Explainable AI for Malicious Insider Threat Detection

Malicious insider threats are a significant cybersecurity challenge because authorized users already have legitimate access to organizational systems and resources. As a result, malicious insider activities can appear similar to normal user behaviour, making them difficult to distinguish using conventional security mechanisms. Artificial Intelligence (AI) and Machine Learning (ML) can support the analysis of user behavioural activities and identify patterns associated with potentially malicious behaviour. However, many machine learning models operate as black boxes, making it difficult for security analysts to understand why a particular activity has been classified as suspicious. This lack of interpretability can reduce trust in automated detection systems and affect security decision-making. This paper proposes a conceptual Explainable Artificial Intelligence (XAI)-based framework for malicious insider threat detection. The proposed framework considers multiple sources of user activity data, including logon, file, web, and email activities. After data preprocessing and behavioural feature extraction, XGBoost is proposed for supervised threat classification, while SHAP is used to explain the contribution of behavioural features to individual predictions. A Deep Autoencoder is proposed as a separate anomaly detection component operating on behavioural features to identify unusual or previously unseen activities that may not be adequately captured by supervised classification. LIME may additionally be used as a local explanation technique. The present study follows a conceptual framework design supported by an exploratory and descriptive survey-based research approach. A structured online questionnaire is used to examine respondents' perceptions regarding XAI, explainability, insider threat detection, behavioural features, trust, interpretability, and the perceived usefulness and potential effectiveness of the proposed framework. The study does not claim actual implementation or experimental validation of the proposed machine learning components. Technical implementation and dataset-based performance evaluation are considered future work. The proposed framework aims to provide a more transparent and understandable approach to malicious insider threat detection and support security analysts in making informed decisions.