Insider threats remain one of the most challenging aspects of organizational security, particularly in the era of digital transformation and widespread remote access to sensitive data. This study proposes a machine learning-based approach to personnel security that combines Isolation Forest and Local Outlier Factor algorithms with behavioral features enhanced through the use of large language models (LLMs). To improve detection accuracy, user web activity was classified using LLM-generated labels derived from website content analysis. Experimental results demonstrate strong model performance in identifying insider activity at the user level, with high detection accuracy and minimal false classifications. In addition, time-to-detection analysis revealed that most insider threats were identified before or shortly after the onset of malicious behavior. The findings suggest that the proposed system is not only effective in capturing behavioral anomalies but also feasible for real-time deployment in enterprise environments.
Digital technologies have rapidly permeated nearly all domains of social life, including education, mass media, the workplace, daily routines, commerce, sports, healthcare and entertainment. The development of a digital society entails the creation of a complex yet thoroughly transformed ecosystem in which humans and technologies coexist in new forms of interaction and cohabitation. The integration of information and communication technologies (ICT), artificial intelligence, the Internet of Things (IoT), and cloud computing has facilitated the emergence of an interconnected digital environment. Within this environment, business processes can be executed with minimal time and resource expenditure. Digital transformation initiatives are progressively focused on automating repetitive tasks, leveraging big data analytics to inform strategic management decisions, expanding electronic commerce, and strengthening customer interaction channels. Nevertheless, digital transformation remains a complex, resource-intensive, and time-consuming undertaking for most enterprises—particularly for small and medium-sized businesses. In this context, it becomes imperative for companies to articulate clear digital strategies and define priority areas for transformation. Based on these priorities, enterprises must adapt to ongoing changes and implement innovative solutions across both technological and methodological dimensions.
Simultaneously, the advancement of digital transformation introduces not only new opportunities but also a range of emerging risks and threats. These challenges are inherent both to the transformation process itself and to the subsequent digital operations of an organization. As
0000-0003-4657-1039 (M. Bilychenko); 0000-0001-7729-2011 (N. Kasianova); 0000-0003-2102-1524 (S. Smerichevskyi);
0000-0002-7738-161X (O. Lavrynenko); 0000-0002-8801-4700 (I. Kryvovyazyuk)
noted in a report by Deloitte [
Insider threats, social engineering attacks, and careless handling of sensitive information
frequently lead to serious security incidents. According to IBM’s Cost of a Data Breach report [
Human-related risks have become especially important for enterprises undergoing digital
transformation. Ensuring personnel security is essential for stable business operations and requires
a structured approach that includes developing employees’ digital skills, improving human
resource policies, and applying up-to-date cybersecurity standards in day-to-day operations [
Traditionally, personnel security has been understood as a set of measures aimed at ensuring the stability of human capital, maintaining adequate employee qualifications, fostering effective motivation and preventing internal threats. However, the rapid advancement of digital technologies necessitates a reassessment of existing approaches to evaluating and forecasting the state of this subsystem. In particular, the use of modern modeling techniques is gaining relevance— ranging from score-based assessments of employee motivation to hierarchical models built on fuzzy logic. These approaches enable the analysis of how changes in motivation systems, training programs, and personnel management influence the likelihood of labor-related risks, while also identifying the most vulnerable areas.
Beyond conventional strategies for ensuring personnel security, insider threats have become
especially critical in the digital economy. Despite the availability of extensive software solutions
designed to guard against external intrusions, internal threats—posed by employees or individuals
with privileged access—remain the most challenging to detect and mitigate. Latest research
increasingly shifts from general personnel system management to the development of preventive
analytics tools capable of identifying risky behavior before it leads to serious consequences. In this
context, particular attention has been directed toward the use of data mining and machine learning
methods for building adaptive personnel risk management systems. These systems analyze
extensive digital traces left by employees such as activity within internal networks, access to
information resources, and behavioral pattern shifts, to detect early signs of potential insider
threats with high accuracy [
Insider threat detection systems based on anomaly detection techniques rely on statistical
modeling of typical employee interactions with IT resources. Deviations from established
behavioral patterns may signal potential personnel-related threats. For instance, M.
