Real-time insider threat detection using adaptive user behavior analytics and file-system monitoring

Abnormal user activity and insider misuse are still serious risks in modern computing systems. Many practical solutions do not operate in real time as data volumes increase and infrastructures become more complicated, which slows response times and weakens containment. Reliance on manual processes or third-party solutions diminishes the user experience and limits long-term protection. This paper introduces a system that integrates machine learning with the Linux Filesystem in Userspace (FUSE) to provide real-time, continuous anomaly detection along with targeted security measures. The design uses Isolation Forest to learn baseline behavior and identify deviations from data-driven norms, instead of relying on prior attack signatures. Temporal and spatial profiling incorporate recent behavioral context, while adaptive thresholds track changes in observed deviation scores. This improves sensitivity to minor variations as the system adapts to evolving user behavior and new threats. Detected events are classified according to severity as benign, suspicious, and critical. Furthermore, thresholds are adjusted to minimize disruption to legitimate activity while maintaining protection. Operating at the filesystem layer provides direct visibility into file activity and supports automated detection and response without requiring user intervention. Experiments across the four evaluation sets demonstrate detection accuracy of up to 98.7% and an F -measure of 95.5%. Under normal operating conditions, average read and write times were 36.8 and 44.1 ms, respectively. The results demonstrate adaptive anomaly detection and severity-dependent response under the evaluated file-system workloads.