A Deep Learning Fusion Model for Insider Threat Detection in High Risk Infrastructure

Insider threats are a widespread and severe issue of critical infrastructure and cyber‐physical systems (CPSs), in which traditional security measures are frequently not sufficient. Despite these machine learning (ML) methods being utilized in detecting insider threats, most of the data mining techniques utilized are based either on misuse or anomaly methods, which limits their flexibility and resistance in dynamic operations. In order to overcome these shortcomings, this study presents a hybrid deep learning framework that is built on ensemble learning, and it can detect the presence of insider threat by integrating the spatial and temporal behavioral features. The architecture suggested is based on the convolutional neural networks (CNNs), long short‐term memory (LSTM), gated recurrent unit (GRU), and bidirectional LSTM (Bi‐LSTM) models. The conventional layers can be extracted to obtain spatial features of input sequences that are based on logs, whereas recurrent layers are used to forecast temporal dynamics and changing user behavior. The heterogeneous models are combined via a soft‐averaging ensemble approach, which boosts the generalizability and robustness. Recursive feature elimination (RFE) is used to reduce dimensionality to enhance interpretability using a random forest‐based ranking of feature importance. Moreover, synthetic minority over‐sampling technique (SMOTE) is applied to address the issue of the existing class imbalance, making the model more sensitive to infrequent insider threats. Evaluation of the cyber emergency response team (CERT) insider threat dataset using experimental methods confirms that the proposed ensemble model is much more effective than traditional baselines, with a detection accuracy of 90% and a ROC area under the curve (AUC) score of 0.96, a true positive rate (TPR) of 0.96 and a fairly low false positive rate (FPR) of 0.128. This article helps to fill the gap between approaches based on misuse and others on anomaly, and a scalable, real‐time‐capable detection solution, as well as provides a solid architecture of human‐centric security in digitized and complex CPS environments.