuous adaptation, a capability few models demonstrate.

“The CERT dataset's 17-month static window [7] exemplifies this limitation, as real-time anomalies (e.g., unauthorized access spikes) require continuous adaptation, a capability few models demonstrate.”

• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourcePartly supported

  The CERT insider threat dataset section describes a finite dataset, but says the analysis extracted 18 months of data, not a 17-month window. The Conclusion also refers to 72 weeks of data, approximately 17 months. The citation supports the use of a bounded CERT dataset, but not the precise duration stated. (LLM, conf=0.84)

  Experimental — accuracy not yet measured

May combine two claims.

A tension exists between advanced NLP detection performance (e.g., >99% AUC) and operational feasibility, with insufficient lightweight alternatives.

“Model complexity versus real-time use reveals a tension between advanced detection (e.g., >99% AUC [41]) and operational feasibility, with insufficient lightweight alternatives.”

• cites [41] Silvestri, S., Islam, S., Amelin, D., Weiler, G., Papastergiou, S., Ciampi, M.: Cyber threat assessment and management for securing healthcare ecosystems using natural language processing. Int. J. Inf. Secur. 23(1), 31–50 (2024) sourceCould not verify

  The citation is attached to the example of >99% AUC, but no passage in our copy reports that figure; searches for AUC, 99, and area under the ROC curve did not find it. The limitations in Section 6 concern data acquisition, language, and domain-specific resources, not a trade-off between detection performance and real-time feasibility or a shortage of lightweight alternatives. (LLM, conf=0.72)

  Experimental — accuracy not yet measured

May combine two claims.

The complexity of current NLP models, such as BERT (>94% accuracy) and DD-GCN (96.26%-96.70%), poses challenges for real-time deployment and trust, necessitating development of lightweight and interpretable alternatives.

“The complexity of current NLP models, such as BERT (>94% accuracy [25]) and DD-GCN (96.26%-96.70%[7]), poses challenges for real-time deployment and trust, necessitating the development of lightweight and interpretable alternatives.”

• cites [25] Jones, R., Omar, M.: Detecting IoT malware with knowledge distillation technique. In: 2023, Congress in Computer Science, Computer Engineering, & Applied Computing (CSCE), pp. 131–135. IEEE (2023, July) sourceNot checked — no full text of the source
• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourceCould not verify

  The Learning algorithms section studies self-organizing maps, hidden Markov models, and decision trees, while the CERT insider threat dataset results report their detection performance. A search of our copy found no DD-GCN result, 96.26%–96.70% accuracy, or discussion of that model’s real-time deployment or trust challenges; the cited paper therefore does not verify the part attached to [7]. (LLM, conf=0.78)

  Experimental — accuracy not yet measured

May combine two claims.

Studies rarely justify dataset selection beyond availability, and the lack of real-time, multi-source datasets restricts model robustness.

“Studies rarely justify dataset selection beyond availability [34], and the lack of real-time, multi-source datasets (e.g., integrating social media or chat logs [27]) restricts model robustness.”

• cites [34] Alzaabi, F.R., Mehmood, A.: A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods. IEEE Access. 12, 30907–30927 (2024) sourceCould not verify

  Citation [34] is attached to the claim that studies rarely justify dataset selection beyond availability. The paper’s “Data Sources and Features” section describes datasets and their uses, but neither it nor the passages retrieved by searches for dataset-selection rationale and availability assess how often studies justify their choices. The later claim about real-time, multi-source datasets is outside the part attributed to [34]. (LLM, conf=0.72)

  Experimental — accuracy not yet measured
• cites [27] Le, D.C., Zincir-Heywood, N.: Anomaly detection for insider threats using unsupervised ensembles. IEEE Trans. Netw. Serv. Manage. 18(2), 1152–1164 (2021) sourceNot checked — no full text of the source

May combine two claims.

Lightweight models, such as optimized TF-IDF ensembles (99.2% AUC) or simplified Adaboost (98.3% accuracy), offer faster inference but lack depth to capture subtle threats.

“Lightweight models, such as optimized TF-IDF ensembles (99.2% AUC [41]) or simplified Adaboost (98.3% accuracy [10]), offer faster inference but lack the depth to capture subtle threats.”

