Detecting Insider Threat from Enterprise Social and Online Activity Data
Abstract
Insider threat is a significant security risk for organizations. In this paper, we attempt to discover insider threat by identifying abnormal behavior in enterprise social and online activity data of employees. To this end, we process and extract relevant features that are possibly indicative of insider threat behavior. This includes features extracted from social data including email communication patterns and content, and online activity data such as web browsing patterns, email frequency, and file and machine access patterns. Subsequently, we detect statistically abnormal behavior with respect to these features using state-of-the-art anomaly detection methods, and declare this abnormal behavior as a proxy for insider threat activity. We test our approach on a real world data set with artificially injected insider threat events. We obtain a ROC score of 0.77, which shows that our proposed approach is fairly successful in identifying insider threat events. Finally, we build a visualization dashboard that enables managers and HR personnel to quickly identify employees with high threat risk scores which will enable them to take suitable preventive measures and limit security risk.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Cites
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601 · see citing works
A survey of intrusion detection techniques
Lunt, T. F. (1993) · Computers & Security · doi:10.1016/0167-4048(93)90029-5 · Cited by 424 · see citing works
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
A Data-Centric Approach to Insider Attack Detection in Database Systems
Mathew, S., Petropoulos, M., Ngo, H. Q., & Upadhyaya, S. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-15512-3_20 · Cited by 164 · see citing works
Insider Threat Prediction Tool: Evaluating the probability of IT misuse
Magklaras, G., & Furnell, S. (2001) · Computers & Security · doi:10.1016/s0167-4048(02)00109-8 · Cited by 150 · see citing works
An Insider Threat Prediction Model
Kandias, M., Mylonas, A., Virvilis, N., Theocharidou, M., & Gritzalis, D. A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-15152-1_3 · Cited by 133 · see citing works
Insider Threat Detection Using a Graph-Based Approach
Eberle, W., Graves, J. A., & Holder, L. B. (2010) · Journal of Applied Security Research · doi:10.1080/19361610.2011.529413 · Cited by 119 · see citing works
Multi-Domain Information Fusion for Insider Threat Detection
Eldardiry, H., Bart, E., Liu, J., Hanley, J., Price, B., & Brdiczka, O. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.14 · Cited by 100 · see citing works
Self-citationIdentifying at-risk employees: A behavioral model for predicting potential insider threats
Greitzer, F. L., Kangas, L. J., Noonan, C. F., & Dalton, A. C. (2010) · doi:10.2172/1000159 · Cited by 45 · see citing works
Detecting Unknown Insider Threat Scenarios
Young, W. T., Memory, A., Goldberg, H. G., & Senator, T. E. (2014) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2014.42 · Cited by 35 · see citing works
A Scenario-Based Approach to Mitigating the Insider Threat
Mills, R. F., Grimaila, M. R., Peterson, G. L., & Butts, J. W. (2011) · Cited by 11 · see citing works
Context-Aware Insider Threat Detection
Memory, A., Goldberg, H. G., & Senator, T. E. (2013) · National Conference on Artificial Intelligence · Cited by 8 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3363224 · Cited by 319 · see citing works
Insider Threat Detection with Deep Neural Network
Yuan, F., Cao, Y., Shang, Y., Liu, Y., Tan, J., & Fang, B. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-93698-7_4 · Cited by 168 · see citing works
Scenario-Based Insider Threat Detection From Cyber Activities
Chattopadhyay, P., Wang, L., & Tan, Y.-P. (2018) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2018.2857473 · Cited by 115 · see citing works
A graph empowered insider threat detection framework based on daily activities
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., Liu, M., & Man, C. (2023) · ISA Transactions · doi:10.1016/j.isatra.2023.06.030 · Cited by 60 · see citing works
Al-Shehari, T. A., Rosaci, D., Al-Razgan, M., Alfakih, T., Kadrie, M., Afzal, H., & Nawaz, R. (2024) · IEEE Access · doi:10.1109/access.2024.3373694 · Cited by 51 · see citing works
“An anomaly and quitter detection mechanism were proposed to compact insider threats by Gavai et al. [11] They employed various machine learning-based techniques on insiders’ activity log data throughout the organization.”
