Explainable AI-Driven Insider Threat Detection and Data Loss Prevention Framework for Hybrid Work En

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

Explainable AI-Driven Insider Threat Detection and Data Loss Prevention Framework for Hybrid Work Environments

Dr. P. Boobalan1, Rajasri S 2 , Magapu Varshini Maha Lakshmi 3, Isha Afreen EK4

1Professor, Dept. of Information Technology, Puducherry Technological University, Puducherry, India. 234Under Graduate Students, Dept. of Information Technology, Puducherry Technological University, Puducherry, India.

Abstract - Hybrid work environments have significantly increasedthe riskof insider threats andsensitivedataleakage due to distributed access to organizational resources. Traditional security mechanisms and rule-based data loss prevention systems lack intelligent behavior analysis and fail to provide transparent decision-making for security enforcement. This paper proposes an Explainable AI-Driven Insider Threat Detection and Data Loss Prevention (XAI-ITDDLP) frameworkfor hybridwork environments. Theproposed systemcontinuouslymonitorsemployeeactivitiesoncompanyprovided devices including login behavior, file access, email communication, cloud uploads, and external device usage. A weighted ensemble risk scoring engine combining Isolation Forest, DBLOF, Bi-LSTM, GCN, Z-Score deviation, and rulebased analysis detects abnormal activities in real time and assigns graduated risk scores across four severity tiers: LOW, MEDIUM, HIGH, and CRITICAL. Each tier triggers a proportional automatedresponse, from managerwarningsto real-time Socket.IO push notifications. Upon threat detection, the frameworkenforces data loss preventioncontrols toblock unauthorized actions immediately. An intelligent manager dashboard provides centralized monitoring, real-time alerts, and explainable insights using SHAP, ensuring transparency and administrative control. The proposed framework enhances organizational securitybyintegratinginsiderthreat detection, automated data protection, and explainable decisionsupport into a unifiedsystemfor modernhybridwork environments.

Key Words: Explainable AI, Insider Threat Detection, Data Loss Prevention, Hybrid Work Environment, Behavioral Analytics, SHAP, Weighted Ensemble, Anomaly Detection, Risk Scoring.

1.INTRODUCTION

Therapidadoptionofhybridworkmodelshastransformed organizationaloperationsbyenablingemployeestoaccess corporateresourcesfromdiverselocationsusingcompanyprovided devices. While this flexibility improves productivity, it also introduces significant security challengesrelatedtoinsiderthreatsandunauthorizeddata leakage. Employees frequently interact with sensitive information through files, emails, cloud platforms, and external devices, making continuous monitoring and protectionessential.

Conventional security solutions and data loss prevention systems primarily rely on static rules and predefined policies, which are insufficient to detect evolving insider attack patterns and abnormal user behaviours. Moreover, manual monitoring approaches are inefficient, lack scalability,andfailtoprovidetransparentexplanationsfor security actions, reducing managerial trust in automated systems. Single-model detection approaches further limit accuracy, as no individual algorithm captures the full spectrumofbehaviouralanomaliesexhibitedbymalicious, negligent,orcompromisedinsiders.

Recent advancements in artificial intelligence and behavioural analytics have enabled intelligent threat detection through real-time activity analysis. Techniques suchasGraphConvolutionalNetworks(GCN),Bidirectional LongShort-TermMemory(Bi-LSTM),IsolationForest,and density-based outlier detection have individually demonstrated strong results in anomaly identification. However, deploying these models in isolation limits robustness, and many AI-based systems function as black boxes,offeringlimitedinterpretabilityofdecisions.Thislack of explainability hinders adoption in security-critical environments where accountability and auditability are required.

To overcome these challenges, this paper proposes an Explainable AI-Driven Insider Threat Detection and Data Loss Prevention framework tailored for hybrid work environments.Thesystemmonitorsemployeeactivitiessuch asloginbehaviour,fileaccess,emailcommunication,cloud uploads, file transfers, and USB interactions. A weighted ensemble risk scoring engine integrating Isolation Forest, DBLOF, Bi-LSTM, GCN, Z-Score deviation, and rule-based analysis computes a unified risk score classified into four graduatedtiers:LOW(0–39),MEDIUM(40–69),HIGH(70–89),andCRITICAL(90+).Eachtiertriggersaproportional automated response,from managerwarningsto real-time Socket.IO alerts on the dashboard. Additionally, an intelligentmanagerdashboardprovidescentralizedlogging, real-time alerts, approval workflows, and explainable insightsintodetectedthreatsusingSHAP.Bycombininga multi-model ensemble, automated data protection, and explainable AI-driven decision-making, the proposed XAIITD-DLPframeworkoffersacomprehensiveandtransparent solution for enhancing organizational security in hybrid workenvironments.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