• cites [41] Silvestri, S., Islam, S., Amelin, D., Weiler, G., Papastergiou, S., Ciampi, M.: Cyber threat assessment and management for securing healthcare ecosystems using natural language processing. Int. J. Inf. Secur. 23(1), 31–50 (2024) sourceCould not verify

  The citation to this paper is attached to the simplified AdaBoost example. The Related Works section (2.3) discusses other machine-learning approaches, and the Conclusion discusses possible improvements to its NLP approach, but the searched passages do not address simplified AdaBoost, 98.3% accuracy, faster inference, or an inability to capture subtle threats. The separate TF-IDF figure is attached to a different citation. (LLM, conf=0.76)

  Experimental — accuracy not yet measured
• cites [10] Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. (2017)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

High metrics often stem from controlled evaluations, with real-world false positive rates climbing to 12-20% due to linguistic variability.

“high metrics often stem from controlled evaluations, with real-world false positive rates (FPRs) climbing to 12-20% due to linguistic variability [18,25]”

• cites [18] Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., Ochoa, M.: Insight into insiders and it: A survey of insider threat taxonomies, analysis, modelling, and countermeasures. ACM Comput. Surv. (CSUR). 52(2), 1–40 (2019) sourcePartly supported

  Section 5.2 (Datasets; page unavailable) says dataset selection can simplify classification tasks and notes that the authors knew of only one real-world dataset, lending support to the concern about controlled evaluations. It does not report real-world false-positive rates of 12–20%, attribute such rates to linguistic variability, or establish a measured increase from controlled to real-world settings. (LLM, conf=0.76)

  Experimental — accuracy not yet measured
• cites [25] Jones, R., Omar, M.: Detecting IoT malware with knowledge distillation technique. In: 2023, Congress in Computer Science, Computer Engineering, & Applied Computing (CSCE), pp. 131–135. IEEE (2023, July) sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Poor explainability erodes trust.

“poor explainability [19], eroding trust”

• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourcePartly supported

  Section 4.2 (page unavailable) identifies intelligibility—explaining how a model operates—as an important standard for AI in policing. Section 6 links responsible AI practices to building trust, but does not specifically say that poor explainability erodes trust. (LLM, conf=0.78)

  Experimental — accuracy not yet measured

Classified as probably not a substantial claim.

There is a gap in benchmark-ready datasets standardized across CERT, TWOS, and SKAION.

“Benchmark-ready datasets, standardized across CERT, TWOS, and SKAION [10,33], would facilitate comparative evaluation, a gap noted in Homoliak et al. [19].”

• cites [10] Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. (2017)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [33] Meng, F., Lou, F., Fu, Y., Tian, Z.: Deep learning-based attribute classification for insider threat detection for data security. In 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) (pp. 576–581). IEEE. (2018, June) sourceNot checked — no full text of the source
• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourceCould not verify

  The dataset tables in section 7 list crime datasets and model results, but do not discuss CERT, TWOS, or SKAION or a gap in standardized, benchmark-ready datasets across them. Searches for those names and for comparative-evaluation benchmarks found no passage addressing the claim; the citing sentence attributes the gap to a separate citation [19]. (LLM, conf=0.76)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

RQ1's focus on NLP applications mirrors Homoliak et al. but adds depth with specific metrics.

“RQ1's focus on NLP applications (e.g., 99.2% AUC [41]) mirrors Homoliak et al. [19], which surveys insider threat taxonomies, but adds depth with specific metrics (e.g., 94.28% on Enron [4]).”

• cites [19] Sarzaeim, P., Mahmoud, Q.H., Azim, A., Bauer, G., Bowles, I.: A systematic review of using machine learning and natural language processing in smart policing. Computers. 12(12), 255 (2023) sourcePartly supported

  The Research Questions section defines RQ1 around ML and NLP methods for crime data and predictive policing, and §4.1.3 reports performance metrics for NLP applications. The copy does not establish a comparison with Homoliak et al. or support the sentence’s specific 99.2% AUC and 94.28% Enron examples; those figures have separate citations in the citing sentence. (LLM, conf=0.84)

  Experimental — accuracy not yet measured
• cites [4] Costa, D.L., Albrethsen, M.J., Collins, M.L., Perl, S.J., Silowash, G.J., Spooner, D.L.: An insider threat indicator ontology. Technical Report CMU/SEI-2016-TR-007. (2016)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

RQ2's dataset analysis corroborates Glasser and Lindauer on synthetic data challenges and identifies new gaps in real-time logs.

