Research on insider threat detection based on personalized federated learning and behavior log analysis

Abstract

As the cybersecurity landscape becomes increasingly challenging, insider threat detection has emerged as a critical research area. Traditional methods for detecting insider threats, such as Random Forest and Isolation Forest, suffer from high computational resource consumption, poor feature representation, and sensitivity to noise. While machine learning methods offer certain advantages, they still face challenges in complex data scenarios. This study focuses on the application of Federated Learning in insider threat detection. As a distributed machine learning framework, FL enables collaborative model building and analysis while safeguarding data privacy. It encompasses various types, including horizontal, vertical, and federated transfer learning. However, its application in insider threat detection remains limited. This research proposes an innovative solution to address the shortcomings of existing Federated Learning-based detection methods (e.g., FedAT), such as insufficient feature extraction and high resource consumption. Drawing on the DeepInsight concept, we convert different data types into image formats for use with Convolutional Neural Networks (CNNs) to train insider threat detection models. This approach leverages the advantages of FL’s privacy protection and multi-source data integration while harnessing the powerful feature learning capabilities of CNNs. It improves key metrics such as accuracy and recall in insider threat detection. The proposed method offers a more efficient and precise approach to detecting insider threats in cybersecurity, advancing the development and practical application of relevant technologies in this field with significant theoretical and practical implications.

Introduction

Insider threats refer to behaviors where internal personnel, leveraging legitimate access rights, negatively impact an organization’s confidentiality, integrity, and availability of information systems. Compared to external threats, the damage caused by insider threats is often more severe. According to the 2023 Insider Threat Report by Cybersecurity Insiders, more than 60% of companies and organizations experienced insider threats in the past year, with 8% facing over 20 attacks. Insider threats often exploit data collected within the organization, such as user access logs, system logs, and device information. Given the irregular nature of these threats, it is necessary for organizations distributed across different geographic locations to analyze this data collaboratively. However, considering the sensitive nature of such information, centralizing the processing in a single server could lead to significant privacy concerns. Therefore, adopting Federated Learning technology to detect insider threats across multiple locations has become feasible¹.

Federated Learning, a distributed machine learning technique, allows multiple parties to train a machine learning model collaboratively while protecting data privacy. It addresses the privacy challenges inherent in traditional centralized machine learning¹. In FL, the end devices participate in model training by sending only partial model information to the central server, aggregating the information, and sending the updated model back to the end devices for further training. Federated Learning has found extensive implementation across various domains, including but not limited to finance, healthcare, governmental operations, and natural language processing².

Federated Learning enables secure data sharing and model training while safeguarding data privacy, critical for insider threat detection. Its advantage lies in analyzing and learning from internal data without exposing sensitive information, thus detecting potential threats accurately. Multiple organizations and regions can collaboratively use the same neural network model without sharing their private data externally. This ability to maintain data privacy provides a strong foundation for cooperation in addressing insider threats and expanding the scope of data models, thereby significantly improving model performance.

Further, in non-independent and identically distributed (non-IID) scenarios, the data distribution across participants may differ significantly, leading to suboptimal model updates during global model aggregation. In extreme cases, this may even prevent the model from converging. While local models may perform well on specific data distributions, they may negatively affect the global model’s generalization ability. These challenges in Federated Learning arise from heterogeneity and coupling between source and target domains or the simultaneous heterogeneity and coupling of multiple tasks.

This paper innovatively proposes a method for converting insider threat features into images and using a popular Convolutional Neural Network to detect insider threats. By transforming behavioral data into images, the method enables a distinct separation between normal and malicious behavior patterns, significantly improving key performance metrics such as accuracy and recall in insider threat detection. The model is further applied within a Federated Learning framework, enhancing detection performance while preserving user privacy.

Contributions of this paper:

1. Innovative architecture for insider threat detection: We propose a novel architecture for insider threat detection, providing a new perspective and direction for technical development in this domain.

2. Transformation of CERT dataset into image format: We cleverly convert numerical data from the CERT dataset into image format, enabling convolutional neural networks widely applied in various fields. This approach significantly improves detection accuracy compared to previous insider threat detection models, offering more reliable technical support for practical applications.

3. Federated learning integration for insider threat detection: We integrate this new model into a Federated Learning system and conduct detection in scenarios with varying degrees of non-IID distribution. Practical results demonstrate the model’s excellent detection performance, validating its effectiveness and applicability in complex environments and providing a powerful tool for solving real-world problems.

Related work

Machine learning-based insider threat detection methods

Internal threat is an important part of cyberspace security. Detecting internal threats relies on previous machine learning detection methods like Random Forest and Isolation Forest. Gavai et al.³ used Random Forest⁴ and Isolation Forest⁵ to classify retirees in the ”Vegas” dataset. The system extracted the behavior features from the email transmission mode and content, log in and logout records, web browsing mode, and file access mode. Random Forest is suitable for labeled datasets and can evaluate feature importance, while Isolation Forest is suitable for unlabeled datasets and focuses on anomaly detection. However, both methods have some limitations, such as relatively high consumption of computing resources, poor performance in dealing with highly correlated data, and sensitivity to data noise.

