Weighted Percentile-Rank Fusion of Heterogeneous Unsupervised Anomaly Detection Models for Insider Threat Detection

Insider threat detection is challenging because malicious activity may be performed through legitimate user accounts and can therefore resemble normal organisational behaviour. Unsupervised anomaly detection identifies behavioural deviations without requiring malicious labels during training, however different detection algorithms may produce heterogeneous anomaly scores and identify different aspects of anomalous behaviour. This study investigates a weighted percentile-rank score-fusion approach for combining four heterogeneous unsupervised anomaly detectors within a common behavioural analytics framework. The study uses the CERT Insider Threat Dataset Release 4.2 and represents user activity at the user-week level using behavioural features derived from logon, device, file, web, and email activity. Isolation Forest, a stochastic gradient descent one-class support vector machine, a copula-based outlier detector, and MiniBatch K-Means clustering are independently trained and evaluated. Their anomaly scores are transformed into empirical percentile ranks before weighted aggregation, with ensemble weights selected using validation data and subsequently fixed for held-out testing. On 27,302 test user-weeks containing 157 malicious user-weeks, the weighted ensemble achieved an area under the precision-recall curve of 0.094 and an area under the receiver operating curve of 0.899, exceeding the precision-recall area of every individual detector. Leave-one-detector-out analysis showed that excluding the copula-based detector reduced the precision-recall area to 0.072, whereas excluding the clustering-based detector increased it to 0.097. Weight-sensitivity experiments further examined individual detector contributions to ensemble behaviour. The findings demonstrate both the potential and limitations of heterogeneous score fusion for highly imbalanced insider-threat detection and provide empirical evidence on how detector composition affects the resulting ensemble.