“RQ2's dataset analysis (CERT, Enron [4,7]) corroborates Glasser and Lindauer [web:9] on synthetic data challenges, though it identifies new gaps in real-time logs [12].”

• cites [4] Costa, D.L., Albrethsen, M.J., Collins, M.L., Perl, S.J., Silowash, G.J., Spooner, D.L.: An insider threat indicator ontology. Technical Report CMU/SEI-2016-TR-007. (2016)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [7] Le, D.C., Nur Zincir-Heywood, A.: Evaluating insider threat detection workflow using supervised and unsupervised learning. In: 2018 IEEE Security and Privacy Workshops (SPW), pp. 270–275. IEEE (2018) sourcePartly supported

  The Data preprocessing section (page unavailable) describes challenges in combining continuously generated logs from multiple sources, and the Conclusion identifies streaming-data analysis as future work. The paper therefore supports a gap related to timely log analysis, but does not present an RQ2 dataset analysis or identify a new gap specifically in real-time logs. The Glasser and Lindauer comparison is attached to a different citation. (LLM, conf=0.82)

  Experimental — accuracy not yet measured
• cites [web:9]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [12] Huang, R., Riloff, E.: Inducing domain-specific semantic class taggers from (almost) nothing. In Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics (pp. 275–285). (2010, July)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

NLP for fraud detection handles volume but struggles with adversarial attacks.

“NLP for fraud detection in transaction narratives [22] handles volume but struggles with adversarial attacks”

• cites [22] Silvestri, S., Islam, S., Papastergiou, S., Tzagkarakis, C., Ciampi, M.: A machine learning approach for the NLP-based analysis of cyber threats and vulnerabilities of the healthcare ecosystem. Sensors. 23(2), 651 (2023) sourceCould not verify

  The Introduction and §3.2 describe NLP for extracting cybersecurity threats from unstructured documents, not fraud detection in transaction narratives. Searches for transaction narratives, fraud detection, and adversarial attacks found no passage addressing the attributed claim; the paper’s discussion of large cybersecurity text collections does not establish it for transactions. (LLM, conf=0.77)

  Experimental — accuracy not yet measured

May combine two claims.

Federated learning mitigates data leaks but increases latency by 20-30% in real-time financial monitoring.

“privacy-preserving federated learning [22] mitigates data leaks but increases latency by 20-30% in real-time financial monitoring [4]”

• cites [22] Silvestri, S., Islam, S., Papastergiou, S., Tzagkarakis, C., Ciampi, M.: A machine learning approach for the NLP-based analysis of cyber threats and vulnerabilities of the healthcare ecosystem. Sensors. 23(2), 651 (2023) sourceCould not verify

  The citation to this paper is attached to the claimed 20–30% latency increase in real-time financial monitoring. Section 4.5 evaluates healthcare cybersecurity vulnerability models, not federated learning or financial monitoring; searches for the latency figure and those terms found no supporting passage in our copy. (LLM, conf=0.78)

  Experimental — accuracy not yet measured
• cites [4] Costa, D.L., Albrethsen, M.J., Collins, M.L., Perl, S.J., Silowash, G.J., Spooner, D.L.: An insider threat indicator ontology. Technical Report CMU/SEI-2016-TR-007. (2016)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Following PRISMA 2020 guidelines, 132 records were identified from databases and registers: IEEE (n = 68), ScienceDirect (n = 18), Springer (n = 32), MDPI (n = 7), and other sources (n = 7).

“Following the PRISMA 2020 guidelines, a total of 132 records were identified from databases and registers: IEEE (n = 68), ScienceDirect (n = 18), Springer (n = 32), MDPI (n = 7), and other sources (n = 7).”

May combine two claims.

The yearly distribution from 2019 to 2024 shows a gradual increase in research activity starting from 2019, with a significant rise in 2023 (27.3% of total studies) and 2024 (24.2%).

“Figure 3 illustrates the yearly distribution of publications from 2019 to 2024.The trend shows a gradual increase in research activity starting from 2019, with a significant rise observed in 2023 (27.3% of total studies) and 2024 (24.2%).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The 80 reports were assessed for eligibility, with 14 excluded: duplicate/overlapping = 5, review papers = 4, and incomplete/inaccessible = 5.

“These 80 reports were assessed for eligibility, with 14 excluded (duplicate/overlapping = 5, review papers = 4, incomplete/inaccessible = 5).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The remaining 80 reports were sought for retrieval, and all were obtained.

“The remaining 80 **reports** were sought for retrieval, and all were obtained.”