Researchers commonly utilize Bayesian algorithms and Support Vector Machines (SVMs) in insider threat detection. Bayesian algorithms excel in calculating the probabilistic relationships between events within a dataset⁶, making them particularly advantageous in modeling enterprise-level insider threat detection systems due to their simplicity, privacy-preserving nature, and portability⁷. However, developing, training, and optimizing Bayesian models requires extensive mathematical knowledge and expertise, often costly and challenging to obtain⁸. Moreover, disagreements among experts regarding the probability of specific events or causal relationships can undermine the reliability of the models. In contrast, SVMs are highly efficient in classification tasks, benefiting from low latency⁹ and the property of a single minimum in convex optimization¹⁰, which enhances their performance, even with limited training data^11,12. Nonetheless, SVMs present challenges such as complex parameter tuning, time-consuming training processes, and a lack of interpretability for human operators⁹, making their application less intuitive.

The advantage of machine learning lies in its ability to automatically learn from a large amount of data and identify patterns that may characterize malicious activities or abnormal behaviors. Machine learning detection methods are more accurate and stable in detecting internal threats than rule-based detection methods. Duc C. Le et al. used machine learning to analyze data at multiple granularity levels to identify malicious behaviors and insiders under real-world conditions¹³. They employed various methods to determine the appropriate combination of algorithms. With the development of deep learning technology in recent years, its diversity and effectiveness in detecting internal threats have emerged. It can handle complex datasets, learn nonlinear relationships, and reduce the dependence on domain knowledge. Jianguo Jiang et al. proposed an anomaly detection model based on a Graph Convolutional Network (GCN) to detect the malicious behaviors of users and malicious threat groups, which was the first work to apply the GCN model to anomaly detection applications¹⁴. In addition, using the Convolutional Neural Network (CNN) can help us learn the associations between similar features and distinguish the subtle changes between features.

Federated learning

Federated Learning is a distributed machine learning framework, with its primary and core objective being to achieve collaborative modeling and comprehensive data analysis while effectively safeguarding data privacy and security. In 2016, Google introduced the concept of Federated Learning¹⁵, highlighting privacy as a fundamental attribute. Ensuring adequate and reliable privacy protection within this framework requires the application of security models and comprehensive analysis¹. Federated Learning enables multiple participating parties to jointly build a unified machine-learning model without sharing their respective original data. This process keeps the data local, avoiding transfer or leakage of privacy information and ensuring data compliance¹. In this way, it not only effectively protects data privacy but also successfully realizes the sharing and integration of data across institutions, greatly expanding the sample size and enriching the data dimension, providing solid and robust support for various big data applications^16–18. Researchers categorize federated learning into various paradigms based on the distribution of client data, including Horizontal Federated Learning (HFL), Vertical Federated Learning (VFL), and Federated Transfer Learning (FTL). These types of federated learning exhibit significant differences in system architecture design. HFL¹⁹ focuses on datasets with overlapping features but distinct users, combining samples across participants to expand the training sample space and improve model accuracy and generalization²⁰. VFL is suited for datasets with overlapping users but differing features²¹, requiring data alignment to enable training on shared user data²². In contrast, FTL addresses scenarios with minimal overlap in features and samples^23,24, enabling the construction of a global model using limited yet diverse data while ensuring privacy and security.

The application of federated learning in the field of insider threat detection is still relatively scarce at present. For example, R G Gayathri et al. proposed Federated Adversarial Training (FedAT) for efficient internal threat detection²⁵. This method mainly covers the following two key parts: The first is generating a distributed feature space. Given that the input for internal threat detection is user behavior, private feature extraction is performed on the heterogeneous access resources involved in user login, file use, and other actions to generate a dedicated private internal threat detection data set. The second step employs the Federated Adversarial Training approach, using the SNN-MLP technique for multi-classification processing. Nevertheless, due to certain limitations in its feature extraction, the performance of FedAT in terms of precision, recall, and F1 score is not satisfactory, making it challenging to complete the internal threat detection task effectively. In addition, this method requires each client to conduct GAN training, which will consume a lot of resources and time and have certain drawbacks in practical applications.

Converting numerical data into image data

In practical task execution, the data used to build models often comes in diverse formats. Researchers have shown that pre-trained neural networks for a specific task domain effectively undergo retraining and solve problems in other domains. Therefore, we can convert various data types into a unified image format for training deep neural networks.

In previous studies, much of the research on converting numerical data into image data has focused on the medical field. For instance, in paper²⁶, clinical diabetes data was transformed into images for CNN models. Paper²⁷ proposed the Vec2Image model, which uses principal component coordinate transformation, deep residual neural networks, and embedded k-nearest neighbor representations to convert high-dimensional biological data into pseudo-images for analysis. Another paper²⁸ introduced the DeepInsight method, which transforms non-image data into images, enabling CNNs to process non-image samples and improve classification performance. The core idea behind DeepInsight is to transform non-image samples into an image format and feed these image data into the convolutional neural network (CNN) architecture for prediction or classification tasks. When constructing these images, the process groups similar elements or features together and separates dissimilar ones. This method enables the collective use of adjacent elements, which is more valuable than handling each feature individually. It allows the integration of important information, enhancing the model’s overall performance.

In insider threat detection, the DeepInsight method can similarly convert various data types into formats suitable for CNN processing. These transformed data then train the model, enhancing the performance and effectiveness of the insider threat detection system. By leveraging the power of CNNs and the DeepInsight approach, the model can more effectively capture complex patterns and relationships in the data, leading to more accurate threat detection and classification outcomes.

