# Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams

arXiv: https://arxiv.org/abs/1710.00811 · HTML: https://mlsanity.com/paper/1710.00811/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Oct 2017.

## Built on by (most cited first, 19 of 19)

- [An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series](https://mlsanity.com/paper/2109.11428/) (2021)
- [Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspective](https://mlsanity.com/paper/2405.10757/) (2024)
- [LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection](https://mlsanity.com/paper/2403.09209/) (2024)
- [DANTE: Predicting Insider Threat using LSTM on system logs](https://mlsanity.com/paper/2102.05600/) (2021)
- [AD-NEV: A Scalable Multi-level Neuroevolution Framework for Multivariate Anomaly Detection](https://mlsanity.com/paper/2305.16497/) (2023)
- [System Design for a Data-driven and Explainable Customer Sentiment Monitor](https://mlsanity.com/paper/2101.04086/) (2021)
- [Insider Detection using Deep Autoencoder and Variational Autoencoder Neural Networks](https://mlsanity.com/paper/2109.02568/) (2021)
- [Insider Threat Detection Using GCN and Bi-LSTM with Explicit and Implicit Graph Representations](https://mlsanity.com/paper/2512.18483/) (2025)
- [Detection of Insider Threats using Artificial Intelligence and Visualisation](https://mlsanity.com/paper/2109.02417/) (2021)
- [Conical Classification For Computationally Efficient One-Class Topic Determination](https://mlsanity.com/paper/2111.00375/) (2021)
- [Using Color To Identify Insider Threats](https://mlsanity.com/paper/2111.13176/) (2021)
- [Towards efficient deep autoencoders for multivariate time series anomaly detection](https://mlsanity.com/paper/2403.02429/) (2024)
- [AD-NEv++ : The multi-architecture neuroevolution-based multivariate anomaly detection framework](https://mlsanity.com/paper/2404.07968/) (2024)
- [A Mallows-like Criterion for Anomaly Detection with Random Forest Implementation](https://mlsanity.com/paper/2405.18932/) (2024)
- [Unsupervised anomaly detection on cybersecurity data streams: a case with BETH dataset](https://mlsanity.com/paper/2503.04178/) (2025)
- [Leveraging large language models for SQL behavior-based database intrusion detection](https://mlsanity.com/paper/2508.05690/) (2025)
- [Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection](https://mlsanity.com/paper/2603.13246/) (2026)
- [TraXion: Rethinking Pre-training Frameworks for Mobility and Beyond](https://mlsanity.com/paper/2605.06906/) (2026)
- [MOLE: Detecting Insider Threats in AI Agents](https://mlsanity.com/paper/2609.06966/) (2026)

## Abstract (arXiv)

Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective filter for the human analyst, we present an online unsupervised deep learning approach to detect anomalous network activity from system logs in real time. Our models decompose anomaly scores into the contributions of individual user behavior features for increased interpretability to aid analysts reviewing potential cases of insider threat. Using the CERT Insider Threat Dataset v6.2 and threat detection recall as our performance metric, our novel deep and recurrent neural network models outperform Principal Component Analysis, Support Vector Machine and Isolation Forest based anomaly detection baselines. For our best model, the events labeled as insider threat activity in our dataset had an average anomaly score in the 95.53 percentile, demonstrating our approach's potential to greatly reduce analyst workloads.