CausalXBoost: A Causal Explainable CatBoost Framework for Insider Threat Detection

Abstract

Many organizations face increasing risk from the insider threats where employees misuse the legitimate access to compromise sensitive data or systems. It is often complex in detecting the using the traditional ways. To address this issue, CausalXBoost framework was proposed which is detects the malicious behavior with transparency and causal effect. The backbone of the proposed framework is the CatBoost model which performed the best with 96.98% of accuracy, 95.45% of precision, 96.87% of recall and 96.16% of F1-score. SHAP identifies the features such as total files burned, number of printed pages off hours and number of unique campuses are few of the influential attributes. While the causal inferences resulted that number of unique campuses as the largest effect. The proposed framework could assist in early detection of the threat, with clear explanation and parameters how the decision was made. It could assist the organizations in better decisionmaking, improved security policies, protect sensitive data and maintain trust within the workplace.