Methods

Method overview

Fig. 1 illustrates the overall data processing and classification workflow. The system begins by collecting user activity logs from multiple sources, such as login records, file accesses, email events, web browsing, and device usage, which are aggregated into weekly intervals. These logs are then enriched with auxiliary data, including LDAP-based user profiles, psychometric traits (e.g., Big Five personality scores), and insider threat labels, resulting in comprehensive behavioral representations. The combined data undergoes preprocessing by converting all features into numerical representations (via category encoding and content transformation) and then applying z-score normalization. This structured high-dimensional data is transformed into grayscale images to enable visual-based classification. Specifically, we employ the DeepInsight method²⁸, which computes a pairwise cosine similarity matrix among features to preserve semantic distances. The feature embeddings are then reduced to two dimensions using t-distributed Stochastic Neighbor Embedding (t-SNE), and the resulting 2D coordinates are discretized into a fixed-size pixel grid (6464) to construct grayscale image representations of user behavior.

Fig. 1.

Data processing and classification workflow. Module (a) extracts and categorizes user activity logs. Module (b) integrates user profiles, psychometric traits, and threat labels. Module (c) combines and standardizes behavioral and user features into numerical form. Module (d) transforms these features into images via dimensionality reduction and pixel mapping and feeds them into a CNN to classify behaviors as normal or malicious.

Fig. 2 presents the federated learning model architecture built on this foundation. Each client independently performs the entire data processing pipeline on its local log data, generates image datasets via DeepInsight, and trains a convolutional neural network model. For local training, we adopt the SqueezeNet architecture, which is known for its lightweight design and consists of multiple fire modules-each containing a squeeze layer with 1 × 1 filters and an expand layer with a mix of 1× 1 and 33 filters, activated by ReLU functions. Max-pooling layers are used for downsampling, and dropout layers (dropout rate = 0.5) are introduced to mitigate overfitting. The models are implemented using the PyTorch deep learning framework. Training is performed using the Adam optimizer, with an initial learning rate of , and the loss function is set as cross-entropy. After a predefined number of local epochs, each client uploads its trained model parameters (not raw data) to a central server. The server performs Federated Averaging (FedAvg) by aggregating these parameters based on the relative dataset size of each client, producing an updated global model. This model is then distributed back to all participating clients, enabling collaborative learning while preserving data privacy and local autonomy.

Fig. 2.

Federated learning model architecture. Feature engineering aggregates user activity logs weekly, converts them into feature vectors, and transforms each into an image. Local training happens on clients, each training its model with local data. Model aggregation uploads client models to the server, where parameters are aggregated into a global model and then broadcast back to the clients.

Feature space generation

Each client collects a significant volume of log files from employees daily. These logs include various records such as device usage, email communication, file access, HTTP requests, and user logon activities. Table 1 provides a detailed description of the log contents in the CERT v5.2 dataset²⁹. In CERT r5.2, each malicious insider belongs to one of the following four common internal threat scenarios: data leakage (Scenario 1), intellectual property theft (Scenarios 2 and 4), and information technology sabotage (Scenario 3). These logs are aggregated over a specified time, based on user IDs, to combine data from multiple sources to construct the feature space.

Table 1.

Content of the CERT r5.2 dataset.

File	Contents
logon.csv	Records of users logging into the system
device.csv	Logs of users connecting to and disconnecting from external devices
http.csv	Records of users’ web browsing activities
email.csv	Logs detailing email communications
file.csv	Records of users’ activities on files
psychometric.csv	Data containing users’ psychological traits
LDAP	Files describing users and their assigned work roles

Given the crucial role of time granularity in behavior analysis, selecting an appropriate aggregation period is important. If the time granularity (e.g., hourly) is too fine, the data collected may not capture meaningful behavior patterns. If the time granularity is too long (e.g., aggregation by month), the data may become too sparse to capture meaningful behavior patterns promptly. Long-term aggregation can mask short-term fluctuations and sudden behavior changes, making it difficult for the system to detect potential threats promptly. We refer to the work of Duc C. Le et al., which discusses the impact of different time granularities, including weekly, daily, and session-based data, on model performance. Weekly and daily granularities provide a high-level overview of user behavior over extended periods (such as a week or a day)¹³. These ”coarse-grained” data types summarize user activities during these periods, resulting in more extracted features than session data. In contrast, session-based granularity offers greater detail, capturing user activities from login to logout. This finer granularity helps isolate malicious behaviors, as malicious users typically engage in suspicious activities within specific sessions, while other sessions within the same day or week may remain normal. In “Evaluation of different time granularities” section, we further analyze the model performance across various time granularities and find that the model performs best with weekly granularity. Therefore, we choose the weekly granularity for time aggregation in this study, aiming to optimize the system’s performance and response time while retaining sufficient behavioral details.

After aggregating the data based on time intervals, feature extraction is performed on the aggregated logs, transforming them into fixed-length numerical vectors, denoted as . These vectors, called data instances, summarize user behavior over a week. Each feature vector encapsulates a numerical representation of user activity, making it suitable for machine-learning applications. Using the CERT v5.2 dataset, we extract a comprehensive set of 1098 features, covering the activities of 2,000 users over 74 weeks, yielding a total of 140,124 data instances (note that some users left the company before completing the full 74 weeks of data collection). Table 2 outlines representative features extracted from the CERT v5.2 dataset, spanning multiple behavioral domains such as login activity, USB usage, file access, email, and HTTP requests. These features are selected based on their potential relevance to abnormal or suspicious behavior patterns. For instance, n_afterhourlogon captures the frequency of login events outside regular working hours, a common indicator in insider threat scenarios. Similarly, file_n-to_usb reflects the number of files copied to external devices, a key behavior in data exfiltration. Including such features enables the model to learn nuanced behavioral deviations that may signal malicious intent.

