# Scalable and Ethical Insider Threat Detection through Data Synthesis and Analysis by LLMs

arXiv: https://arxiv.org/abs/2502.07045 · HTML: https://mlsanity.com/paper/2502.07045/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 42 references that are in the map.
- First posted on arXiv 10 Feb 2025.

## Builds on (most cited first, 4 of 4)

- [Bias and Unfairness in Information Retrieval Systems: New Challenges in the LLM Era](https://mlsanity.com/paper/2404.11457/) (2024)
- [Exploring Large Language Model for Graph Data Understanding in Online Job Recommendations](https://mlsanity.com/paper/2307.05722/) (2023)
- [Using LLMs to Establish Implicit User Sentiment of Software Desirability](https://mlsanity.com/paper/2408.01527/) (2024)
- [Utilizing Large Language Models to Synthesize Product Desirability Datasets](https://mlsanity.com/paper/2411.13485/) (2024)

## Built on by (most cited first, 4 of 4)

- [RedChronos: A Large Language Model-Based Log Analysis System for Insider Threat Detection in Enterprises](https://mlsanity.com/paper/2503.02702/) (2025)
- [DMFI: A Dual-Modality Log Analysis Framework for Insider Threat Detection with LoRA-Tuned Language Models](https://mlsanity.com/paper/2508.05694/) (2025)
- [An Ethically Grounded LLM-Based Approach to Insider Threat Synthesis and Detection](https://mlsanity.com/paper/2509.06920/) (2025)
- [Evaluating LLM Usage for Efficient and Explainable Numerical and Classified Implicit Sentiment Analysis of Product Desirability](https://mlsanity.com/paper/2606.23701/) (2026)

## Abstract (arXiv)

Insider threats wield an outsized influence on organizations, disproportionate to their small numbers. This is due to the internal access insiders have to systems, information, and infrastructure. %One example of this influence is where anonymous respondents submit web-based job search site reviews, an insider threat risk to organizations. Signals for such risks may be found in anonymous submissions to public web-based job search site reviews. This research studies the potential for large language models (LLMs) to analyze and detect insider threat sentiment within job site reviews. Addressing ethical data collection concerns, this research utilizes synthetic data generation using LLMs alongside existing job review datasets. A comparative analysis of sentiment scores generated by LLMs is benchmarked against expert human scoring. Findings reveal that LLMs demonstrate alignment with human evaluations in most cases, thus effectively identifying nuanced indicators of threat sentiment. The performance is lower on human-generated data than synthetic data, suggesting areas for improvement in evaluating real-world data. Text diversity analysis found differences between human-generated and LLM-generated datasets, with synthetic data exhibiting somewhat lower diversity. Overall, the results demonstrate the applicability of LLMs to insider threat detection, and a scalable solution for insider sentiment testing by overcoming ethical and logistical barriers tied to data acquisition.