ITD_Model — Insider Threat Detection
A supervised ensemble machine-learning model for detecting insider threats in Active Directory environments using behavioral features.
🔍 What this model does
This model classifies users as:
• Normal behavior
• Anomalous / insider-threat behavior
based on engineered activity features derived from AD logs.
It uses a weighted ensemble of Random Forest, XGBoost, and LightGBM with an optimized decision threshold.
📦 Model artifact
The published file:
contains:
- Trained ensemble classifier
- Individual base models
- Fitted
StandardScaler - Feature column list
- Optimized decision threshold
⚙️ Installation
pip install -r requirements.txt
## 🚀 Basic usage
from huggingface_hub import hf_hub_download
import joblib
import pandas as pd
path = hf_hub_download(
repo_id="Mallikarjunac902/Insider_Threat_Detection",
filename="improved_threat_detector.joblib"
)
artifact = joblib.load(path)
model = artifact["model"]
scaler = artifact["scaler"]
features = artifact["feature_columns"]
threshold = artifact["optimal_threshold"]
df = pd.read_csv("new_features.csv")
X = df[features]
X_scaled = scaler.transform(X)
scores = model.predict_proba(X_scaled)[:,1]
preds = (scores >= threshold).astype(int)
print(preds[:10])