Table 2.

Some key features extracted from CERT v5.2. A total of 6 major categories of features and one label .

Category	Feature	Description	Source file
User info	User	Project identifier	psychometric.csv
	Project	User’s job position
	b_unit	Business unit affiliation
	f_unit	Functional unit affiliation
	Dept	Department affiliation
	Team	Team affiliation within department
Logon	N_logon	Number of logins	logon.csv
	n_workhourlogon	Logins during working hours
	n_afterhourlogon	Logins after working hours
	n_weekendlogon	Logins on weekends
USB	n_usb	Number of USB connections	device.csv
	usb_mean_usb_dur	Avg. USB usage duration
	usb_mean_file_tree_len	Avg. file tree depth (USB)
	n_workhourusb	USB usage during work hours
	workhourusb_mean_file_tree_len	Avg. file depth (work hours)
File	n_file	Number of files accessed	file.csv
	file_mean_file_len	Avg. file size accessed
	file_mean_file_depth	Avg. file system depth
	file_mean_file_nwords	Avg. file word count
	file_n-to_usb	Files transferred to USB
	file_n-from_usb	Files transferred from USB
Email	n_email	Number of emails sent/received	email.csv
	email_mean_n_des	Avg. email recipients
	email_mean_n_atts	Avg. email attachments
	email_mean_n_exdes	Avg. external email recipients
	email_mean_n_bccdes	Avg. BCC recipients in email
HTTP	n_http	Number of HTTP requests	http.csv
	http_mean_url_len	Avg. URL length accessed
	http_mean_url_depth	Avg. URL path depth
	http_mean_http_c_len	Avg. HTTP response size
	http_mean_http_c_nwords	Avg. HTTP response words
Label	Insider	Insider threat label	answers folder

Table 3 details the distribution of instances across each scenario in the CERT v5.2 dataset, including five predefined insider threat cases. This dataset offers a rich source of behavioral signals, enabling us to model user activity patterns for internal threat detection effectively. The scenario descriptions highlight diverse attack strategies such as after-hour logins, USB-based data exfiltration, insider sabotage, and long-term unauthorized access. These varied behaviors emphasize the necessity for detection models that can handle multi-class classification and adapt to complex, behaviorally diverse threat patterns.

Table 3.

Number of instances and descriptions for each scenario in CERT v5.2.

Scenario	Count	Scenario description
Normal	139,572	Regular user behavior with no known insider threat activity
Scenario 1	49	User who did not previously use removable drives or work after hours begins logging in after hours, using a removable drive, and uploading data to wikileaks.org. Leaves the organization shortly thereafter
Scenario 2	245	User begins surfing job websites and soliciting employment from a competitor. Before leaving the company, they use a thumb drive (at markedly higher rates than their previous activity) to steal data
Scenario 3	10	System administrator becomes disgruntled. Downloads a keylogger and uses a thumb drive to transfer it to his supervisor’s machine. The next day, he uses the keylogs to log in as supervisor and send a mass email that causes panic
Scenario 4	248	A user logs into another user’s machine and searches for interesting files, emailing them to personal accounts. This behavior increases over a three-month period

We also introduced Principal Component Analysis (PCA) to further reduce the data’s dimensionality and extract the most important features. Table 4 illustrates the top 20 features contributing the most to the first principal component(PC1) and their corresponding feature weight ratios. These features play a critical role in detecting anomalous behaviors. By leveraging this approach, the model can capture complex behavioral patterns, effectively distinguishing between normal users and malicious activities, thereby enhancing its capability to detect insider threats.

Table 4.

Top 20 features contributing to principal component 1. In the feature names, the suffixes act1, usb1, and pc0 represent identifiers for file operation types, USB devices, and PC devices, respectively.

Feature	PC1 loading	Meaning
n_file	0.091653	Number of file operations
file_n-file_act1	0.091155	File operations with activity type 1
file_n-to_usb1	0.090725	Files copied to USB devices
file_n-file_act3	0.090725	File operations with activity type 3
file_n-from_usb1	0.090617	Files copied from USB devices
file_n_docf	0.089101	Document file operations
file_docf_n-file_act1	0.088797	Document file ops with activity type 1
file_n-pc0	0.088389	File operations on device pc0
file_docf_n-file_act3	0.087673	Document file ops with activity type 3
file_docf_n-to_usb1	0.087673	Document files copied to USB
file_docf_n-from_usb1	0.087619	Document files copied from USB
file_n-disk1	0.086179	File operations on disk1
file_docf_n-pc0	0.085746	Document file ops on device pc0
file_docf_n-disk1	0.084291	Document file ops on disk1
n_workhourfile	0.083391	File operations during work hours
workhourfile_n-file_act1	0.082890	Work hour file ops with activity type 1
workhourfile_n-pc0	0.082705	Work hour file ops on device pc0
workhourfile_n-to_usb1	0.082516	Work hour files copied to USB
workhourfile_n-file_act3	0.082516	Work hour file ops with activity type 3
workhourfile_n-from_usb1	0.082426	Work hour files copied from USB

Feature vector transformation into images

First, the labels and some irrelevant features (such as start time, end time, and user ID) are removed from the extracted feature vector , resulting in the input feature vector . These input features are then transformed into an image using the following method:

Consider a training set consisting of n samples with d-dimensional features, each sample . The corresponding feature set is , where each feature ., and clearly, .

