Differential equation models of insider threat dynamics
Rahul Thakurrahul.thakur.orp@chitkara.edu.inCentre of Research Impact and Outcome (CRIO)Chitkara UniversityRajpura, Punjab, 140417, IndiaView full profile → , *Saumya GoyalCorresponding authorsaumyaqsb@quantumeducation.inQuantum University Research CenterQuantum UniversityRoorkee, Uttarakhand, 247667, IndiaView full profile → , Tanveer Ahmad Wanitanveer.ahmad@niu.edu.inDepartment of PhysicsNoida International UniversityGreater Noida, Uttar Pradesh, 201312, IndiaView full profile → , Subramanian Karthickkarthick.sb@vit.eduDepartment of Computer EngineeringVishwakarma Institute of TechnologyPune, Maharashtra, 411037, IndiaView full profile → , D. Balajibalaji@avit.ac.inDepartment of Humanities and SciencesAarupadai Veedu Institute of TechnologyVinayaka Mission’s Research Foundation (Deemed to be University)Paiyanur, Tamil Nadu, 603104, IndiaView full profile → , Surayyo Khasanovaxasanova_surayyo@mamunedu.uzDepartment of Psychology and MedicineMamun UniversityKhiva, 220900, UzbekistanView full profile → , Samariddin Makhmudovsamariddin_maxmudov@tues.uzDepartment of Finance and TourismTermez University of Economics and ServiceTermez, 190111, UzbekistanView full profile →
* Corresponding author · click or hover a name for details
- Received:
- 01 Apr 2026
- Published Online:
- 27 Oct 2026
- Article type:
- Research Article
- Language:
- EN
- Article no.:
- JIM-2807
- Pages:
- 2905–2916
Abstract
Insider threats are among the most complex cybersecurity threats as trusted employees can be intentional or unintentional threats to the organization. This study proposes a differential equation model of insider threat behavior as a representation of the dynamic interactions between trusted users, suspicious activity, compromised states and insider threat mitigation mechanisms. The proposed approach is a system of ODEs to describe the progression of threats, behavioral transitions, and the effect of monitoring and response strategies with time. Under different security conditions, the long-term behavior of the system is investigated by carrying out equilibrium and stability analyses. The numerical simulation results show the potential of the model for simulating threat escalation and assessing threat mitigation policies. The suggested mathematics-based modeling approach offers a quantitative basis for understanding the dynamics of insider threat, for a proactive assessment of risk, for making security decisions in complex organizations, and for formulating adaptable defense strategies against insider threat in cybersecurity.
Keywords
Subject Classifications
References
[1] M. Jurišić, I. Tomičić, and A. Bernik, "Time is of the essence: A comparative study of continuous (NCDE) and discrete (LSTM) time models for user anomaly detection," Signals, vol. 7, no. 4, Art. no. 59 (2026), doi: 10.3390/signals7040059.
[2] A. R. Alkharabsheh, G. Binsalma, M. Alharmi, R. Alshateri, S. Altaee, and M. Sweidan, "Artificial intelligence-based insider-threat detection: A hybrid explainable framework with automated response and privilege containment," Computers, vol. 15, no. 7, Art. no. 426 (2026), doi: 10.3390/computers15070426.
[3] V. Sobchuk, V. Savchenko, B. Stepanchenko, and H. Haidur, "Application of impulsive SIRQ models for the development of forecasting and cyberattack mitigation scenarios," Axioms, vol. 15, no. 3, Art. no. 229 (2026), doi: 10.3390/axioms15030229.
[4] D. Mukhammejanova, A. Mukasheva, and S. Chen, "Numerical study of the dynamics of medical data security in information systems," Computers, vol. 15, no. 1, Art. no. 37 (2026), doi: 10.3390/computers15010037.
[5] A. D. Gaikwad, H. H. Kulkarni, P. B. Patel, V. S. Jape, A. R. Soman, and L. R. Chudhari, "Harmonic analysis in speech recognition systems," Journal of Interdisciplinary Mathematics, vol. 29, no. 3, pp. 719–727 (2026), doi: 10.47974/JIM-2508.
[6] R. A. Alsowail and T. Al-Shehari, "A multi-tiered framework for insider threat prevention," Electronics, vol. 10, no. 9, Art. no. 1005 (2021), doi: 10.3390/electronics10091005.
[7] A. Sayyad, S. Sontakke, G. Pathan, A. Zode, and R. Bangre, "Cloud-based data analytics," International Journal on Advanced Computer Theory and Engineering, vol. 14, no. 1, pp. 244–247 (2025), doi: 10.65521/ijacte.v14i1.474.
[8] H. Damak, M. A. Hammami, and S. Jawadi, "Some existence and stability results for abstract evolution equations with perturbations," Journal of Dynamical Systems and Geometric Theories, vol. 23, nos. 1–2, pp. 99–119 (2025), doi: 10.47974/JDSGT-2025-02003.
[9] L. Sakalauskas, V. Denisov, and A. Dirzyte, "Hybrid modeling of anxiety propagation in response to threat stimuli flow," Mathematics, vol. 11, no. 19, Art. no. 4121 (2023), doi: 10.3390/math11194121.
[10] L. Rojas, V. Yepes, and J. Garcia, "Complex dynamics and intelligent control: Advances, challenges, and applications in mining and industrial processes," Mathematics, vol. 13, no. 6, Art. no. 961 (2025), doi: 10.3390/math13060961.
[11] D. P. Chavan, "FJSO-based optimized multipath routing in mobile ad-hoc networks," International Journal on Advanced Computer Engineering and Communication Technology, vol. 14, no. 2, pp. 48–52 (2025), doi: 10.65521/ijacect.v14i2.1277.
[12] T. Hu, B. Xin, X. Liu, T. Chen, K. Ding, and X. Zhang, "Tracking the insider attacker: A blockchain traceability system for insider threats," Sensors, vol. 20, no. 18, Art. no. 5297 (2020), doi: 10.3390/s20185297.
[13] R. C. Poonia, R. Almakki, A. K. J. Saudagar, A. Altameem, and M. Albathan, “An optimization approach for real-time object detection in IoT devices through edge computing and deep learning,” Journal of Information and Optimization Sciences, vol. 45, no. 5, pp. 1465–1475 (2024), doi: 10.47974/JIOS-1768.