May combine two claims.

The years 2022 and 2023 show a significant uptick, with 2023 standing out as a peak.

“The years 2022 and 2023 show a significant uptick, with 2023 standing out as a peak, suggesting a surge in activity possibly driven by advancements in technology or heightened cybersecurity concerns.”

May combine two claims.

The volume of research rises steadily into 2020 and 2021, indicating a deepening exploration of the topic.

“This trend continues into 2020 and 2021, where the volume of research rises steadily, indicating a deepening exploration of the topic.”

May combine two claims.

The year 2019 marks the beginning of a notable increase in publications, setting a foundation with a moderate number of studies.

“The year 2019 marks the beginning of a notable increase in publications, setting a foundation with a moderate number of studies.”

May combine two claims.

Of the 120 records, 40 were excluded: irrelevant topic = 20, not NLP/ML-based = 12, and insufficient data = 8.

“Of these, 40 records were excluded (irrelevant topic = 20, not NLP/ML-based = 12, insufficient data = 8).”

May combine two claims.

There has been no prior systematic review of NLP for insider threat detection, and this study is the first to address that gap using the PRISMA 2020 framework.

“There has been no prior systematic review of NLP for insider threat detection.This study is the first to address that gap using the PRISMA 2020 framework.”

May combine two claims.

SPCAGAN, a GAN variant, was used for synthetic data augmentation in insider threat analysis, outperforming traditional oversampling with faster convergence and reduced mode collapse.

“SPCAGAN, a GAN variant, was used for synthetic data augmentation in insider threat analysis, outperforming traditional oversampling with faster convergence and reduced mode collapse [20,42].”

• cites [20] Gayathri, R.G., Sajjanhar, A., Xiang, Y.: Hybrid deep learning model using SPCAGAN augmentation for insider threat analysis. Expert Syst. Appl. 249, 123533 (2024) sourceNot checked — no full text of the source
• cites [42] Niyaoui, O.: and Oussama Mohamed Reda. Malicious URL Detection Using Transformers’ NLP Models and Machine Learning. In International Conference on Advanced Intelligent Systems for Sustainable Development, pp. 389–399. Cham: Springer Nature Switzerland, (2023) sourceNot checked — no full text of the source

May combine two claims.

Transformers like BERT and RoBERTa excel in contextual understanding, achieving over 94% accuracy, precision, recall, F1-score, and AUC on CERT r4.2.

“Transformers like BERT and RoBERTa excel in contextual understanding, achieving over 94% accuracy, precision, recall, F1-score, and AUC on CERT r4.2 [25].”

• cites [25] Jones, R., Omar, M.: Detecting IoT malware with knowledge distillation technique. In: 2023, Congress in Computer Science, Computer Engineering, & Applied Computing (CSCE), pp. 131–135. IEEE (2023, July) sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Rashid et al. utilized HMMs to detect insider threats by analyzing deviations in user behavior, reporting effective identification of dynamic threats.

“For example, Rashid et al. utilized HMMs to detect insider threats by analyzing deviations in user behavior, reporting effective identification of dynamic threats [6].”

• cites [6] Rashid, T., Agrafiotis, I., Nurse, J.R.: A new take on detecting insider threats: exploring the use of hidden markov models. In Proceedings of the 8th ACM CCS International Workshop on managing insider security threats (pp. 47–56). (2016), October sourceNot checked — no full text of the source

May combine two claims.

Topic modeling using Latent Dirichlet Allocation or BERT embeddings detects thematic anomalies, such as discussions about sensitive data, achieving 88.45% accuracy in vulnerability detection from cybersecurity news.

“Topic modeling, using techniques like Latent Dirichlet Allocation (LDA) or BERT embeddings, detects thematic anomalies, such as discussions about sensitive data, achieving 88.45% accuracy in vulnerability detection from cybersecurity news [30,71].”

• cites [30] Iorga, D., Corlătescu, D., Grigorescu, O., Săndescu, C., Dascălu, M., Rughiniş, R.: Early detection of vulnerabilities from news websites using machine learning models. In 2020, 19th RoEduNet Conference: Networking in Education and Research (RoEduNet) (pp. 1–6). IEEE. (2020, December) sourceNot checked — no full text of the source
• cites [71] Raut, M., Dhavale, S., Singh, A., Mehra, A.: Insider threat detection using deep learning: A review. 2020 3rd International Conference on Intelligent Sustainable Systems (ICISS), Thoothukudi, India, 856–863. (2020). https://doi.org/10.1109/ICISS49785.2020.9315932 sourceNot checked — no full text of the source

May combine two claims.