For the feature set G, we apply similarity measurement techniques to compute the similarity between features and then map these features onto a 2D plane. Each point on the plane represents a feature, and we determine the position of the feature based on its similarity. By doing so, we place similar features closer together while placing dissimilar features farther apart. This arrangement helps us understand the relationships between features and enables the convolutional neural network to train and learn from the data more effectively. The transformation process from features to image involves the following steps (Fig. 3):

1. Similarity calculation: Compute the similarity between features in the set G to evaluate their relationships.

2. Mapping to 2D plane: Map each feature from the set G to a point on a 2D plane. The distance between points in the plane reflects their similarity.

3. Minimal bounding rectangle: Use the convex hull algorithm to find the smallest rectangle that contains all the feature points.

4. Rotate rectangle: Rotate the bounding rectangle to better align with the data distribution.

5. Pixel mapping: Convert the Cartesian coordinates of the rotated rectangle to pixel values and map feature values to corresponding pixel positions.

These operations can be represented by a transformation matrix . Specifically, for a sample , the feature matrix M can be derived as:

1

In this feature matrix, the position of the features is determined by their similarity, with similar features placed closer together and dissimilar features placed farther apart. This arrangement helps leverage adjacent features together, enhancing the CNN model’s ability to learn and understand the relationships between features, thereby improving the training process.

Fig. 3.

Feature vector transformation into images. The feature vector maps onto a 2D plane, where a coordinate system is defined. Feature values are then assigned to pixel locations, generating a transformed image that serves as input to the CNN model.

Federated learning

The security and privacy of employee data are critical challenges in distributed systems, especially in domains involving sensitive data. Although this data is valuable for internal threat detection, the high sensitivity of such information makes direct collection and transmission problematic due to privacy risks. To address this issue, Federated Learning offers an innovative solution for distributed machine learning. Federated Learning allows clients to train models locally without sharing raw data, only sharing locally computed model weights, thus effectively protecting data privacy.

In the context of insider threat detection, Federated Learning enables multiple geographically distributed client devices to build models locally without uploading data to a central server. Each client aggregates local logs (e.g., device usage, email records, file access), constructs local models, and trains them on-site. After local training, the clients upload the model parameters (rather than raw data) to a central server, where the server aggregates them to form a global model.

A key advantage of this approach is that sharing only model weights rather than raw data ensures the protection of sensitive information, mitigating the risk of data breaches. The central server then uses optimization methods such as Federated Averaging or Federated Proximal to aggregate the models, improving the accuracy and robustness of the global model. The updated global model is then distributed back to the clients for the next round of training. Algorithm 1 outlines using the Federated Learning framework for insider threat detection.

Algorithm 1.

Federated Learning: There are three procedures. K is the number of clients; E is the number of local epochs; T is the number of communication rounds.

Experiment and result analysis

Dataset

Due to the difficulty in obtaining actual enterprise system logs, we used the ”CERT Insider Threat Tool” dataset (Carnegie Mellon University Software Engineering Institute, Pittsburgh, Pennsylvania, USA)²⁹. The CERT dataset contains employee computer usage logs (login, device, HTTP, file, and email) and organizational information such as employee departments and roles. Each table consists of user ID, timestamp, and activity columns. The CERT dataset has six major versions (CERT v1 to CERT v6). The types of information, number of variables, number of employees, and number of malicious insider activities vary across different dataset versions. For this study, we used CERT v4.2 and CERT v5.2. The CERT v4.2 dataset covers 1,000 users over 500 days and includes 70 insider threats across three threat scenarios. The CERT v5.2 dataset contains data from 2,000 users and 30 insiders from four scenarios.

Experimental setup

1. Machine learning training configuration and parameter settings: Python 3.9 was used for data preprocessing in this study, and we employed SqueezeNet³⁰ for CNN. Forrest N. Iandola et al. introduced SqueezeNet 2016 as a lightweight convolutional neural network model. Its primary goal is to achieve efficient deep-learning inference by reducing the number of model parameters while maintaining good classification performance. SqueezeNet performs similarly to AlexNet on the ImageNet dataset but uses only 1/50 of the parameters of AlexNet and has a model size smaller than 1MB. Fig. 4 shows the structure diagram of SqueezeNet. Table 5 provides a detailed description of the modified SqueezeNet 1.1 architecture used in our experiments. We set the scene label as the target for model training and used the cross-entropy loss function for optimization, as defined by:

   2

   is the number of samples, is the number of classes, is the one-hot representation of the actual label, and is the predicted probability (output by the Softmax function). The Adam optimizer was chosen, with a learning rate and a weight decay factor of .In the Centralized Training, the batch size is set to 250, and the number of epochs is 200. In Federated Learning, the batch size (B) is set to 50, the number of local epochs (E) is 5, and the number of communication rounds (T) is 100. All experiments conducted in this study use these parameters.
2. Performance evaluation metrics: Given the class imbalance in the dataset, this study employs Precision (P), Recall (R), and F1-score (F-score) as the primary evaluation metrics. These are defined as follows:

   3

   4

   5

   TP represents true positives, i.e., the number of samples correctly predicted as positive; FP represents false positives, i.e., the number of samples incorrectly predicted as positive; and FN represents false negatives, i.e., the number of samples incorrectly predicted as unfavorable. Precision reflects the proportion of actual malicious alerts among all system-generated alerts. At the same time, the F1-score is the harmonic mean of precision and recall, providing a balance between detection ability and false alarms. Due to the highly imbalanced data distribution (as shown in Table 3), even a relatively low false positive rate may lead to many false alarms. Thus, by reporting Precision and F1-score, the results better reflect the cost and impact of investigating false alarms.