2. LITERATURE REVIEW

Yumlembametal.[1]proposedaninsiderthreatdetection modelintegratingDual-GraphConvolutionalNetworkswitha Bi-LSTMandattentionmechanism.Thesystemmodelsboth explicitandimplicitgraphrepresentationstocapturefeature similaritiesandtemporalbehaviouralpatternsacrossuser activities.Whiletheapproachdemonstratesstrongdetection capability,themodeliscomputationallyheavyforreal-time deploymentandlacksanintegratedlayerforactivedataloss preventionorimmediatethreatblocking.

Al-Shehari et al. [2] introduced an insider threat detection approach using the Density-Based Local Outlier Factor (DBLOF) algorithm to identify anomalies in highly imbalancedcybersecuritydatasets.Themethodfocuseson localdensitydeviationstopinpointraremaliciousactivities thatglobalmodelsoftenmiss.However,theapproachlacks temporal sequence analysis and does not provide an automated response or data loss prevention framework suitableforhybridworkenvironments.

Nikiforova et al. [3] presented a graph-based behavioural modelling system combined with unsupervised clustering algorithms to group users with similar activity patterns. Anomaliesareidentifiedbycomparingreal-timeuseractions againsttheestablishedbehaviouralbaselineoftheirspecific cluster.Thelimitationofthisapproachisitsheavyreliance on historical audit logs for cluster formation, with no provision for automated policy enforcement or real-time preventionofdataexfiltrationacrosshybridplatforms.

RoyandChen[4]proposedGraphCH,adeepframeworkthat constructsacyber-humangraphbycombiningsystemlogs withpsychologicaltraits,applyingagraphneuralnetworkto learn behaviour embeddings for insider threat detection. While this approach improves detection by incorporating humanbehaviouralfactors,itremainslimitedtosystemlog analysisandlacksexplainabilityandautomatedprevention mechanismsessentialforpracticalsecuritydeployment.

Arreche et al. [5] developed the E-XAI framework, which evaluates multiple post-hoc explainable AI techniques appliedtoblack-boxintrusiondetectionmodels,measuring their impact on interpretability, fidelity, and detection accuracy.Thestudyhighlightsthecriticalgapintransparency for AI-based security systems. However, the framework focusesexclusivelyonnetworkintrusiondetectionanddoes not address insider threat scenarios, hybrid work environments,orintegrateddatalossprevention.

3. INFERENCE FROM LITERATURE SURVEY

The review of existing literature reveals several critical limitationsincurrentinsiderthreatdetectionanddataloss preventionapproaches.Existingsolutionsprimarilyaddress individual problems such as imbalanced data handling,

network intrusion explainability, or graph-based behaviouralmodelling,ratherthanprovidinganintegrated andunifiedsecurityframework[1][2][4][5].Mostbehaviour monitoring and threat identification approaches rely on reactivemechanisms,leadingtosuccessfuldataexfiltration and temporary security degradation during the interval betweenthreatdetectionandmanualintervention[3][5]. Machinelearningtechniquesincludingdeeplearningmodels such as Bi-LSTM and graph neural networks have significantly improved threat prediction and behaviour analysis[2][5].However,standalonemodelslackadaptive controlandreal-timeenforcementofdatalossprevention policiesindynamichybridworkenvironments.Noexisting approach combines multiple detection algorithms into a weightedensemblethatproducesaunified,graduatedrisk score capable of triggering proportional automated responses.

