1
Department of Computer Engineering, University of Mazandaran
2
Computer Engineering Department, University of Mazandaran, Babolsar, Mazandaran, Iran
10.22042/isecure.2026.552872.1260
Abstract
Insider threats pose a critical cybersecurity challenge, causing damage that extends beyond immediate financial harm to include reputational erosion, diminished customer confidence, legal ramifications, and loss of stakeholder trust. Mitigating such threats requires a multifaceted approach that combines technological safeguards with a deep understanding of human behavior. Deep Learning (DL) and stacked generalization techniques have emerged as promising solutions for detecting these complex attacks. This paper proposes a deep ensemble Intrusion Detection System (IDS) designed to accurately detect insider threats by leveraging DL-based stacked generalization. The proposed approach transforms raw tabular data into an image-based format and applies a stacking ensemble strategy comprising three base learners, a Convolutional Neural Network (CNN), a Convolutional Autoencoder (CAE), and a CNN-LSTM. evaluated on two versions of the CERT insider threat dataset (r4.2 and r5.2). To address class imbalance in the training data, the Synthetic Minority Oversampling Technique (SMOTE) was applied, and a Deep Neural Network (DNN) was employed as the meta-classifier within the stacked generalization framework. The proposed system achieved high performance on both dataset versions, attaining a Precision of 99.98%, Recall of 99.98%, and an AUC of 100% on r4.2, and a Precision of 99.98%, Recall of 99.98%, and an AUC of 99.69% on r5.2. These results demonstrate that integrating image-based data transformation with deep ensemble learning and stacked generalization yields a robust and highly accurate IDS for insider threat detection, with future work directed toward broader dataset generalization and the incorporation of behavioral analytics to further enhance detection capabilities.
Almoayed,M , Mahmoudi-Nasr,P and mosafer,M . (2026). A Deep Ensemble Learning Method to Detect Insider Threats. (e247850). The ISC International Journal of Information Security, 18(2), e247850 doi: 10.22042/isecure.2026.552872.1260
MLA
Almoayed,M , , Mahmoudi-Nasr,P , and mosafer,M . "A Deep Ensemble Learning Method to Detect Insider Threats" .e247850 , The ISC International Journal of Information Security, 18, 2, 2026, e247850. doi: 10.22042/isecure.2026.552872.1260
HARVARD
Almoayed M, Mahmoudi-Nasr P, mosafer M. (2026). 'A Deep Ensemble Learning Method to Detect Insider Threats', The ISC International Journal of Information Security, 18(2), e247850. doi: 10.22042/isecure.2026.552872.1260
CHICAGO
M Almoayed, P Mahmoudi-Nasr and M mosafer, "A Deep Ensemble Learning Method to Detect Insider Threats," The ISC International Journal of Information Security, 18 2 (2026): e247850, doi: 10.22042/isecure.2026.552872.1260
VANCOUVER
Almoayed M, Mahmoudi-Nasr P, mosafer M. A Deep Ensemble Learning Method to Detect Insider Threats. ISC Int. J. Inf. Secur.. 2026;18(2):e247850. doi: 10.22042/isecure.2026.552872.1260