Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection
Open accessAbstract
An insider threat is anyone who has legitimate access to a particular organization’s network and uses that access to harm that organization. Insider threats may act with or without intent, but when they have an intention, they usually also have some specific motivation. This motivation can vary, including but not limited to personal discontent, financial issues, and coercion. It is hard to face insider threats with traditional security solutions because those solutions are limited to the signature detection paradigm. To overcome this restriction, researchers have proposed using Machine Learning which can address Insider Threat issues more comprehensively. Some of them have used batch learning, and others have used stream learning. Batch approaches are simpler to implement, but the problem is how to apply them in the real world. That is because real insider threat scenarios have complex characteristics to address by batch learning. Although more complex, stream approaches are more comprehensive and feasible to implement. Some studies have also used unsupervised and supervised Machine Learning techniques, but obtaining labeled samples makes it hard to implement fully supervised solutions. This study proposes a framework that combines different data science techniques to address insider threat detection. Among them are using semi-supervised and supervised machine learning, data stream analysis, and periodic retraining procedures. The algorithms used in the implementation were Isolation Forest, Elliptic Envelop, and Local Outlier Factor. This study evaluated the results according to the values obtained by the precision, recall, and F1-Score metrics. The best results were obtained by the ISOF algorithm, with 0.78 for the positive class (malign) recall and 0.80 for the negative class (benign) recall.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Scalability and performance of insider threat detection systems is a significant challenge, because organizations with large user bases and complex infrastructures require algorithms and models that efficiently handle vast datasets and scale horizontally.
“One significant challenge involves the scalability and performance of detection systems, as organizations with large user bases and complex infrastructures require algorithms and models capable of efficiently handling vast datasets and scaling horizontally to accommodate growth [8], [20].”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [20]
The approach in [20] shows promise in handling highly imbalanced datasets and adapting to concept changes in the data stream.
“The approach shows promise in handling highly imbalanced datasets and adapting to concept changes in the data stream.”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [20]
The approach in [20] requires labeled normal samples, may lead to false positives, and needs further validation in real-world scenarios to assess its practical effectiveness.
“However, it requires labeled normal samples, may lead to false positives, and needs further validation in real-world scenarios to assess its practical effectiveness.”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [20]
Recent work [20] explores the application of one-class algorithms for data stream-based insider threat detection, using a hybrid analysis approach that combines offline batch training and online stream retraining.
“Recent work [20] explores the application of one-class algorithms for data stream-based insider threat detection, using a hybrid analysis approach that combines offline batch training and online stream retraining.”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [20]
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538 · see citing works
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601 · see citing works
LOF: identifying density-based local outliers
Breunig, M. M., Kriegel, H.-P., Ng, R. T., & Sander, J. (2000) · Proceedings of the 2000 ACM SIGMOD international conference on Management of data · doi:10.1145/342009.335388 · Cited by 4,149 · see citing works
New ensemble methods for evolving data streams
