Insider threat detection study reports 95% recall in daily checks

What happened

Researchers reported a 95% recall rate for an insider threat detection model using 30-day activity sequences in a study published in Scientific Reports on 5 August 2025.

The system assesses individual days of employee behaviour rather than assigning a single judgement to a person’s overall activity. The research used the CERT insider threat dataset, which the paper describes as covering 1,000 employees over 18 months.

Recall measures the proportion of actual positive cases that a system identifies. The reported figure therefore concerns the detection of malicious activity in the experiment; it does not mean that 95% of alerts were correct or that the system prevented 95% of incidents.

The Scientific Reports paper, the original source for this report, combines a temporal convolutional network, or TCN, with a Transformer. Both are machine-learning architectures designed to find patterns in data, but they examine relationships across an activity sequence in different ways.

The TCN component looks for patterns across time, including changes between nearby days. The Transformer connects information from different points in the sequence, allowing an unusual action to be considered alongside behaviour elsewhere in the same window.

The result comes from a dataset experiment. The supplied article text does not describe a live workplace deployment or document an incident stopped by the model.

The background

The authors frame their work around a limitation of systems that classify whole users as malicious or benign. Such systems can require an accumulation of evidence, potentially identifying a person only after harmful activity has ended.

Daily classification changes the question being asked: whether a particular day’s activity appears malicious, rather than whether an employee should receive a lasting label. It is intended to detect changes within an otherwise ordinary history of work.

The input covers five types of records: web access, email activity, logins and logouts, device use, and file operations. Records are grouped by employee and ordered by time before being converted into daily summaries.

Those summaries include activity counts, login frequency, file operations, email volumes, web requests and activity duration. The preparation process also brings together information about roles, departments and teams, alongside psychological assessment information included in the dataset.

Missing values are handled through estimation, including the use of feature means. This matters because a model’s assessment depends not only on its architecture but also on the completeness and preparation of the records it receives.

The paper describes reducing the extracted information to 104 input features, excluding employee information at that stage. Each employee’s records are then divided into overlapping sequences, with each new sequence beginning one day later than the previous one.

The researchers considered window lengths of 20, 25, 30, 35, 40 and 45 days. They chose that range partly because one dataset scenario involves an employee concealing malicious behaviour over roughly two months, making a very short history potentially insufficient.

The architecture contains four TCN blocks followed by two Transformer layers and a classifier. Its output is a prediction for every daily time step within the input window, rather than one prediction for the entire sequence.

A separate challenge is data imbalance: ordinary activity greatly outnumbers malicious examples. A system trained without accounting for that imbalance can become good at recognising the common category while missing the cases security teams most need to find.

The researchers address this through phased training and a technique called focal loss, which directs more learning towards difficult-to-classify examples. They explain that conventional methods for generating extra minority-class examples are difficult to apply to ordered sequences of employee activity.

Overlapping windows create another risk: the model may repeatedly encounter very similar information and learn patterns too specific to its training material. The paper describes using dropout, which temporarily excludes some model units during training, alongside validation and early stopping to limit this problem.

The focus on earlier detection reflects concerns raised in other insider-risk research. In an earlier survey on confidence in early insider threat detection, Cybersecurity Insiders and Cogility reported that only 23% of respondents expressed strong confidence in identifying threats before serious damage.

What people are saying

The study’s authors argue that assessing daily sessions could allow organisations to intervene before harm escalates while preserving information about the circumstances surrounding suspicious activity. They present this as an alternative to identifying malicious users after events have concluded.

They also say user-level classification cannot adequately distinguish accidental misuse from deliberate abuse by the same person. Their proposed approach concentrates on individual periods of activity, although the supplied text does not establish that the model itself can determine a person’s intent.

In reviewing earlier research, the authors report that activity-level detection has generally been harder than retrospective user classification. They cite two studies in which activity-level assessments produced lower scores than user-level assessments, supporting their argument that finer-grained detection presents a distinct technical challenge.

The authors attribute their model’s reported performance to combining local behavioural patterns with relationships across the wider sequence. They say that using both forms of information gives the final classifier a richer representation of employee activity.

What happens next

The supplied text gives no deployment timetable. For organisations considering this approach, the outstanding issue is how the experimental result would translate into a working monitoring system with different employees, roles and activity patterns.

The 95% recall figure alone cannot establish the likely investigation workload. That requires information about false positives—ordinary activity incorrectly flagged as malicious—and precision, the proportion of alerts that are correct. Neither measure is supplied for this model in the available excerpt.

Detection timing also needs clarification. The paper describes the Transformer as considering all time steps within a window, including behaviour before and after a day being assessed. Daily predictions within a completed sequence are not necessarily equivalent to an alert available on that day, before later records exist.

Employee information would require careful handling in any organisational evaluation. Earlier CISA guidance on insider threat management teams recommends bringing together security, human resources, legal and operational expertise, with safeguards for sensitive staff information. That provides a governance context for assessing a model built from detailed behavioural records.