Does It Generalize? A Cross-Dataset Study of Graph-Based Insider Threat Detection Beyond CERT
Graph-based insider threat detection methods increasingly report strong performance by modelling relationships among users, hosts, resources and security events. However, many studies still evaluate within a single benchmark family—usually CERT—or report separate within-dataset results, so it is unclear whether the lea...