Log-Correlation Methods for Early Detection of Insider-Threat Indicators in Small-to-Medium Enterprise Networks

Insider threats represent one of the most challenging cybersecurity risks for smallto-medium enterprises (SMEs), primarily because malicious activities oftenoriginate from legitimate users with authorized access to internal systems.Traditional security monitoring mechanisms frequently rely on isolated log analysisand rule-based alerting, which are inadequate for identifying subtle behavioralanomalies that characterize insider misuse. This study proposes a log-correlationframework designed to enhance early detection of insider-threat indicators byintegrating heterogeneous system logs and analysing behavioral relationshipsacross multiple enterprise systems. The framework aggregates authentication logs,endpoint activity records, file access logs, and network connection logs into acentralized monitoring architecture where events are normalized and transformedinto structured behavioral features. A correlation scoring model is introduced toquantify relationships among user activities using weighted anomaly indicatorsderived from multi-source log data. The framework further incorporatesprobabilistic threat estimation using logistic modeling to estimate the likelihood ofinsider-threat activity. Experimental evaluation was conducted using a simulatedSME network environment consisting of 200 endpoints and multiple distributed logsources. Detection performance was evaluated using precision, recall, and F1-scoremetrics across several detection models, including rule-based monitoring, statisticalanomaly detection, machine learning classifiers, and the proposed correlationdrivenapproach. Results demonstrate that the proposed log-correlation modelimproves detection accuracy and significantly reduces detection latency comparedwith traditional SIEM-based monitoring systems. The findings highlight theimportance of multi-log behavioral analytics in identifying coordinated useractivities that indicate potential insider misuse. The proposed framework provides ascalable and computationally efficient solution suitable for SME environmentswhere security resources are limited, enabling organizations to detect insiderthreats earlier and respond more effectively to emerging security risks.