A Staged Architectural Framework for Behaviourally Grounded and Adversarially Robust Insider Threat Detection

Insider cyber threats remain among the most operationally damaging and conceptually challenging categories of organisational risk. Because harmful actions often occur within legitimate trust boundaries and mimic normative workflows, they remain difficult to distinguish from benign behavioural variance. While machine learning (ML) has become central to detection strategies, much prior research relies on relatively reductionist models and evaluation protocols that may not fully reflect operational complexities, such as temporal drift, domain heterogeneity, and adaptive evasion. Consequently, high benchmark scores do not always guarantee reliable performance in live, non-stationary environments.

This thesis proposes a behaviourally grounded and evaluation-disciplined approach to insider-threat detection. Rather than seeking a singular algorithmic solution, the research treats representational stability, semantic alignment, and robustness as incremental design objectives. Four architectural contributions are presented. First, a Hybrid Self-Organising Map–Artificial Neural Network (SOMANN) framework explores the separation of unsupervised perceptual learning from supervised inference to help stabilise high-variance telemetry. Second, a Modular Artificial Neural Network (MANN) architecture addresses domain-specific semantics through structured decomposition and controlled fusion, aiming to reduce cross-domain masking. Third, a multi-layered hierarchical framework models behaviour across different temporal granularities to capture longer-horizon trajectories. Fourth, the R-Guard architecture formalises behaviourally constrained adversarial models to evaluate resilience under perturbations that preserve behavioural plausibility.

Using the CERT insider-threat benchmark, the thesis applies chronology-preserving validation and leakage-aware pre-processing to ensure a defensible comparison between architectures. The results suggest that structured representations and disciplined evaluation can improve stability and reduce certain error modes relative to monolithic baselines. While not a complete solution to the insider problem, this work provides a principled foundation for detection systems that better integrate behavioural reasoning with architectural design and adversarial awareness.