RaissiDehkordi and D. Carr [
An alternative approach was introduced by T. Rashid and colleagues [
In contrast, G. Gavai and colleagues [
In the study by D. C. Le and N. Zincir-Heywood [
C. Song and colleagues [
The comparison of models is presented in Table 1.
Author & Year
M. Raissi-Dehkordi
& D. Carr, 2011 [
G. Gavai et al., 2015
[
Random Forests D. C. Le & N.
Zincir-Heywood,
2021 [
Autoencoder, LOF,
LODA Density-Based Local Outlier
Factor (LOF) LLM-based MultiAgent System (Audit-LLM)
Simulated data via OPNET CERT
RUU Research Dataset
Vegas CERT R4.2,
R6.2
High accuracy for group attacks; moderate performance for individual threats Model is easy to train but becomes computationally intensive with scale High accuracy, though primarily focused on biometric profiling
models in terms of detection effectiveness Autoencoder and LOF achieved the highest detection accuracy
datasets; interpretability remains limited High detection accuracy and improved explainability; scalability constraints noted
In summary, the most prevalent and effective approaches to insider threat detection within personnel security systems are based on the use of Isolation Forest and Local Outlier Factor algorithms. Their effectiveness lies in analyzing behavioral data collected from corporate networks, such as event logs, access records, and system activity. These algorithms have demonstrated high performance in identifying anomalous employee behavior that may indicate internal security threats.
However, much of the existing research primarily focuses on optimizing model accuracy while
paying limited attention to the practical challenges of deploying such solutions in real
organizational settings. Key challenges, including the adaptability of detection models to evolving
operational environments, the scalability of solutions across enterprise contexts, and their seamless
integration into existing IT infrastructures, remain underexplored in the current body of research.
Furthermore, the potential of emerging technologies such as large language models (LLMs) to
enhance system scalability, computational efficiency, and the interpretability of detection outcomes
has received limited scholarly attention. Recent works have highlighted the importance of
integrating real-time monitoring and secure data handling into insider threat detection systems.
For instance, Zhuravchak et al. [
Building upon the insights from the literature and addressing the identified research gaps, this study proposes a hybrid insider threat detection approach that integrates both established anomaly detection techniques and recent advancements in data-driven modeling. Specifically, two algorithms were selected for model development: Isolation Forest and Local Outlier Factor (LOF), both of which have demonstrated high accuracy in previous studies while offering complementary strengths in detecting anomalous behavior.
The LOF algorithm is based on the concept of local density. Unlike global models that assess each data point in relation to the entire dataset, LOF evaluates an observation in the context of its immediate neighborhood. The underlying assumption is that an anomalous instance will exhibit significantly lower local density compared to its neighbors—indicating its presence in a relatively sparse region of the feature space. Mathematically, the LOF algorithm is implemented through several sequential steps. The first involves calculating the distance to the -nearest neighbors distance().
This parameter defines the radius of the local neighborhood around an observation p within which the analysis is conducted. Subsequently, the algorithm calculates the reachability distance, a measure designed to prevent unrealistically low density estimates that may result from the presence of extremely close neighboring points
reach dist k ( p , o )= max ( k− distance ( o ) , dist ( p , o )).
The next step involves computing the local reachability density () of the observation: where N k ( p) is the collection of the k closest points to p, based on a distance metric which is typically Euclidean distance. This metric quantifies how densely the pointp is surrounded by its knearest neighbors. In the final step, the LOF score is computed: lrdk ( p)=
∑ o ∈ Nk( p)
| N k ( p)| reach dist k ( p , o )
.
∑ L O F k ( p)= o ∈ Nk( p) lrdk ( p) .
| N k ( p)|
lrdk ( o )
The LOF score represents the ratio of the average local reachability density of a point’s neighbors to the local reachability density of the point itself. Formally, if L O F k ( p)≈ 1 the behavior of point p is considered normal. However, if L O F k ( p)≫ 1, the point is identified as anomalous, indicating that its local density is significantly lower than that of its surrounding neighbors. The second algorithm selected for this study is Isolation Forest. Unlike most traditional methods that model normal behavior and identify deviations, Isolation Forest is based on the principle of isolation. The core idea is that anomalous instances are more susceptible to isolation—they tend to be located further away from dense clusters of points and can therefore be separated more quickly through recursive partitioning of the feature space. The model consists of an ensemble of isolation trees (iTrees). The construction of each isolation tree involves the random selection of a feature, followed by the choice of a split value within the domain of that feature. This recursive partitioning continues until the instance is fully isolated in a leaf node, with the resulting isolation depth serving as an empirical indicator of separability—where shorter path lengths typically correspond to anomalous instances due to their greater isolation from the general data distribution.
