Exploring Adversarial Properties of Insider Threat Detection
Abstract
Insider threat represents a major cybersecurity challenge to companies and government agencies. The challenges in insider threat detection include unbalanced data, limited ground truth, and possible user behaviour changes. This research presents an unsupervised machine learning (ML) based anomaly detection approach for insider threat detection. We employ two ML methods with different working principles, specifically auto-encoder and isolation forest, and explore various representations of data with temporal information. Evaluation results show that the approach allows learning from unlabelled data under adversarial conditions for insider threat detection with a high detection and a low false positive rate. For example, 60% of malicious insiders are detected under 0.1% investigation budget. Furthermore, we explore the ability of the proposed approach to generalize for detecting unseen anomalous behaviours in different datasets, i.e. robustness. Comparisons with other work in the literature confirm the effectiveness of the proposed approach.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The effectiveness of behavior-based detection methods hinges on the quality of the baseline behavior models.
“The authors of [62], [63] show that the effectiveness of these methods hinges on the quality of the baseline behavior models.”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [62]
Cites
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946 · see citing works
Scikit-learn: Machine Learning in Python
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Müller, A., Nothman, J., Louppe, G., et al. (2012) · arXiv · doi:10.48550/arxiv.1201.0490 · Cited by 71,016 · see citing works
(2011) · Cited by 6,993 · see citing works
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601 · see citing works
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332 · see citing works
Isolation-Based Anomaly Detection
Liu, F. T., Ting, K. M., & Zhou, Z. (2012) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2133360.2133363 · Cited by 2,112 · see citing works
Network Anomaly Detection: Methods, Systems and Tools
Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.052213.00046 · Cited by 1,358 · see citing works
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194 · see citing works
Aggregation and Correlation of Intrusion-Detection Alerts
Debar, H., & Wespi, A. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45474-8_6 · Cited by 618 · see citing works
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
Open challenges for data stream mining research
Krempl, G., Žliobaitė, I., Brzeziński, D., Hüllermeier, E., Last, M., Lemaire, V., Noack, T., Shaker, A., Sievi, S., Spiliopoulou, M., et al. (2014) · ACM SIGKDD Explorations Newsletter · doi:10.1145/2674026.2674028 · Cited by 295 · see citing works
Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint
Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 286 · see citing works
Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., & Ochoa, M. (2020) · ACM Computing Surveys · doi:10.1145/3303771 · Cited by 255 · see citing works
Analyzing Data Granularity Levels for Insider Threat Detection Using Machine Learning
Le, D. C., Zincir-Heywood, N., & Heywood, M. I. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2967721 · Cited by 191 · see citing works
Self-citationA New Take on Detecting Insider Threats: Exploring the Use of Hidden Markov Models
Rashid, T., Agrafiotis, I., & Nurse, J. R. C. (2016) · Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats · doi:10.1145/2995959.2995964 · Cited by 152 · see citing works
On the capability of an SOM based intrusion detection system
Kayacık, H. G., Zincir-Heywood, N., & Heywood, M. I. (2004) · doi:10.1109/ijcnn.2003.1223682 · Cited by 149 · see citing works
Self-citationAutomated Insider Threat Detection System Using User and Role-Based Profile Assessment
Legg, P., Buckley, O. E., Goldsmith, M. H., & Creese, S. (2015) · IEEE Systems Journal · doi:10.1109/jsyst.2015.2438442 · Cited by 145 · see citing works
Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data
Azaria, A., Richardson, A., Kraus, S., & Subrahmanian, V. S. (2014) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2014.2377811 · Cited by 133 · see citing works