Current activity monitoring and automated response methods often operate independently [1][2], resulting in suboptimal resource protection and a failure to block unauthorizedactionssuchasUSBtransfersorsensitivefile accessatthemomentananomalyisdetected.Furthermore, the black-box nature of most AI-based detection models reduces transparency, managerial trust, and auditability, which are essential requirements in security-critical organizationalenvironments

Basedontheseidentifiedgaps,thispaperproposestheXAIITD-DLP Framework an Explainable AI-Driven Insider Threat Detection and Data Loss Prevention system for hybridworkenvironments.Theproposedsystemaddresses allidentifiedgapsbycombiningasix-componentweighted ensembleriskscoringengine,real-timegraduatedresponse tiers, automated data loss prevention enforcement, and explainableAI-drivendecisionsupportthroughSHAPintoa singleunifiedplatform.

4. PROPOSED SYSTEM

The proposed system introduces the XAI-ITD-DLP Framework, an Explainable AI-Driven Insider Threat Detection and Data Loss Prevention solution designed specificallyforhybridworkenvironments.Theframework addresses the growing insider security risks caused by distributedemployeeaccesstosensitiveorganizationaldata through company-provided devices. Unlike traditional fragmentedandreactivesecuritytools,theproposedsystem integratesreal-timeemployeeactivitymonitoring,intelligent behaviour analysis, and automated data protection into a unifiedplatform.

The system continuously observes employee activities including location-based login, file access, email communication, cloud uploads, file transfers, USB usage, webcamstatus,screenshotattempts,copy-pasteoperations, and device interactions. These activities are captured as

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

structured feature vectors and fed into a six-component weighted ensemble risk scoring engine. The ensemble combines Isolation Forest (20%), Density-Based Local Outlier Factor DBLOF (20%), Bi-LSTM (20%), Graph Convolutional Network GCN (15%), Z-Score deviation (15%),andarule-basedanalysisengine(10%)tocomputea unifiedriskscoreforeachemployeesession.

The computed risk score is classified into four graduated severitytiersthattriggerproportionalautomatedresponses. A LOW score between 0 and 39 requires no action. A MEDIUMscorebetween40and69generatesawarningalert tothemanager.AHIGHscorebetween70and89triggersa security alert and logs the event as a security incident. A CRITICALscoreof90andabovetriggersanimmediaterealtime push notification to the manager dashboard via Socket.IOinadditiontofullsecurityloggingandautomated DLPenforcement.

UpondetectionofsuspiciousactivityatHIGHorCRITICAL levels, the system automatically enforces data loss prevention controls to block unauthorized access, file transfers, USB operations, cloud uploads, and external sharinginrealtime.Toensuretransparencyandmanagerial trust, the explainability layer integrates SHAP (Shapley AdditiveExplanations)toidentifyandrankthebehavioural features contributing to each risk score, assigning a contribution value to each feature so managers can understandexactlywhyanemployeewasflagged.Insteadof presentingonlyarisklabel,thedashboarddisplaystherisk score,primarycontributingbehavioural factorswiththeir SHAPcontributionvalues,andaplain-languageexplanation summary.Bycombiningamulti-modelweightedensemble, graduated automated responses, real-time data loss preventionenforcement,andexplainableAI-drivendecision support,theproposedXAI-ITD-DLPreducesfalsepositives, minimizes response time, and significantly enhances organizationaldatasecurityinhybridworkenvironments.

The XAI-ITD-DLP framework is organized into three functional modules that operate sequentially and collaboratively to deliver end-to-end insider threat detection,riskscoring,anddatalossprevention.

5.1

Module I: User Authentication and Context Monitoring

This module serves as the entry point of the framework, responsibleforauthenticatingemployees,establishingtheir role-basedaccesscontext,andinitializingtheirbehavioural baseline profile for downstream analysis. The module validatescredentialsagainsttheorganizationaldatabaseand assigns role-based access permissions. Location data and logintimestampsarerecordedandcross-referencedagainst theemployee'shistoricalloginpatterns.Deviationssuchas unusual geographic locations, off-hours logins, or unrecognized devices are flagged as contextual anomalies and forwarded as features to the risk scoring engine. The moduleacceptsemployeelogincredentials,roleinformation, device identification details, location and network information, and login timestamp as input and produces authentication status, role-based access assignment, login activity logs, and a user context profile for behavioural baselineasoutput.

