Insider Threat Detection and its Behavior with Excessive Access Privileges

Insider threats, one of the most challenging cyber threats, often result in significant organizational losses. This study explores the correlation between suspicious users and job roles vulnerable to insider threats. The research highlights that users with higher access privileges are more exposed to potential insider attacks. K-Nearest Neighbors (KNN) and hierarchical clustering, implemented using Weka, were employed to detect suspicious activity and group users by their roles. Based on a comparison of successive months, an overall accuracy value of 0.85 was obtained. By monitoring for suspicious changes in their cluster over time, we were able to identify 80% of insider threats with the ITAdmin job. The results revealed that many users exhibiting abnormal activities held IT admin roles, indicating that those with the highest access permissions are more prone to insider threats. This study addresses a gap in understanding the relationship between excessive access permissions and security risks.