AI-Based Insider Threat Detection in Cloud

Abstract - This study proposes a federated transformer–graph neural network (GNN) framework for zero-trust insider threat detection in multi-cloud environments, enhancing privacy-preserving and real-time behavioral analytics. The approach combines LSTM autoencoders for analysing sequential logs, GNNs for modelling user-network interactions, and reinforcement learning for setting adaptive risk thresholds. It is trained using augmented CERT Insider and CSE-CIC-IDS2018 datasets through federated learning across simulated AWS/Azure/GCP environments. The experimental findings reveal outstanding performance, achieving a 97% AUC-ROC, a 15% reduction in false positives, and a 10% increase in accuracy compared to previous hybrid ML/DL baselines. This framework facilitates proactive detection of insider actions such as privilege escalation and data exfiltration while maintaining GDPR-compliant privacy through differential mechanisms. These innovations provide scalable, explainable AI solutions for enterprise multi-cloud security, overcoming the limitations of traditional UEBA with modern zero-trust architectures and setting the stage for autonomous threat mitigation systems. Key Words Insider Threat Detection, Zero-Trust Architecture, Federated Learning, Graph Neural Networks (GNN), Cloud Security, Anomaly Detection, User and Entity Behavior Analytics (UEBA), Differential Privacy, Multi-Cloud Security, Deep Learning.