The overall structure of the algorithm can be summarized as follows: the isolation forest builds
a tree-based structure capable of efficiently isolating each individual instance [
The mathematical formalization of the Isolation Forest algorithm can be introduced as follows. In the first step, the expected path length for isolating a data point x in a tree constructed from n observations is computed:
where ℎ() denotes the path length required to isolate the point x, and is a correction constant (the Euler’s constant). Following this, the anomaly score is calculated as:
E [h( x) ]≈ log2 ( n)+ γ,
− E [h( x)] s ( x , n)= 2 c (n) , where () represents the average path length, which, for a binary search tree, can be approximated as follows:
2 ( n− 1) c ( n)= 2 H ( n− 1)− , (6)
n where () denotes the i-th harmonic number, defined as the sum of the reciprocals of the first i positive integers.
The interpretation of results obtained using the Isolation Forest algorithm is based on the anomaly score s ( x), which ranges from 0 to 1. Values approaching 1 (i.e., s ( x ) → 1) indicate a high likelihood that the observation is anomalous, suggesting that the behavior of the corresponding instance significantly deviates from the norm observed in the overall dataset. Conversely, values of s ( x) < 0.5 are indicative of typical, non-anomalous behavior consistent with the majority of the observations. Scores near 0.5 require further investigation, as they may represent borderline or potentially risky cases that have not yet escalated into overt violations.
Due to the limited availability of actual corporate data for insider threat research, this study
utilizes the publicly accessible CERT Insider Threat Dataset [
The first step of the analysis involved constructing a focused sample of users for more detailed investigation. Since the full dataset is quite large and contains more information than necessary for initial model development, a decision was made to reduce its size while preserving a balanced distribution between classes. Specifically, 20 out of the 70 users flagged as insider threats were selected, along with 30 users from the remaining 930 who exhibited no suspicious behavior. This resulted in a working sample of 50 employees, with insiders making up 40% of the group. Class balance was a key factor in building this sample. In the original dataset, insider cases were relatively rare accounting for less than 10% of all observations. Using the original distribution would have led to a strong class imbalance, which could hinder the model’s ability to detect insider threats effectively. By selecting a more balanced subset, we aimed to improve the model’s capacity to learn from and identify unusual behavioral patterns.
A key innovation in this study is the enhancement of existing behavioral data through the integration of additional features generated by large language models. This approach aims to increase the informativeness of features relevant to personnel security analysis, particularly in relation to employees’ web activity. The analysis focuses on two primary risk scenarios: 1.
Visiting job search websites, which may be linked to attempts to take sensitive data when changing jobs.
Accessing websites that could be used to share confidential company information without permission.
Traditional threat classification methods often rely on fixed lists of domains (such as job search or data leak sites), but these are inflexible and cannot detect new or unlisted threats. To address this, we propose a content-based approach that uses the text of visited websites to determine their type. Based on the content and url fields in the CERT dataset, we created two binary indicators, which were evaluated using LLM prompts to classify the intent behind each web visit. This LLMdriven feature enrichment allows for more nuanced and adaptive threat identification beyond rigid rule-based systems.
Given the large volume of data it was essential to select a fast and resource-efficient model for
generating LLM-based responses. For this purpose, the Phi-3.5-mini-instruct model [
The complete dataset was then split into training and test sets. Model training was performed on the training subset, while evaluation was conducted using the test set. Following best practices, the training data was composed primarily of normal users, whereas the test set included a higher proportion of users exhibiting anomalous or risky behavior. Specifically, the split was performed at the user level: 19 users were assigned to the test set, 68\% of whom were identified as insiders, while 31 users were included in the training set, of which only 22\% were labeled as insiders. The distribution of data instances was similarly stratified, with approximately 65\% of records allocated to the training set.
