Bayesian Hierarchical Temporal Model for the Early Prediction of Insider Threats

Abstract

Insider threats constitute one of the most severe and costly categories of cybersecurity risk, as malicious insiders exploit legitimate access and organisational knowledge to conduct attacks that accumulate gradually over weeks or months. This paper proposes a Bayesian Hierarchical Temporal Model for the early detection of insider threats. The model represents each employee as a latent continuous risk state evolving according to a linear Gaussian state-space process, with observations generated from four heterogeneous data modalities: network and endpoint telemetry, behavioural analytics, organisational and HR indicators, and OSINT-derived social media sentiment. A hierarchical Dirichlet-process mixture prior enables population-level knowledge sharing across the employee base. Two inference algorithms are developed: a structured mean-field variational Bayes (VB) algorithm for scalable offline learning, and a Rao-Blackwellized Sequential Monte Carlo particle filter for real-time risk scoring. An early-warning decision rule is derived from Bayesian decision theory under asymmetric misclassification costs. Experiments on the CERT Insider Threat Dataset v6.2 demonstrate ROC-AUC of 0.947, PR-AUC of 0.831, ECE of 0.038, and expected time-to-detection of 4.2 days, outperforming logistic regression, HMM, LSTM, and rule-based baselines on all metrics.