Explainable AI for Multi-Modal Insider Threat Detection: A CNN-LSTM-Autoencoder Framework with SHAP-LIME Comparative Analysis

Insider threat is one of the most malevolent and catastrophic categories of failures in the security of the world’s financial infrastructure, and this is magnified exponentially in institutional vectors with highly intricate transaction contexts, liquid gateways across the globe, and widespread administrative power among multi-level user roles. Though today’s advanced deep learning architectures succeed at the identification of complex and non-linear patterns within massive data volume, they are hampered critically and in parallel by the restrictions imposed by data protection statutes (e.g., GDPR and SOX) which limit opaque data ingestion, coupled with the well-known black box phenomenon inherent to deep architectures. To overcome these two severe limitations, we report here on the extensive empirical valuation of a multi-modal deep learning architecture coupled with post-hoc XAI techniques, designed to broadly encompass the financial industry.

We constructed a multi-modal architecture that intakes varied data including structural digital transaction logs, serial continuous authentication, and non-structural behavioural logs (e.g., security logs on communication, access violations).

Our predictive engine fuses a CNN-LSTM hybrid model with an auto-encoding scheme to analyse transverse spatial anomaly detection and the sequential, historical dimension for long-term trend dependencies. Finally, to provide an auditable audit trail, we apply and contrast the state-of-the-art post-hoc model-agnostic explainability systems, SHAP and LIME. Utilizing an enriched synthetic data suite, built upon realistic financial institutional workflows from the CMU CERTv4.2 dataset, our multimodal deep architecture achieved an outstanding 96.5% and an F_1- Score of 94.8%, significantly outperforming baseline systems based on a single modality. Furthermore, and more importantly, a direct comparative experimental analysis revealed a specific operational trade-off between SHAP and LIME where SHAP offered both superior global causal explanation, mathematical certainty, and a level of audit trail depth ideal for reporting for financial regulatory compliance. Compared with SHAP, LIME exhibited superior performance by being 24 times faster in processing time and proved better in sorting out potential security alert issues in institutional Security Operation Center (SOC) as its ideal for threat triage and verification of system alarms.

This paper delivers concrete building blocks and operative instructions for the implementation of high-performing, defensively actionable, and regulation compliant Insider threat identification for financial institutions.

Keywords: Insider Threat Detection, Explainable AI (XAI), Deep Learning, Multi-Modal Fusion, Financial Industry Cybersecurity, SHAP, LIME.