Profiling the Invisible Insider: A UEBA-Based Machine Learning Framework for Low-and-Slow Data Exfiltration Detection

Abstract

Low-and-slow data exfiltration by malicious insiders remains among the most operationally difficult threat classes to detect: the behavior is unremarkable in any individual session and becomes recognizable only across weeks of otherwise routine activity. This paper presents a UEBA-based machine learning framework that constructs per-user behavioral profiles from enterprise proxy and access log data, scoring sessions against a 30-feature behavioral representation spanning temporal patterns, data-transfer anomalies, domain interactions, HTTP characteristics, and session-device signals. The contribution is an operationally integrated and empirically audited UEBA pipeline that combines a pre-specified behavioral representation, isolated evaluation regimes, and session-level analyst explanations. Training used a hybrid corpus of approximately 8.96 million sessions drawn from 160 GB of real and behaviorally parameterized simulated logs. On the full hybrid held-out partition, the LightGBM classifier achieved 96.84% overall accuracy, 95.38% balanced accuracy, 91.80% malicious-class precision, 92.90% recall, 92.35% F1-score, and 98.2% ROC-AUC. Because the hybrid test set uses an enriched 20.5% malicious-session evaluation prevalence, balanced accuracy and malicious-class F1 are emphasized alongside overall accuracy. In the strict real-only evaluation, the independently trained and calibrated LightGBM model achieved 95.99% overall accuracy, 93.80% balanced accuracy, 90.30% malicious-class precision, 90.10% recall, 90.20% F1-score, and 95.8% ROC-AUC, while hybrid-to-real transfer achieved 90.1% F1-score, 89.8% recall, and 96.1% ROC-AUC. These settings are reported separately to distinguish full-corpus benchmark performance from real-log generalization. Each scored session is accompanied by a SHAP-based decomposition that identifies which behavioral signals drove the alert, supporting analyst triage in operational SOC environments. The framework was further validated on a confirmed 17-day insider exfiltration incident that existing organizational controls had not detected. BiLSTM and a Tabular Transformer evaluated under the same regime-specific partitions produced closely matched performance, with malicious-class F1 differences of at most 0.4 percentage points; LightGBM retained the strongest measured performance–deployment trade-off for the engineered tabular pipeline.