DEVELOPMENT OF AN ANOMALY-BASED INSIDER THREAT MONITORING SYSTEM IN FINANCIAL ORGANIZATION

ABSTRACT Insider threats pose a significant security challenge to financial organizations due to the legitimate access privileges granted to internal users. Unlike external attacks, insider activities often appear normal within organizational systems, making them difficult to detect using traditional rule-based and signature-driven security mechanisms. As a result, conventional monitoring systems frequently fail to identify subtle or previously unseen insider attacks. This study presents the development of an anomaly-based insider threat monitoring system designed to detect deviations from baseline user behavior using statistical and machine learning techniques. The proposed system models normal behavioral patterns from user activity logs and applies Z-score analysis alongside unsupervised machine learning algorithms, specifically Isolation Forest and Local Outlier Factor, to identify anomalous activities indicative of insider threats. The system was implemented using Python and evaluated using simulated and anonymized datasets representative of financial organizational environments. Performance evaluation was conducted using standard security metrics, including precision, recall, F1-score, false positive rate, and response time, to assess both detection effectiveness and operational feasibility. Experimental results demonstrated detection accuracy exceeding 90%, low false positive rates, and near real-time anomaly detection performance. These findings confirm that anomaly-based detection provides a more effective approach for identifying insider threats compared to traditional logging and rule-based monitoring systems. The study contributes a practical and scalable framework for insider threat detection and provides a foundation for further research and potential real-world deployment in financial institutions