An Integrated Machine Learning and Deep Learning Framework for Insider Threat Detection in Healthcare EHR Logs

Abstract

Insider threats pose a significant security challenge to healthcare organizations due to privileged access to sensitive Electronic Health Record (EHR) systems. While machine learning and deep learning techniques have been independently applied for insider threat detection, each approach has inherent limitations in modeling complex healthcare access behavior. This paper proposes an integrated hybrid machine learning–deep learning framework for insider threat detection in healthcare EHR logs. The framework combines traditional machine learning models for structured feature learning with Long Short-Term Memory (LSTM) networks for capturing temporal user behavior patterns. The proposed approach is evaluated using the CERT insider threat dataset and simulated healthcare EHR logs. Experimental results demonstrate that the hybrid model consistently outperforms standalone machine learning and deep learning models in terms of accuracy, precision, recall, F1-score, and AUC. The findings highlight the effectiveness of hybrid learning strategies in improving insider threat detection performance in dynamic healthcare environments.