Abstract:Insider threat detection has become a paramount concern in modern times where organizations strive to safeguard their sensitive information and critical assets from malicious actions by individuals with privileged access. This survey paper provides a comprehensive overview of insider threat detection, highlighting its significance in the current landscape of cybersecurity. The review encompasses a broad spectrum of methodologies and techniques, with a particular focus on classical machine-learning approaches and their limitations in effectively addressing the intricacies of insider threats. Furthermore, the survey explores the utilization of modern deep learning and natural language processing (NLP) based methods as promising alternatives, shedding light on their advantages over traditional methods. The comprehensive analysis of results from experiments utilizing NLP and large language models to detect malicious insider threats on the CMU CERT dataset reveals promising insights. Studies surveyed in this paper indicate that these advanced techniques demonstrate notable efficacy in identifying suspicious activities and anomalous behaviors associated with insider threats within organizational systems. Additionally, the survey underscores the potential of NLP and large language model-based approaches, which can enhance threat detection by deciphering textual and contextual information. In the conclusion section, the paper offers valuable insights into the future directions of insider threat detection. It advocates for the integration of more sophisticated time-series-based techniques, recognizing the importance of temporal patterns in insider threat behaviors. These recommendations reflect the evolving nature of insider threats and emphasize the need for proactive, data-driven strategies to safeguard organizations against internal security breaches. In conclusion, this survey not only underscores the urgency of addressing insider threats but also provides a roadmap for the adoption of advanced methodologies to enhance detection and mitigation capabilities in contemporary cybersecurity paradigms.

Insider threat mitigation: Systematic literature review

A systematic literature review on insider threats

Techniques and countermeasures for preventing insider threats

Systematic Literature Review and Metadata Analysis of Insider Threat Detection Mechanism

Insider Threats Mitigation: Role of Penetration Testing

Insight into Insiders and IT: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

A Review of the Insider Threat, a Practitioner Perspective Within the U.K. Financial Services

Insight into Insiders: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

Dynamical System approach to insider threat detection

A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods

Analysis of Research on Specific Insider Information Security Threats

Organizations' readiness for insider attacks: A process‐oriented approach

A systematic literature review on advanced persistent threat behaviors and its detection strategy

A Systematic Review on Machine Learning Insider Threat Detection Models, Datasets and Evaluation Metrics

What Do We Know About the Psychology of Insider Threats?

Insider threats in Cyber Security: The enemy within the gates

Machine learning approaches to detect, prevent and mitigate malicious insider threats: State-of-the-art review

Mitigation Techniques for Cyber Attacks: A Systematic Mapping Study

Insider Threat Detection: Exploring User Event Behavior Analytics and Machine Learning in Security Reviews

A systematic literature review for network intrusion detection system (IDS)

New Frontiers of Network Security: The Threat Within