A Deep Ensemble Learning Method to Detect Insider Threats

Document Type : Research Article

Authors

1 Department of Computer Engineering, University of Mazandaran

2 Computer Engineering Department, University of Mazandaran, Babolsar, Mazandaran, Iran

10.22042/isecure.2026.552872.1260
Abstract
Insider threats pose a critical cybersecurity challenge, causing damage that extends beyond immediate financial harm to include reputational erosion, diminished customer confidence, legal ramifications, and loss of stakeholder trust. Mitigating such threats requires a multifaceted approach that combines technological safeguards with a deep understanding of human behavior. Deep Learning (DL) and stacked generalization techniques have emerged as promising solutions for detecting these complex attacks. This paper proposes a deep ensemble Intrusion Detection System (IDS) designed to accurately detect insider threats by leveraging DL-based stacked generalization. The proposed approach transforms raw tabular data into an image-based format and applies a stacking ensemble strategy comprising three base learners, a Convolutional Neural Network (CNN), a Convolutional Autoencoder (CAE), and a CNN-LSTM.
evaluated on two versions of the CERT insider threat dataset (r4.2 and r5.2). To address class imbalance in the training data, the Synthetic Minority Oversampling Technique (SMOTE) was applied, and a Deep Neural Network (DNN) was employed as the meta-classifier within the stacked generalization framework. The proposed system achieved high performance on both dataset versions, attaining a Precision of 99.98%, Recall of 99.98%, and an AUC of 100% on r4.2, and a Precision of 99.98%, Recall of 99.98%, and an AUC of 99.69% on r5.2. These results demonstrate that integrating image-based data transformation with deep ensemble learning and stacked generalization yields a robust and highly accurate IDS for insider threat detection, with future work directed toward broader dataset generalization and the incorporation of behavioral analytics to further enhance detection capabilities.

Keywords