A Hybrid Insider Threat Detection Framework Combining Multi-Agent Simulation, Layered SIEM Correlation, and Theory-of-Mind Reasoning

arXiv:2601.04243 · cs.CR, cs.AI · Submitted 2026-01-06 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-01-06

Updated: 2026-09-01

Comments: v2: Substantially revised and extended version with new experimental results, additional evaluation, and expanded analysis. The title has been updated to reflect the revised scope of the manuscript

Code: https://github.com/firdous3679/Insider-Threat-Detection-MAS-SIEM

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Actor — 26× in this paper · explained in 3 episodes
Accuracy — 8× in this paper · explained in 1 episode
Multi-Agent Simulation — 7× in this paper
Calibration — 5× in this paper · explained in 7 episodes
Core — 4× in this paper · explained in 2 episodes
Consistency — 3× in this paper · explained in 3 episodes
Layered SIEM-Core — 3× in this paper
Multi-Agent System — 3× in this paper · explained in 6 episodes
Theory of Mind — 3× in this paper
Tokenization — 2× in this paper · explained in 2 episodes
Agent-based modeling — 1× in this paper · explained in 1 episode
Alert Fatigue — 1× in this paper · explained in 1 episode
Benchmark — 1× in this paper · explained in 2 episodes
Exponentially Weighted Moving Average — 1× in this paper
Fine-Tuning — 1× in this paper · explained in 5 episodes
Human-in-the-Loop — 1× in this paper · explained in 3 episodes
Lexical Diversity — 1× in this paper · explained in 2 episodes
Robustness — 1× in this paper · explained in 5 episodes
Security Information and Event Management — 1× in this paper
Theory of Mind (ToM) — 1× in this paper · explained in 2 episodes
Unified Framework — 1× in this paper · explained in 5 episodes
Verification — 1× in this paper · explained in 2 episodes

Terminology

Related papers