5.2

Module II: Behavioural Activity Monitoring and Insider Threat Detection

Thismoduleformstheanalyticalcoreoftheframework.It continuously monitors all employee interactions on company-provided devices, extracts behavioural feature vectors, and passes them through the six-component weightedensembleriskscoringenginetocomputeaunified riskscore.Capturedactivitydataincludingfileaccesslogs, copy-pasteandscreenshotattemptevents,webcamstatus, phone detection data, email communication details, cloud upload activities, USB insertion and removal events are convertedintostructurednumericalfeaturevectors.These vectors are simultaneously processed by Isolation Forest, DBLOF,Bi-LSTM,GCN,Z-Scoredeviation,andtherule-based engine,whoseoutputsarecombinedusingtheirrespective weightsof20%,20%,20%,15%,15%,and10%toproduce aunifiedriskscorebetween0and100.Theriskscoreisthen classifiedintoLOW,MEDIUM,HIGH,orCRITICALtiers,each triggeringitscorrespondingautomatedresponseincluding

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

managerwarnings,securitylogging,andreal-timeSocket.IO pushnotificationsforCRITICALevents.

MonitoringandInsiderThreatDetection

5.3 Module III: Data Loss Prevention and Explainable Manager Dashboard

This module enforces automated data protection controls basedontherisktierreceivedfromModuleIIandprovides managers with explainable, human-readable insights into every detected security event. Upon receiving a HIGH or CRITICAL risk score, the DLP enforcement engine automatically blocks the relevant unauthorized activity in realtimeincludingfiletransfers,USBdeviceaccess,external cloud uploads, restricted folder access, external email attempts, screenshot capture, and copy-paste operations involving confidential content. For CRITICAL events, Socket.IOdeliversaninstantaneouspushnotificationtothe managerdashboard.SHAPcalculatesthecontributionvalue of each behavioural feature to the risk score, producing a ranked feature importance breakdown that explains precisely why the employee was flagged. Instead of displayingonlyarisklabel,thedashboardpresentstherisk score,primarycontributingbehavioural factorswiththeir SHAPcontributionvalues,andaplain-languageexplanation summary. Managers can use this information to review alerts,approveorrejectaccessrequests,andmaintainaudit recordsforregulatorycompliance.

6. METHODOLOGY

The XAI-ITD-DLP framework follows a structured methodology that begins with continuous collection of employee activity data on company-provided devices. Behaviouralattributesincludingloginlocation,logintime, fileaccesstype,filedownloadvolume,copy-pasteattempts,

screenshot attempts, USB insertion events, external email attempts, cloud upload attempts, frequency of restricted folder access, and webcam obstruction are captured per employeesessionandconvertedintostructurednumerical featurevectors.

TheensembledetectionpipelinewastrainedontheCERT Insider Threat Dataset r4.2, a benchmark released by the Software Engineering Institute at Carnegie Mellon University. The dataset simulates 1,000 employees over approximately500workingdaysandcomprisesfiveactivity log files covering login events, USB device activity, file operations,emailbehaviour,andpsychometricpersonality scores,totallingover3.9millionbehaviouralrecords.After preprocessinganddailyaggregation,approximately500,000 user-dayfeaturevectorsweregeneratedformodeltraining. Inaddition to theCERT benchmark,real-timeliveactivity data was continuously collected from the organizational MongoDB database through the system's monitoring infrastructure,enablingtheframeworktotrainonvalidated historical patterns while continuously updating employee behaviouralprofilesinrealtime.

Thesefeaturevectorsaresimultaneouslyprocessedbysix analytical components. Isolation Forest detects global outliersbyisolatinganomalousbehaviourpatternsfromthe normalactivitydistribution,trainedwith200estimatorsand acontaminationrateof0.05reflectingtheapproximate5% prevalenceofmaliciousinsidersintheCERTdataset.DBLOF identifieslocaldensitydeviationstopinpointraremalicious activitiesthatglobalmodelstypicallymiss,configuredwith 20 nearest neighbours and novelty detection enabled. BiLSTManalysesthetemporalandsequentialnatureofuser actions over a rolling 7-day window using a bidirectional encoder of 2 layers with 64 hidden units, trained for 15 epochsusingtheAdamoptimizer,wherehighreconstruction errorindicatestemporalbehaviouraldrift.GCNmodelsthe relationships between users, files, devices, and actions as explicit and implicit graph structures using two graph convolutionallayers,trainedfor100epochstoreconstruct each node's feature vector from its graph neighbourhood, where high reconstruction error signals behavioural inconsistency with the employee's peer group. Z-Score deviation measures the statistical distance of current behaviourfromtheemployee'shistoricalbaselineacrossall 22behaviouralfeatures,withper-featureZ-scorescappedat 3.0tolimittheinfluenceofextremeoutliers.Therule-based engineappliespredefinedorganizationalsecuritypoliciesto flagexplicitviolationssuchasunauthorizedexternalemail attempts,USBusage,andafter-hoursaccess.