Fig. 4.

SqueezeNet architecture. The left image shows the architecture of SqueezeNet, where the input image (such as a picture of a dog) is processed through various layers of the network, ultimately producing a classification result. The right image illustrates how we transform the CERT dataset into images, which are then fed into SqueezeNet to obtain predicted probabilities for different classes. The varying shapes of the images at the exact location indicate that this position represents key features used to distinguish different scenarios. These image features can only be recognized by CNNs, highlighting the model’s ability to capture important distinguishing patterns.

Table 5.

Detailed architecture of the modified SqueezeNet 1.1 model used in our experiments.

Layer	Type/name	Configuration	Activation/description
1	Conv2d (conv1)	in: 3, out: 64, kernel: 33, stride: 2	ReLU + MaxPool(33, stride=2)
2	Fire2	Squeeze: 11 (16); Expand: 11 (64), 33 (64)	ReLU
3	Fire3	Same as Fire2	ReLU + MaxPool(33, stride=2)
4	Fire4	Squeeze: 11 (32); Expand: 11 (128), 33 (128)	ReLU
5	Fire5	Same as Fire4	ReLU + MaxPool(33, stride=2)
6	Fire6	Squeeze: 11 (48); Expand: 11 (192), 33 (192)	ReLU
7	Fire7	Same as Fire6	ReLU
8	Fire8	Squeeze: 11 (64); Expand: 11 (256), 33 (256)	ReLU
9	Fire9	Same as Fire8	ReLU
10	Dropout	Dropout(p=0.5)	Prevents overfitting
11	Conv2d (classifier)	in: 512, out: 1000, kernel: 11	ReLU
12	AvgPool2d	Global Avg Pool (adaptive kernel)	Output shape: (1000, 1, 1)
13	Flatten (added)	-	Flattens to 1000-dim vector
14	Linear (added)	in: 1000, out: num_classes	Final classification layer

Centralized training

We first employed centralized machine learning, where each client stores all the data on a single device to train a global model and evaluate the Convolutional Neural Network (CNN) performance on the CERT dataset. We split the dataset into 80% training and 20% testing sets.

The experimental results reveal that the CNN model demonstrated excellent performance in Scenarios 1, 3, and 4, achieving high accuracy. However, in Scenario 2, the accuracy was approximately 5%, consistent with findings from prior studies¹³, suggesting that Scenario 2 represents the most challenging detection scenario. The challenge arises because in Scenario 2, insiders may deliberately obfuscate their malicious activities by executing them over prolonged periods (with an average duration of two months), complicating the detection process. To mitigate this challenge, we implemented a rule-based approach specifically for Scenario 2, integrating targeted rules into the feature vector to better accommodate the characteristics of this scenario. This adaptation led to a significant improvement in the model’s detection accuracy. Table 6 summarizes the training results of the centralized machine learning model . The Precision (P), Recall (R), and F1-score (F) all achieved very high accuracy. Fig. 5 presents the confusion matrices for internal threat detection using CNN on the CERT v4.2 and CERT v5.2 datasets. The ”Predicted label” represents the scene label, where label zero corresponds to the expected behavior category. Fig. 6 shows the corresponding Receiver Operating Characteristic (ROC) curves. The AUC values for both test sets reached 0.99, demonstrating that the SqueezeNet model effectively distinguishes between normal and malicious behaviors with high discriminatory power.

Table 6.

Performance of centralized machine learning training.

Version	Precision (P)	Recall (R)	F-score (F)
CERT v4.2	0.9974	0.9971	0.9972
CERT v5.2	0.9997	0.9997	0.9997

Fig. 5.

Confusion matrices on centralized training.

Fig. 6.

ROC curves on centralized training.

These findings underscore the CNN model’s robustness in detecting internal threats across different scenarios. They particularly highlight its strengths and weaknesses, which could guide further optimization and tailored approaches for challenging scenarios like Scenario 2.

The performance metrics across different prediction confidence intervals are shown in Fig. 7. As the softmax confidence increases, the model achieves higher precision, recall, and F1-score, with peak performance observed around the [0.8–0.9] range. This suggests that high-confidence predictions are more reliable and could be prioritized or used with lower false alarm risk.

Fig. 7.

Performance in different confidence ranges (experiments conducted on CERT v5.2).

