{"id":"https://openalex.org/W2137102757","doi":"https://doi.org/10.1142/s0218213013600130","title":"EVOLVING INSIDER THREAT DETECTION STREAM MINING PERSPECTIVE","display_name":"EVOLVING INSIDER THREAT DETECTION STREAM MINING PERSPECTIVE","publication_year":2013,"publication_date":"2013-10-01","ids":{"openalex":"https://openalex.org/W2137102757","doi":"https://doi.org/10.1142/s0218213013600130","mag":"2137102757"},"language":"en","primary_location":{"id":"doi:10.1142/s0218213013600130","doi":"https://doi.org/10.1142/s0218213013600130","is_oa":false,"landing_page_url":"https://doi.org/10.1142/s0218213013600130","pdf_url":null,"source":{"id":"https://openalex.org/S178780388","display_name":"International Journal of Artificial Intelligence Tools","issn_l":"0218-2130","issn":["0218-2130","1793-6349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","dongbi-d","jufo-1","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal on Artificial Intelligence Tools","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037324793","display_name":"Pallabi Parveen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I162577319","display_name":"The University of Texas at Dallas","ror":"https://ror.org/049emcs32","country_code":"US","type":"education","lineage":["https://openalex.org/I162577319"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"PALLABI PARVEEN","raw_affiliation_strings":["Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States","institution_ids":["https://openalex.org/I162577319"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010420173","display_name":"Nathan McDaniel","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I162577319","display_name":"The University of Texas at Dallas","ror":"https://ror.org/049emcs32","country_code":"US","type":"education","lineage":["https://openalex.org/I162577319"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"NATHAN MCDANIEL","raw_affiliation_strings":["Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States","institution_ids":["https://openalex.org/I162577319"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089946779","display_name":"Zackary R. Weger","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I162577319","display_name":"The University of Texas at Dallas","ror":"https://ror.org/049emcs32","country_code":"US","type":"education","lineage":["https://openalex.org/I162577319"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"ZACKARY WEGER","raw_affiliation_strings":["Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States","institution_ids":["https://openalex.org/I162577319"]}]},{"author_position":"middle","author":{"id":null,"display_name":"JONATHAN EVANS","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I162577319","display_name":"The University of Texas at Dallas","ror":"https://ror.org/049emcs32","country_code":"US","type":"education","lineage":["https://openalex.org/I162577319"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"JONATHAN EVANS","raw_affiliation_strings":["Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States","institution_ids":["https://openalex.org/I162577319"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072193842","display_name":"Bhavani M. Thuraisingham","orcid":"https://orcid.org/0000-0003-4653-2080","observed_orcids":["https://orcid.org/0000-0003-4653-2080"]},"institutions":[{"id":"https://openalex.org/I162577319","display_name":"The University of Texas at Dallas","ror":"https://ror.org/049emcs32","country_code":"US","type":"education","lineage":["https://openalex.org/I162577319"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"BHAVANI THURAISINGHAM","raw_affiliation_strings":["Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States","institution_ids":["https://openalex.org/I162577319"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051312448","display_name":"Kevin W. Hamlen","orcid":"https://orcid.org/0000-0003-0479-6280","observed_orcids":["https://orcid.org/0000-0003-0479-6280"]},"institutions":[{"id":"https://openalex.org/I162577319","display_name":"The University of Texas at Dallas","ror":"https://ror.org/049emcs32","country_code":"US","type":"education","lineage":["https://openalex.org/I162577319"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"KEVIN HAMLEN","raw_affiliation_strings":["Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States","institution_ids":["https://openalex.org/I162577319"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005002693","display_name":"Latifur R. Khan","orcid":"https://orcid.org/0000-0002-9300-1576","observed_orcids":["https://orcid.org/0000-0002-9300-1576"]},"institutions":[{"id":"https://openalex.org/I162577319","display_name":"The University of Texas at Dallas","ror":"https://ror.org/049emcs32","country_code":"US","type":"education","lineage":["https://openalex.org/I162577319"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"LATIFUR KHAN","raw_affiliation_strings":["Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Texas at Dallas, 800 W. Campbell Rd. Richardson, TX 75080-3021, United States","institution_ids":["https://openalex.org/I162577319"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I162577319"],"apc_list":null,"apc_paid":null,"fwci":1.6557,"has_fulltext":false,"cited_by_count":28,"citation_normalized_percentile":{"value":0.85738802,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"22","issue":"05","first_page":"1360013","last_page":"1360013"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.4867999851703644,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.4867999851703644,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4041000008583069,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.012400000356137753,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat-detection","display_name":"insider threat detection","score":1.0},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"data stream mining","score":0.8679999709129333},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"ensemble learning","score":0.824999988079071},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.9909999966621399},{"id":"https://openalex.org/keywords/system-logs","display_name":"system logs","score":0.7649999856948853},{"id":"https://openalex.org/keywords/graph-anomaly-detection","display_name":"graph anomaly detection","score":0.949999988079071},{"id":"https://openalex.org/keywords/model-weighting","display_name":"model weighting","score":0.6299999952316284},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"unsupervised