# A Graph Based Framework for Malicious Insider Threat Detection

arXiv: https://arxiv.org/abs/1809.00141 · HTML: https://mlsanity.com/paper/1809.00141/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Sep 2018.

## Built on by (most cited first, 4 of 4)

- [Graph Mining for Cybersecurity: A Survey](https://mlsanity.com/paper/2304.00485/) (2023)
- [Insider Detection using Deep Autoencoder and Variational Autoencoder Neural Networks](https://mlsanity.com/paper/2109.02568/) (2021)
- [Unsupervised User-Based Insider Threat Detection Using Bayesian Gaussian Mixture Models](https://mlsanity.com/paper/2211.14437/) (2022)
- [LogSHIELD: A Graph-based Real-time Anomaly Detection Framework using Frequency Analysis](https://mlsanity.com/paper/2410.21936/) (2024)

## Abstract (arXiv)

While most security projects have focused on fending off attacks coming from outside the organizational boundaries, a real threat has arisen from the people who are inside those perimeter protections. Insider threats have shown their power by hugely affecting national security, financial stability, and the privacy of many thousands of people. What is in the news is the tip of the iceberg, with much more going on under the radar, and some threats never being detected. We propose a hybrid framework based on graphical analysis and anomaly detection approaches, to combat this severe cybersecurity threat. Our framework analyzes heterogeneous data in isolating possible malicious users hiding behind others. Empirical results reveal this framework to be effective in distinguishing the majority of users who demonstrate typical behavior from the minority of users who show suspicious behavior.