MethodBRITD: behavior rhythm insider threat detection with time awareness and user adaptation
Song, S., Gao, N., Zhang, Y., & Ma, C. (2024) · Cybersecurity · doi:10.1186/s42400-023-00190-9 · Cited by 45 · see citing works
“Gavai et al. (2015) use IF to capture anomalies in user behaviors relative to their own historical behaviors and relative to their colleagues’ behaviors.”
BackgroundAttack Tree Analysis for Insider Threats on the IoT Using Isabelle
Kammüller, F., Nurse, J. R. C., & Probst, C. W. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-39381-0_21 · Cited by 36 · see citing works
Edge‐based blockchain enabled anomaly detection for insider attack prevention in Internet of Things
Tukur, Y. M., Thakker, D., & Awan, I. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4158 · Cited by 42 · see citing works
Graph Intelligence Enhanced Bi-Channel Insider Threat Detection
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., & Liu, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-23020-2_5 · Cited by 34 · see citing works
Kul, G., Luong, D. T. A., Xie, T., Coonan, P., Chandola, V., Kennedy, O. A., & Upadhyaya, S. (2016) · International World Wide Web Conference (WWW) · doi:10.1145/2872518.2888608 · Cited by 31 · see citing works
Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
Wang, J., Sun, Q., & Zhou, C. (2023) · Applied Sciences · doi:10.3390/app132413021 · Cited by 32 · see citing works
Ye, X. L., Luo, F., Cui, H., Wang, J., Xiong, X., Zhang, W., Yu, J., & Zhao, W. (2025) · Scientific Reports · doi:10.1038/s41598-025-04029-w · Cited by 30 · see citing works
Image-Based Insider Threat Detection via Geometric Transformation
Li, D., Yang, L., Zhang, H., Wang, X., Ma, L., & Xiao, J. (2021) · Security and Communication Networks · doi:10.1155/2021/1777536 · Cited by 22 · see citing works
A Model-Based Approach to Predicting the Performance of Insider Threat Detection Systems
Roberts, S. C., Holodnak, J. T., Nguyen, T., Yuditskaya, S., Milosavljevic, M., & Streilein, W. (2016) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2016.14 · Cited by 20 · see citing works
A Hybrid Model Based on Multi-dimensional Features for Insider Threat Detection
Lv, B., Wang, D., Wang, Y., Lv, Q., & Lu, D. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-94268-1_28 · Cited by 20 · see citing works
Randive, K. D., & Ramasundaram, M. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.126588 · Cited by 16 · see citing works
Ethereum Blockchain-Based Solution to Insider Threats on Perception Layer of IoT Systems
Tukur, Y. M., Thakker, D., & Awan, I. (2019) · doi:10.1109/gciot47977.2019.9058395 · Cited by 14 · see citing works
User Behavior Threat Detection Based on Adaptive Sliding Window GAN
Tao, X., Lu, S., Zhao, F., Lan, R., Chen, L., Fu, L., & Jia, R. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3355698 · Cited by 13 · see citing works
GRU and Multi-autoencoder based Insider Threat Detection for Cyber Security
Meng, F., Lu, P., Li, J., Hu, T., Yin, M., & Lou, F. (2021) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc53577.2021.00035 · Cited by 13 · see citing works
Insider Intrusion Detection Techniques: A State-of-the-Art Review
Nisha, T. N., & Pramod, D. (2023) · Journal of Computer Information Systems · doi:10.1080/08874417.2023.2175337 · Cited by 16 · see citing works
Prediction and Detection of Insider Threat Detection using Emails: A Comparision
