Aug 2026· Security and Privacy· Vol 9· 0 citations· 15 references
TL;DR
This work proposes MARS‐ITD (Multi‐Agent Real‐time System for Insider Threat Detection), which consists of a detection framework and an investigation framework that improves real‐time detection performance and interpretability but also provides a scalable, collaborative architecture for LLM‐based security analysis systems.
Abstract
Insider threats have become a critical cybersecurity risk for enterprises and institutions due to their covert nature, authorized access privileges, and deceptive behavior. Traditional rule‐based or statistical anomaly detection methods struggle with the dynamic complexity of insider activities. Deep learning methods offer superior feature extraction but often suffer from imbalanced data and coarse‐grained detection granularity. Meanwhile, large language models (LLMs) present new possibilities for insider threat detection but face challenges such as high detection latency and limited multidimensional analysis capabilities. To address these issues, we propose MARS‐ITD (Multi‐Agent Real‐time System for Insider Threat Detection), which consists of a detection framework and an investigation framework. The detection framework performs preliminary screening of anomalous logs through parallelized multi‐agent processing, while the investigation framework reconstructs the complete threat scenario by collaboratively correlating multiple types of logs, thereby reducing the false positive rate. We evaluated MARS‐ITD on the widely used CERT r4.2 insider threat dataset at the user‐session granularity. Compared with state‐of‐the‐art graph neural network baselines and the recent LLM fine‐tuning method ITDLM, MARS‐ITD achieves the highest recall of 94.44% while maintaining an accuracy of 95.42% and an FPR of 4.58%, which is substantially lower than GNN baselines (8.25%–14.88%). This demonstrates that its detection‐investigation pipeline can effectively prioritize the discovery of coordinated insider threats while suppressing isolated false positives. Ablation studies further highlight the investigation framework's effectiveness in reducing false positives while improving recall. Overall, this work not only improves real‐time detection performance and interpretability but also provides a scalable, collaborative architecture for LLM‐based security analysis systems.
Traditional rule-based intrusion detection systems are increasingly ineffective against modern and rapidly evolving cyber threats, creating the need for intelligent and scalable intrusion detection frameworks supported by realistic datasets. Existing IDS benchmarks often suffer from limitations such as outdated attack scenarios, limited multiclass coverage, and insufficient realism in traffic generation and monitoring environments. Therefore, this paper aims to develop an intelligent end-to-end threat-hunting framework supported by a novel large-scale multiclass intrusion detection dataset generated within a controlled cybersecurity laboratory environment designed to emulate realistic network conditions. The proposed dataset contains more than 7 million labeled network packets, including benign traffic and 15 modern cyberattack categories such as MITM ARP Spoofing, SSH/FTP brute-force attacks, SQL Injection, XSS, Port Scanning, Remote Code Execution, SYN Flood, and multiple DDoS variants. The proposed framework integrates realistic traffic generation, data acquisition, preprocessing, feature engineering, multiclass labeling, and intelligent intrusion detection using several supervised ML and DL models, including Naïve Bayes, Logistic Regression, Random Forest, Decision Trees, Feedforward Neural Networks, Multi-Layer Perceptron, and Convolutional Neural Networks. Traffic generation and monitoring were performed using real-world attacker tools and security platforms, including Kali Linux, Snort, Suricata, Wireshark, pfSense, and OWASP BWA. Experimental results demonstrate that the Decision Tree model achieved the highest overall performance, with detection accuracy reaching 99.9% and prediction latency as low as 1.1 μs. The findings confirm the effectiveness of the proposed framework for scalable real-time intrusion detection and cyber threat analysis. Compared with traditional IDS benchmarks such as NSL-KDD, UNSW-NB15, and CICIDS2017, the proposed dataset provides more realistic multiclass attack generation and live traffic monitoring within a unified experimental environment.
Q. Abu Al-haija, Zaid Masoud, Assim Yasin et al.· Journal of Computer Virology...· 1 citation
Large-scale DDoS attacks remain a serious threat to today's networked systems, which aim to make services unavailable by sending a massive amount of traffic. The traditional detection methods are mostly about attack categorization and are not that context-aware or actionable in providing support to security analysts. We propose SentinelsGuard AI, a self-learning DDoS classification and mitigation system that is built from a combination of machine learning, retrieval-augmented knowledge, and LLM-based reasoning in one platform. The proposed system is realized as a Flask-based web application, which processes the network flow statistics data, extracted from incoming traffic, and transforms the data to generate representative features of the network flows, before detecting the attacks using the XGBoost classifier. After classification, the framework accesses domain-specific attack intelligence from a structured Retrieval-Augmented Generation (RAG) knowledge base with profiles of multiple categories of DDoS attacks. This contextual information is used with LLM-enabled reasoning to derive comprehensible security explanations, determine the severity of the attack, and suggest the firewall mitigation rules that can be applied. The framework stores analysis data in a SQLite database for operational monitoring, and displays security events in an interactive dashboard that includes traffic visualization, attack logs, and threat summaries. The architecture proposed brings statistical learning together with contextual knowledge of cybersecurity and attempts to bridge the gap between automatic attack detection and explainable incident response. It integrates all the key features of a classification-based network security decision support platform into a single stream, enabling a classification-based approach to network security to become more interpretable and usable in reality: persistent logging, visualization, knowledge retrieval, reasoning, and system recommendation of mitigations.
