Insider Threat Detection: A Novel Approach Combining User Behaviour Trust Evaluation and Fuzzy Recommendations

Insider Threat Detection: A Novel Approach Combining User Behaviour Trust Evaluation and Fuzzy Recommendations | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Insider Threat Detection: A Novel Approach Combining User Behaviour Trust Evaluation and Fuzzy Recommendations Zenan Wu, Tiancai Zhang, Liqin Tian, Zhangxuan Bai, Yuejun Dong, and 1 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6024991/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Insider threats can cause significant damage to a business or organisation, and insider threat detection is critical to maintaining the security of vital corporate information. By evaluating and monitoring the behaviours of visiting users, abnormal behaviours, unusual activities or potential threatening behaviours can be detected at an early stage, which will help to improve the identification of insider threats in a business/organisation and to take effective measures to deal with potential risks. Existing insider threat detection methods rely more on predefined rules, require explicit feature engineering, and generate more false positives.To overcome these limitations, the focus of the work proposed in this paper is to introduce an enhanced insider threat detection method based on credible assessment of user behaviour. It enables fewer false positives, faster threat detection, and significantly higher classifier accuracy. This enhancement is achieved due to the fact that: firstly, the model contains both a direct and an indirect assessment module, and ensures the dynamics of the assessment by balancing the factors; furthermore, the model optimises the balance of the subjective and objective weights in the direct assessment module, which effectively solves the impact of the unequal distribution of the subjective and objective weights on the assessment results; and, based on the trust recommendation of the user by the service provider of a comparable system, the user is evaluated by using a fuzzy Petri net to assess the indirect trust attributes of the user. Finally, the model was tested on the CMU-CERT v4.2 dataset using four different performance evaluation metrics, and compared and analysed with existing evaluation models. The test results show that the model has higher accuracy for untrustworthy user detection and better applicability of the model. Physical sciences/Mathematics and computing/Computer science Physical sciences/Mathematics and computing/Information technology Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6024991","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":418631613,"identity":"8cf5a1fc-43df-421c-a729-fcf8a4dee6c7","order_by":0,"name":"Zenan Wu","email":"","orcid":"","institution":"Zhongyuan University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Zenan","middleName":"","lastName":"Wu","suffix":""},{"id":418631615,"identity":"dd793cd3-12bf-45f4-911f-fbbfc1e7f420","order_by":1,"name":"Tiancai Zhang","email":"","orcid":"","institution":"Zhongyuan University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Tiancai","middleName":"","lastName":"Zhang","suffix":""},{"id":418631617,"identity":"b6441613-f5d7-48f8-ac6f-5eef458fc4ae","order_by":2,"name":"Liqin Tian","email":"","orcid":"","institution":"North China Institute of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"Liqin","middleName":"","lastName":"Tian","suffix":""},{"id":418631618,"identity":"03c9a62c-48ed-4df8-82e4-62454cd1b245","order_by":3,"name":"Zhangxuan Bai","email":"","orcid":"","institution":"Yu'an Information Technology Co.Nanjing","correspondingAuthor":false,"prefix":"","firstName":"Zhangxuan","middleName":"","lastName":"Bai","suffix":""},{"id":418631619,"identity":"2019b41c-3ea8-4861-8715-d25c9decb1ff","order_by":4,"name":"Yuejun Dong","email":"","orcid":"","institution":"Zhongyuan University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Yuejun","middleName":"","lastName":"Dong","suffix":""},{"id":418631620,"identity":"4310e555-9a86-458c-871a-2bdfd573c984","order_by":5,"name":"Yan Wang","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA6klEQVRIiWNgGAWjYBACNvb+BwcSeGzq+eXPP3yQUFFDWAsfzxnGAw9k0hIkZ/AwGzw4c4ywFjmJHOaDD2wOJRjc4GGTfNjCTITDeM4eOJCQcyCP4XbvsYrEBjYG/vbuBAJ+6Us4kHDmTjHjnHNpNxJ3yDBInDm7gYAtBwwOJPY8Y2xmSDC7kXiGjcFAIpeAFokEoJZ/hxnbgFoKEtuYidGSYwAM5MOJPRI5ZgzEaeE5BvQLT5qxBM+xZImEM8d4CPpFvr358McfPDZy9sebD378UVEjx9/ei18LBuAhTfkoGAWjYBSMAqwAAA3XUqYbfpenAAAAAElFTkSuQmCC","orcid":"","institution":"Ningbo University of Technology","correspondingAuthor":true,"prefix":"","firstName":"Yan","middleName":"","lastName":"Wang","suffix":""}],"badges":[],"createdAt":"2025-02-13 17:23:12","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6024991/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6024991/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":78778950,"identity":"0f2a0ad5-0636-45ef-b5ec-311c7c9b6cc0","added_by":"auto","created_at":"2025-03-18 19:01:29","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":838766,"visible":true,"origin":"","legend":"","description":"","filename":"3.0Insiderthreatdetectionanovelapproachcombininguserbehaviouranalysisandfuzzyrecommendations.pdf","url":"https://assets-eu.researchsquare.com/files/rs-6024991/v1_covered_463f450b-2cd0-423e-8f4e-9572f33e2d1b.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Insider Threat Detection: A Novel Approach Combining User Behaviour Trust Evaluation and Fuzzy Recommendations","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-6024991/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6024991/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Insider threats can cause significant damage to a business or organisation, and insider threat detection is critical to maintaining the security of vital corporate information. By evaluating and monitoring the behaviours of visiting users, abnormal behaviours, unusual activities or potential threatening behaviours can be detected at an early stage, which will help to improve the identification of insider threats in a business/organisation and to take effective measures to deal with potential risks. Existing insider threat detection methods rely more on predefined rules, require explicit feature engineering, and generate more false positives.To overcome these limitations, the focus of the work proposed in this paper is to introduce an enhanced insider threat detection method based on credible assessment of user behaviour. It enables fewer false positives, faster threat detection, and significantly higher classifier accuracy. This enhancement is achieved due to the fact that: firstly, the model contains both a direct and an indirect assessment module, and ensures the dynamics of the assessment by balancing the factors; furthermore, the model optimises the balance of the subjective and objective weights in the direct assessment module, which effectively solves the impact of the unequal distribution of the subjective and objective weights on the assessment results; and, based on the trust recommendation of the user by the service provider of a comparable system, the user is evaluated by using a fuzzy Petri net to assess the indirect trust attributes of the user. Finally, the model was tested on the CMU-CERT v4.2 dataset using four different performance evaluation metrics, and compared and analysed with existing evaluation models. The test results show that the model has higher accuracy for untrustworthy user detection and better applicability of the model.","manuscriptTitle":"Insider Threat Detection: A Novel Approach Combining User Behaviour Trust Evaluation and Fuzzy Recommendations","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-02-21 06:02:23","doi":"10.21203/rs.3.rs-6024991/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"1b791cd4-d5c3-442f-9194-96ff4c01f3c9","owner":[],"postedDate":"February 21st, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":44636026,"name":"Physical sciences/Mathematics and computing/Computer science"},{"id":44636027,"name":"Physical sciences/Mathematics and computing/Information technology"}],"tags":[],"updatedAt":"2025-03-18T18:53:19+00:00","versionOfRecord":[],"versionCreatedAt":"2025-02-21 06:02:23","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-6024991","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6024991","identity":"rs-6024991","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}