The next logical step in the study involved selecting appropriate evaluation metrics to assess the performance of the developed models. Three commonly used classification metrics from machine learning practice were chosen: Detection Rate (DR), Accuracy, and F1 Score.
The primary and most critical metric is the Detection Rate, which reflects the proportion of true insider threats correctly identified by the model out of the total number of actual insiders. This metric is particularly important in the context of personnel security, where the main objective is to minimize the number of undetected threats. The formula for calculating the Detection Rate is as follows:
Number of detected insiders D R=
Total number of actual insiders The second evaluation metric is Balanced Accuracy, which reflects the overall correctness of the model’s predictions. It measures the proportion of all correctly classified instances relative to the total number of observations. The formula for calculating Balanced Accuracy is:
Balanced Accuracy=
T P + TN T P + F P + TN + F N , where: TP—correctly identified insiders, TN—correctly identified non-insiders, FP—normal employees incorrectly labeled as insiders, FN—actual insiders missed by the model.
The third key evaluation metric is the F1 Score, which represents the harmonic mean of Precision and Recall. This metric provides a more balanced assessment of model performance, particularly in scenarios where the dataset exhibits significant class imbalance. The F1 Score is especially useful when both false positives and false negatives carry important consequences. The formula for calculating the F1 Score is:
F 1= 2 P R ,
P + R R =
T P T P + F N where P denotes precision and calculated as follow: Accordingly, the evaluation of these metrics provides a multifaceted understanding of the model’s performance, capturing both its ability to promptly detect insider threats and its overall classification accuracy with respect to employee activity.
Based on the engineered features, anomaly detection models were trained to identify potential insider threats. The evaluation was conducted at two levels: individual daily activity records and aggregated user-level behavior. This section presents the results of model performance at the daily level, where each data point represents a single day of activity for a specific user. The evaluation metrics are summarized in Table 2.
As shown in Table 2, both models demonstrate relatively low F1 Scores, suggesting that accurately identifying anomalous behavior based solely on daily patterns remains challenging. This limitation is likely due to the subtle and context-dependent nature of insider activity, which may not manifest clearly within a single day’s behavioral footprint.
Nevertheless, the Balanced Accuracy values are moderately higher, particularly for the Isolation Forest model, which outperforms LOF by more than two percentage points. Balanced Accuracy, which accounts for both sensitivity and specificity in imbalanced datasets, indicates that Isolation Forest has a slightly better ability to distinguish between normal and anomalous classes. This result highlights its relative robustness in handling behavioral data where insider activity represents a minority class.
A substantially different outcome was observed when the analysis shifted from daily-level activity to user-level behavior. In this approach, all behavioral data were aggregated per user, allowing for a more holistic representation of activity patterns. The results of this evaluation are presented in Table 3. As shown in Table 3, the Isolation Forest model achieved outstanding performance across all metrics, including a 100% Detection Rate, meaning that it correctly identified all insider threats in the test set. (8) (9) (10) (11) Moreover, it achieved perfect Balanced Accuracy and F1 Score, indicating a high degree of precision and recall with no false positives or negatives. This level of performance suggests that, when user activity is considered in aggregate rather than on a daily basis, distinct behavioral patterns become more detectable and easier to classify. Although the LOF model also achieved a 100% Detection Rate, its Balanced Accuracy (58%) and F1 Score (84%) were substantially lower than those of Isolation Forest. This indicates that while LOF was able to detect all insiders, it misclassified a larger portion of non-insiders, resulting in reduced precision and overall classification stability.
It is important to emphasize that in insider threat detection tasks, timeliness of detection is as critical as the detection itself. The earlier a threat is identified, the greater the likelihood of implementing preventive measures before confidential information is leaked or organizational harm occurs. To illustrate this aspect, the modeling results for an individual user are presented in Figure 3, which shows the temporal dynamics of several key features used by the Isolation Forest model for user “KRL0501” over the analyzed period.
