Comprehensive Review of Insider Threat Detection: Models, Datasets, and Metrics for Effective Threat Identification

This research study presents a comprehensive review of Insider Threat Detection (ITD) models, highlighting the transition from traditional methods to advanced machine learning (ML), deep learning (DL), and hybrid approaches for enhanced threat detection. As ITD evolves to address the challenges posed by Big Data, ML and DL techniques have gained prominence, though they require careful model selection, data preprocessing, and ensembling to optimize performance. The inclusion of hybrid methods, such as the Hybrid Anomaly Checker, which combines statistical and ML-based techniques like the Local Outlier Factor (LoF), enhances the precision of anomaly detection by analyzing individual user behaviors. The review emphasizes the use of advanced datasets like CERT r4.2 and a wide range of evaluation metrics, including True Positive Rate (TPR), Matthews Correlation Coefficient (MCC), and Time to Detection (TTD), to provide a more comprehensive model performance analysis. These metrics ensure robust and reliable ITD systems that are better equipped to handle evolving insider threats.