Detecting insider threats in a real corporate database of computer usage activity
Senator, T. E., Goldberg, H. G., Memory, A., Young, W. T., Rees, B., Pierce, R., Huang, D., Reardon, M., Bader, D. A., Chow, E., et al. (2013) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2487575.2488213 · Cited by 132 · see citing works
Insider Threat Detection Using a Graph-Based Approach
Eberle, W., Graves, J. A., & Holder, L. B. (2010) · Journal of Applied Security Research · doi:10.1080/19361610.2011.529413 · Cited by 119 · see citing works
Multi-Domain Information Fusion for Insider Threat Detection
Eldardiry, H., Bart, E., Liu, J., Hanley, J., Price, B., & Brdiczka, O. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.14 · Cited by 100 · see citing works
Böse, B., Avasarala, B., Tirthapura, S., Chung, Y.-Y., & Steiner, D. D. (2017) · IEEE Systems Journal · doi:10.1109/jsyst.2016.2558507 · Cited by 94 · see citing works
Ferreira, P. H. G., Le, D. C., & Zincir-Heywood, N. (2019) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm46954.2019.9012708 · Cited by 81 · see citing works
Self-citationEvaluating Insider Threat Detection Workflow Using Supervised and Unsupervised Learning
Le, D. C., & Zincir-Heywood, A. N. (2018) · 2018 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00043 · Cited by 66 · see citing works
Self-citationExploring anomalous behaviour detection and classification for insider threat identification
Le, D. C., & Zincir‐Heywood, N. (2021) · International Journal of Network Management · doi:10.1002/nem.2109 · Cited by 56 · see citing works
Self-citationA Trust Aware Unsupervised Learning Approach for Insider Threat Detection
Aldairi, M., Karimi, L., & Joshi, J. B. D. (2019) · IEEE International Conference on Information Reuse and Integration (IRI) · doi:10.1109/iri.2019.00027 · Cited by 40 · see citing works
Unsupervised incremental sequence learning for insider threat detection
Parveen, P., & Thuraisingham, B. M. (2012) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2012.6284271 · Cited by 37 · see citing works
Benchmarking evolutionary computation approaches to insider threat detection
Le, D. C., Khanchi, S., Zincir-Heywood, N., & Heywood, M. I. (2018) · Genetic and Evolutionary Computation Conference (GECCO) · doi:10.1145/3205455.3205612 · Cited by 33 · see citing works
Self-citationInsider Threat Identification Using the Simultaneous Neural Learning of Multi-Source Logs
Liu, L., Chen, C., Zhang, J., De Vel, O., & Xiang, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2957055 · Cited by 31 · see citing works
Machine learning based Insider Threat Modelling and Detection
Le, D. C., & Zincir-Heywood, N. (2019) · Immunotechnology · Cited by 30 · see citing works
Self-citationA Frontier: Dependable, Reliable and Secure Machine Learning for Network/System Management
Le, D. C., & Zincir-Heywood, N. (2020) · Journal of Network and Systems Management · doi:10.1007/s10922-020-09512-5 · Cited by 21 · see citing works
Self-citationInsider Threat Detection in PRODIGAL
Goldberg, H. G., Young, W., Reardon, M., Phillips, B., & Senator, T. E. (2017) · Hawaii International Conference on System Sciences (HICSS) · doi:10.24251/hicss.2017.320 · Cited by 21 · see citing works
Common Sense Guide to Mitigating Insider Threats, Fifth Edition
Collins, M. L., Theis, M., Trzeciak, R., Strozer, J., Clark, J., Costa, D., Cassidy, T., Albrethsen, M., & Moore, A. (2016) · Figshare · doi:10.1184/r1/12890918 · Cited by 19 · see citing works
Unsupervised Insider Detection Through Neural Feature Learning and Model Optimisation
Liu, L., Chen, C., Zhang, J., Vel, O. D., & Xiang, Y. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-36938-5_2 · Cited by 17 · see citing works
Peer Group Metadata-Informed LSTM Ensembles for Insider Threat Detection.
Matterer, J., & LeJeune, D. (2018) · The Florida AI Research Society · Cited by 6 · see citing works
Dynamic Insider Threat Detection Based on Adaptable Genetic Programming
Le, D. C., Zincir-Heywood, N., & Heywood, M. I. (2019) · IEEE Symposium Series on Computational Intelligence (SSCI) · doi:10.1109/ssci44817.2019.9003134 · Cited by 6 · see citing works
Self-citation
Flagged first, then by citations
5 of the 41 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
“The authors of [62] and [63] show that the effectiveness of these methods hinges on the quality of the baseline behavior models.”