Figure 3 reveals several noteworthy behavioral signals. The purple line shows intermittent spikes, suggesting periods where the user connected additional devices shortly after job search activity which is a potentially suspicious pattern. Red vertical dotted lines indicate the actual periods of insider activity, as defined by the original dataset authors. Overall, the user’s activity pattern appears irregular, characterized by alternating periods of high engagement and inactivity. Especially concerning are the timeframes where elevated job search behavior coincides with increased access to suspicious files or tools. This convergence of risk indicators may signal a heightened probability of insider threat—for instance, a user actively seeking new employment while accessing or exfiltrating sensitive resources. Visualizations of this kind are critical tools for insider threat detection systems, as they capture the interplay between behavioral indicators and provide actionable insights into user intent and risk escalation over time. Such patterns can help security teams prioritize monitoring efforts and trigger early interventions.
To further assess the effectiveness of the proposed insider threat detection model, an additional analysis was conducted to examine the timing of the model’s first alert relative to the actual onset of insider activity. Given the critical importance of early detection in mitigating risks such as data leaks or internal sabotage, a key objective of this analysis was to evaluate how promptly the model responds to anomalous behavioral patterns. A comparative study was carried out, measuring the time between the model’s first detection of suspicious activity and the verified beginning of insider behavior. The findings are summarized below: 6 insiders were flagged either on the exact day of their first suspicious activity or several days prior, indicating the model’s high sensitivity and its capacity to detect emerging threats at a very early stage. 4 users were identified within the first 31 days after the onset of insider activity, confirming the model’s effectiveness under medium- and short-term monitoring scenarios.
All insiders were detected before the end of their malicious activity period, demonstrating the model’s reliability in completing the detection-response cycle before significant harm was done.
These results provide strong evidence that the model not only performs well in detecting anomalies but also offers timely intervention, which is essential for proactive threat mitigation. Therefore, the developed approach can be considered a robust and practical solution for real-time monitoring of employee activity in enterprise environments. It is well-suited for supporting timely, evidence-based decision-making in the context of personnel security.
This study introduced a data-driven approach to insider threat detection by combining unsupervised machine learning algorithms such as Isolation Forest and Local Outlier Factor with behavioral data and novel features generated through LLMs. Using the CERT R4.2 dataset, the models were evaluated at both daily and user-aggregated levels. While detection performance on daily records was limited, the user-level analysis yielded highly promising results, with the Isolation Forest model achieving 100% detection rate, perfect balanced accuracy, and no false positives. A key innovation was the integration of LLM-based content classification to dynamically assess web activity associated with job search and data leak risks. These enriched features improved the model’s ability to capture complex behavioral patterns indicative of insider threats. Time-to-detection analysis further demonstrated that the model could identify risks before or shortly after the start of malicious activity, supporting its use for early intervention. Overall, the results confirm the high effectiveness, robustness, and practical utility of the proposed approach in real-world personnel security contexts.
Based on the outcomes of this study, the following directions are recommended for practical implementation and broader adaptation of the proposed model:
Integration into real-world monitoring systems. The results support the effective integration of the Isolation Forest model into corporate employee monitoring platforms. Its ability to detect suspicious behavior in a timely manner makes it a valuable tool for mitigating the risk of internal data leaks.
Strengthening internal control and risk management. Real-time detection of insider threats enables organizations not only to respond to current risks but also to proactively prevent future incidents. The model can be used as a key part of internal control systems, helping quickly detect unusual behavior that may point to data misuse, access abuse, or attempts to leak confidential information.
Adaptation across sectors and organizations. Due to its flexibility, the Isolation Forest model can be adapted for use in various industries, including finance, government and technology. Its deployment can be tailored to the specific operational needs and risk profiles of different organizations, making it a scalable solution for enhancing personnel security in high-stakes environments.
In conclusion, the proposed approach demonstrates high potential as a practical tool for realtime monitoring and early detection of insider threats. It offers a balanced combination of detection accuracy, timeliness, and operational applicability, making it well-suited for deployment in enterprise security systems operating in dynamic, data-rich environments.
While preparing this work, the authors used the AI programs Grammarly Pro to correct text grammar and Strike Plagiarism to search for possible plagiarism. After using this tool, the authors reviewed and edited the content as needed and took full responsibility for the publication’s content.