MACHINE LEARNING-BASED PREDICTION OF INSIDER THREATS: A CASE FOR ENTERPRISE RESOURCE PLANNING (ERP) SYSTEMS

Abstract

Enterprise Resource Planning (ERP) systems consolidate core operational functions of business processes on a single database, thereby making them prime targets for insider threats. Thus, insider threats remain among the most consequential yet least detectable risks, because the individuals responsible for most anomalous activity already hold legitimate, and often extensive, system’s privileges. Traditional insider threat controls rely on operating access rules and retrospective audit trails that register violations only after damage has occurred. This study proposes a machine learning-based predictive framework for the early detection of insider threats within ERP systems environments. The framework integrates sequential deep learning architectures, primarily the Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) networks with ensemble learning methods of Random Forest (RF) and Gradient Boosting (GB) to model the temporal evolution of user behavior across authentication, file-access, email, and enterprise transaction logs. The methodology addresses data imbalance through the Synthetic Minority Over-sampling Technique (SMOTE), employs temporally aware cross-validation to avoid information leakage, and evaluates candidate models using precision, recall, F1-score, and the Area Under the Receiver Operating Characteristic Curve (AUC-ROC). Five conceptual diagrams operationalized the framework. A structured synthesis of benchmark outcomes reported across comparable insider threat studies indicated recurrent architectures consistently improved the detection of temporally patterned insider behavior relative to static classifiers, while ensemble methods retained advantages in interpretability, training efficiency, and auditability. The study closes with ethical deployment guidelines and a concrete roadmap for empirically validating the framework on live ERP telemetry.