A Hybrid Rule-Based and Machine-Learning Framework for Detecting Human-Layer Cybersecurity Policy Violations in Simulated High-Assurance Environments
TL;DR
The findings imply that the hybrid model provides a more efficient and balanced way of detecting cybersecurity policies’ violations compared to either rule-based or machine learning models analysed sep- arately.
Abstract
Authorised users can create substantial cybersecurity risk through malicious actions, negligence or non-compliance with organisational policies. Deterministic rule engines provide auditable policy enforcement but may miss subtle be- havioural deviations, whereas anomaly-detection models can identify novel patterns but frequently produce false-positive and difficult-to-interpret alerts. The framework was evaluated using a synthetic dataset of 1,000 us- er-activity records. Models were trained on the training partition, fusion weights and thresholds were selected using a separate validation partition, and final performance was measured once on an untouched test partition. On the held-out test set, the hybrid model achieved a precision of 0.882, recall of 1.000, F1-score of 0.938 and false-positive rate of 0.057. The findings imply that the hybrid model provides a more efficient and balanced way of detecting hu- man-layer cybersecurity policies’ violations compared to either rule-based or machine learning models analysed sep- arately.