{"id":"https://openalex.org/W4320717886","doi":"https://doi.org/10.1080/08874417.2023.2175337","title":"Insider Intrusion Detection Techniques: A State-of-the-Art Review","display_name":"Insider Intrusion Detection Techniques: A State-of-the-Art Review","publication_year":2023,"publication_date":"2023-02-14","ids":{"openalex":"https://openalex.org/W4320717886","doi":"https://doi.org/10.1080/08874417.2023.2175337"},"language":"en","primary_location":{"id":"doi:10.1080/08874417.2023.2175337","is_oa":false,"landing_page_url":"https://doi.org/10.1080/08874417.2023.2175337","pdf_url":null,"source":{"id":"https://openalex.org/S83133229","display_name":"Journal of Computer Information Systems","issn_l":"0887-4417","issn":["0887-4417","2380-2057"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320547","host_organization_name":"Taylor & Francis","host_organization_lineage":["https://openalex.org/P4310320547","https://openalex.org/P4310320449"],"host_organization_lineage_names":["Taylor & Francis","Informa"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Information Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016304186","display_name":"T N Nisha","orcid":null},"institutions":[{"id":"https://openalex.org/I244572783","display_name":"Symbiosis International University","ror":"https://ror.org/005r2ww51","country_code":"IN","type":"education","lineage":["https://openalex.org/I244572783"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Nisha T. N.","raw_affiliation_strings":["Symbiosis Centre for Information Technology (SCIT), A Constituent of the Symbiosis International (Deemed University) (SIU), Pune, India"],"raw_orcid":"https://orcid.org/0000-0002-3197-6271","affiliations":[{"raw_affiliation_string":"Symbiosis Centre for Information Technology (SCIT), A Constituent of the Symbiosis International (Deemed University) (SIU), Pune, India","institution_ids":["https://openalex.org/I244572783"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5068895642","display_name":"Dhanya Pramod","orcid":"https://orcid.org/0000-0003-3451-9794"},"institutions":[{"id":"https://openalex.org/I244572783","display_name":"Symbiosis International University","ror":"https://ror.org/005r2ww51","country_code":"IN","type":"education","lineage":["https://openalex.org/I244572783"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Dhanya Pramod","raw_affiliation_strings":["Symbiosis Centre for Information Technology (SCIT), A Constituent of the Symbiosis International (Deemed University) (SIU), Pune, India"],"raw_orcid":"https://orcid.org/0000-0003-3451-9794","affiliations":[{"raw_affiliation_string":"Symbiosis Centre for Information Technology (SCIT), A Constituent of the Symbiosis International (Deemed University) (SIU), Pune, India","institution_ids":["https://openalex.org/I244572783"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5016304186"],"corresponding_institution_ids":["https://openalex.org/I244572783"],"apc_list":null,"apc_paid":null,"fwci":1.5308,"has_fulltext":false,"cited_by_count":13,"citation_normalized_percentile":{"value":0.81728049,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"64","issue":"1","first_page":"106","last_page":"123"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.8493597507476807},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.8076322674751282},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.7714410424232483},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7258095741271973},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6850706934928894},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5929602980613708},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.5479514598846436},{"id":"https://openalex.org/keywords/signature","display_name":"Signature (topology)","score":0.5190601944923401},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5102548599243164},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.4944620132446289},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.4568820893764496},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4546343684196472},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.44820550084114075},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.4423544108867645},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.4304891526699066},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.417474627494812},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4004143476486206},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.07333466410636902},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.06883677840232849}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.8493597507476807},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.8076322674751282},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.7714410424232483},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7258095741271973},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6850706934928894},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5929602980613708},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.5479514598846436},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.5190601944923401},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5102548599243164},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