Hybrid GCN Framework for Insider Threat Detection with Reduced False Alarms

Abstract

Among the most consequential vulnerabilities in contemporary IoT-based systems is the insider threat — a class of attack in which authorised users deliberately or inadvertently misuse their privileges, often evading detection for prolonged intervals. Mainstream detection approaches continue to be undermined by three unresolved obstacles: severe class imbalance between benign and malicious records, the curse of dimensionality arising from rich feature sets, and the non-stationary nature of user behavioural profiles. To address these co-occurring challenges within a unified architecture, this work proposes a graph-structured detection framework underpinned by a Graph Convolutional Network (GCN). Relational dependencies among users, devices, and system resources are encoded as graph topology, enabling the model to capture interaction-driven threat indicators that scalar feature vectors cannot represent. Improved Principal Component Analysis (IPCA) performs dimensionality reduction while maximising the retention of discriminative variance. An Outlier-Resistant K-Means algorithm segments the activity space into semantically coherent clusters, and the Enhanced Bidirectional Generative Adversarial Network (EBiGAN) synthesises statistically faithful malicious samples to redress class skew. Hyperparameter optimisation is conducted via Bayesian search guided by the Probability of Improvement (PI) acquisition function. On the CMU CERT benchmark, the proposed system achieves a detection accuracy of 96.8%, a detection rate of 96.7%, and a false alarm rate of only 3%, outperforming all compared baselines and demonstrating readiness for deployment in production IoT security environments.

Introduction

This research proposes an AI-based Insider Threat Detection Framework for Internet of Things (IoT) environments that combines Graph Convolutional Networks (GCNs) with advanced preprocessing, data augmentation, clustering, and automated hyperparameter optimization to improve the detection of malicious insider activities.

Background and Motivation

The rapid growth of IoT in healthcare, industry, education, and critical infrastructure has increased connectivity while expanding cybersecurity risks. Insider threats are particularly difficult to detect because attackers operate using legitimate credentials and exhibit behavior that closely resembles normal user activity. Traditional rule-based and machine learning approaches struggle with:

• Highly imbalanced datasets, where malicious activities are rare.
• Loss of contextual information when treating each log entry independently.
• Manual hyperparameter tuning and limited use of relationships between users, devices, and resources.

Proposed Framework

The proposed framework integrates five key components into a unified detection pipeline:

1. Improved Principal Component Analysis (IPCA):
   • Reduces feature dimensionality.
   • Removes noise and lowers computational cost.
2. Outlier-Resistant K-Means Clustering:
   • Groups similar user behaviors while minimizing the influence of outliers.
   • Generates behavioral cluster labels for graph construction.
3. Enhanced Bidirectional GAN (EBiGAN):
   • Generates realistic synthetic insider attack samples.
   • Addresses severe class imbalance more effectively than traditional oversampling methods.
4. Graph Convolutional Network (GCN):
   • Models users, devices, and resources as graph nodes.
   • Learns relationships between entities to detect insider threats using both node features and interaction patterns.
5. Bayesian Optimization (Probability of Improvement):
   • Automatically tunes model hyperparameters such as learning rate, dropout, hidden units, and network depth for optimal performance.

The complete system is implemented as a Python-based Django web application.

System Workflow

The detection pipeline follows these stages:

1. Collect IoT log data.
2. Preprocess and encode features.
3. Reduce dimensions using IPCA.
4. Cluster behavioral patterns with Outlier-Resistant K-Means.
5. Balance the dataset using EBiGAN.
6. Construct an entity interaction graph.
7. Train the GCN.
8. Optimize hyperparameters using Bayesian Optimization.
9. Classify activities as normal or malicious.

Experimental Results

The framework was evaluated using the CMU CERT Insider Threat Dataset (r6.1 and r6.2).

The proposed framework significantly outperformed conventional machine learning and graph-based methods.

Key Findings

• Graph-based learning effectively captures relationships between users, devices, and resources.
• EBiGAN substantially improves minority-class detection by generating realistic insider attack samples.
• IPCA reduces noise and enhances generalization while lowering computational complexity.
• Bayesian Optimization consistently identifies better hyperparameters than manual tuning.
• Training and validation curves demonstrate stable convergence with minimal overfitting.

Conclusion

This work has introduced and validated a multi-component insider threat detection framework that addresses four co-occurring challenges — feature redundancy, class imbalance, relational structure neglect, and manual hyperparameter selection — within a single, end-to-end trainable architecture. The GCN backbone provides the structural foundation by encoding user-device-resource interactions as a property graph and learning to classify nodes through spectral neighbourhood aggregation. IPCA preprocessing, outlier-resistant clustering, EBiGAN augmentation, and Bayesian PI optimisation each contribute measurable, additive performance improvements, as confirmed by the comparative benchmarking results. On the CMU CERT benchmark, the proposed system achieves 96.8% detection accuracy and a 3% false alarm rate, establishing a new performance reference point for graph-based insider threat detection. Beyond raw performance, the modular architecture supports incremental deployment: organisations may adopt individual components — for example, IPCA and Bayesian Optimisation — without committing to the full pipeline, enabling phased integration into existing security operations infrastructure. Future work will extend the framework toward real-time graph streaming, federated learning across organisational boundaries, and explainability mechanisms that surface the specific interaction sub-graphs driving individual threat classifications.

References

[1] Lavanya, P., Glory, H. A., and Sriram, V. S., “Mitigating insider threat: A neural network approach for enhanced security,” IEEE Access, 2024. [2] Nikiforova, O., Romanovs, A., Zabiniako, V., and Kornienko, J., “Detecting and identifying insider threats using clustering,” IEEE Access, 2024. [3] Roy, K. C., and Chen, G., “Graph-CH: Deep framework for cyber-human threat detection,” IEEE Transactions on Dependable and Secure Computing, 2024. [4] Peccatiello, R. B., Gondim, J. J. C., and Garcia, L. P. F., “Applying one-class algorithms for data stream-based insider threat detection,” IEEE Access, 2023. [5] Singh, S., and Chattopadhyay, P., “Hierarchical classification for insider threat detection,” IEEE INDICON, 2023. [6] Rao, T. K., Darapaneni, N., Paduri, A. R., Kumar, A., and Ps, G., “Insider threat detection using classification models,” IEEE ICCC, 2023. [7] Zhu, D., Huang, X., Li, N., Sun, H., Liu, M., and Liu, J., “RAP-Net: A resource access pattern network for insider threat detection,” IEEE IJCNN, 2022. [8] Bin Sarhan, B., and Altwaijry, N., “Insider threat detection using machine learning,” IEEE (Applied Sciences indexed), 2022. [9] Meng, F., Lu, P., Li, J., Hu, T., Yin, M., and Lou, F., “GRU and auto-encoder based insider threat detection,” IEEE DSC, 2021.

Copyright

Copyright © 2026 Dr. M. Muni Babu, E. Divya, K. V N S Bhavana, N. Prashanthi, G. Sri Charan Reddy. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.