Mittal, A., & Garg, U. (2023) · 2023 Second International Conference on Electrical, Electronics, Information and Communication Technologies (ICEEICT) · doi:10.1109/iceeict56924.2023.10157297 · Cited by 12 · see citing works
A Data-Driven Evaluation for Insider Threats
Sun, Y., Xu, H., Bertino, E., & Sun, C. (2016) · Data Science and Engineering · doi:10.1007/s41019-016-0009-x · Cited by 12 · see citing works
A Hybrid Intelligent System for Insider Threat Detection Using Iterative Attention
Ren, X., & Wang, L. (2020) · International Conference on Computing and Data Engineering (ICCDE) · doi:10.1145/3379247.3379251 · Cited by 11 · see citing works
RShield: A Refined Shield for Complex Multi-step Attack Detection Based on Temporal Graph Network
Yang, W., Gao, P., Huang, H., Wei, X., Liu, W., Zhu, S., & Luo, W. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-00129-1_40 · Cited by 10 · see citing works
Insider Threat Detection Using Multi-autoencoder Filtering and Unsupervised Learning
Wei, Y., Chow, K.-P., & Yiu, S. (2020) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-56223-6_15 · Cited by 10 · see citing works
Paxton-Fear, K., Hodges, D., & Buckley, O. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-50309-3_42 · Cited by 9 · see citing works
Insider Threat Detection Based On Heterogeneous Graph Neural Network
Tian, T., Gong, Y., Jiang, B., Liu, J., Feng, H., & Lu, Z. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00096 · Cited by 8 · see citing works
An Insider Threat Detection Model Using One-Hot Encoding and Near-Miss Under-Sampling Techniques
Alsowail, R. A. (2022) · Algorithms for intelligent systems · doi:10.1007/978-981-19-0332-8_13 · Cited by 8 · see citing works
An Internal/Insider Threat Score for Data Loss Prevention and Detection
Kongsgård, K. W., Nordbotten, N. A., Mancini, F., & Engelstad, P. E. (2017) · ACM International Workshop on Security and Privacy Analytics (IWSPA) · doi:10.1145/3041008.3041011 · Cited by 8 · see citing works
Anomaly Detection in Security Logs using Sequence Modeling
Gökstorp, S., Nyberg, J., Kim, Y., Johnson, P., & Dán, G. (2024) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms59830.2024.10575561 · Cited by 8 · see citing works
Shalev, N., Keidar, I., Weinsberg, Y., Moatti, Y., & Ben-Yehuda, E. (2017) · ACM SIGOPS Symposium on Operating Systems Principles (SOSP) · doi:10.1145/3132747.3132752 · Cited by 7 · see citing works
Insider Threat Detection: A Review
Manoharan, P., Yin, J., Wang, H., Zhang, Y., & Ye, W. (2024) · International Conference on Networking and Network Applications (NaNA) · doi:10.1109/nana63151.2024.00031 · Cited by 6 · see citing works
Jaiswal, A., Dwivedi, P., & Dewang, R. K. (2024) · Multimedia Tools and Applications · doi:10.1007/s11042-024-20273-0 · Cited by 6 · see citing works
An approach to internal threats detection based on sentiment analysis and network analysis
Wen, X., Dai, K., Xiong, Q., Chen, L., Zhang, J., & Wang, Z. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103557 · Cited by 5 · see citing works
Memory-Augmented Insider Threat Detection with Temporal-Spatial Fusion
Li, D., Yang, L., Zhang, H., Wang, X., & Ma, L. (2022) · Security and Communication Networks · doi:10.1155/2022/6418420 · Cited by 6 · see citing works
A Web Back-End Database Leakage Incident Reconstruction Framework Over Unlabeled Logs
Liu, Y., Liu, Z., Liu, X., & Guo, W. (2022) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2022.3198080 · Cited by 4 · see citing works
