| Naslov: | The Cert dataset decade : a systematic review of methodological evolution and performance bias |
|---|
| Avtorji: | ID Jurišić, Marko (Avtor)
ID Tomičić, Igor (Avtor) |
|---|
| Datoteke: |  RAZ_Jurisic_Marko_2026.pdf (928,41 KB)
MD5: 9B30B98F26AE5E189F52541180F55E79
 https://www.fvv.um.si/rv/arhiv/2026/2026-02-Jurisic-Tomicic-E.html
|
|---|
| Jezik: | Angleški jezik |
|---|
| Vrsta gradiva: | Znanstveno delo |
|---|
| Tipologija: | 1.02 - Pregledni znanstveni članek |
|---|
| Organizacija: | FVV - Fakulteta za varnostne vede
|
|---|
| Opis: | Purpose: The purpose of this paper is to identify methodological biases and limitations in machine learning–based insider threat detection using the Computer Emergency Response Team [CERT] dataset, in order to guide the development of more realistic, robust, and operationally relevant detection approaches. Design/Methods/Approach: The objectives are achieved through a systematic literature analysis of 131 peer-reviewed studies published between 2013 and 2025 that apply machine learning to insider threat detection using the CERT dataset, employing a Preferred Reporting Items for Systematic Reviews and Meta-Analyses [PRISMA]-guided selection process and a structured comparative framework to examine dataset versions, feature engineering strategies, model architectures, and evaluation metrics from a methodological and empirical perspective. Findings: The analysis shows that most studies rely on the less realistic CERT v4.2 dataset, resulting in inflated performance that does not generalize to operational settings. It also finds that feature engineering is a stronger determinant of detection performance than model complexity, while inconsistent evaluation practices hinder meaningful comparison across studies. Research Limitations / Implications: The study is limited by its reliance on published research using a single synthetic dataset, which constrains generalization to real-world environments. Practical Implications: The findings indicate that practitioners should be cautious when adopting models validated on simplified benchmark settings, and instead prioritize solutions tested under extreme class imbalance. Emphasis should be placed on robust feature engineering, unsupervised or hybrid detection approaches, and evaluation metrics. Originality/Value: This paper provides the first large-scale, methodologically focused analysis of insider threat detection research that explicitly exposes performance inflation caused by dataset version bias and evaluation inconsistency, offering concrete, evidence-based guidance for improving the realism, comparability, and operational value of future studies in the field. |
|---|
| Ključne besede: | insider threat detection, CERT dataset, machine learning, anomaly detection, dataset bias, evaluation metrics |
|---|
| Status publikacije: | Objavljeno |
|---|
| Verzija publikacije: | Objavljena publikacija |
|---|
| Datum objave: | 19.03.2026 |
|---|
| Leto izida: | 2026 |
|---|
| Št. strani: | str. 1-24 |
|---|
| Številčenje: | Vol. 28 |
|---|
| PID: | 20.500.12556/DKUM-97658  |
|---|
| UDK: | 004.056 |
|---|
| COBISS.SI-ID: | 273493251 |
|---|
| ISSN pri članku: | 2232-2981 |
|---|
| Datum objave v DKUM: | 30.03.2026 |
|---|
| Število ogledov: | 312 |
|---|
| Število prenosov: | 4 |
|---|
| Metapodatki: |    |
|---|
| Področja: | Ostalo
|
|---|
|
:
|
Kopiraj citat |
|---|
| | | | Skupna ocena: | (0 glasov) |
|---|
| Vaša ocena: | Ocenjevanje je dovoljeno samo prijavljenim uporabnikom. |
|---|
| Objavi na: |  |
|---|
Postavite miškin kazalec na naslov za izpis povzetka. Klik na naslov izpiše
podrobnosti ali sproži prenos. |