Bifet, A., Holmes, G., Pfahringer, B., Kirkby, R., & Gavaldà, R. (2009) · Knowledge Discovery and Data Mining · doi:10.1145/1557019.1557041 · Cited by 640 · see citing works
One-class classification: taxonomy of study and review of techniques
Khan, S. S., & Madden, M. G. (2014) · The Knowledge Engineering Review · doi:10.1017/s026988891300043x · Cited by 605 · see citing works
Grid Search, Random Search, Genetic Algorithm: A Big Comparison for NASPreprint
Liashchynskyi, P. B., & Liashchynskyi, P. B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.06059 · Cited by 585 · see citing works
A Survey on Ensemble Learning for Data Stream Classification
Gomes, H. M., Barddal, J. P., Enembreck, F., & Bifet, A. (2018) · ACM Computing Surveys · doi:10.1145/3054925 · Cited by 579 · see citing works
Knowledge Discovery from Data Streams
da Gama, J. M. P. (2010) · Chapman & Hall/CRC eBooks · doi:10.1201/ebk1439826119 · Cited by 572 · see citing works
Detecting and Preventing Cyber Insider Threats: A Survey
Liu, L., Vel, O. D., Han, Q., Zhang, J., & Xiang, Y. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2800740 · Cited by 386 · see citing works
A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems
Kendall, K. R. (1999) · Cited by 379 · see citing works
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint
Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 286 · see citing works
Deep learning for insider threat detection: Review, challenges and opportunities
Yuan, S., & Wu, X. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102221 · Cited by 271 · see citing works
Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., & Ochoa, M. (2020) · ACM Computing Surveys · doi:10.1145/3303771 · Cited by 255 · see citing works
Al‐Mhiqani, M. N., Ahmad, R., Abidin, Z. Z., Yassin, W. M., Hassan, A., Abdulkareem, K. H., Ali, N. S., & Yunos, Z. (2020) · Applied Sciences · doi:10.3390/app10155208 · Cited by 188 · see citing works
Gheyas, I. A., & Abdallah, A. E. (2016) · Big Data Analytics · doi:10.1186/s41044-016-0006-0 · Cited by 150 · see citing works
Impact and Key Challenges of Insider Threats on Organizations and Critical Businesses
Saxena, N., Hayes, E., Bertino, E., Ojo, P., Choo, K.-K. R., & Burnap, P. (2020) · Electronics · doi:10.3390/electronics9091460 · Cited by 136 · see citing works
Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
Kim, J., Park, M., Kim, H., Cho, S., & Kang, P. (2019) · Applied Sciences · doi:10.3390/app9194018 · Cited by 134 · see citing works
Detecting insider threats in a real corporate database of computer usage activity
Senator, T. E., Goldberg, H. G., Memory, A., Young, W. T., Rees, B., Pierce, R., Huang, D., Reardon, M., Bader, D. A., Chow, E., et al. (2013) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2487575.2488213 · Cited by 132 · see citing works
Scenario-Based Insider Threat Detection From Cyber Activities
Chattopadhyay, P., Wang, L., & Tan, Y.-P. (2018) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2018.2857473 · Cited by 115 · see citing works
Vakili, M., Ghamsari, M., & Rezaei, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.09636 · Cited by 109 · see citing works
Böse, B., Avasarala, B., Tirthapura, S., Chung, Y.-Y., & Steiner, D. D. (2017) · IEEE Systems Journal · doi:10.1109/jsyst.2016.2558507 · Cited by 94 · see citing works
One-class classifiers with incremental learning and forgetting for data streams with concept drift
Krawczyk, B., & Woźniak, M. (2014) · Soft Computing · doi:10.1007/s00500-014-1492-5 · Cited by 91 · see citing works
Common Sense Guide to Mitigating Insider Threats 4th Edition
Silowash, G. J., Cappelli, D. M., Moore, A., Trzeciak, R. F., Shimeall, T. J., & Flynn, L. (2012) · doi:10.21236/ada585500 · Cited by 74 · see citing works
Employee profiling via aspect-based sentiment and network for insider threats detection
Soh, C., Yu, S., Narayanan, A., Duraisamy, S., & Chen, L. (2019) · Expert Systems with Applications · doi:10.1016/j.eswa.2019.05.043 · Cited by 61 · see citing works
Active learning approach to concept drift problem
Kurlej, B., & Woźniak, M. (2011) · Logic Journal of IGPL · doi:10.1093/jigpal/jzr011 · Cited by 40 · see citing works
Resample-Based Ensemble Framework for Drifting Imbalanced Data Streams
