MLBRS: A Multi-Layer Behavioural Risk Scoring Framework for Insider Threat Detection

Abstract

: Insider threats remain difficult to detect because malicious actions often resemble legitimate user behaviour and may evolve gradually over time. This paper presents MLBRS, a multi-layer behavioural risk scoring framework that combines rule-based scoring, statistical deviation analysis, and Isolation Forest-based anomaly detection to generate continuous employee-level risk scores. The framework integrates behavioural indicators, personalised deviation modelling, and multivariate anomaly detection to identify both abrupt and gradual behavioural changes. Due to the limited availability of publicly accessible datasets containing database-query-level insider threat activity, a synthetic dataset was constructed to simulate organisational behaviour with temporal consistency, multiple employee roles, and diverse attack scenarios. Existing insider-threat datasets primarily capture system-level activity and do not adequately represent database interactions. Experimental evaluation demonstrates consistent detection performance, achieving an ROC-AUC of 0.978 and an F1-score of 0.88 on the synthetic dataset. Additional cross-dataset evaluation using CERT-derived behavioural traces shows reduced but stable performance under less aligned behavioural conditions. The results indicate that MLBRS provides an interpretable and scalable approach for behavioural insider threat detection across heterogeneous activity patterns.