Insider threats, where legitimate users misuse their access for malicious purposes, remain challenging to detect due to their contextual and behavioral subtleties. This paper presents a novel machine learning framework that captures user activity sequences through a user-centric representation named the User Daily Activity Sentence (UDAS). Unlike prior work that informally uses daily sequences, we formalize UDAS as a behavioral encoding technique using Word2Vec embeddings and extensively evaluate it across multiple unsupervised anomaly detection methods.To enrich this representation with relational context, we propose a graph-based extension that constructs a user interaction graph based on co-device usage and domain access. A Graph Convolutional Network (GCN) is applied to enhance semantic user embeddings, and anomaly detection is performed using Kmeans clustering.To the best of our knowledge, this is the first work to systematically combine semantic sequence embeddings with graph-based relational learning for insider threat detection. Experiments on the CERT Insider Threat v4.2 dataset show that our method outperforms prior unsupervised models in accuracy and robustness. The proposed framework requires no feature engineering or labeled data, making it applicable to real-world monitoring environments.

Insider threats in cybersecurity are notoriously difficult to detect due to their covert nature, often evading traditional security measures. In this paper, we propose an unsupervised method for insider threat detection, where we leverage advanced Natural Language Processing (NLP) techniques to enhance the detection of abnormal user activities indicative of insider threats. We represent user behaviors in a vector space using Word2Vec, which in turn are analyzed using state-of-the-art NLP models, including BERT, SciBERT, RoBERTa, GPT-2, and LLaMA. These models are integrated with Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) networks to analyze the temporal behavior of user actions. We evaluate the proposed method using the CMU-CERT dataset version 4.2. Our implemented approaches based on NLP achieve better results than previous state-of-the-art approaches that use traditional unsupervised learning.