BEHAVIORAL RISK SCORING FOR INSIDER THREAT MITIGATION IN ZERO TRUST ENTERPRISE NETWORKS

Abstract

Insider threats remain difficult to mitigate because authenticated users can misuse legitimate privileges while enterprise environments continuously produce heterogeneous identity, endpoint, application, and network telemetry. This study develops an applied behavioral risk-scoring pipeline that converts windowed events from the CERT Insider Threat Test Dataset into a time-indexed signal intended for Zero Trust access decisions and analyst triage. The method combines metadata-only feature aggregation, Logistic Regression and HistGradientBoosting baselines, user-window scoring, top-K ranking, and an explicit mapping from risk levels to allow, step-up multi-factor authentication, or restrictive actions. Daily and weekly aggregation are evaluated with 30 stratified 70/30 train/test splits under severe class imbalance. Ranking metrics are emphasized because they correspond to a fixed analyst review budget more directly than a single classification threshold. Weekly aggregation achieved Recall@10 = 1.0000 and Recall@1000 = 1.0000 in the reported case study, whereas daily aggregation achieved Recall@10 = 0.2667 ± 0.1729 and Recall@1000 = 0.4667 ± 0.2249. The contribution is an operational integration rather than a new classifier: behavioral evidence is transformed into a continuous, reviewable risk state and connected to reversible Zero Trust controls, while the temporal trade-off between ranking stability and response latency is made explicit.