learning","score":0.4959999918937683},{"id":"https://openalex.org/keywords/supervised-learning","display_name":"supervised learning","score":0.597000002861023}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8889691233634949},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.7710390090942383},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.695164680480957},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.636834979057312},{"id":"https://openalex.org/C183115368","wikidata":"https://www.wikidata.org/wiki/Q856577","display_name":"Weighting","level":2,"score":0.6076745390892029},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5579869151115417},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5430958867073059},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5295456647872925},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.48709678649902344},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.47776496410369873},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.4651528298854828},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.44464507699012756},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.41146165132522583},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.10571369528770447},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C126838900","wikidata":"https://www.wikidata.org/wiki/Q77604","display_name":"Radiology","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1142/s0218213013600130","doi":"https://doi.org/10.1142/s0218213013600130","is_oa":false,"landing_page_url":"https://doi.org/10.1142/s0218213013600130","pdf_url":null,"source":{"id":"https://openalex.org/S178780388","display_name":"International Journal of Artificial Intelligence Tools","issn_l":"0218-2130","issn":["0218-2130","1793-6349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","dongbi-d","jufo-1","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal on Artificial Intelligence Tools","raw_type":"journal-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.431.6968","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.431.6968","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.utdallas.edu/~kxh060100/parveen13ijait.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320338279","display_name":"Air Force Office of Scientific Research","ror":"https://ror.org/011e9bt93"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":45,"referenced_works":["https://openalex.org/W26537291","https://openalex.org/W33933511","https://openalex.org/W61807067","https://openalex.org/W133500409","https://openalex.org/W1515026043","https://openalex.org/W1539745582","https://openalex.org/W1546570283","https://openalex.org/W1566480186","https://openalex.org/W1569393825","https://openalex.org/W1586807939","https://openalex.org/W1760565668","https://openalex.org/W1792904922","https://openalex.org/W1832277845","https://openalex.org/W1898491644","https://openalex.org/W1941427975","https://openalex.org/W1964723226","https://openalex.org/W1968980002","https://openalex.org/W1973704753","https://openalex.org/W1986466096","https://openalex.org/W1998711561","https://openalex.org/W2022309369","https://openalex.org/W2040985831","https://openalex.org/W2053003065","https://openalex.org/W2068714596","https://openalex.org/W2071744657","https://openalex.org/W2096632950","https://openalex.org/W2099579641","https://openalex.org/W2107056945","https://openalex.org/W2122819555","https://openalex.org/W2123941465","https://openalex.org/W2128217000","https://openalex.org/W2130416896","https://openalex.org/W2131904035","https://openalex.org/W2138209477","https://openalex.org/W2147263871","https://openalex.org/W2153635508","https://openalex.org/W2156542272","https://openalex.org/W2166657964","https://openalex.org/W2168386304","https://openalex.org/W2170726034","https://openalex.org/W2497849059","https://openalex.org/W2542582667","https://openalex.org/W2603273327","https://openalex.org/W3004355593","https://openalex.org/W4229853139"],"related_works":["https://openalex.org/W7100486679","https://openalex.org/W2542582667","https://openalex.org/W1998711561","https://openalex.org/W2907265470","https://openalex.org/W1981158329","https://openalex.org/W4214561768","https://openalex.org/W4383751149","https://openalex.org/W2908137371","https://openalex.org/W2898158700","https://openalex.org/W2907178643"],"abstract_inverted_index":{"Evidence":[0],"of":[1,84,111,125],"malicious":[2],"insider":[3,53,85,157],"activity":[4],"is":[5,41,94],"often":[6],"buried":[7],"within":[8],"large":[9],"data":[10],"streams,":[11,36],"such":[12,35],"as":[13],"system":[14],"logs":[15],"accumulated":[16],"over":[17,65],"months":[18],"or":[19],"years.":[20],"Ensemble-based":[21],"stream":[22,40,71],"mining":[23],"leverages":[24],"multiple":[25],"classification":[26],"models":[27],"to":[28,57,81,115,131,149,152],"achieve":[29],"highly":[30],"accurate":[31],"anomaly":[32,79],"detection":[33,80],"in":[34,128],"even":[37],"when":[38],"the":[39,48,82,91,109],"unbounded,":[42],"evolving,":[43],"and":[44,74,77,107,146],"unlabeled.":[45],"This":[46,67],"makes":[47],"approach":[49,93],"effective":[50,97],"for":[51,142],"identifying":[52],"threats":[54],"who":[55],"attempt":[56],"conceal":[58],"their":[59,63],"activities":[60],"by":[61],"varying":[62],"behaviors":[64],"time.":[66],"paper":[68],"applies":[69],"ensemble-based":[70,92],"mining,":[72],"supervised":[73,102],"unsupervised":[75,105],"learning,":[76,106],"graph-based":[78],"problem":[83],"threat":[86],"detection.":[87],"It":[88],"demonstrates":[89],"that":[90],"significantly":[95],"more":[96,138,153],"than":[98],"traditional":[99],"single-model":[100],"methods,":[101],"learning":[103],"outperforms":[104],"increasing":[108],"cost":[110],"false":[112,134],"negatives":[113],"correlates":[114],"higher":[116],"accuracy.":[117],"Future":[118],"work":[119],"will":[120],"consider":[121],"a":[122,137],"wider":[123],"range":[124],"tunable":[126],"parameters":[127],"an":[129],"effort":[130],"further":[132],"reduce":[133],"positives,":[135],"include":[136],"sophisticated":[139],"polling":[140],"algorithm":[141],"weighting":[143],"better":[144],"models,":[145],"implement":[147],"parallelization":[148],"lower":[150],"runtimes":[151],"rapidly":[154],"detect":[155],"emerging":[156],"threats.":[158]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":3},{"year":2013,"cited_by_count":2}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2016-06-24T00:00:00"}