{"id":"https://openalex.org/W7160188340","doi":"https://doi.org/10.1016/j.future.2026.108543","title":"Towards trustworthy cybersecurity: Reclassifying insider threat detection using SHAP","display_name":"Towards trustworthy cybersecurity: Reclassifying insider threat detection using SHAP","publication_year":2026,"publication_date":"2026-04-30","ids":{"openalex":"https://openalex.org/W7160188340","doi":"https://doi.org/10.1016/j.future.2026.108543"},"language":"en","primary_location":{"id":"doi:10.1016/j.future.2026.108543","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.future.2026.108543","pdf_url":null,"source":{"id":"https://openalex.org/S186357190","display_name":"Future Generation Computer Systems","issn_l":"0167-739X","issn":["0167-739X","1872-7115"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Generation Computer Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.future.2026.108543","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5027898636","display_name":"Raddad Faqihi","orcid":"https://orcid.org/0000-0002-9976-8911"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]},{"id":"https://openalex.org/I120238654","display_name":"Saudi Electronic University","ror":"https://ror.org/05ndh7v49","country_code":"SA","type":"education","lineage":["https://openalex.org/I120238654"]}],"countries":["AU","SA"],"is_corresponding":true,"raw_author_name":"Raddad Faqihi","raw_affiliation_strings":["College of Computing and Informatics, Saudi Electronic University, Riyadh, Saudi Arabia","Faculty of Engineering and Information Technology, University of Technology Sydney, Sydney, Australia"],"raw_orcid":"https://orcid.org/0000-0002-9976-8911","affiliations":[{"raw_affiliation_string":"College of Computing and Informatics, Saudi Electronic University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I120238654"]},{"raw_affiliation_string":"Faculty of Engineering and Information Technology, University of Technology Sydney, Sydney, Australia","institution_ids":["https://openalex.org/I114017466"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045431254","display_name":"Priyadarsi Nanda","orcid":"https://orcid.org/0000-0002-5748-155X"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Priyadarsi Nanda","raw_affiliation_strings":["Faculty of Engineering and Information Technology, University of Technology Sydney, Sydney, Australia"],"raw_orcid":"https://orcid.org/0000-0002-5748-155X","affiliations":[{"raw_affiliation_string":"Faculty of Engineering and Information Technology, University of Technology Sydney, Sydney, Australia","institution_ids":["https://openalex.org/I114017466"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135168997","display_name":"Manoranjan Mohanty","orcid":"https://orcid.org/0000-0002-0258-4586"},"institutions":[{"id":"https://openalex.org/I4210089979","display_name":"Carnegie Mellon University Qatar","ror":"https://ror.org/00az5dt38","country_code":"QA","type":"education","lineage":["https://openalex.org/I4210089979","https://openalex.org/I74973139"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Manoranjan Mohanty","raw_affiliation_strings":["School of Information Systems, Carnegie Mellon University, Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0002-0258-4586","affiliations":[{"raw_affiliation_string":"School of Information Systems, Carnegie Mellon University, Doha, Qatar","institution_ids":["https://openalex.org/I4210089979"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121929643","display_name":"Saleh Alqahtani","orcid":null},"institutions":[{"id":"https://openalex.org/I120238654","display_name":"Saudi Electronic University","ror":"https://ror.org/05ndh7v49","country_code":"SA","type":"education","lineage":["https://openalex.org/I120238654"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Saleh Alqahtani","raw_affiliation_strings":["College of Computing and Informatics, Saudi Electronic University, Riyadh, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-9051-319X","affiliations":[{"raw_affiliation_string":"College of Computing and Informatics, Saudi Electronic University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I120238654"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5135118041","display_name":"Bashair Alrashed","orcid":"https://orcid.org/0000-0002-7393-5355"},"institutions":[{"id":"https://openalex.org/I4210099699","display_name":"University of Jeddah","ror":"https://ror.org/015ya8798","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210099699"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Bashair Alrashed","raw_affiliation_strings":["College of Computer Science and Engineering, University of Jeddah, Jeddah, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-7393-5355","affiliations":[{"raw_affiliation_string":"College of Computer Science and Engineering, University of Jeddah, Jeddah, Saudi Arabia","institution_ids":["https://openalex.org/I4210099699"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5027898636"],"corresponding_institution_ids":["https://openalex.org/I114017466","https://openalex.org/I120238654"],"apc_list":{"value":3340,"currency":"USD","value_usd":3340},"apc_paid":{"value":3340,"currency":"USD","value_usd":3340},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.5249351,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"183","issue":null,"first_page":"108543","last_page":"108543"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1720999926328659,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1720999926328659,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.1720000058412552,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.049300000071525574,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/trustworthiness","display_name":"Trustworthiness","score":0.7581999897956848},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.6233000159263611},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.5527999997138977},{"id":"https://openalex.org/keywords/deception","