BackgroundAnomaly Detection for Insider Threats Using Unsupervised Ensembles
Le, D. C., & Zincir-Heywood, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3071928 · Cited by 147 · see citing works
Self-citationS, A., D, S., & G, P. (2023) · Computers and Electrical Engineering · doi:10.1016/j.compeleceng.2022.108519 · Cited by 27 · see citing works
Secure IoT Search Engine: Survey, Challenges Issues, Case Study, and Future Research Direction
Hatcher, W. G., Qian, C., Liang, F., Liao, W., Blasch, E., & Yu, W. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3153171 · Cited by 24 · see citing works
Image-Based Insider Threat Detection via Geometric Transformation
Li, D., Yang, L., Zhang, H., Wang, X., Ma, L., & Xiao, J. (2021) · Security and Communication Networks · doi:10.1155/2021/1777536 · Cited by 22 · see citing works
An Exploratory Study of Cognitive Sciences Applied to Cybersecurity
Andrade, R., Fuertes, W., Cazares, M. F., Ortiz-Garcés, I., & Navas, G. (2022) · Electronics · doi:10.3390/electronics11111692 · Cited by 18 · see citing works
Training regime influences to semi-supervised learning for insider threat detection
Le, D. C., Zincir-Heywood, N., & Heywood, M. I. (2021) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw53761.2021.00010 · Cited by 19 · see citing works
Self-citationUAG: User Action Graph Based on System Logs for Insider Threat Detection
Wang, X., Jiang, J., Wang, Y., Lv, Q., & Wang, L. (2023) · 2023 IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc58397.2023.10218139 · Cited by 6 · see citing works
Ofori, H. K., Bell-Dzide, K., Brown-Acquaye, W. L., Lempogo, F., Frimpong, S. O., Agbehadji, I. E., & Millham, R. C. (2025) · Symmetry · doi:10.3390/sym17101704 · Cited by 7 · see citing works
Jaiswal, A., Dwivedi, P., & Dewang, R. K. (2024) · Multimedia Tools and Applications · doi:10.1007/s11042-024-20273-0 · Cited by 6 · see citing works
Memory-Augmented Insider Threat Detection with Temporal-Spatial Fusion
Li, D., Yang, L., Zhang, H., Wang, X., & Ma, L. (2022) · Security and Communication Networks · doi:10.1155/2022/6418420 · Cited by 6 · see citing works
Insider Threat Detection: Using Classification Models
Rao, T. K. R., Darapaneni, N., Paduri, A. R., Amarnath, G. S., Kumar, A., & Ps, G. (2023) · International Conference on Contemporary Computing · doi:10.1145/3607947.3608009 · Cited by 3 · see citing works
Mohapatra, M., Phukan, A., & Madisetti, V. K. (2023) · Journal of Software Engineering and Applications · doi:10.4236/jsea.2023.1611030 · Cited by 2 · see citing works
Systematic Literature Review and Metadata Analysis of Insider Threat Detection Mechanism
Idris, I., & Damilola, A. N. (2023) · International Journal of Computer Science and Mobile Computing · doi:10.47760/ijcsmc.2023.v12i04.007 · Cited by 1 · see citing works
Big Data in Network Anomaly Detection
Le, D. C., & Zincir-Heywood, N. (2012) · Encyclopedia of Big Data Technologies · doi:10.1007/978-3-319-63962-8_161-2
Self-citationGhawa, S., & Alhargan, A. (2026) · Electronics · doi:10.3390/electronics15091863
CLASSIFICATION OF VISITORS AND IDENTIFYING INTRUDERS IN A NETWORK
Hejazi, N., & Ozdemır, E. (2026) · International Journal of Informatics and Applied Mathematics · doi:10.53508/ijiam.1780395
- Authors
- Le, D. C., & Zincir-Heywood, N.
- Affiliations
- Dalhousie University (CA)
- Venue
- 2020 IEEE Conference on Communications and Network Security (CNS)
- Publisher
- IEEE
- Published
- 2020-06
- Pages
- 1-9
- ISSN
- 2474-025X (ISSN-L)
- OpenAlex
- W3047980200
- Cited by
- 17
- References
- 41
- Citations by year
- 2026: 2 · 2025: 1 · 2024: 2 · 2023: 4 · 2022: 4 · 2021: 3 · 2012: 1
- FWCI
- 2.31
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Conference on Communications and Network Security (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Keywords
- insider threat detection, anomaly detection, unsupervised learning, autoencoder, Isolation Forest, temporal data representation, adversarial robustness, class imbalance, user behavior change, false positive rate
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
