Adaptive Hybrid Machine Learning Framework for Insider Threat Detection in Cloud-Based Enterprise Environments

K. Selvamani, S. Kanimozhi, S. K. Muthusundar, H. Riasudheen, Rahul Panakkal, Raja Brahmendra Chowdary Veerepalli, Srinath Venkatesan, Varun Kumar Nomula Department of Computer Science and Engineering, College of Engineering Guindy, Anna University, Chennai, Tamil Nadu, India. Department of Artificial Intelligence and Data Science, Meenakshi College of Engineering, Chennai, Tamil Nadu, India. Department of Artificial Intelligence and Data Science, Chennai Institute of Technology, Chennai, Tamil Nadu, India. Department of Artificial Intelligence and Machine Learning, Saveetha School of Engineering, Chennai, Tamil Nadu, India. Department of Computer Science and Engineering, University of Illinois at Urbana, Champaign, Illinois, United States of America. Department of Computer Science, Texas State University, San Marcos, Texas, United States of America. Department of Computer Science, New York University, New York, United States of America. Department of Analytics/Industrial and Systems Engineering, Georgia Institute of Technology, Atlanta, Georgia, United States of America.

Abstract: Insider threats are among the most complex and persistent security issues in cloud-based enterprise systems, as they can be carried out by someone who has legitimate access to the system or network. In this paper, researchers present an Adaptive Hybrid Machine Learning Framework (AHMLF) for scalable, real-time insider threat identification that combines unsupervised anomaly detection with supervised classification. The framework includes analysing authentication logs, file access records, network activity traces and command execution histories and creating behavioural baselines for user entities. A combined approach aggregates the anomaly scores from the Isolation Forest and Autoencoder models, along with the classification confidence scores from the Random Forest and Gradient Boosting learners, to produce a threat score that reduces false positives and increases detection coverage. An additional continuous learning module continuously updates user profiles to address behavioural drift in dynamic cloud environments. The experimental testing results, which were conducted on the augmented benchmark datasets using synthetic attack scenarios such as data exfiltration, privilege escalation, unauthorised resource access, and abnormal login time, have yielded 97.3% accuracy, 96.8% precision, 95.6% recall, 96.2% F1-score, and a 2.1% false positive rate. These results show that in real-world deployments, AHMLF has the potential to enhance enterprise cloud security by helping to detect insider threats, alert in a risk context, and proactively defend against them with minimal architectural changes.

---

Keywords: Insider Threat Detection; Hybrid Machine Learning; Anomaly Detection; Cloud Security; Continuous Learning; Supervised Classification; Authentication Logs; Isolation Forest.

---

Received on: 01/08/2025Revised on: 10/10/2025Accepted on: 07/11/2025Published on: 03/03/2026

---

---