We did not explicitly apply any techniques for the data imbalance issue, such as oversampling, undersampling, or algorithmic adjustments. One reason is that applying these methods, especially oversampling and undersampling, could interfere with the time-dependent nature of the continuous behavioral data. Oversampling could generate synthetic examples that do not accurately reflect real-world behavior patterns, potentially introducing unrealistic data points that could harm model generalization. On the other hand, undersampling would reduce the amount of normal behavior data, which is crucial for the model to recognize common patterns, thus risking the loss of valuable information and reducing the model’s ability to detect normal activities effectively. However, the experimental results demonstrated that the model can effectively distinguish between normal and abnormal behaviors. This highlights the power of transforming employee behavior data into images, which allows the data to be represented uniquely, distinguishing normal users from anomalous ones. Despite the dataset’s imbalance, the model achieved high accuracy, suggesting that this transformation method effectively captures and emphasizes the characteristics of abnormal behavior, leading to robust detection performance without the need for additional data balancing techniques.

FedAvg

In our approach, we utilize the classic federated learning algorithm FedAvg¹⁵ to conduct distributed training across clients. Due to the relatively small number of clients distributed across various enterprise locations, we set the number of clients, . The irregular occurrence of internal threat behaviors and the varying types of threats across different clients lead to highly imbalanced overall class distributions. Given these practical considerations, we train the dataset under IID and non-IID conditions.

To simulate the non-independent and identically distributed (non-IID) data across clients, we model the data distribution between clients using the Dirichlet distribution ³¹, where smaller values of indicate higher data heterogeneity. Each client performs 5 local training rounds, and we set the training batch size per client to 50. Fig. 8 shows the distribution of the dataset under IID and non-IID conditions ( ).

Fig. 8.

Scenario distribution for each client on CERT v5.2.

The training results appear in Table 7 (communication rounds = 100). As shown, the Precision (P), Recall (R), and F-Score (F) values reach 0.99 in both IID and non-IID conditions, indicating that the CNN model maintains excellent performance even in non-IID settings.

Table 7.

Metrics of FedAvg (B=50, E=5 and T=100).

Dataset	K	iid
		P	R	F	P	R	F	P	R	F
CERT v4.2	3	0.9984	0.9985	0.9984	0.9983	0.9983	0.9983	0.9983	0.9983	0.9983
	5	0.9983	0.9983	0.9983	0.9968	0.9974	0.9971	0.9969	0.9977	0.9973
CERT v5.2	3	0.9988	0.9992	0.9990	0.9988	0.9992	0.9990	0.9995	0.9996	0.9995
	5	0.9995	0.9995	0.9995	0.9988	0.9992	0.9990	0.9995	0.9996	0.9996

Fig. 9 illustrates the Precision (P), Recall (R), and F-Score (F) curves when K=5 on CERT v5.2. As the data heterogeneity increases, the curves become less stable. Higher heterogeneity leads to a more complex and ambiguous decision boundary between normal and abnormal behaviors. In such cases, the model struggles to establish clear decision boundaries, causing unstable predictions across different samples, which results in significant fluctuations in the performance metrics due to the randomness of the data. Although the model initially exhibits instability and significant fluctuations in the non-IID case, the curves stabilize after approximately 60 communication rounds.

Fig. 9.

FedAvg: precision, recall, and F-score curves under IID and non-IID conditions on CERT v5.2 (K=5, B=50, E=5 and T=100).

Evaluation of different time granularities

To investigate the impact of time granularity on model performance, we conducted experiments using different aggregation periods: session-based, daily, and weekly. The aim was to identify the optimal time granularity that best balances performance stability and detection accuracy for insider threat detection in enterprise environments. The following metrics were evaluated: accuracy, recall, and F1-score.

The results of the experiments are summarized in Table 8. The table shows that the week granularity consistently achieves the highest precision, recall, and F1-score, with values of 0.9997 across all metrics. This makes it the optimal choice for insider threat detection in this context. In contrast, while highly accurate, the session granularity is more sensitive to transient behaviors, leading to potential instability. The day granularity slightly improves stability but still does not capture enough temporal variations. On the other hand, the monthly granularity loses finer details crucial for effectively detecting insider threats. This suggests that the week aggregation period strikes the best balance between capturing temporal patterns and maintaining model stability, making it the most suitable choice for our model.

Table 8.

Comparison of model performance with different time granularities.

Time granularity	Precision	Recall	F1-score
Session (4-hour)	0.9975	0.9976	0.9980
Day	0.9977	0.9978	0.9977
Week	0.9997	0.9997	0.9997

Comparative analysis of federated and centralized learning

Building upon the implementation and results of the FedAvg algorithm presented in “FedAvg” section, we further expand our discussion to explore the applicability and implementation of federated learning (FL) in the context of insider threat detection. This task typically involves processing sensitive behavioral log data across multiple organizations or departments, where centralized data aggregation is often infeasible due to privacy concerns, security policies, or regulatory constraints. Federated learning provides a promising privacy-preserving alternative for such scenarios.

Implementation details: In our study, we adopt a horizontal federated learning approach using the FedAvg algorithm, where each client represents an individual enterprise site or department. All clients share the same feature space (i.e., structured behavioral logs), but their local data distributions vary significantly-for example, in the frequency and type of insider threat activities observed. Each client performs local training using its log data and transmits only model updates (e.g., parameter deltas) to a central server. The server performs weighted aggregation of the updates to construct a global model, which is then redistributed to all clients for the next round of training. This iterative communication-training process continues over a fixed number of communication rounds until convergence.

Performance comparison: To ensure a fair comparison, we train centralized and federated models using the same CNN architecture, dataset, and hyperparameters (batch size, learning rate, and number of epochs). As reported in Table 9, the federated model performs comparable to the centralized model across metrics such as accuracy, precision, recall, and F1-score. Despite slight performance fluctuations under non-IID conditions, the federated CNN effectively identifies key insider threat behaviors such as unauthorized logins, data exfiltration, and suspicious device usage. These results highlight the robustness and practical applicability of federated learning in real-world security analytics.