K. V. Sai Phani, P. Karthik, Farooq Sunar Mahammad et al.· 2026 International Conferenc...· 0 citations
: Insider threats remain difficult to detect because malicious actions often resemble legitimate user behaviour and may evolve gradually over time. This paper presents MLBRS, a multi-layer behavioural risk scoring framework that combines rule-based scoring, statistical deviation analysis, and Isolation Forest-based anomaly detection to generate continuous employee-level risk scores. The framework integrates behavioural indicators, personalised deviation modelling, and multivariate anomaly detection to identify both abrupt and gradual behavioural changes. Due to the limited availability of publicly accessible datasets containing database-query-level insider threat activity, a synthetic dataset was constructed to simulate organisational behaviour with temporal consistency, multiple employee roles, and diverse attack scenarios. Existing insider-threat datasets primarily capture system-level activity and do not adequately represent database interactions. Experimental evaluation demonstrates consistent detection performance, achieving an ROC-AUC of 0.978 and an F1-score of 0.88 on the synthetic dataset. Additional cross-dataset evaluation using CERT-derived behavioural traces shows reduced but stable performance under less aligned behavioural conditions. The results indicate that MLBRS provides an interpretable and scalable approach for behavioural insider threat detection across heterogeneous activity patterns.
V. L. Kartheek, Aayush Shah, Rishav Jain et al.· International Conference on...· 0 citations
An explainable machine learning framework for network intrusion detection using the CICIDS2017 dataset is proposed, which improves detection accuracy, reduces false positives, and supports informed decision-making, thereby enhancing the transparency, trustworthiness, and practical applicability of intrusion detection systems.
Moa’ath Sa’ad Al-A’athal, Q. A. Al-Haija· Recent Progress in Science a...· 0 citations
The rapid growth of Internet of Things (IoT) networks has increased their exposure to cyber threats, while existing Intrusion Detection Systems (IDS) remain largely reactive and resource-intensive. This paper proposes a HMCTI Framework for proactive cyberattack detection in IoT environments. The framework distributes threat intelligence across Edge, Fog, and Cloud layers, integrating behavioral drift analysis, flow-level features, and device-context information to identify attacks at their early stages. By combining lightweight anomaly detection, context-aware threat analysis, and multi-layer threat correlation, HMCTI enhances detection capability while maintaining scalability and efficiency. Experimental evaluation using the CICIoT2023 dataset assesses detection accuracy, Detection Lead Time (DLT), and resource overhead. The proposed framework provides a scalable and proactive approach for early cyberattack detection in next-generation IoT networks.
Sajjad Ahmed, Yaseen Baig, Rabi Iqbal Rana et al.· International Conference on...· 0 citations
Advanced persistent threats, zero-day exploits, encrypted command-and-control traffic, and botnet campaigns continue to reduce the reliability of conventional intrusion detection systems because static detectors provide limited transparency and weak adaptation under traffic drift. This paper presents an explainable and adaptive machine learning framework that integrates a LightGBM threat detector, SHAP-based decision explanations, density-aware concept drift detection, active incremental updating, and a contextual bandit defense policy. LightGBM is adopted because its leaf-wise gradient boosting structure provides high discrimination for heterogeneous flow features while maintaining low inference latency and native feature-importance support. The framework is evaluated on CIC-IDS2017, UNSW-NB15, and ToN_IoT using stratified train-validation-test splits, leakage prevention, five-run validation, and a 48-hour Kafka-based streaming simulation. The proposed model achieved 99.1% accuracy, 98.7% F1-score, 98.4% recall, and a 0.007 false alarm rate. During streaming evaluation, 14 adaptive model updates reduced mean detection latency from 27.4 s to 11.2 s, while SHAP explanations based on DNS entropy, JA3 rarity, packet interval, and flow-duration evidence reduced analyst triage time by 23%. Comparative results show that the proposed explainable adaptive pipeline improves detection reliability, reduces false alarms, and supports auditable mitigation decisions better than static and black-box IDS baselines.
P. A. Prakash, Salath Joseph A, A. M et al.· 2026 7th International Confe...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
