Insider Threat Detection using Explainable Machine Learning Models in Corporate Networks

Insider threats are a significant risk to corporate cybersecurity, as they can typically remain undetected using standard detection methods since they have legitimate access. The challenge is achieving high detection accuracy while also providing interpretability, since most state-of-the-art models are black-box machines. In this paper, we present an explainable insider threat detection model based on Gradient Boosted Decision Trees (GBDT), Explainable Boosting Machine (EBM), and Graph Neural Networks with attention mechanism. To improve transparency, we applied SHAP and LIME to both global and local explanations of anomalous activities. Using the CERT Insider Threat Dataset, the proposed system was able to achieve an accuracy of 96.3 percent, significantly higher than the five baseline methods used for comparison. Results show that it has a more reliable trustworthiness and fewer false positives for the analysts. The study highlights that explainable AI can not only increase reliability of threat detection, but also provide actionable information to decision-makers, bridging the gap between predictiveness and interpretability.