Zhang, H., Liu, W., Wang, S., Shan, J., & Liu, Q. (2019) · IEEE Access · doi:10.1109/access.2019.2914725 · Cited by 37 · see citing works
Machine learning based Insider Threat Modelling and Detection
Le, D. C., & Zincir-Heywood, N. (2019) · Immunotechnology · Cited by 30 · see citing works
Hall, A. J., Pitropakis, N., Buchanan, W. J., & Moradpoor, N. (2018) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2018.8621922 · Cited by 28 · see citing works
EVOLVING INSIDER THREAT DETECTION STREAM MINING PERSPECTIVE
Parveen, P., McDaniel, N., Weger, Z. R., EVANS, J., Thuraisingham, B. M., Hamlen, K. W., & Khan, L. R. (2013) · International Journal of Artificial Intelligence Tools · doi:10.1142/s0218213013600130 · Cited by 27 · see citing works
Real-Time Dynamic Network Anomaly Detection
Noble, J., & Adams, N. M. (2018) · IEEE Intelligent Systems · doi:10.1109/mis.2018.022441346 · Cited by 14 · see citing works
A study on Classification of Insider threat using Markov Chain Model
Kim, D., Hong, S.-S., & Han, M.-M. (2018) · KSII Transactions on Internet and Information Systems · doi:10.3837/tiis.2018.04.027 · Cited by 10 · see citing works
Algorithm Recommendation for Data Streams
de, J. M. C., Rossi, A. L. D., Batista, G. E. A. P. A., & Garcia, L. P. F. (2021) · Proceedings - International Conference on Pattern Recognition/Proceedings/International Conference on Pattern Recognition · doi:10.1109/icpr48806.2021.9411923 · Cited by 5 · see citing works
Self-citationA Holistic Approach to Insider Threat Detection
Berdal, S. J. (2018) · NORA - Norwegian Open Research Archives · Cited by 3 · see citing works
The Elliptical EnvelopePreprint
Howard, S. (2007) · arXiv (Cornell University) · doi:10.48550/arxiv.math/0703048 · Cited by 3 · see citing works
Contextual One-Class Classification in Data StreamsPreprint
Moulton, R. H., Viktor, H. L., Japkowicz, N., & da Gama, J. M. P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.04233 · Cited by 2 · see citing works
Flagged first, then by citations
3 of the 39 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
“One significant challenge involves the scalability and performance of detection systems, as organizations with large user bases and complex infrastructures require algorithms and models capable of efficiently handling vast datasets and scaling horizontally to accommodate growth [8], [20].”
BackgroundInfluentialSaeed Alketbi, K., & Mehmood, A. (2025) · IEEE Access · doi:10.1109/access.2025.3587114 · Cited by 41 · see citing works
“As demonstrated in studies such as [45] and [56], SHAP enables the tracing of influential features in models trained on complex datasets like UNSW-NB15 and IoT telemetry.”
Mitigating Insider Threat: A Neural Network Approach for Enhanced Security
Lavanya, P., Glory, H. A., & Sriram, V. S. S. (2024) · IEEE Access · doi:10.1109/access.2024.3404814 · Cited by 19 · see citing works
Securing the edge: privacy-preserving federated learning for insider threats in IoT networks
Kamatchi, K., & Uma, E. (2024) · The Journal of Supercomputing · doi:10.1007/s11227-024-06752-z · Cited by 17 · see citing works
Qawasmeh, S. A.-D., & AlQahtani, A. A. S. (2025) · Future Internet · doi:10.3390/fi17020093 · Cited by 9 · see citing works
Insider Threat Detection using Explainable Machine Learning Models in Corporate Networks
Bhatnagar, P., Mandru, S. K., Sharma, P., Singh, V., Singh, J. P., & Katheria, S. (2025) · International Conference on Electronics, Communication and Aerospace Technology (ICECA) · doi:10.1109/iceca66444.2025.11383006 · Cited by 3 · see citing works
Game Theoretic Modeling of Insider Threats in an Organization
Lalropuia, K. C., Goyal, S. B., & de Soto, B. G. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-61489-7_12 · Cited by 2 · see citing works
Assessing Current Scenario of Insider Threat in the Perspective of Recent Pandemic
Sandra, G., Silas, S., & Rajsingh, E. B. (2024) · IEEE International Conference on Signal Processing, Informatics, Communication and Energy Systems (SPICES) · doi:10.1109/spices62143.2024.10779964 · Cited by 2 · see citing works
Wanyonyi, E. N., Abeka, S., & Masinde, N. (2023) · International Journal of Network Security & Its Applications · doi:10.5121/ijnsa.2023.15603 · Cited by 2 · see citing works
