Proactive Insider Threat Detection Framework: An Explainable AI and Behavioral Analytics-Driven Approach

Insider threats remain a critical security challenge, necessitating advanced AI-driven behavioral analytics. However, the deployment of these systems faces two distinct but equally paralyzing hurdles: strict data protection regulations (such as GDPR and NDPR) which restrict the centralization of sensitive user logs, and the opaque "black box" nature of deep learning models which erodes the trust of security analysts. To resolve this dual conflict, this paper proposes a unified framework integrating Federated Learning (FL), Differential Privacy (DP), and Explainable AI (XAI). We employ an LSTM-based architecture where user data remains local, protected by the Laplace mechanism, while SHAP and LIME provide transparent model interpretations. Crucially, to test robustness beyond standard benchmarks, the framework is validated across two fundamentally different environments: the synthetic, user-centric CERT dataset and the real-world, cloud-native BETH dataset. Results demonstrate high adaptability, achieving F1-Scores of 0.88 on CERT and 0.86 on the complex BETH dataset - a minimal performance trade-off for guaranteed privacy. The XAI layer successfully demystified alerts across both environments, proving that high-accuracy detection, robust privacy, and actionable transparency can be achieved simultaneously in modern IT infrastructure.