{"id":"https://openalex.org/W7212948811","doi":"https://doi.org/10.2174/0129503752478819260828114104","title":"Enhancing a Multi-Lens Behavioral Anomaly-Detection Framework for Insider Threat Mitigation","display_name":"Enhancing a Multi-Lens Behavioral Anomaly-Detection Framework for Insider Threat Mitigation","publication_year":2026,"publication_date":"2026-09-09","ids":{"openalex":"https://openalex.org/W7212948811","doi":"https://doi.org/10.2174/0129503752478819260828114104"},"language":"en","primary_location":{"id":"doi:10.2174/0129503752478819260828114104","doi":"https://doi.org/10.2174/0129503752478819260828114104","is_oa":false,"landing_page_url":"https://doi.org/10.2174/0129503752478819260828114104","pdf_url":null,"source":{"id":"https://openalex.org/S4389157623","display_name":"Current Artificial Intelligence","issn_l":"2950-3752","issn":["2950-3752"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310320079","host_organization_name":"Bentham Science Publishers","host_organization_lineage":["https://openalex.org/P4310320079"],"host_organization_lineage_names":["Bentham Science Publishers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Current Artificial Intelligence","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5151670739","display_name":"Ishak Hafdallah","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I2800638415","display_name":"University of Applied Sciences Potsdam","ror":"https://ror.org/012m9bp23","country_code":"DE","type":"education","lineage":["https://openalex.org/I2800638415"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Ishak Hafdallah","raw_affiliation_strings":["Master\u2019s in AI, Data Science, GISMA University of Applied Sciences, Potsdam, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Master\u2019s in AI, Data Science, GISMA University of Applied Sciences, Potsdam, Germany","institution_ids":["https://openalex.org/I2800638415"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042044358","display_name":"Mousa Farajallah","orcid":"https://orcid.org/0000-0002-2220-4253","observed_orcids":["https://orcid.org/0000-0002-2220-4253"]},"institutions":[{"id":"https://openalex.org/I37417134","display_name":"Palestine Polytechnic University","ror":"https://ror.org/03wwspn40","country_code":"PS","type":"education","lineage":["https://openalex.org/I37417134"]}],"countries":["PS"],"is_corresponding":false,"raw_author_name":"Mousa Farajallah","raw_affiliation_strings":["Assistant Professor of Computer Systems Engineering at Palestine Polytechnic University, Hebron, Palestine"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Assistant Professor of Computer Systems Engineering at Palestine Polytechnic University, Hebron, Palestine","institution_ids":["https://openalex.org/I37417134"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5065141303","display_name":"Sami Salamin","orcid":"https://orcid.org/0000-0002-1044-7231","observed_orcids":["https://orcid.org/0000-0002-1044-7231"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Sami Alsalamin","raw_affiliation_strings":["Professor of Computer Science and Engineering at Gisma University of Applied Sciences in Potsdam, Germany"],"raw_orcid":"https://orcid.org/0000-0002-1044-7231","affiliations":[{"raw_affiliation_string":"Professor of Computer Science and Engineering at Gisma University of Applied Sciences in Potsdam, Germany","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5065141303"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"04","issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8022000193595886,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8022000193595886,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.06560000032186508,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.05460000038146973,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat-detection","display_name":"insider threat detection","score":0.9430000185966492},{"id":"https://openalex.org/keywords/abnormal-behavior-detection","display_name":"abnormal behavior detection","score":0.9940000176429749},{"id":"https://openalex.org/keywords/user-activity-tracking","display_name":"user activity monitoring","score":0.6240000128746033},{"id":"https://openalex.org/keywords/social-interaction-patterns","display_name":"social interaction patterns","score":0.6110000014305115},{"id":"https://openalex.org/keywords/multi-view-fusion","display_name":"multi-view fusion","score":0.5189999938011169},{"id":"https://openalex.org/keywords/cert-insider-threat-dataset","display_name":"CERT insider threat dataset","score":0.9309999942779541}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.8385000228881836},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6161999702453613},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5835999846458435},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5472000241279602},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5374000072479248},{"id":"https://openalex.org/C29825287","wikidata":"https://www.wikidata.org/wiki/Q1427940","display_name":"Warning