This paper introduces an explainable AI-based Insider-Threat Detection (AIB-ITD) model that integrates enterprise telemetry—including email, web, logon/VPN, and file events—into a unified behavioral framework and shows superior robustness, stability, and operational effectiveness to classical methods.
Abstract
Insider threats continue to be the most persistent and most destructive threat to cybersecurity; malicious or negligent users work only in the real-time restricted area of the organization and are gradually breaking the boundaries of company norms. Conventional rule-based and statistical detection methods have difficulty detecting inconspicuous, context-dependent, and ever-changing behavior, leading to detection delays and high false-positive rates. Our paper introduces an explainable AI-based Insider-Threat Detection (AIB-ITD) model that integrates enterprise telemetry—including email, web, logon/VPN, and file events—into a unified behavioral framework. The effectiveness of combining heterogeneous behavioral indicators observed in AIB-ITD is consistent with recent behavioral analytics implementations that have demonstrated the value of multimodal user-behavior profiling for insider-threat identification in enterprise environments. The proposed AIB-ITD framework is based on anomaly-driven processing, unsupervised models (Isolation Forest, PCA reconstruction, and Autoencoder) are combined with sequential modeling (with an LSTM Autoencoder) to model both static and temporal deviations in behavior. An ensemble strategy is applied to combine the outputs of these models to yield a probabilistic insider risk score. To improve transparent analysis and to help the analyst gain trust, SHapley Additive Explanations (SHAP) is used to keep every detection outcome transparent and interpretable using the features. It also integrates feature correlation analysis, static vs sequential-model comparisons, and SHAP stability assessment to validate methodological robustness and reproducibility. An experimental review of the hybrid ensemble using the SEI/CMU CERT Insider Threat Dataset reveals that it performs better than single models for anomaly detection and stability, especially with the inclusion of temporal patterns. The assessment prioritizes anomaly score consistency and reliable risk ranking, rather than classification accuracy, to better reflect real deployment scenarios. In addition, an Automated Response and Privilege Containment (ARPC) feature automatically converts risk scores to multilevel mitigation actions that serve to protect the privacy of the user as the least privileged policies are enforced promptly. The proposed model showed superior robustness, stability, and operational effectiveness to classical methods, especially in the presence of scarce labeled data. Through hybrid anomaly recognition, explainable AI and automated response, AIB-ITD is a practical and scalable solution for next-generation insider-threat detection in enterprise systems.
The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.
Indu Asitha, Manjunatha B. N.· International Journal of Com...· 0 citations
As the number and sophistication of cyberattacks increase, including those like ransomware, advanced persistent threats (APTs), and zero-day exploits, the structural weaknesses of signature-based and static intrusion detection systems (IDS) become evident as they fail to generalize to novel or adversarially crafted attack patterns Agbroko (2024), Hakke et al. (2025). The paper provides a systematic review of the application of modern security operations in threat detection and automated incident response using classical machine learning (ML), deep learning (DL), reinforcement learning (RL), and metaheuristic optimization. A review of some of the benchmark sets shows that the ensemble and hybrid AI models consistently yield detection accuracy rates of 97–99% on curated datasets like NSL-KDD, CICIDS2017, and UNSW-NB15, which is significantly higher than the detection accuracy rates of legacy rule-based tools Waghmode and Kanumuri (2025), Sah et al. (2023), Jairu (2021). The paper also reviews Security Orchestration, Automation and Response (SOAR) integration, reinforcement-learning-driven adaptive defense policies, and threat-intelligence feedback loops that will allow for continuous retraining of the model. Some persistent challenges include adversarial evasion and data-poisoning attacks, false positives causing alert fatigue, interpretability problems in deep models, and autopilot restrictions on autonomous response actions Jha (2025), Dong et al. (2018). The most significant frontiers for making this leap from high laboratory accuracy to robust, audit- and legally sound operational deployments are explainable AI (XAI), federated and privacy-preserving learning, and standardized benchmarking Hermosilla et al. (2025), Bi et al. (2024). A conceptual framework is proposed that combines detection, explanation, and orchestrated response in a continuous feedback loop that is suitable for zero trust and IoT-enabled critical-infrastructure environments Silva (2026).
Jayesh Dalmet· Journal of Digital Security...· 0 citations
Insider threats have become a critical cybersecurity risk for enterprises and institutions due to their covert nature, authorized access privileges, and deceptive behavior. Traditional rule‐based or statistical anomaly detection methods struggle with the dynamic complexity of insider activities. Deep learning methods offer superior feature extraction but often suffer from imbalanced data and coarse‐grained detection granularity. Meanwhile, large language models (LLMs) present new possibilities for insider threat detection but face challenges such as high detection latency and limited multidimensional analysis capabilities. To address these issues, we propose MARS‐ITD (Multi‐Agent Real‐time System for Insider Threat Detection), which consists of a detection framework and an investigation framework. The detection framework performs preliminary screening of anomalous logs through parallelized multi‐agent processing, while the investigation framework reconstructs the complete threat scenario by collaboratively correlating multiple types of logs, thereby reducing the false positive rate. We evaluated MARS‐ITD on the widely used CERT r4.2 insider threat dataset at the user‐session granularity. Compared with state‐of‐the‐art graph neural network baselines and the recent LLM fine‐tuning method ITDLM, MARS‐ITD achieves the highest recall of 94.44% while maintaining an accuracy of 95.42% and an FPR of 4.58%, which is substantially lower than GNN baselines (8.25%–14.88%). This demonstrates that its detection‐investigation pipeline can effectively prioritize the discovery of coordinated insider threats while suppressing isolated false positives. Ablation studies further highlight the investigation framework's effectiveness in reducing false positives while improving recall. Overall, this work not only improves real‐time detection performance and interpretability but also provides a scalable, collaborative architecture for LLM‐based security analysis systems.