Advantages of hybrids include improved robustness through feature fusion, e.g., NER-BiLSTM with CNN for 92% TPR/TNR, and better handling of imbalances via GAN augmentation.

“Advantages include improved robustness through feature fusion, e.g., NER-BiLSTM with CNN for 92% TPR/TNR [35], and better handling of imbalances via GAN augmentation [20].”

• cites [35] Hendawi, S., Jararweh, Y.: Yazan Zreqat, and Shadi AlZu’bi. Cybersecurity Empirics: Evaluating Machine Learning Techniques for Phishing Detection. In 14th International Conference on Information and Communication Systems (ICICS), pp. 1–5. IEEE, 2023. (2023) sourceNot checked — no full text of the source
• cites [20] Gayathri, R.G., Sajjanhar, A., Xiang, Y.: Hybrid deep learning model using SPCAGAN augmentation for insider threat analysis. Expert Syst. Appl. 249, 123533 (2024) sourceNot checked — no full text of the source

May combine two claims.

Graph-based features, used in Graph Convolutional Networks or Multi-Edge Weight Relational GNN, model relationships in access logs or social interactions, achieving 93.97% accuracy by fusing multi-edge weights for relational anomalies.

“Graph-based features, used in Graph Convolutional Networks (GCN) or Multi-Edge Weight Relational GNN (MEWRGNN), model relationships in access logs or social interactions, achieving 93.97% accuracy by fusing multi-edge weights for relational anomalies [39,72].”

• cites [39] Saganowski, S.: A three-stage machine learning network security solution for public entities. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1097–1104. IEEE, (2020) sourceNot checked — no full text of the source
• cites [72] Xiao, J., et al.: Robust anomaly-based insider threat detection using graph neural network. IEEE Trans. Netw. Serv. Manage. 20, 3717–3733 (2022) sourceNot checked — no full text of the source

May combine two claims.

N-grams capture phrase sequences in emails, enabling pattern matching for policy breaches with low false positive rates, e.g., 0.38% in LSTM models.

“N-grams capture phrase sequences in emails, enabling pattern matching for policy breaches with low False Positive Rates (FPR), e.g., 0.38% in LSTM models [2].”

• cites [2] Predd, J., Pfleeger, S.L., Hunker, J., Bulford, C.: Insiders are behaving badly. IEEE Secur. Priv. 6(4), 66–70 (2008) sourceNot checked — no full text of the source

May combine two claims.

Access logs are treated as text sequences, with LSTM recurrent networks yielding 0.72 average AUC-ROC on Los Alamos datasets for anomaly detection.

“Access logs are treated as text sequences, with LSTM recurrent networks yielding 0.72 average AUC-ROC on Los Alamos datasets for anomaly detection [29].”

• cites [29] Le, D.C., Zincir-Heywood, N., Heywood, M.I.: Analyzing data granularity levels for insider threat detection using machine learning. IEEE Trans. Netw. Serv. Manage. 17(1), 30–44 (2020) sourceNot checked — no full text of the source

May combine two claims.

Word2Vec identifies behavioral cues like tone shifts, achieving 100% TPR in window-based models.

“Word2Vec identifies behavioral cues like tone shifts, achieving 100% TPR in window-based models [14].”

• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source

May combine two claims.

LLMs, XGBoost combined with BERT, and RFO each achieved close to 98% accuracy.

“LLMs, XGBoost combined with BERT, and RFO also performed well, each achieving close to 98% accuracy.”

May combine two claims.

CNN + LSTM technique achieved the highest accuracy, reaching nearly 100%.

“From the chart, it is evident that the CNN + LSTM technique achieved the highest accuracy, reaching nearly 100%.”

May combine two claims.

Precision varies from 85.1% to 100%, recall from 82.3% to 100%, and F1-scores from 77% to 100%.

“Precision varies from 85.1% to 100%, recall from 82.3% to 100%, and F1-scores from 77% to 100%.”

May combine two claims.

FPR ranges from 0% to 20%, with many models maintaining FPR below 10%.

“FPR ranges from 0% to 20%, with many models maintaining FPR below 10%.”

May combine two claims.

NLP approaches for insider threat detection include high accuracy (e.g., 98.3% Adaboost, >99% DistilledTrans), enabling precise threat detection.

