Pre-Conference Talk by YU Jiongchi | Chimera: Harnessing Multi-Agent LLMs for Automatic Insider Threat Simulation

Insider threats remain a critical yet difficult-to-detect security risk in enterprise environments, where malicious actions are often embedded in subtle, legitimate-looking behaviors. Although machine-learning-based insider threat detection (ITD) methods have shown promise, their effectiveness is fundamentally limited by the scarcity of high-quality, realistic training data. Enterprise data is rarely accessible due to sensitivity, while existing public datasets are small, and synthetic datasets often lack semantic richness, behavioral realism, and generalizability. 

We present Chimera, an LLM-based multi-agent framework that simulates realistic benign and malicious insider behaviors and generates enterprise-scale system logs. Chimera models employees with fine-grained roles and organizational dynamics. We deploy Chimera to instantiate with 15 real-world-inspired insider attacks across three representative data-sensitive scenarios to construct ChimeraLog. Human and quantitative evaluations demonstrate the dataset's realism and diversity; existing ITD methods perform substantially worse on ChimeraLog than on prior benchmarks, while models trained on it exhibit strong generalization despite distribution shifts, highlighting the value of LLM-based multi-agent simulation for ITD. 

This is a Pre-Conference talk for The Network and Distributed System Security Symposium (NDSS 2026).

Jiongchi YU is a Ph.D. candidate at Singapore Management University, advised by Prof. Xiaofei Xie. His research interests include cloud-native system security and AI for software engineering. His work has been published in leading venues such as NDSS, ICSE, FSE, ASE, ISSTA, WWW, and KDD. He is a recipient of the SMU Presidential Doctoral Fellowship and the SCIS Dean's List Award. More information is available at https://ttfish.cc/.