Evaluating Insider Threat Detection Workflow Using Supervised and Unsupervised Learning

The citation [7] is attached to the CERT dataset’s claimed 17-month window, not the LSTM-RNN result. The paper’s “A. CERT insider threat dataset” section says that 18 months of data were extracted, contrary to the cited figure. The sentence’s proposal for a hybrid pipeline is not directly attributed to this source. (LLM, conf=0.89)

Checked by a reasoning model — may be wrong.

The CERT insider threat dataset section says release 4.2 has significantly more insider-threat incidents than other releases, allowing tests across more diverse scenarios. It does not give a 7% malicious-activity rate, identify an expanded feature set relative to 4.1, or compare model accuracy across the two releases. The Conclusion instead reports that malicious instances comprise 0.39% of weekly and 0.29% of daily preprocessed data in 4.2. (LLM, conf=0.88)

The CERT insider threat dataset section describes records of logins, email, web, file, and device activity, supporting its use for log-based behavioral analysis. The paper evaluates hidden Markov models, self-organizing maps, and decision trees; it does not support the attributed NER or graph-based models, a 93.97% accuracy for them, or the claim that CERT is 'best suited' for this analysis. Page numbers are unavailable in our copy. (LLM, conf=0.88)

The CERT insider threat dataset section says the study used release 4.2. But the passage labeled V. Conclusion reports that insider-threat instances were 0.39% of weekly and 0.29% of daily preprocessed data, not 7%. The contrastive-learning result is attached to a different citation, and the broader characterization is the citing authors’ framing. (LLM, conf=0.89)

The CERT insider threat dataset section says the study used release 4.2, and Table I reports accuracies above 94% for its C4.5 decision tree. Those figures do not establish the attributed performance of BERT, RoBERTa, or DD-GCN: the paper evaluates HMM, SOM, and decision-tree methods, not those deep-learning models. The CERT 6.2 figure is attached to a different citation in the citing sentence and is not assessed here. (LLM, conf=0.87)

The CERT dataset and decision-tree results sections report shifts and drifts in user behavior and say a conventional supervised model may not adapt well. They evaluate simulated CERT data, however, not live data; the reported accuracy values do not include a drop to 73.4%. The paper also does not establish that CERT logs fail to capture dynamic real-world behavior. (LLM, conf=0.82)

The CERT insider threat dataset section describes a finite dataset, but says the analysis extracted 18 months of data, not a 17-month window. The Conclusion also refers to 72 weeks of data, approximately 17 months. The citation supports the use of a bounded CERT dataset, but not the precise duration stated. (LLM, conf=0.84)

The CERT insider threat dataset section (page unavailable) says release 4.2 has more insider-threat incidents than other releases, allowing tests across a more diverse set of scenarios. It does not report that CERT r4.2 was used in 40.9% of studies or that hybrid models achieved 96.70% accuracy; the reported results concern HMM, SOM, and decision-tree methods. (LLM, conf=0.88)

The CERT insider threat dataset section identifies release 4.2 as a synthesized dataset used in this study. The Feature extraction section says the study excluded email, web, and file content from analysis, so it does not establish reliance by NLP detection. The reported accuracy results also do not substantiate the cited 96.26% figure; the Enron figure is attached to a different citation. (LLM, conf=0.88)

The Data preprocessing section (page unavailable) describes challenges in combining continuously generated logs from multiple sources, and the Conclusion identifies streaming-data analysis as future work. The paper therefore supports a gap related to timely log analysis, but does not present an RQ2 dataset analysis or identify a new gap specifically in real-time logs. The Glasser and Lindauer comparison is attached to a different citation. (LLM, conf=0.82)

The Learning algorithms section describes self-organizing maps, hidden Markov models, and decision trees—not DD-GCN. Table I reports accuracy results on the CERT dataset, but not 96.26%–96.70%. Searches for DD-GCN and those figures found no passage addressing the claimed method or result. (LLM, conf=0.76)

The Learning algorithms section studies self-organizing maps, hidden Markov models, and decision trees, while the CERT insider threat dataset results report their detection performance. A search of our copy found no DD-GCN result, 96.26%–96.70% accuracy, or discussion of that model’s real-time deployment or trust challenges; the cited paper therefore does not verify the part attached to [7]. (LLM, conf=0.78)