“Pros include high accuracy (e.g., 98.3% Adaboost [10], >99% DistilledTrans [25]), enabling precise threat detection”

• cites [10] Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. (2017)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [25] Jones, R., Omar, M.: Detecting IoT malware with knowledge distillation technique. In: 2023, Congress in Computer Science, Computer Engineering, & Applied Computing (CSCE), pp. 131–135. IEEE (2023, July) sourceNot checked — no full text of the source

May combine two claims.

Traditional ML (27.3%) provided interpretable baselines like SVM with 98.3% AUC on Enron datasets.

“traditional ML (27.3%) provided interpretable baselines like SVM with 98.3% AUC on Enron datasets [10]”

• cites [10] Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. (2017)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Semantic richness from embeddings (e.g., Word2Vec TPR 100%) and relational modeling (MEWRGNN 93.97%) enhance pattern recognition.

“Semantic richness from embedding's (e.g., Word2Vec TPR 100% [14]) and relational modeling (MEWRGNN 93.97% [39]) enhance pattern recognition.”

• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source
• cites [39] Saganowski, S.: A three-stage machine learning network security solution for public entities. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1097–1104. IEEE, (2020) sourceNot checked — no full text of the source

May combine two claims.

The review found a diverse yet unbalanced adoption of NLP approaches.

“The core findings from RQ1 (techniques) and RQ3 (performance metrics) underscore a diverse yet unbalanced adoption of approaches.”

May combine two claims.

Hybrid NLP-ML/DL pipelines (27.3%) excelled in unstructured data processing, combining sentiment analysis with ensembles for F1-scores exceeding 94%.

“Hybrid NLP-ML/DL pipelines (27.3%) excelled in unstructured data processing, combining sentiment analysis with ensembles for F1-scores exceeding 94% [17,35]”

• cites [17] Sharma, S., Arjunan, T.: Natural language processing for detecting anomalies and intrusions in unstructured cybersecurity data. Int. J. Inform. Cybersecur. 7(12), 1–24 (2023)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [35] Hendawi, S., Jararweh, Y.: Yazan Zreqat, and Shadi AlZu’bi. Cybersecurity Empirics: Evaluating Machine Learning Techniques for Phishing Detection. In 14th International Conference on Information and Communication Systems (ICICS), pp. 1–5. IEEE, 2023. (2023) sourceNot checked — no full text of the source

May combine two claims.

NLP-only methods (15.2%) focused on semantic tasks, such as NER for entity extraction in chat logs (92% F1).

“NLP-only methods (15.2%) focused on semantic tasks, such as NER for entity extraction in chat logs (92% F1 [35])”

• cites [35] Hendawi, S., Jararweh, Y.: Yazan Zreqat, and Shadi AlZu’bi. Cybersecurity Empirics: Evaluating Machine Learning Techniques for Phishing Detection. In 14th International Conference on Information and Communication Systems (ICICS), pp. 1–5. IEEE, 2023. (2023) sourceNot checked — no full text of the source

May combine two claims.

Synthetic dominance (72.7% of datasets) introduced biases, such as over-optimization.

“synthetic dominance (72.7% of datasets) introduced biases, such as over-optimization”

May combine two claims.

Insiders obfuscate intent via synonyms, dropping F1-scores to 75%.

“insiders obfuscate intent via synonyms, dropping F1-scores to 75% [12]”

• cites [12] Huang, R., Riloff, E.: Inducing domain-specific semantic class taggers from (almost) nothing. In Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics (pp. 275–285). (2010, July)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Healthcare systems show 89% TPR and F1-scores above 94%.

“89% TPR in healthcare F1-scores above 94%”

Classified as probably not a substantial claim.

This paper applies the PRISMA 2020 framework to conduct a systematic review of recent studies on insider threat detection using NLP, ML, and DL techniques.

“This paper applies the PRISMA 2020 framework to conduct a systematic review of recent studies on Insider Threat Detection using NLP, ML, and DL techniques.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Anomaly detection is a commonly employed method for identifying insider threats, using machine learning to learn typical and authorized behavior and identify deviations.

“Anomaly detection is a commonly employed method for identifying insider threats.These systems employ Machine Learning (ML) methodologies to acquire knowledge about typical and authorized behaviour within a network or user behaviour.They subsequently identify and highlight any activity that deviates from this established norm [11].”

