# Insider Detection using Deep Autoencoder and Variational Autoencoder Neural Networks

arXiv: https://arxiv.org/abs/2109.02568 · HTML: https://mlsanity.com/paper/2109.02568/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 49 references that are in the map.
- First posted on arXiv 6 Sep 2021.

## Builds on (most cited first, 6 of 6)

- [Auto-Encoding Variational Bayes](https://mlsanity.com/paper/1312.6114/) (2013)
- [Cyclical Learning Rates for Training Neural Networks](https://mlsanity.com/paper/1506.01186/) (2015)
- [Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams](https://mlsanity.com/paper/1710.00811/) (2017)
- [Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities](https://mlsanity.com/paper/2005.12433/) (2020)
- [Insider Threat Detection via Hierarchical Neural Temporal Point Processes](https://mlsanity.com/paper/1910.03171/) (2019)
- [A Graph Based Framework for Malicious Insider Threat Detection](https://mlsanity.com/paper/1809.00141/) (2018)

## Built on by (most cited first, 1 of 1)

- [AI-Driven IRM: Transforming insider risk management with adaptive scoring and LLM-based threat detection](https://mlsanity.com/paper/2505.03796/) (2025)

## Abstract (arXiv)

Insider attacks are one of the most challenging cybersecurity issues for companies, businesses and critical infrastructures. Despite the implemented perimeter defences, the risk of this kind of attack is still very high. In fact, the detection of insider attacks is a very complicated security task and presents a serious challenge to the research community. In this paper, we aim to address this issue by using deep learning algorithms Autoencoder and Variational Autoencoder deep. We will especially investigate the usefulness of applying these algorithms to automatically defend against potential internal threats, without human intervention. The effectiveness of these two models is evaluated on the public dataset CERT dataset (CERT r4.2). This version of the CERT Insider Threat Test dataset includes both benign and malicious activities generated from 1000 simulated users. The comparison results with other models show that the Variational Autoencoder neural network provides the best overall performance with a greater detection accuracy and a reasonable false positive rate