DOCUMENTATION

i INSIDER THREAT DETECTION SYSTEM: MACHINE LEARNING BASED USER BEHAVIOR MONITORING A MAJOR PROJECT report submitted to JNTUA, Ananthapuramu In partial fulfillment of the requirements for the award of the degree of Bachelor of Technology (Computer Science and Engineering) By P. AZFAR (22KB1A05D6) SK. MAHAMOOD (22KB1A05F8) P. SRI VISHNU (22KB1A05D4) P. JASWANTH (22KB1A05D7) Under the Esteemed Guidance of, Mrs. A. Divya, M. Tech. Assistant Professor, Dept. of CSE DEPARTMENT OF COMPUTER SCIENCE & ENGINEERING N.B.K.R INSTITUTE OF SCIENCE & TECHNOLOGY (Autonomous) VIDYANAGAR–524413, TIRUPATIDIST. APRIL 2026ii Website: www.nbkrist.org. Ph: 08624-228 247 Email: [email protected]. Fax: 08624-228 257 N.B.K.R. INSTITUTE OF SCIENCE & TECHNOLOGY (Autonomous) (Approved by AICTE: Accredited by NBA: Affiliated to JNTUA, Anantapuramu) An ISO 9001-2000 Certified Institution Vidyanagar -524 413, Tirupati District, Andhra Pradesh, India BONAFIDE CERTIFICATE This is to certify that the project work entitled “Insider Threat Detection System : Machine Learning Based User Behavior Monitoring” is a bonafide work done by P. AZFAR (22KB1A05D6), SK. MAHAMOOD (22KB1A05F8), P. SRI VISHNU (22KB1A05D4), P. JASWANTH (22KB1A05D7), in the Department of Computer Science & Engineering, N.B.K.R. Institute of Science & Technology, Vidyanagar and is submitted to JNTUA, Anantapuramu in the partial fulfillment for the award of B.Tech degree in Computer Science & Engineering. This work has been carried out under our supervision. Mrs.A.Divya,M.Tech Mr.M.Hari Babu Assistant Professor P.O.P & Head Department of CSE Department of CSE NBKRIST, Vidyanagar NBKRIST, Vidyanagar Submitted for the Viva-Voce Examination held on Examiner-1 Examiner-2iii ACKNOWLEDGEMENT The satisfaction that accompanies the successful completion of a project would be incomplete without the people who made it possible with their constant guidance and encouragement crowned our efforts with success. We would like to express our profound sense of gratitude to our project guide Mrs.A.Divya, M.Tech, Assistant Professor, Department of Computer Science & Engineering, N.B.K.R.I.S.T (affiliated to JNTUA, Anantapuramu), Vidyanagar, for his masterful guidance and the constant encouragement throughout the project. Our sincere appreciation for his suggestions and unmatched services without, which this work would have been an unfulfilled dream. We convey our special thanks to Dr. Y. VENKATA RAMI REDDY respectable chairman of N.B.K.R. Institute of Science and Technology, for providing excellent infrastructure in our campus to complete the project. We convey our special thanks to Sri N. RAM KUMAR respectable correspondent of N.B.K.R. Institute of Science and Technology, for providing excellent infrastructure in our campus to complete the project. We are grateful to Dr. V. Vijaya Kumar Reddy, Director, N.B.K.R Institute of Science and Technology for allowing us to avail all the facilities in the college. We express our sincere gratitude to Mr.M.Hari Babu, P.O.P, Head of Department, Computer Science & Engineering, for providing exceptional facilities for the successful completion of our project work. We would like to convey our heart full thanks to Staff members, Lab technicians, and our friends, who extended their cooperation in making this project a successful one. We would like to thank one and all who have helped us directly and indirectly to complete this project successfully.iv ABSTRACT The increasing risk of internal security breaches has made insider threat detection a critical concern for modern organizations. This project presents an Insider Threat Detection System: Machine Learning Based User Behavior Monitoring, designed to identify suspicious employee behavior using machine learning and behavioral analysis. The