CAS - Attention based ISO/IEC 15408–2 Compliant Continuous Audit System for Insider Threat Detection
Rizvi, S. K. J., Javed, K. F., & Moazam, M. (2023) · doi:10.1109/icai58407.2023.10136657 · Cited by 4 · see citing works
Sharma, A. K., G, K. K. V., & Poojari, A. (2024) · Journal of The Institution of Engineers (India) Series B · doi:10.1007/s40031-024-01175-z · Cited by 4 · see citing works
TabSec: A Collaborative Framework for Novel Insider Threat Detection
Huang, Z., Tang, X., Li, H., Cao, X., Cheng, J., Tu, W., & Liu, L. B.-Y. (2024) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa63168.2024.00277 · Cited by 4 · see citing works
Contextual Sequence-Based User Behavior Anomaly Detection
Gonzales, O., Yang, K., & Huang, S. (2025) · IEEE Access · doi:10.1109/access.2025.3543500 · Cited by 3 · see citing works
IDU-Detector: A Synergistic Framework for Robust Masquerader Attack Detection
Huang, Z., Li, X., Cao, X., Chen, K., Wang, L., & Liu, L. B.-Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3503057 · Cited by 4 · see citing works
Yang, Y., & Zhang, M. (2023) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw59978.2023.00042 · Cited by 2 · see citing works
Randive, K. D., Mohan, R., & Sivakrishna, A. M. (2025) · International Journal of Data Science and Analytics · doi:10.1007/s41060-025-00960-3 · Cited by 2 · see citing works
Analyze Organizational Internal Threats Using Machine Learning
Jing, Y., Jiang, C., Chen, W., & Xu, Y. (2023) · International Conference on Applied Machine Learning (ICAML) · doi:10.1109/icaml60083.2023.00013 · Cited by 2 · see citing works
Systematic Literature Review and Metadata Analysis of Insider Threat Detection Mechanism
Idris, I., & Damilola, A. N. (2023) · International Journal of Computer Science and Mobile Computing · doi:10.47760/ijcsmc.2023.v12i04.007 · Cited by 1 · see citing works
Insider Threat Detection on an Imbalanced Dataset Using Balancing Methods
Dinardo, K., Lemoudden, M., & Ahmad, J. E. (2023) · Lecture notes in networks and systems · doi:10.1007/978-3-031-37717-4_80 · Cited by 1 · see citing works
Evaluation of Machine Learning Algorithm and SMOTE for Insider Threat Detection
Ojo, D., Al‐Mhiqani, M. N., Al-Aqrabi, H., & Al‐Shehari, T. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-82931-4_23 · Cited by 1 · see citing works
A Bi-hierarchical Graph Based Approach for Insider Threat Detection
Hou, R., & Deng, X. (2025) · Lecture notes in electrical engineering · doi:10.1007/978-981-96-5318-8_31 · Cited by 1 · see citing works
Behavior‐based Confidence Scoring to Support Access Management in Zero Trust Systems
Schulker, D., Wang, J., Mellon, J., & Garrett, R. C. (2025) · INCOSE International Symposium · doi:10.1002/iis2.70076 · Cited by 1 · see citing works
Socio-technical Security: User Behaviour, Profiling and Modelling and Privacy by Design
Wood, P. (2021) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-030-87166-6_4 · Cited by 1 · see citing works
Application of machine learning methods to counter insider threat to information security
Strizhkov, V. A. (2023) · Вопросы безопасности · doi:10.25136/2409-7543.2023.4.68856 · Cited by 1 · see citing works
Data Leakage Detection Using ML
Ramachandiran, R., Amudhini, J., Priya, P., Harini, C., & Premkumar, K. (2023) · International Conference on System, Computation, Automation and Networking (ICSCAN) · doi:10.1109/icscan58655.2023.10395027 · Cited by 1 · see citing works
Gonzales, O., Huang, S., & Yang, K. (2024) · IEEE International Systems Conference (SysCon) · doi:10.1109/syscon61195.2024.10553441 · Cited by 1 · see citing works
