Insider Threat Detection: A Review

In the cyber world, insider threats significantly challenge organizational security. These threats originate from malicious or negligent employees with authorized access, making them difficult to detect using traditional security measures such as access control methods. This review examines the landscape of insider threat detection, exploring existing approaches and the spectrum of detection methods and techniques. We elaborate on different aspects concerning the insider, including their threats, activities, and motivations. We explore current detection approaches like user activity monitoring and behavior analytics. Analyzing network traffic logs, email communications, and access control records offers unique insights into user behavior, allowing for the identification of potential threats. We explore anomaly detection, signature-based detection, and user behavior analytics with machine learning algorithms. This review provides valuable insights for researchers in the insider threat detection field. It sheds light on the evolving landscape of insider threats and equips readers with the knowledge to develop effective detection strategies.