system","level":2,"score":0.520799994468689},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4767000079154968},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.3885999917984009},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.3546000123023987},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3418000042438507},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.3402999937534332},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.32679998874664307},{"id":"https://openalex.org/C2781426361","wikidata":"https://www.wikidata.org/wiki/Q5326940","display_name":"Earnings","level":2,"score":0.32179999351501465},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.3199000060558319},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.30889999866485596},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.28850001096725464},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.27630001306533813},{"id":"https://openalex.org/C149782125","wikidata":"https://www.wikidata.org/wiki/Q160039","display_name":"Econometrics","level":1,"score":0.2759000062942505},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.27489998936653137},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C112758219","wikidata":"https://www.wikidata.org/wiki/Q16038819","display_name":"Duration (music)","level":2,"score":0.25920000672340393},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2524999976158142}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.2174/0129503752478819260828114104","doi":"https://doi.org/10.2174/0129503752478819260828114104","is_oa":false,"landing_page_url":"https://doi.org/10.2174/0129503752478819260828114104","pdf_url":null,"source":{"id":"https://openalex.org/S4389157623","display_name":"Current Artificial Intelligence","issn_l":"2950-3752","issn":["2950-3752"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310320079","host_organization_name":"Bentham Science Publishers","host_organization_lineage":["https://openalex.org/P4310320079"],"host_organization_lineage_names":["Bentham Science Publishers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Current Artificial Intelligence","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4416409674","https://openalex.org/W2976051608","https://openalex.org/W7204254421","https://openalex.org/W7212432732","https://openalex.org/W4410013257","https://openalex.org/W2964493783","https://openalex.org/W7135233075","https://openalex.org/W7221357861","https://openalex.org/W3202733154","https://openalex.org/W2892204215"],"abstract_inverted_index":{"Objective:":[0],"The":[1,51,88,107,120,289],"growing":[2],"challenges":[3,19],"posed":[4],"by":[5,11,20,162,236],"insider":[6,172,277],"attacks":[7],"cannot":[8],"be":[9],"addressed":[10],"traditional":[12],"defense":[13],"mechanisms.":[14],"This":[15,265],"study":[16,266],"addresses":[17],"these":[18],"proposing":[21],"a":[22,104,133,224,269,293],"behavioral":[23,249],"anomaly":[24],"detection":[25,182],"framework":[26,52,121,179,273],"that":[27,176,190,246,268],"examines":[28],"user":[29],"activities":[30],"from":[31,46,79,84],"four":[32],"complementary":[33],"perspectives:":[34],"aggregate":[35],"daily":[36,100],"actions,":[37],"temporal":[38],"event":[39,74],"sequences,":[40],"group":[41],"sociability":[42],"patterns,":[43],"and":[44,62,76,95,98,138,231,254,286],"deviations":[45,78],"data-driven":[47,80],"role/peer":[48,81],"baselines.":[49,242],"Methods:":[50],"employs":[53],"machine":[54],"learning":[55,272],"models,":[56],"including":[57],"Gated":[58],"Recurrent":[59],"Unit":[60],"(GRU)":[61],"Long":[63],"Short-Term":[64],"Memory":[65],"(LSTM)":[66],"predictors,":[67],"as":[68,70],"well":[69],"autoencoders,":[71],"to":[72,154,240],"forecast":[73],"sequences":[75],"evaluate":[77],"prototypes":[82],"learned":[83],"historical":[85],"normal":[86],"behavior.":[87],"prediction":[89],"mechanism":[90],"captures":[91],"static":[92],"action":[93],"counts":[94],"social":[96],"interactions":[97],"incorporates":[99],"deviation":[101],"signals":[102],"through":[103],"multilayer":[105],"perceptron.":[106],"resulting":[108],"decision":[109,117],"logic":[110],"is":[111],"approximated":[112],"using":[113],"an":[114,123,140,211],"interpretable":[115],"surrogate":[116],"tree.":[118],"results:":[119],"achieves":[122,180],"overall":[124,212],"accuracy":[125,183,213],"of":[126,130,136,145,214,220,228],"96.7%,":[127,216],"detects":[128,217],"90%":[129,219],"anomalies":[131,222],"with":[132,184,279],"false-positive":[134,186],"rate":[135,227],"2.7%,":[137,230],"provides":[139,292],"early":[141,193],"warning":[142,194],"lead":[143,195],"time":[144,196],"over":[146],"3":[147,198],"days":[148,199],"before":[149,200],"harmful":[150,201],"activity":[151,202],"manifests.":[152],"Compared":[153],"prior":[155],"multi-model":[156],"baselines,":[157],"the":[158,170,177,191,207,233],"F1":[159,234],"score":[160,235],"improves":[161,232],"5\u201310":[163],"percentage":[164],"points.":[165],"Results:":[166],"Empirical":[167],"evaluations":[168],"on":[169],"CERT":[171],"threat":[173],"dataset":[174],"show":[175],"proposed":[178,290],"high":[181,280],"low":[185,282],"rates.":[187],"Results":[188],"indicate":[189,245],"average":[192],"exceeds":[197],"occurs.":[203],"Discussion:":[204],"In":[205],"particular,":[206],"fusion":[208],"model":[209],"reaches":[210],"about":[215],"roughly":[218],"true":[221],"at":[223],"false":[225,283],"positive":[226,284],"around":[229],"approximately":[237],"5-10%":[238],"compared":[239],"state-of-the-art":[241],"Such":[243],"results":[244],"combining":[247],"multiple":[248],"lenses":[250],"yields":[251],"more":[252],"robust":[253],"practically":[255],"useful":[256],"alerts":[257],"than":[258],"single-view":[259],"or":[260],"solely":[261],"sequence-based":[262],"methods.":[263],"Conclusion:":[264],"indicates":[267],"multi-lens":[270],"deep":[271],"can":[274],"effectively":[275],"detect":[276],"threats":[278],"accuracy,":[281],"rates,":[285],"improved":[287],"interpretability.":[288],"methodology":[291],"practical":[294],"solution":[295],"for":[296],"deployment":[297],"in":[298],"organizational":[299],"security":[300],"operations.":[301]},"counts_by_year":[],"updated_date":"2026-09-23T05:00:35.095934","created_date":"2026-09-15T00:00:00"}