... in this domain due to extreme class imbalance, limited labelled data and the subtlety of insider threats. This study proposes a lightweight, hybrid anomaly detection framework that integrates unsupervised, supervised and rule-based approaches using a meta-classifier architecture. Design/methodology/approach...