NLP and Neural Networks for Insider Threat Detection

Insider threats in cybersecurity are notoriously difficult to detect due to their covert nature, often evading traditional security measures. In this paper, we propose an unsupervised method for insider threat detection, where we leverage advanced Natural Language Processing (NLP) techniques to enhance the detection of abnormal user activities indicative of insider threats. We represent user behaviors in a vector space using Word2Vec, which in turn are analyzed using state-of-the-art NLP models, including BERT, SciBERT, RoBERTa, GPT-2, and LLaMA. These models are integrated with Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) networks to analyze the temporal behavior of user actions. We evaluate the proposed method using the CMU-CERT dataset version 4.2. Our implemented approaches based on NLP achieve better results than previous state-of-the-art approaches that use traditional unsupervised learning.