Privacy-Preserving User Behaviour Analytics For Insider-Threat Detection: A Federated Learning and Differential Privacy Pipeline Evaluated Against Saudi Arabia's PDPL and NCA-ECC

Abstract

This paper presents the implementation and experimental evaluation of a three-stage user behaviour analytics (UBA) pipeline with built-in protections for privacy and regulatory compliance. Given the computational resources available in comparison to the full 4,000-user dataset, the system was tested on a reduced-scale, CERT Insider Threat Dataset v6.2-inspired synthetic corpus (400 users, 60000+ behavioral items per day, with 15 CERT-consistent insider-threat scenario archetypes represented in 2.5% of users). The solution implements a de-identified preprocessing stage, a Federated-Learning-plus-Differential-Privacy (FL+DP) detection layer, and a governance and compliance-mapping component based on the SHAP explanation Framework. Three baseline detectors (Isolation Forest, Random Forest, Deep Autoencoder) were compared to the FL+DP logistic-regression model using seven privacy-budget values (epsilon = 0.5, 1, 2, 5, 10, 20, infinity) on a hold-out test partition with cross-validation over five random seeds, revealing F1-scores (mean +/- std) of 0.988 +/- 0.027 for the best baseline (Autoencoder) and 0.334 +/- 0.253 (epsilon=0.5) to 0.727 +/- 0.217 (epsilon=20) for the FL+DP model. For comparison, epsilon=5 corresponds to F1=0.602 +/- 0.190, or 84.3% of the maximal value for the private model. Membership-inference attack AUC scores were found to range between 0.486 and 0.505 for all privacy budgets, consistent with random guessing. An eight-control regulatory compliance matrix, relevant to both Saudi Arabia’s Personal Data Protection Law and NCA-ECC cybersecurity controls, was developed and scored 85.4/100 in terms of the UBA pipeline’s adherence to the technical requirements. Feature importance scores obtained via SHAP were used to provide natural language justifications for each alert, grounded in the scenario archetypes. The findings establish, on a reduced-scale testbed, the practical feasibility of balancing detection capabilities, privacy, and regulatory compliance within a unified analytical framework and identify the validation on the full CERT v6.2 corpus as a priority for future work.