Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities

• 25% of cyberattacks are committed by insiders, and 30% of survey respondents say insider incidents are more costly or damaging than outsider attacks.Source: §1 · p. 1
• CERT/CC defines malicious insiders as current or former employees, contractors, or partners who intentionally misuse authorized access; insiders may be traitors, masqueraders, or accidental perpetrators, causing sabotage, IP theft, or fraud [34].Source: §1 · p. 1
• Shallow models underuse high-dimensional, complex, heterogeneous, sparse behavior data, whereas deep representation learning can learn layered representations to identify potential malicious activity [8].Source: §1 · p. 1
• Recent work applies feedforward, CNN, RNN, and GNN models; RNNs analyze sequential user data and GNNs use organizational structure.Source: §1 · p. 1
• Extremely few malicious activities and adaptive attacks remain challenges, leaving further development of deep-learning detection models under-explored.Source: §1 · p. 2
• The survey reviews a commonly used dataset and recent deep-learning work, then organizes detection challenges and future research opportunities.Challenges include extreme class imbalance, subtle and adaptive attacks, temporal information, heterogeneous fusion, fine-grained and early detection, explainability, lack of testbeds, and practical metrics. Opportunities include few-shot and self-supervised learning, temporal point processes, multimodal learning, survival analysis, Bayesian nonparametric learning, reinforcement learning, explainable deep learning, and testbed development.Source: §1 · p. 2

2.1 Deep Learning

• Deep learning learns semantic representations from raw data with minimal feature engineering, using lower layers for low-level features and higher layers for abstract features.This multi-layer representation-learning approach contrasts with traditional models that rely heavily on hand-engineered features.Source: §2.1 · p. 2
• Deep learning architectures include deep feedforward networks, CNNs, recursive neural networks, and RNNs, which capture shift-invariant, hierarchical, or sequential structure.Examples of deep feedforward models include deep belief networks, deep Boltzmann machines, and deep autoencoders.Source: §2.1 · p. 2

2.2 Deep Learning for Anomaly Detection

• Anomaly detection identifies instances dissimilar to others, and insider threats can be treated as one type of anomaly, although anomaly-detection methods may not fit them.Anomaly detection has applications including fraud detection, intrusion detection, and video surveillance.Source: §2.2 · p. 2
• Deep anomaly detection is categorized as supervised, semi-supervised, or unsupervised according to label availability [12].Supervised approaches use labeled normal and anomalous data for classification [10] [11]; semi-supervised methods leverage abundant normal samples when anomalies are scarce [1]; unsupervised methods detect anomalies from intrinsic data properties without labels [31, 68, 69].Source: §2.2 · p. 2
• Deep learning's performance gains for anomaly detection may be less significant than in computer vision or natural language processing because models with millions of parameters need many labeled samples, while labeled anomalies are scarce.Collecting large numbers of labeled anomalies for training is very difficult, if not impossible.Source: §2.2 · p. 2

3.1 CERT Insider Threat Dataset

• No comprehensive real-world dataset is publicly available, so recent studies commonly evaluate on synthetic CMU CERT; sparse r6.2 contains 5 insiders and 3995 normal users.CERT records logon, email, web, file, and removable-device activity, as well as Big Five traits; r4.2 is dense, whereas r6.2 is sparse. Detecting threats is described as a needle-in-a-haystack task, generally infeasible with manually defined features or shallow models.Source: §3.1 · pp. 3–4

3.2 Why Deep Learning for Insider Threat Detection?

• Deep learning can learn representations of complex, nonlinear user behavior, model activity sequences, and combine heterogeneous activity, profile, and organizational-structure data.The review contrasts this with the difficulty of manual feature design and shallow models, and notes RNNs and Transformers as sequence-modeling options.Source: §3.2 · p. 4

3.3 Deep Learning For Insider Threat Detection

• Because datasets are extremely imbalanced, most approaches use unsupervised learning and detect malicious subsequences or sessions; only one study targets individual activities.A session is a sequence between logon and logoff; detecting malicious activities is difficult because little information is available.Source: §3.3 · p. 4

3.3.1 Deep Feedforward Neural Network.

• Deep feedforward approaches use autoencoder reconstruction errors as anomaly scores, or apply a one-class SVM to learned representations.The autoencoder learns hidden representations by reconstructing inputs; the one-class classifier operates on those representations.Source: §3.3.1 · pp. 4–5

3.3.2 Recurrent Neural Network.

• RNN approaches predict users’ next activities as normal-behavior baselines; [69] uses stacked LSTM daily sequences, while models activity types and timing with temporal point processes.Differences between predicted and observed behavior provide anomalous scores.Source: §3.3.2 · p. 5

3.3.3 Convolutional Neural Network.

• A CNN-based authentication method represents mouse behavior as images and detects potential insider threats from behavioral inconsistency with the legal user.Source: §3.3.3 · p. 5

3.3.4 Graph Neural Network.

• Graph-based approaches detect malicious users or activities by modeling relationships among users or audit activities.[37] uses a GCN over user connections and profile features to predict malicious nodes; builds a heterogeneous activity graph, embeds its nodes, and clusters activities.Source: §3.3.4 · p. 5

