Authors: Assistant Professor T.Pravalika, B.Gayathri
Abstract: The fact that malevolent actions are carried out by persons with legal access to organisational resources makes insider threats one of the most difficult cybersecurity issues confronted by contemporary organisations. Since suspicious actions typically mimic legitimate user behaviour, insider threats are harder to identify than external intrusions. When dealing with very unbalanced datasets, where harmful events make only a tiny proportion of overall user actions, traditional rule-based security systems often fail to detect modest behavioural anomalies. In order to enhance organisational security via intelligent behavioural analysis, this research proposes a system for insider threat identification that is based on machine learning and uses the CERT 5.2 Insider Threat Dataset. A variety of machine learning algorithms, such as Logistic Regression, Decision Tree, Random Forest, Support Vector Machine (SVM), K-Nearest Neighbours (KNN), Naïve Bayes, AdaBoost, and XGBoost, are included in the suggested framework, along with thorough data preprocessing and the Synthetic Minority Oversampling Technique (SMOTE) to deal with class imbalance. To find out how well the models detect insider threats, we use Accuracy, Precision, Recall, and F1-score. The experimental findings show that among the machine learning models tested, Random Forest and AdaBoost surpass the rest with a classification accuracy of 97.5%, all while retaining outstanding recall and precision. While maintaining the original methodology, dataset, algorithms, and experimental results, the suggested framework offers a scalable and efficient solution for early insider threat detection. This helps organisations with cybersecurity, security risk reduction, and intelligent behavioural analysis for better decision-making.