• cites [11] Paxton-Fear, K.: Understanding Insider Threats Using Natural Language Processing (Doctoral dissertation). (2021)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Security professionals frequently use NLP to categorize textual content, particularly to identify publications related to terrorism.

“Security professionals frequently use NLP to categorize textual content, particularly to identify publications related to terrorism [14].”

• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source

Classified as probably not a substantial claim.

To guarantee the accuracy and consistency of the findings, the caliber of the included studies was evaluated using quality assessment criteria based on research design, methodology, dataset usage, and result reporting.

“To guarantee the accuracy and consistency of the findings, the caliber of the included studies was evaluated.Key elements pertaining to research design, methodology, dataset usage, and result reporting served as the foundation for the development of the quality assessment criteria.”

Classified as probably not a substantial claim.

Research articles published between 2019 and 2024 were systematically analyzed.

“For this purpose, research articles published between year 2019 to 2024 were systematically analyzed.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Multiple areas have addressed insider threat detection by devising numerous approaches and frameworks from an NLP standpoint.

“Multiple areas have addressed this issue, devising numerous approaches and frameworks from an NLP standpoint [12,13].”

• cites [12] Huang, R., Riloff, E.: Inducing domain-specific semantic class taggers from (almost) nothing. In Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics (pp. 275–285). (2010, July)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [13] Liang, N., Biros, D.P., Luse, A.: An empirical validation of malicious insider characteristics. J. Manage. Inform. Syst. 33(2), 361–392 (2016) sourceNot checked — no full text of the source

May combine two claims.

Traditional ML models are typically supervised and rely on feature engineering from NLP techniques like TF-IDF for vectorizing text data from emails or logs.

“These models are typically supervised and rely on feature engineering from NLP techniques like TF-IDF (Term Frequency-Inverse Document Frequency) for vectorizing text data from emails or logs [10,33].”

• cites [10] Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. (2017)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [33] Meng, F., Lou, F., Fu, Y., Tian, Z.: Deep learning-based attribute classification for insider threat detection for data security. In 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) (pp. 576–581). IEEE. (2018, June) sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Hidden Markov Models represent another traditional approach, particularly for modeling sequential user behaviors in behavioral analysis.

“Hidden Markov Models (HMM) represent another traditional approach, particularly for modeling sequential user behaviors in behavioral analysis.”

May combine two claims.

Pros of traditional ML models include interpretability, lower computational requirements, and ease of deployment on resource-constrained systems, making them suitable for real-time anomaly detection in smaller organizations.

“Pros of traditional ML models include interpretability, lower computational requirements, and ease of deployment on resource-constrained systems, making them suitable for real-time anomaly detection in smaller organizations [10,33].”

• cites [10] Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In Workshops at the Thirty-First AAAI Conference on Artificial Intelligence. (2017)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [33] Meng, F., Lou, F., Fu, Y., Tian, Z.: Deep learning-based attribute classification for insider threat detection for data security. In 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) (pp. 576–581). IEEE. (2018, June) sourceNot checked — no full text of the source

May combine two claims.

Traditional models lack the ability to capture complex semantic relationships in text, such as contextual anomalies in social media or chat logs, which justifies the shift toward DL integrations.

“They also lack the ability to capture complex semantic relationships in text, such as contextual anomalies in social media or chat logs, which justifies the shift toward DL integrations as per QA1 [12,14].”

• cites [12] Huang, R., Riloff, E.: Inducing domain-specific semantic class taggers from (almost) nothing. In Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics (pp. 275–285). (2010, July)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source

May combine two claims.

DL models are justified for their capacity to learn hierarchical representations, with empirical validations on datasets like CERT and Enron.

“These models are justified for their capacity to learn hierarchical representations, addressing QA1 by providing robust justifications through empirical validations on datasets like CERT and Enron [2,3,13].”

• cites [2] Predd, J., Pfleeger, S.L., Hunker, J., Bulford, C.: Insiders are behaving badly. IEEE Secur. Priv. 6(4), 66–70 (2008) sourceNot checked — no full text of the source
• cites [3] Yuan, S., Wu, X.: Deep learning for insider threat detection: Review, challenges, and opportunities. Computers Secur. 104, 102221 (2021) sourceNot checked — no full text of the source
• cites [13] Liang, N., Biros, D.P., Luse, A.: An empirical validation of malicious insider characteristics. J. Manage. Inform. Syst. 33(2), 361–392 (2016) sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Support Vector Machines and Naive Bayes are commonly applied to classify anomalous behaviors in log data or email content.