Extremely Unbalanced Data

• Rare malicious activities and scarce labeled insider examples make it difficult to train parameter-intensive deep learning models effectively.The challenge is to train models properly using the small number of malicious samples that can realistically be collected.Source: §4 · p. 6

Temporal Information in Attacks

• Activity type alone is insufficient because the same action, such as copying files, may be benign during work hours but suspicious at midnight.Incorporating temporal information into user behavior analysis is a challenge for identifying malicious threats.Source: §4 · p. 6

Heterogeneous Data Fusion

• Fusing heterogeneous sources, such as user profiles or interaction data, could reveal threats that activity logs alone may not expose.The example describes routine file copying followed by copying credential files to removable media after anticipating a layoff.Source: §4 · p. 6

Subtle Attacks

• Insiders may make subtle malicious changes that keep their behavior close to benign users, defeating anomaly detection based on separation from normal patterns.Existing approaches often train on benign samples and use a threshold or anomaly score, but cannot reliably detect insiders close to benign users in feature space.Source: §4 · p. 6

Adaptive Threats

• Learning-based detectors may miss new adaptive attacks, while collecting examples and retraining from scratch delays timely detection and prevention.The section calls for models that can adaptively improve detection performance as attack strategies evolve.Source: §4 · p. 6

Fine-grained Detection / Early Detection

• Session-level detection can be too coarse for timely response, while identifying exact malicious activities is difficult because each activity provides little information.The section also identifies early detection of potential malicious activity before it occurs as an emerging need; it reports no learning-based approach for that task.Source: §4 · p. 6

Explainability

• Black-box predictions and false positives can undermine employee trust, making explainability important for domain experts to assess decisions confidently.The section notes that misclassifying benign users as insiders can seriously affect employee loyalty.Source: §4 · p. 6

Lack of Testbed / Lack of Practical Evaluation Metrics

• Public testbed limitations include synthetic CERT data with simple routines and only five insider scenarios, while the practicality of ROC-AUC or PR-AUC remains unclear for rare threats.The section notes that ROC-AUC values are often close across algorithms, making it hard to identify a better model; PR-AUC focuses more on the minority class.Source: §4 · pp. 6–7

Few-shot Learning and Self-supervised Learning based Insider Threat Detection

• Few-shot and self-supervised learning could address scarce labels by using prior knowledge and input-derived pretext tasks to distinguish insiders from benign users.Few-shot approaches may use prior knowledge to augment data, constrain hypothesis spaces, or alter search strategies [76], including one-shot and zero-shot settings. Self-supervised models could learn salient input information through pretraining and then be fine-tuned with little data; suitable pretext tasks remain to be designed [5] [7] [75].Source: §5 · p. 7

Deep Marked Temporal Point Process based Insider Threat Detection

• Marked temporal point processes could combine user activity types and timing to improve insider threat detection.These models can use recurrent neural networks to characterize conditional intensity functions [43].Source: §5 · p. 7

Multi-model Learning based Insider Threat Detection

• Combining activity logs with psychological, profile, and relationship data is an under-explored opportunity for improving detection.Prior work has studied psychological data and user graphs based on organizational hierarchy or email communication [24].Source: §5 · pp. 7–8

Deep Survival Analysis based Insider Threat Early Detection

• Deep survival analysis could predict when malicious activity occurs, giving organizations earlier alerts about potential insider attacks.It treats the malicious activity as the event of interest and models the time until that event; deep models have been used to model complex survival distributions [14] [52].Source: §5 · p. 8

Deep Bayesian Nonparametric Model for Fine-grained Insider Threat Detection

• Deep Bayesian nonparametric models could cluster users’ activity streams into fine-grained groups of potentially malicious activities.Models such as Dirichlet processes can generate unbounded clusters, while deep Bayesian nonparametric generative models combine neural representations with Bayesian methods [26] [55].Source: §5 · p. 8

Deep Reinforcement Learning based Insider Threat Detection

• Deep reinforcement learning could improve detection of adaptive attacks through reward signals, but reward design and limited training data are challenges.Inverse reinforcement learning may infer reward functions from insider behavior [57]; meta-learning or imitation learning may help address data scarcity [22] [72].Source: §5 · p. 8

Explainable Deep Learning for Insider Threat Detection

• Explainable models are important for trustworthy high-stakes decisions and could help identify malicious activities within a user’s activity sequence.Counterfactual explanations can identify relevant feature changes that alter the predicted outcome.Source: §5 · p. 8

Testbed Development and Practical Evaluation Metrics

• Insider threat research needs a comprehensive testbed and practical evaluation metrics suited to the scarcity of insiders and malicious activities.The widely used CERT dataset is synthetic and its activities are not sufficiently complicated. Cumulative recall (CR-k) sums recall across budgets up to k, approximating area under the recall curve; recall-based metrics may suit settings where missed detections cost more than false positives [69].Source: §5 · p. 8

6 CONCLUSION

• Deep learning for insider threat detection remains under-explored despite some progress.Source: §6 · p. 9
• The survey reviews existing approaches and categorizes them by their adopted deep learning architectures.Source: §6 · p. 9
• It discusses challenges and proposes research directions to advance deep learning-based insider threat detection, with future updates as advanced approaches emerge.Source: §6 · p. 9