Theoutputsofallsixcomponentsarecombinedthrougha weighted aggregation to produce a unified risk score between 0 and 100. The weights assigned are Isolation Forest20%,DBLOF20%,Bi-LSTM20%,GCN15%,Z-Score deviation15%,andrule-basedanalysis10%,whereIsolation Forest,DBLOF,andBi-LSTMserveasprimarydetectors,GCN andZ-Scoredeviationserveascontextualrefiners,andthe

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

rule-based engine acts as a hard-violation safety net. The computedriskscoreisclassifiedintofourgraduatedseverity tiers. A score between 0 and 39 is classified as LOW and requiresnoaction.Ascorebetween40and69isclassifiedas MEDIUMandgeneratesa warningalerttothemanager. A scorebetween70and89isclassifiedasHIGHandtriggersa security alert with full incident logging. A score of 90 and aboveisclassifiedasCRITICALandtriggersimmediaterealtime push notification to the manager dashboard via Socket.IOalongsideautomatedDLPenforcement.

Upon classification, the SHAP explainability layer is activated. SHAP calculates the contribution value of each behaviouralfeaturetothefinalriskscoreusingtheShapley valueformula fromcooperative game theory, producing a ranked feature importance breakdown showing which behaviours most influenced the alert. The SHAP Tree Explainerisapplied to the trainedIsolationForest model, computing per-feature contribution values across all 22 behaviouralattributes.Theseoutputsarepresentedonthe manager dashboard alongside the risk score, contributing factors with their SHAP values, and recommended enforcementaction,enablingmanagerstomakeinformed, transparent,andauditablesecuritydecisions.

7. RESULTS AND DISCUSSION

TheproposedXAI-ITD-DLPframeworkwasevaluatedonthe Carnegie Mellon CERT Insider Threat Dataset r4.2 comprisingover3.9millionbehaviouralrecords,alongwith liveemployeeactivity data collectedthroughthesystem's monitoring infrastructure. The ensemble model was assessedusingprecision,recall,F1-score,andfalsepositive ratemetrics,andcomparedagainsteachindividualdetection componentdeployedinisolation.

Theproposedensemblemodelachievedaprecisionof0.84, recall of0.81,F1-scoreof0.82,anda falsepositive rate of 0.09,consistentlyoutperformingallindividualmodelsacross every metric. Among the standalone models, Bi-LSTM performed best individually with an F1-score of 0.73 and false positive rate of 0.15, while the rule-based engine performedlowestwithanF1-scoreof0.62andfalsepositive rate of 0.24. The ensemble's false positive rate of 0.09 represents a significant reduction compared to individual models, demonstrating that combining complementary detectiontechniquesprovidesbroaderandmoreaccurate insiderthreatcoveragethananystandaloneapproach.Table 1presentstheevaluationresultsoftheproposedensemble modelcomparedtoindividualsingle-modelapproaches.

Table-1: PerformanceComparisonofIndividualModelsvs ProposedEnsemble

The system was also validated on live organizational employee data. All registered active employees were successfullyprofiledandassigneddailyriskscoreswithfull behavioural explanations. In a representative run, three activeemployeesreceivedMEDIUMriskscoresintherange of42to44,drivenprimarilybyafter-hoursloginpatterns, elevated email activity relative to personal baselines, and loginhourdeviations.Anewlyregisteredinactiveemployee wascorrectlyassigneda riskscoreof0.0andclassifiedas LOWrisk,demonstratingtheeffectivenessofthecold-start handling mechanism in preventing false positives for employeeswithnorecordedactivityhistory.

The SHAP explainability layer successfully identified and ranked the primary contributing behavioural features for each flagged employee. For the highest-scoring employee, the top contributing factors were logoff count deviation, loginhourmeandeviation,andafter-hourslogonfrequency, providing managers with a clear and transparent explanation of why the employee was flagged rather than simplypresentingarisklabel.TheSHAPfeatureimportance barchart,individualmodelscorebreakdownchart,30-day risk score trend graph, and DLP violations summary collectively provide managers with comprehensive, actionable, and auditable insights through the centralized dashboard.

