Generative Agent-Based Modeling with Large Language Models for insider threat detection

Abstract

Insider threats pose a critical challenge in cybersecurity, as individuals within organizations misuse legitimate access to compromise sensitive systems and data. Traditional detection methods often struggle with the complexity of such threats, while Deep Learning (DL) approaches face issues like overfitting and lack of interpretability. To address these limitations, we propose a Generative Agent-Based Modeling (GABM) framework that integrates Large Language Models (LLMs) with a hierarchical multi-agent system.

Our framework employs Specialized Agents to process categorized log files and generate detailed reports, which are synthesized by a Supervisor Agent for final activity classification. We validated this approach on both network-centric (PicoDomain) and behavior-rich (CERT r5.2) datasets, demonstrating its ability to handle diverse logs, model complex threats, and generalize across insider risk scenarios.

The framework outperformed existing baselines, prioritizing high recall to minimize false negatives—crucial in cybersecurity contexts. While precision was comparatively lower, this trade-off supports early threat detection. An ablation study highlighted the importance of the Supervisor Agent, whose removal led to a significant drop in performance and increased false positives.

These results demonstrate the potential of LLM-powered hierarchical multi-agent frameworks for scalable, interpretable, and reliable insider threat detection. Our contributions include the integration of GABM and LLMs, a hierarchical system for log analysis, and the use of Chain-of-Thought reasoning for enhanced interpretability.