display_name":"Deception","score":0.5303999781608582},{"id":"https://openalex.org/keywords/credibility","display_name":"Credibility","score":0.29280000925064087}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8551999926567078},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.7581999897956848},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7465000152587891},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.6233000159263611},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.5527999997138977},{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.5303999781608582},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.492900013923645},{"id":"https://openalex.org/C2780224610","wikidata":"https://www.wikidata.org/wiki/Q1530061","display_name":"Credibility","level":2,"score":0.29280000925064087},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.27489998936653137},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.274399995803833},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.25690001249313354},{"id":"https://openalex.org/C2779390178","wikidata":"https://www.wikidata.org/wiki/Q29137","display_name":"Cybercrime","level":3,"score":0.250900000333786}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.future.2026.108543","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.future.2026.108543","pdf_url":null,"source":{"id":"https://openalex.org/S186357190","display_name":"Future Generation Computer Systems","issn_l":"0167-739X","issn":["0167-739X","1872-7115"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Generation Computer Systems","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.future.2026.108543","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.future.2026.108543","pdf_url":null,"source":{"id":"https://openalex.org/S186357190","display_name":"Future Generation Computer Systems","issn_l":"0167-739X","issn":["0167-739X","1872-7115"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Generation Computer Systems","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":33,"referenced_works":["https://openalex.org/W1988930537","https://openalex.org/W2036548140","https://openalex.org/W2076646346","https://openalex.org/W2092170487","https://openalex.org/W2107138773","https://openalex.org/W2137070227","https://openalex.org/W2999615587","https://openalex.org/W3045880080","https://openalex.org/W3183729494","https://openalex.org/W3207298831","https://openalex.org/W3216671775","https://openalex.org/W4210659135","https://openalex.org/W4213315944","https://openalex.org/W4389386867","https://openalex.org/W4390807477","https://openalex.org/W4391741433","https://openalex.org/W4392151675","https://openalex.org/W4392405644","https://openalex.org/W4393992045","https://openalex.org/W4396668454","https://openalex.org/W4398165763","https://openalex.org/W4400275440","https://openalex.org/W4402526776","https://openalex.org/W4403608280","https://openalex.org/W4403649623","https://openalex.org/W4406610597","https://openalex.org/W4406882703","https://openalex.org/W4410086717","https://openalex.org/W4410936137","https://openalex.org/W4411878412","https://openalex.org/W4414802890","https://openalex.org/W7117866801","https://openalex.org/W7135225187"],"related_works":[],"abstract_inverted_index":{"Explainable":[0],"artificial":[1,176],"intelligence":[2,177],"methods":[3],"remain":[4],"critical":[5],"for":[6,17,91,158],"trustworthy":[7,175],"insider":[8],"threat":[9,58],"detection,":[10],"yet":[11],"existing":[12],"approaches":[13],"lack":[14],"systematic":[15],"frameworks":[16,184],"validating":[18],"explanation":[19,85,183],"quality":[20,86],"against":[21],"domain":[22,42],"expertise.":[23],"This":[24,172],"research":[25],"presents":[26],"a":[27,57],"SHAP":[28,162],"(SHapley":[29],"Additive":[30],"exPlanations)":[31],"based":[32],"reclassification":[33,81],"framework":[34,55],"that":[35,61],"integrates":[36],"exact":[37],"Shapley":[38],"value":[39],"computation":[40],"with":[41,72,96],"knowledge":[43],"mapping":[44,60],"to":[45,114],"enhance":[46],"detection":[47,191],"accuracy":[48,106],"whilst":[49,161],"enabling":[50,185],"transparent":[51],"analyst":[52,74],"oversight.":[53],"The":[54],"introduces":[56],"directions":[59],"systematically":[62],"translates":[63],"feature":[64],"attributions":[65],"into":[66],"cybersecurity":[67,179],"interpretations,":[68],"achieving":[69],"high":[70],"alignment":[71],"security":[73],"assessments":[75],"across":[76],"27":[77],"behavioural":[78],"indicators.":[79],"Human-in-the-loop":[80],"guided":[82],"by":[83],"automated":[84],"assessment":[87],"demonstrates":[88,144],"practical":[89],"feasibility":[90],"operational":[92],"deployment.":[93],"Experimental":[94],"evaluations":[95],"the":[97,145],"help":[98],"of":[99,147],"316,250":[100],"CMU":[101],"CERT":[102],"instances":[103],"yield":[104],"substantial":[105],"improvements":[107,125],"and":[108,169],"significant":[109,124],"false":[110],"positive":[111],"reduction":[112],"compared":[113],"baseline":[115],"classification.":[116],"Statistical":[117],"validation":[118],"through":[119,180],"paired":[120],"t-tests":[121],"confirms":[122],"highly":[123],"(":[126],"p":[127],"=":[128,135],"0":[129,136],".":[130,137],"0023":[131],",":[132],"Cohen\u2019s":[133],"d":[134],"368":[138],").":[139],"A":[140],"thorough":[141],"comparative":[142],"analysis":[143,168],"strengths":[146],"our":[148],"scheme:":[149],"LIME":[150],"(Local":[151],"Interpretable":[152],"Model-agnostic":[153],"Explanations)":[154],"provides":[155],"computational":[156],"efficiency":[157],"real-time":[159],"response,":[160],"delivers":[163],"mathematical":[164],"rigour":[165],"supporting":[166],"forensic":[167],"regulatory":[170],"compliance.":[171],"work":[173],"advances":[174],"in":[178],"mathematically":[181],"rigorous":[182],"confident":[186],"human":[187],"oversight":[188],"without":[189],"sacrificing":[190],"performance.":[192]},"counts_by_year":[],"updated_date":"2026-06-19T15:47:20.252518","created_date":"2026-05-05T00:00:00"}