Thecomparativeanalysisagainsttraditionalsystemsfurther validatestheeffectivenessoftheproposedframework.Table 2 summarizes the key differences between conventional existingsystemsandtheproposedXAI-ITD-DLPframework acrosstenevaluationdimensions.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Table -2: Comparative Analysis of Traditional Systems vs ProposedXAI-ITD-DLP

Conventionalsystemsrelyonpassword-onlyauthentication, staticrule-baseddetection,offlinemonitoring,andblack-box outputswithnoexplainability.TheproposedXAI-ITD-DLP system replaces these with multi-factor authentication combinedwithdevicefingerprintingandgeofencing,asixmodelweightedensembletrainedonavalidatedbenchmark dataset, real-time background monitoring via Socket.IO, active DLP enforcement, and SHAP-based feature-level explanationsonacentralizedmanagerdashboard.Thefourlevel risk classification into LOW, MEDIUM, HIGH, and CRITICAL enables graduated and proportional automated responses,replacingthebinaryclassificationoftraditional systems with a significantly more nuanced and effective threatmanagementapproach.

8. CONCLUSIONS

This paper presented the XAI-ITD-DLP Framework, an Explainable AI-Driven Insider Threat Detection and Data Loss Prevention system designed for hybrid work environments.Theframeworkintegratesasix-component weightedensembleriskscoringenginecombiningIsolation Forest,DBLOF,Bi-LSTM,GCN,Z-Scoredeviation,andrulebased analysis, achieving an F1-score of 0.82 and a false positiverateof0.09ontheCERTr4.2benchmarkdataset. The graduated four-tier risk classification system ensures proportional automated responses, while real-time DLP enforcementblocksunauthorizedactionsimmediatelyupon detection.SHAP-basedexplainabilitytransformsopaqueAI decisions into transparent, feature-level insights on the manager dashboard, improving managerial trust and

supportingauditcompliance.Thesystemisapplicableacross IT organizations, corporate enterprises, financial institutions,andhealthcaresectorsoperatinginhybridwork models. Future enhancements include integration of advanced deep learning models, adaptive risk scoring tailored to individual user profiles, cross-platform deployment,andintegrationwithenterpriseSIEMsystems forend-to-endsecuritymanagement.

ACKNOWLEDGEMENT

TheauthorswouldliketoexpresssinceregratitudetoDr.P. Boobalan,Professor,DepartmentofInformationTechnology, Puducherry Technological University, for his valuable guidanceandcontinuoussupportthroughoutthisresearch work.TheauthorsalsothanktheDepartmentofInformation Technology, Puducherry Technological University, for providingthenecessaryresourcesandfacilitiestocarryout thiswork.

REFERENCES

1. R.Yumlembam,B.Issac,S.M.Jacob,L.Yang,andD. Krishnan,"InsiderthreatdetectionusingGCNand Bi-LSTM with explicit and implicit graph representations," IEEE Transactions on Artificial Intelligence,earlyaccess,2025.

2. T.Al-Shehari,D.Rosaci,M.Al-Razgan,T.Alfakih,M. Kadrie,H.Afzal,andR.Nawaz,"Enhancinginsider threat detection in imbalanced cybersecurity settingsusingthedensity-basedlocaloutlierfactor algorithm,"IEEEAccess,vol.12,pp.34820–34835, 2024.

3. O. Nikiforova, A. Romanovs, V. Zabiniako, and J. Kornienko, "Detecting and identifying insider threats based on advanced clustering methods," IEEEAccess,vol.12,pp.30242–30265,2024.

4. K.C.RoyandG.Chen,"GraphCH:Adeepframework forassessingcyber-humanaspectsininsiderthreat detection," IEEE Transactions on Dependable and SecureComputing,earlyaccess,2024.

5. O. Arreche, T. R. Guntur, J. W. Roberts, and M. Abdallah,"E-XAI:Evaluatingblack-boxexplainable AI frameworks for network intrusion detection," IEEEAccess,vol.12,pp.23954–23975,2024.

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072 © 2026, IRJET | Impact Factor value: 8.315 | ISO 9001:2008