Multi‐Agent Real‐Time Detection of Insider Threats via Collaborative Reasoning
TL;DR
This work proposes MARS‐ITD (Multi‐Agent Real‐time System for Insider Threat Detection), which consists of a detection framework and an investigation framework that improves real‐time detection performance and interpretability but also provides a scalable, collaborative architecture for LLM‐based security analysis systems.
Abstract
Insider threats have become a critical cybersecurity risk for enterprises and institutions due to their covert nature, authorized access privileges, and deceptive behavior. Traditional rule‐based or statistical anomaly detection methods struggle with the dynamic complexity of insider activities. Deep learning methods offer superior feature extraction but often suffer from imbalanced data and coarse‐grained detection granularity. Meanwhile, large language models (LLMs) present new possibilities for insider threat detection but face challenges such as high detection latency and limited multidimensional analysis capabilities. To address these issues, we propose MARS‐ITD (Multi‐Agent Real‐time System for Insider Threat Detection), which consists of a detection framework and an investigation framework. The detection framework performs preliminary screening of anomalous logs through parallelized multi‐agent processing, while the investigation framework reconstructs the complete threat scenario by collaboratively correlating multiple types of logs, thereby reducing the false positive rate. We evaluated MARS‐ITD on the widely used CERT r4.2 insider threat dataset at the user‐session granularity. Compared with state‐of‐the‐art graph neural network baselines and the recent LLM fine‐tuning method ITDLM, MARS‐ITD achieves the highest recall of 94.44% while maintaining an accuracy of 95.42% and an FPR of 4.58%, which is substantially lower than GNN baselines (8.25%–14.88%). This demonstrates that its detection‐investigation pipeline can effectively prioritize the discovery of coordinated insider threats while suppressing isolated false positives. Ablation studies further highlight the investigation framework's effectiveness in reducing false positives while improving recall. Overall, this work not only improves real‐time detection performance and interpretability but also provides a scalable, collaborative architecture for LLM‐based security analysis systems.