CNN-LSTM-Based Insider Threat Detection Model

With the continuous development of electrical, automation, and artificial intelligence (AI) systems, ensuring the security of system data has become increasingly important. Compared to external threats, insider threats to intelligent systems present greater concealment and potential harm. In this article, an insider threat detection model based on the CNN-LSTM (Convolutional Neural Network-Long Short-Term Memory) algorithm is proposed. The method first extracts key features of user behavior through the CNN layer, followed by user behavior prediction using the LSTM layer. Finally, a fully connected layer performs binary classification to identify whether the behavior constitutes a threat. The experiments are conducted using the CMU-CERT R4.2 public dataset. Results from comparative neural network experiments demonstrate that this model achieves stable accuracy and precision rates exceeding 90%, with excellent performance on the ROC curve.