“For instance, Support Vector Machines (SVM) and Naive Bayes are commonly applied to classify anomalous behaviors in log data or email content.”

May combine two claims.

Despite trade-offs, hybrids offer superior metrics, making them ideal for dynamic environments.

“Despite this, hybrids offer superior metrics, as validated in QA3, making them ideal for dynamic environments [16,64].”

• cites [16] Michael, A.: A Machine Learning Approach to Detect Insider Threats in Emails Caused by Human Behaviour (Master’s thesis, University of Pretoria (South Africa)). (2020)Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [64] Vinay, M.S., Yuan, S., Wu, X.: Contrastive learning for insider threat detection. International Conference on Database Systems for Advanced Applications. Cham: Springer International Publishing (2022) sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Sentiment analysis identifies emotional tones in emails or chats, flagging precursors like disgruntlement.

“Sentiment analysis identifies emotional tones in emails or chats, flagging precursors like disgruntlement.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Named Entity Recognition extracts entities like names or locations, enhancing threat correlation.

“NER extracts entities like names or locations, enhancing threat correlation.”

May combine two claims.

Hybrid and ensemble models integrate traditional ML with DL, enhancing feature fusion and combining NLP techniques such as TF-IDF and NER with models like XGBoost and LSTM for multi-source data analysis.

“Hybrid and ensemble models integrate traditional ML with DL, enhancing feature fusion and addressing RQ1 by combining NLP techniques (e.g., TF-IDF, NER) with models like XGBoost and LSTM for multi-source data analysis.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Structural features emphasize syntactic patterns, such as n-grams, sentence length, or graph-based representations.

“Structural features emphasize syntactic patterns, such as n-grams, sentence length, or graph-based representations.”

May combine two claims.

Word2Vec generates dense embeddings that capture contextual relationships and is used in log analysis to detect anomalies with True Positive Rates reaching 100% at specific window sizes.

“Word2Vec generates dense embeddings that capture contextual relationships, used in log analysis to detect anomalies with True Positive Rates (TPR) reaching 100% at specific window sizes [14,67].”

• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source
• cites [67] Singh, M., Mehtre, B.M., Sangeetha, S.: User behaviour based insider threat detection in critical infrastructures. 2021 2nd International Conference on Secure Cyber Computing and Communications (ICSCCC). IEEE (2021) sourceNot checked — no full text of the source

May combine two claims.

Jovanovic et al. (2024) proposed a method combining NLP with XGBoost and BERT to analyze employee behaviour, achieving accuracy exceeding 97% on simulated security datasets.

“Jovanovic et al. (2024) [53] proposed a method combining NLP with Extreme Gradient Boosting (XGBoost) and BERT to analyze employee behaviour, enhancing robustness against common firewall evasion tactics and achieving accuracy exceeding 97% on simulated security datasets using a modified reptile search algorithm for hyperparameter selection.”

• cites [53] Jovanovic, L., Kaljevic, J., Zivkovic, M., Bacanin, N., Antonijevic, M.: and Miroslav Cajic. Insider Threat Identification From Accessed Website Content Optimized by Modified Metaheuristic. In 2024 International Conference on Circuit, Systems and Communication (ICCSC), pp. 1–6. IEEE, (2024) sourceNot checked — no full text of the source

May combine two claims.

CMU Logs are appropriate for benchmarking NLP models due to structured scenarios, supporting Word2Vec with 100% TPR, but their synthetic bias reduces applicability to real-world settings.

“CMU Logs are appropriate for benchmarking NLP models due to their structured scenarios, supporting Word2Vec with 100% TPR [14,40], but their synthetic bias reduces applicability to real-world settings.”

• cites [14] Choi, D., Ko, B., Kim, H., Kim, P.: Text analysis for detecting terrorism-related articles on the web. J. Netw. Comput. Appl. 38, 16–21 (2014) sourceNot checked — no full text of the source
• cites [40] Qasim, M., Salman, M., Pedersen, J.M., Masood, A., Abbas, H.: NLP and ML Synergy: A Novel Approach in Botnet Detection from Sandbox Artifacts. In 2024 ASU International Conference in Emerging Technologies for Sustainability and Intelligent Systems (ICETSIS), pp. 1679–1684. IEEE, (2024) sourceNot checked — no full text of the source

May combine two claims.