ML-Based Insider Threat Detection for Enterprise Data Exfiltration: A Multi-Agent System Approach

Insider threats are a serious challenge in today's enterprise environment. Malicious users exploit legitimate logins to move around the organization, evade traditional IDS, and quietly steal sensitive information. Current User and Entity Behavior Analytics (UEBA) systems primarily rely on numerical event frequencies and static thresholds; they use little language-level description of session behavior and cannot separate genuine exfiltration from the routine high-volume activity of legitimate power users. This paper proposes an unsupervised Multi-Agent System (MAS) built on a Shared Blackboard communication bus with a bidirectional consensus feedback loop and evaluates it on a labeled benchmark. We propose a cooperative 4-agent architecture: (1) a Global Behavioral Agent (Contractive Autoencoder) that fuses reconstruction error with a Behavioral Normalization (BN) function to net out routine volume noise, (2) a Zero-Shot Semantic NLP Scanner (all-mpnet-base-v2) that scores a text description of each session via cosine similarity to threat/benign anchor embeddings with no domain fine-tuning, (3) a Severity-Weighted Temporal Drift Engine that prioritizes exfiltration-relevant features during per-user Z-score drift computation, and (4) a Consensus Fusion Orchestrator that recalibrates upstream sensitivity on mutual agreement before producing rank-normalized ensemble threat rankings. Evaluated on 153,307 test sessions under a P80 Security Operations Center (SOC) triage budget, all four agents converge above 0.90 ROC-AUC (Orchestrator: 0.9022), with an operational Recall of 93.75% (15 of 16 breach sessions). This convergence, observed under the shared BN function, supports consistent score normalization across the detection agents. At the P80 budget, the system generates 30,662 alerts, of which 15 are malicious (resulting in a precision of approximately 0.05%).