system monitors activity patterns and assigns risk scores to employees, helping administrators take timely action to prevent potential threats. The system integrates multiple technologies to deliver a scalable and efficient solution. The frontend is developed using React, providing an interactive dashboard to visualize employee activity, risk levels, and alerts. The backend is built using FastAPI, which handles API requests, authentication, and communication between system components. A MySQL database is used to store logs, user data, and processed results securely. A key feature of the system is the use of the Isolation Forest algorithm, a machine learning technique for anomaly detection. It analyzes employee behavior such as file access, login patterns, and network activity to detect unusual actions. Based on these insights, the system calculates a risk score (0–100) and categorizes employees into low, medium, or highrisk levels. Additional features include blocking/unblocking employees, assigning cases to analysts, and sending email notifications. Designed forsecurity administrators, the system focuses on accuracy, usability, and realtime monitoring. It has been tested using various datasets and scenarios, demonstrating reliable detection of anomalous behavior and effective risk classification. This project shows how combining machine learning, data analysis, and web technologies can help organizations proactively detect insider threats and enhance overall cybersecurity.v TABLE OF CONTENTS Chapter No Topic Name Page No Certificate ii Acknowledgement iii Abstract iv Table of Contents v-vii List of Figures viii List of Abbreviations ix 1 INTRODUCTION 1-7 1.1 Introduction 2 1.2 Background and Motivation 2-3 1.3 Problem Statement 3 1.4 Objectives and Scope 4-5 1.5 Organization of the Project Report 5-7 1.6 Summary 7 2 LITERATURE REVIEW 8-13 2.1 Introduction 9 2.2 Literature Survey 9-11 2.3 Existing System 11 2.4 Proposed System 12vi 2.5 Feasibility Analysis 12-13 2.6 Summary 13 3 METHODOLOGY 14-24 3.1 Introduction 15-17 3.2 Overview of methodological approach 17-19 3.3 Parameters 19-20 3.4 Performance metrics 20-22 3.5 Description of tools and technologies used 22-23 3.6 Summary 24 4 SYSTEM DESIGN 25-40 4.1 Introduction 26 4.2 Detailed Design of Components 26-28 4.3 UML Diagrams 29-39 4.4 Summary 40 5 IMPLEMETATION 41-50 5.1 Introduction 42 5.2 Code Structure and Organization Procedure 42-45 5.3 System Requirements 45 5.4 Software Installation 46 5.5 System Modules 46-49 5.6 Algorithms and Techniques Implemented 49-50 5.7 Summary 50 6 RESULT AND ANALYSIS 51-56 6.1 Introduction 52vii 6.2 Demonstration of functional results 52-55 6.3 Conclusion 56 7 TESTING & VALIDATION 57-63 7.1 Introduction 58 7.2 Testing strategies 58-59 7.3 Test cases 59-61 7.4 Validation 61-63 7.5 Summary 63 8 CONCLUSION AND FUTURE WORK 64-66 8.1 Conclusion 65 8.2 Future Work 66 9 REFERENCES 67-69viii LIST OF FIGURES Fig No Figure Name Page No 4.1 Use Case Diagram 29 4.2 Activity Diagram 30-32 4.2.1 Analyst Assignment Activity Diagram 30 4.2.2 Employee Review Activity Diagram 31 4.2.3 Dashboard Monitoring Flow Activity Diagram 32 4.3 Class Diagram 33-34 4.3.1 Risk Score Calculation Class Diagram 33 4.3.2 Backend Service Layer Class Diagram 34 4.4 Sequence Diagram 35-38 4.4.1 Authentication Sequence Diagram 35 4.4.2 Anomaly Prediction Sequence Diagram 36 4.4.3 Admin Login & Dashboard Access Sequence Diagram 37 4.4.4 Employee Blocking Sequence Diagram 38 4.5 Component Diagram 39ix LIST OF ABBREVIATIONS SHORT FORM FULL FORM API Application Programming Interface UML Unified Modeling Language UI User Interface ML Machine Learning DB Database SQL Structured Query Language JWT Json Web Token HTTP Hyper Text Transfer Protocol SMTP Simple Mail Transfer Protocol1 CHAPTER - 1 INTRODUCTION