Detection and Mitigation of Insider Attacks in Financial Systems
Pradesh, G., Sangeetha, D., Kishore, V. R., & Sharan, L. (2024) · International Conference on Advances in Computing, Communication and Applied Informatics (ACCAI) · doi:10.1109/accai61061.2024.10602199
Muñoz, P. S., Orozco, A. S. O., Pabón, J., Gómez, D., Salazar-Cabrera, R., Cerón, J. D., López, D. M., & Blobel, B. G. M. E. (2025) · Journal of Personalized Medicine · doi:10.3390/jpm15050208
A Hybrid Machine Learning Framework for Insider Threat Detection and Response
S., S. S., Selvaraj, R., Suresh, V., Gugan, I., & Yogesh, D. (2025) · International Conference on Electronics, Communication and Aerospace Technology (ICECA) · doi:10.1109/iceca66444.2025.11383492
Predictive Modeling of Insider Threats and Corporate Espionage Through Employee Activity Analysis
Srivarshini, R., Suthish., J., & Senthamilarasi, N. (2026) · International Conference on Mobile Computing and Sustainable Informatics (ICMCSI) · doi:10.1109/icmcsi67283.2026.11412695
Mitigating Insider Threat : A Neural Network Approach for Enhanced Security
Ms Bejjanki Pooja, B. A., & Kumar, G. S. K. G. Y. H. (2026) · International Journal of Advanced Research in Science Communication and Technology · doi:10.48175/ijarsct-31933
Detecting Insider Threats Using Unsupervised Machine Learning
Darla, S., N, Y. N. M., Tarun, N., Gaonkar, V. V., & K, M. G. D. (2026) · Contemporary Computing Innovations Conference (CCIC) · doi:10.1109/ccic68129.2026.11486248
Lightweight Supervised Approach for Behavioral Insider Anomaly Detection from SQL Logs
Mahadi, M. H., Abdullah, Y., Ahmed, M. S., Jahan, N., Safwan, M. N., & Chayon, M. H. R. (2025) · International Conference on Computer and Information Technology (ICCIT) · doi:10.1109/iccit68739.2025.11491429
Jurišić, M., Tomičić, I., & Bernik, A. (2026) · Signals · doi:10.3390/signals7040059
AI-Based Insider Threat Detection in Organisations
Vivek, B. S., Ruthvini, M., & Kumar, K. S. (2026) · International Conference on AI, Data Science, Cyber Security and Smart Manufacturing for Sustainable Development (ICADCS) · doi:10.1109/icadcs70036.2026.11583338
CLASSIFICATION OF VISITORS AND IDENTIFYING INTRUDERS IN A NETWORK
Hejazi, N., & Ozdemır, E. (2026) · International Journal of Informatics and Applied Mathematics · doi:10.53508/ijiam.1780395
Adaptive Behavioural Intelligent Insider Threat Detection: A Systematic ReviewPreprint
Galadima, I. B., Wahab, N. H. A., Osman, M. Z., & Danlamid, G. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7302121
Hybrid Ensemble Learning Model with Explainable Anomaly Detection for Insider Threat Analysis
Oommen, L., Abhinav, P., V, Indu Shree, B., & Gadde, A. (2026) · International Conference on Power, Control and Computing Technologies (ICPC2T) · doi:10.1109/icpc2t68221.2026.11646349
Kundiya, K., & Haribhakta, Y. V. (2026) · IEEE Access · doi:10.1109/access.2026.3726811
Hashmi, A. S., Munib, S., Hussain, H., & Kiani, A. A. (2026) · International Journal of Innovations in Science and Technology · doi:10.33411/ijist/2033
Mohan, R., Saleem, F., Alyoubi, K. H., Alsobhi, A. Y., & Bedewi, W. (2026) · Information Sciences · doi:10.1016/j.ins.2026.124281
- Authors
- Peccatiello, R. B., Gondim, J. J. C., & Garcia, L. P. F.
- Affiliations
- Department of Computer Science, University of Brasília, Brasília, Brazil
- Venue
- IEEE Access
- Published
- 2023
- Volume
- 11
- Pages
- 70560-70573
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W4383751149
- Cited by
- 25
- References
- 39
- Citations by year
- 2026: 11 · 2025: 7 · 2024: 6 · 2023: 1
- FWCI
- 2.78
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- IEEE Access (publishedVersion, cc-by-nc-nd)
- LA Referencia (Red Federada de Repositorios Institucionales de Publicaciones Científicas) (submittedVersion, cc-by-nc-nd)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Coordenação de Aperfeiçoamento de Pessoal de Nível Superior—Brazil (CAPES)—Finance Code 001
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- insider threat detection, data stream learning, one-class classification, Isolation Forest, elliptic envelope, local outlier factor, semi-supervised learning, anomaly detection, network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
