HSML-ITD: HYBRID SUPERVISED MACHINE LEARNING FRAMEWORK FOR INSIDER THREAT DETECTION

Abstract

The digital transformation driven by Information and Communication Technology (ICT) has amplified data accessibility and operational efficiency across organizations. However, it has also escalated cybersecurity vulnerabilities, with insider threats emerging as a critical concern. Traditional detection methods often fail to address the sophisticated and evolving nature of these threats, necessitating advanced solutions. This study proposes the Hybrid Supervised Machine Learning Framework for Insider Threat Detection (HSML-ITD), integrating Support Vector Machines (SVM) for initial data classification and Adaptive Neuro-Fuzzy Inference Systems (ANFIS) for predictive learning. The model aims to enhance detection accuracy, reduce false positives, and provide a robust mechanism for insider threat mitigation. The framework was developed using the CERT insider threat dataset, with a structured methodology comprising data preprocessing, SVM-based classification, and ANFIS-based predictive learning. Performance was evaluated using a 5-fold cross-validation technique and comparative analyses with conventional models were conducted to validate the hybrid approach. The HSML-ITD demonstrated superior performance, achieving an accuracy of 92%, precision of 93%, recall of 89%, and F1-Score of 91%. Comparative analysis revealed significant improvements over standalone models, particularly in handling noisy data and high-dimensional input spaces. The hybrid model effectively balanced prediction accuracy and robustness, addressing limitations of conventional methods. The HSML-ITD offers a scalable and accurate solution for insider threat detection, significantly enhancing organizational cybersecurity. Future research will focus on incorporating real-time detection capabilities, optimizing computational efficiency, and expanding validation across diverse datasets. By addressing these aspects, the model can further solidify its applicability in dynamic threat environments.