Detecting the Insider Threat with Long Short Term Memory (LSTM) Neural Networks
Open accessAbstract
Information systems enable many organizational processes in every industry. The efficiencies and effectiveness in the use of information technologies create an unintended byproduct: misuse by existing users or somebody impersonating them - an insider threat. Detecting the insider threat may be possible if thorough analysis of electronic logs, capturing user behaviors, takes place. However, logs are usually very large and unstructured, posing significant challenges for organizations. In this study, we use deep learning, and most specifically Long Short Term Memory (LSTM) recurrent networks for enabling the detection. We demonstrate through a very large, anonymized dataset how LSTM uses the sequenced nature of the data for reducing the search space and making the work of a security analyst more effective.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Preprocessing is vital for scalability, reducing computational overhead while preserving threat indicators.
“Preprocessing is vital for scalability, reducing computational overhead while preserving threat indicators, though challenges like handling multilingual insider jargon or abbreviated text in chats remain underexplored [19,69].”
From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [69]
The citation lists haven’t been fetched yet
References 6 · Cited by 1
- Authors
- Lopez, E., & Sartipi, K.
- Affiliations
- East Carolina University (US)
- ORCID
- Sartipi, Kamran
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2007.11956
- OpenAlex
- W3044488887
- Cited by
- 1
- References
- 6
- Citations by year
- 2022: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Keywords
- insider threat detection, long short-term memory networks, user behavior analysis, log analysis, deep learning for security, user impersonation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
