Users’ scenario-base for analysing insider threat detection based on user’s downloads activity logs

The persistence and growth of insider threats pose a significant challenge to the information security community. Malicious insiders have been identified as one of the most detrimental threats to sensitive data including systems of enterprises and government agencies. Detecting insider threats presents a unique set of challenges, including dealing with large and imbalanced datasets and limited availability of ground truth information. Insider threats pose a serious risk to organizations, financial institutions, and government agencies. Former and current employees often exploit their trusted positions to disrupt regular organizational functions or unlawfully disclose classified or confidential information for personal or group gain. These actions can lead to severe financial, reputational, and operational consequences for the affected entities. To address this pressing issue, the research presented in this paper proposes a user-centric approach for insider threat detection. This approach focuses on leveraging downloads activity logs to analyse and detect patterns associated with insider threats. By examining user behaviours related to downloading activities, valuable insights to gained, and existing detection techniques can be enhanced. The proposed methodology aims to provide practical solutions for identifying and mitigating potential insider threats within organisations. Among the selected classifiers, RandomTree exhibited the highest accuracy rate of 0.981%, making it the most suitable option for the insider threat detection system. The accuracy rate indicates the overall correctness of the model’s predictions, with a higher value indicating a better performance in classifying instances correctly.