# Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities

arXiv: https://arxiv.org/abs/2005.12433 · HTML: https://mlsanity.com/paper/2005.12433/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 May 2020.

## Built on by (most cited first, 18 of 18)

- [Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection](https://mlsanity.com/paper/2408.08902/) (2024)
- [LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection](https://mlsanity.com/paper/2403.09209/) (2024)
- [RedChronos: A Large Language Model-Based Log Analysis System for Insider Threat Detection in Enterprises](https://mlsanity.com/paper/2503.02702/) (2025)
- [Hybrid Deep Learning Model using SPCAGAN Augmentation for Insider Threat Analysis](https://mlsanity.com/paper/2203.02855/) (2022)
- [Chimera: Harnessing Multi-Agent LLMs for Automatic Insider Threat Simulation](https://mlsanity.com/paper/2508.07745/) (2025)
- [Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approaches](https://mlsanity.com/paper/2310.13247/) (2023)
- [Insider Detection using Deep Autoencoder and Variational Autoencoder Neural Networks](https://mlsanity.com/paper/2109.02568/) (2021)
- [Robust Fraud Detection via Supervised Contrastive Learning](https://mlsanity.com/paper/2308.10055/) (2023)
- [User-Based Sequential Modeling with Transformer Encoders for Insider Threat Detection](https://mlsanity.com/paper/2506.23446/) (2025)
- [DMFI: A Dual-Modality Log Analysis Framework for Insider Threat Detection with LoRA-Tuned Language Models](https://mlsanity.com/paper/2508.05694/) (2025)
- [Using Color To Identify Insider Threats](https://mlsanity.com/paper/2111.13176/) (2021)
- [ZETAR: Modeling and Computational Design of Strategic and Adaptive Compliance Policies](https://mlsanity.com/paper/2204.02294/) (2022)
- [Cybersecurity threats in FinTech: A systematic review](https://mlsanity.com/paper/2312.01752/) (2023)
- [FedAT: Federated Adversarial Training for Distributed Insider Threat Detection](https://mlsanity.com/paper/2409.13083/) (2024)
- [Leveraging large language models for SQL behavior-based database intrusion detection](https://mlsanity.com/paper/2508.05690/) (2025)
- [Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection](https://mlsanity.com/paper/2603.13246/) (2026)
- [HBEE: Human Behavioral Entropy Engine -- Pre-Registered Multi-Agent LLM Simulation of Peer-Suspicion-Based Detection Inversion](https://mlsanity.com/paper/2605.07472/) (2026)
- [LLMs for Zero-Shot Threat Detection via Structured Risk Indicators](https://mlsanity.com/paper/2608.16508/) (2026)

## Abstract (arXiv)

Insider threats, as one type of the most challenging threats in cyberspace, usually cause significant loss to organizations. While the problem of insider threat detection has been studied for a long time in both security and data mining communities, the traditional machine learning based detection approaches, which heavily rely on feature engineering, are hard to accurately capture the behavior difference between insiders and normal users due to various challenges related to the characteristics of underlying data, such as high-dimensionality, complexity, heterogeneity, sparsity, lack of labeled insider threats, and the subtle and adaptive nature of insider threats. Advanced deep learning techniques provide a new paradigm to learn end-to-end models from complex data. In this brief survey, we first introduce one commonly-used dataset for insider threat detection and review the recent literature about deep learning for such research. The existing studies show that compared with traditional machine learning algorithms, deep learning models can improve the performance of insider threat detection. However, applying deep learning to further advance the insider threat detection task still faces several limitations, such as lack of labeled data, adaptive attacks. We then discuss such challenges and suggest future research directions that have the potential to address challenges and further boost the performance of deep learning for insider threat detection.