Table 9.

Comparison of Precision, Recall, and F1-Score between Federated and Centralized Learning.

Metric	Federated learning	Centralized learning
Precision	0.9988	0.9997
Recall	0.9992	0.9997
F1-score	0.9990	0.9997

Privacy and security comparison: Insider threat detection often requires analyzing highly sensitive user activity logs, including identity, access patterns, and operational histories. Transferring such data to a central server in centralized learning introduces significant privacy risks and may violate internal governance or compliance requirements. In contrast, federated learning preserves privacy by keeping raw data localized to each client while only exchanging model parameters, significantly reducing the risk of data leakage.

Federated learning demonstrates strong potential for insider threat detection applications, offering a practical balance between maintaining model performance and preserving data privacy. While centralized training may deliver marginally better results under ideal conditions, FL’s privacy-preserving advantages make it a more viable solution for deployment in security-critical, privacy-sensitive environments. This balance is crucial for building collaborative, cross-organization threat intelligence systems without compromising individual data sovereignty.

Limitations

Despite the promising results, this study has several important limitations. First, using synthetic data from the CERT dataset introduces potential bias, as it may not fully capture the complexity, diversity, and evolving nature of real-world insider threats. Second, while the proposed model performs well in the current setting, its generalizability to other datasets or operational environments remains uncertain, especially in the absence of retraining. Third, the current framework lacks real-time detection capability and has not been evaluated in dynamic or large-scale deployment scenarios. Additionally, while federated learning enhances privacy, it relies on the assumption of honest but curious participants and does not incorporate defenses against adversarial behaviors, which may limit its robustness in practical distributed environments.

Future work should explore the integration of adaptive online learning strategies and adversarial resilience mechanisms to improve the system’s scalability, security, and practical applicability.

Conclusion and future work

This paper proposes an innovative architecture for insider threat detection by transforming the CERT dataset, initially presented in numerical format, into images that a Convolutional Neural Network (CNN) can process. This transformation enables the CNN model to effectively capture and analyze complex patterns indicative of insider threats. Integrating the CNN model into a federated learning framework enhances data privacy and security, allowing local models to be trained on decentralized data without sharing sensitive information. Our experimental results demonstrate that this approach significantly improves the accuracy and robustness of insider threat detection in enterprise environments.

The results indicate that CNNs, when deployed in a federated learning environment, can offer high detection accuracy while preserving data privacy, making it a promising solution for sensitive applications in various organizational settings. The effectiveness of this model suggests its potential for widespread adoption in real-world cybersecurity infrastructures, where insider threats are a growing concern.

Building on the success of our proposed model, future work should focus on addressing some of the limitations and exploring additional avenues to enhance the system’s robustness and scalability.

1. Adversarial training for improved robustness: While our model performs well in detecting insider threats, it can be further optimized by incorporating adversarial training. This technique will allow the model to better handle adversarial attacks, particularly in complex scenarios like insider threat detection, where attackers may try to obfuscate their activities. By generating adversarial samples during training, we can increase the model’s resilience and make it more adept at identifying subtle and sophisticated attack patterns. Moreover, adversarial training can help address challenging detection scenarios, such as Scenario 2, where insiders deliberately obfuscate their malicious activities over extended periods. Training the model with adversarial samples makes it better equipped to recognize and detect such elusive threats that might otherwise go unnoticed in traditional detection methods.

2. Transfer learning for adaptability to new threats: Another promising direction for future research is the application of transfer learning. Our model, trained on the CERT dataset, can be adapted to new threat detection tasks by transferring knowledge from one domain to another. This approach will improve the model’s generalization ability, enabling it to perform well on emerging threats or in new environments without requiring extensive retraining. By leveraging pre-trained models, we can accelerate the system’s deployment across various organizations and adapt it to dynamic threat landscapes.

3. Incorporation of adversarial attacks in the federated learning framework: Although the Federated Learning framework enhances data privacy, it assumes that participants are honest but curious without considering potential adversarial attacks that may occur in decentralized environments. Future work should explore how to introduce robust security mechanisms within Federated Learning to protect against such attacks. This could involve integrating techniques like secure multi-party computation (SMPC) or homomorphic encryption to ensure that malicious clients cannot influence the global model, further enhancing the system’s privacy and security.

4. Hybrid models for enhanced detection capability: To further boost the performance of insider threat detection, we plan to explore hybrid models that combine the strengths of different machine learning techniques. For example, integrating Convolutional Neural Networks (CNNs) with Recurrent Neural Networks (RNNs) or attention mechanisms can help the system better capture temporal dependencies in user behavior, an essential aspect of detecting insider threats in dynamic and ever-changing environments. These hybrid models could enhance the model’s ability to detect complex patterns and improve its effectiveness in real-world applications where behaviors evolve.

Data availability

The datasets used and/or analysed during the current study are available in the Carnegie Mellon University KiltHub repository under the title ”Insider Threat Test Dataset” and can be accessed via the following persistent URL:https://kilthub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247 . This dataset is publicly available under the repository’s terms of use and does not contain personally identifiable information requiring de-identification.

Declarations

Competing interests

The authors declare no competing interests.