Kai Cheng, Dongkun Li, Weidong Tang et al.· Security and Privacy· 0 citations
Abstract - Rising volumes of sophisticated cyber attacks have rendered conventional signature-driven security tools insufficient for protecting modern digital assets. This study introduces a multi-layered intelligent detection system that unites supervised learning, unsupervised anomaly analysis, and ensemble decision strategies to identify network intrusions, malicious software activity, and stealthy advanced persistent threats in near real time. The pipeline begins with rigorous data cleansing and feature refinement that combines mutual-information ranking with principal-component analysis. Classification is performed by a soft-voting ensemble of Random Forest, gradient-boosted trees (XGBoost), and a compact deep neural network. Parallel anomaly scoring is obtained from Isolation Forest and a reconstruction-error autoencoder trained solely on benign flows. Evaluation on the NSL-KDD, CIC-IDS2017 and UNSW-NB15 collections yields detection accuracy reaching 98.7 %, precision of 97.9 %, recall of 98.4 % and an F1-score of 98.1 %, accompanied by a low rate of false alarms. SHAP-based explanations are attached to every prediction, giving security analysts transparent insight into model behaviour. Comparative benchmarks against recent published methods confirm that the proposed architecture delivers both higher accuracy and practical deployability inside enterprise security operations centres.
Key Words: network intrusion detection, ensemble machine learning, anomaly scoring, deep autoencoder, explainable artificial intelligence, cyber-attack classification, security operations.
Ameen Pasha.A· International Scientific Jou...· 0 citations
The sophistication of cyber threats is growing, and there is a growing need for timely detection and response to security threats, which is now possible with the help of artificial intelligence (AI) based Intrusion Detection System (IDS). While the accuracy of detection has increased with the implementation of more sophisticated machine learning and deep learning models, those models tend to be opaque and complicated, making it difficult for cybersecurity professionals to understand, verify and believe automated predictions. The study explores how XAI can enhance the understanding and accuracy of artificial intelligence (AI) intrusion detection systems (IDSs). The study is carried out using the qualitative method which examines the application of the existing techniques of XAI such as feature attribution, local or global explanation models, visualization techniques and rule based interpretations for explaining the techniques and gaining enhanced confidence of the analyst and informed security decisions. The secondary data used in this research was obtained from scholarly articles, cybersecurity frameworks, industry reports, and case studies to identify real-world applications, problems in implementation, as well as the current trends of the explainable AI for cyber defense. The results showed that embedding explainability in an IDS enhances the human-AI partnership, allowing security analysts to confirm the results of their IDS, mitigate false-positive ambiguity, optimize incident response, and meet regulatory and ethical obligations. Other challenges remain such as: maintaining the explainability attribute while obtaining the predictive performance, handling large traffic density, avoiding adversarial manipulation on the explanation mechanisms, and scalability. The study finds explainable AI to be an important milestone on the path towards trustworthy and responsible cybersecurity systems. By enabling organizations to make their security operations more resilient, boost the trust in automated cyber defense, and enhance transparency without compromising detection, XAI can help organizations achieve these goals. The study provides valuable insights for practitioners in the cybersecurity industry, AI developers, decision makers and organizations developing intrusion detection systems that are transparent, reliable and ethically responsible in the dynamic digital landscape.
Christian Manna Guimma· Scriptora International Jour...· 0 citations
The increasing scale, speed, and sophistication of cyberattacks have rendered traditional rule-based intrusion detection systems (IDS) insufficient for modern network environments. While machine learning (ML)-based IDSs have significantly improved detection capabilities, their black-box nature limits trust, interpretability, and practical deployment in real-world security operations. To address this challenge, this paper proposes an explainable machine learning framework for network intrusion detection using the CICIDS2017 dataset. The framework integrates multiple supervised learning models, including baseline and ensemble classifiers, and evaluates them using standard performance metrics such as accuracy, precision, recall, F1-score, and ROC-AUC. To enhance transparency, Shapley Additive exPlanations (SHAP) are employed to quantify feature contributions and provide both global and instance-level interpretability of model predictions. Experimental results demonstrate that ensemble models achieve superior detection performance while maintaining high interpretability. Furthermore, the explainability analysis reveals key traffic characteristics associated with different attack behaviors, providing deeper insight into attack behavior and supporting security analysts in interpreting intrusion alerts. The proposed approach improves detection accuracy, reduces false positives, and supports informed decision-making, thereby enhancing the transparency, trustworthiness, and practical applicability of intrusion detection systems.
Moa’ath Sa’ad Al-A’athal, Q. A. Al-Haija· Recent Progress in Science a...· 0 citations