Diagnostics of Insider Risks and Threats in Personnel Security Management of the Enterprise
Zatonatskiy, D. (2019) · Bulletin of Taras Shevchenko National University of Kyiv. Economics · doi:10.17721/1728-2667.2019/204-3/3 · Cited by 1 · see citing works
INSIDER THREAT MANAGEMENT AS AN ELEMENT OF THE CORPORATE ECONOMIC SECURITY
Zatonatskiy, D., Marhasova, V., & Korogod, N. (2021) · Financial and credit activity problems of theory and practice · doi:10.18371/fcaptp.v1i36.227690 · Cited by 1 · see citing works
Computer Vision User Entity Behavior AnalyticsPreprint
Khanna, S. (2022) · arXiv (Cornell University) · doi:10.13140/rg.2.2.29840.94721 · Cited by 1 · see citing works
Not able to resist the urge : social insider attacks on Facebook
Usmani, W. A. (2017) · cIRcle (University of British Columbia) · doi:10.14288/1.0340682
INSIDER THREAT MANAGEMENT: DEFINITION AND INDICATORS UNDER NEW ECONOMY
Zatonatskiy, D. (2019) · Black Sea Economic Studies · doi:10.32843/bses.46-15
Machine Learning based analysis of users’ online behaviour
Kőrösi, G. (2022) · doi:10.14232/phd.11194
Taming Toxic Talk: Detecting Offensive Online Content in HausaPreprint
Adam, F. M., Zandam, A. Y., & Inuwa-Dutse, I. (2024) · Research Square · doi:10.21203/rs.3.rs-4266465/v1
Security Anomaly Detection in Enterprise GitHub
Jordan, A., & Chen, Y. (2024) · Practice and Experience in Advanced Research Computing · doi:10.1145/3626203.3670591
Behavioral Computing for Human Factor Security and Safety in Production
Wang, C. (2025) · Springer eBooks · doi:10.1007/978-981-96-5194-8_9
Contrastive Learning with Knowledge-Enhanced Prompts for Insider Threat Detection
Yu, H., Guo, Y., Wang, J., Zhu, M., Xu, Y., & Li, Z. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11229300
Unsupervised Graph Learning For Insider Threat Detection
Bertrand, S., Germain, P., & Tawbi, N. (2026) · IFIP advances in information and communication technology · doi:10.1007/978-3-032-27993-4_2
Behavioral Fingerprint Analysis for Insider Threat Detection
Devika, D., Dharshana, K. S., & Mohanraj, K. C. (2026) · IEEE International Conference on Intelligent Technologies for a Sustainable and Inclusive Future (ICITSIF) · doi:10.1109/icitsif69060.2026.11608956
FSCNN-ITDNet: A Novel Framework for Insider Threat Detection via Feature Selection and 1D-CNN
Li, Y., Yang, H., Dong, T., & He, J. (2026) · IEEE International Conference on Computer Vision and Deep Learning (DLCV) · doi:10.1109/dlcv69906.2026.11635484
- Authors
- Gavai, G., Sricharan, K., Gunning, D., Rolleston, R., Hanley, J., & Singhal, M.
- Affiliations
- Palo Alto Research Center (US)
- Venue
- Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats
- Publisher
- ACM
- Published
- 2015-10-16
- Pages
- 13-20
- OpenAlex
- W2005221715
- Cited by
- 69
- References
- 12
- Citations by year
- 2026: 3 · 2025: 8 · 2024: 12 · 2023: 14 · 2022: 7 · 2021: 5 · 2020: 4 · 2019: 4 · 2018: 5 · 2017: 3 · 2016: 4
- FWCI
- 3.48
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM CCS International Workshop on Managing Insider Security Threats (MIST) (publishedVersion)
- Funders
- Defense Advanced Research Projects Agency (W911NF-11-C- 0216)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Keywords
- insider threat detection, file access patterns, anomaly detection, feature extraction, dashboard visualization, enterprise security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
