Beyond Firewall: Leveraging Machine Learning for Real-Time Insider Threats Identification and User Profiling
Year: 2025
Type: article
Abstract: Insider threats pose a significant challenge to organizational cybersecurity, often leading to catastrophic financial and reputational damages. Traditional tools like firewalls and antivirus systems lack the sophistication needed to detect and mitigate these threats in real time, particularly when faced with subtle and evolving malicious behaviors. This paper introduces a machine learning-based system that integrates real-time anomaly detection with dynamic user profiling, enabling the classification of employees into risk categories—low, medium, and high. By leveraging continuous monitoring and adaptive algorithms, the proposed tool provides immediate alerts and actionable insights, significantly enhancing organizational responsiveness to insider threats. The system’s efficacy was validated using a synthetic dataset, achieving exceptional accuracy across machine learning models, with XGBoost emerging as the most effective for detection and classification. This work addresses critical gaps in traditional and existing machine learning methods, offering a proactive, scalable, and fully automated solution. Future research will explore real-world data validation and incorporate psychological profiling to further augment detection capabilities, setting a foundation for the next generation of insider threat management systems.
Source: Future Internet
DOI: 10.3390/fi17020093
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,930
OpenAlex ID: W4407702546