One of the mainstream strategies identified for detecting Malicious Insider Threat (MIT) is building stacking ensemble Machine Learning (ML) models to reveal malevolent insider activities through anomalies in user activities. However, most anomalies found by these learning models were not malicious because MIT was treated as a single entity, whereas there are various forms of this threat with their own distinct signature. To address this deficiency, this study focused on designing a stacked ensemble framework for detecting malicious insider threat which utilizes a one scenario per algorithm strategy. A model that can be used to test the framework was proposed.