.4944620132446289},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.4568820893764496},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4546343684196472},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.44820550084114075},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.4423544108867645},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.4304891526699066},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.417474627494812},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4004143476486206},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.07333466410636902},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.06883677840232849},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1080/08874417.2023.2175337","is_oa":false,"landing_page_url":"https://doi.org/10.1080/08874417.2023.2175337","pdf_url":null,"source":{"id":"https://openalex.org/S83133229","display_name":"Journal of Computer Information Systems","issn_l":"0887-4417","issn":["0887-4417","2380-2057"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320547","host_organization_name":"Taylor & Francis","host_organization_lineage":["https://openalex.org/P4310320547","https://openalex.org/P4310320449"],"host_organization_lineage_names":["Taylor & Francis","Informa"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Information Systems","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.5199999809265137}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":131,"referenced_works":["https://openalex.org/W135638923","https://openalex.org/W658869304","https://openalex.org/W1458873377","https://openalex.org/W1481547447","https://openalex.org/W1504455947","https://openalex.org/W1536598138","https://openalex.org/W1572811218","https://openalex.org/W1575590867","https://openalex.org/W1641039719","https://openalex.org/W1646742026","https://openalex.org/W1665985821","https://openalex.org/W1714729475","https://openalex.org/W1859925930","https://openalex.org/W1964723226","https://openalex.org/W1970345884","https://openalex.org/W1981617182","https://openalex.org/W1982563504","https://openalex.org/W1983776999","https://openalex.org/W1984950145","https://openalex.org/W1986566755","https://openalex.org/W1989359075","https://openalex.org/W1991210879","https://openalex.org/W1995976200","https://openalex.org/W1996641605","https://openalex.org/W2000256107","https://openalex.org/W2000689690","https://openalex.org/W2001702225","https://openalex.org/W2005155639","https://openalex.org/W2005221715","https://openalex.org/W2011415044","https://openalex.org/W2013946142","https://openalex.org/W2017735590","https://openalex.org/W2022877137","https://openalex.org/W2023987238","https://openalex.org/W2026449999","https://openalex.org/W2029014126","https://openalex.org/W2034794430","https://openalex.org/W2034882767","https://openalex.org/W2038254631","https://openalex.org/W2040346539","https://openalex.org/W2048481461","https://openalex.org/W2050885659","https://openalex.org/W2056765730","https://openalex.org/W2060821979","https://openalex.org/W2064709052","https://openalex.org/W2070403470","https://openalex.org/W2071702948","https://openalex.org/W2077121139","https://openalex.org/W2083811542","https://openalex.org/W2086469601","https://openalex.org/W2088826400","https://openalex.org/W2092284459","https://openalex.org/W2096144800","https://openalex.org/W2101440759","https://openalex.org/W2106376006","https://openalex.org/W2106649514","https://openalex.org/W2113997717","https://openalex.org/W2114554028","https://openalex.org/W2115408253","https://openalex.org/W2117714912","https://openalex.org/W2118887058","https://openalex.org/W2131976234","https://openalex.org/W2135143063","https://openalex.org/W2142889610","https://openalex.org/W2144531184","https://openalex.org/W2144584907","https://openalex.org/W2145722235","https://openalex.org/W2154543747","https://openalex.org/W2156433640","https://openalex.org/W2237959143","https://openalex.org/W2401501243","https://openalex.org/W2489475429","https://openalex.org/W2512144219","https://openalex.org/W2538737552","https://openalex.org/W2539364216","https://openalex.org/W2540535703","https://openalex.org/W2541036327","https://openalex.org/W2544098645","https://openalex.org/W2546373998","https://openalex.org/W2551166887","https://openalex.org/W2782255728","https://openalex.org/W2784746666","https://openalex.org/W2792450155","https://openalex.org/W2887742767","https://openalex.org/W2910074034","https://openalex.org/W2953434642","https://openalex.org/W2955029134","https://openalex.org/W2963748489","https://openalex.org/W2970411681","https://openalex.org/W2976972209","https://openalex.org/W2977635641","https://openalex.org/W2982354918","https://openalex.org/W2986944522","https://openalex.org/W2989230867","https://openalex.org/W2989690704","https://openalex.org/W3001147583","https://openalex.org/W3002257945","https://openalex.org/W3004183086","https://openalex.org/W3005632683","https://openalex.org/W3005790741","https://openalex.org/W3010957669","https://openalex.org/W3040266635","https://openalex.org/W3081765621","https://openalex.org/W3086164996","https://openalex.org/W3109728331","https://openalex.org/W3130625521","https://openalex.org/W3131771344","https://openalex.org/W3133583991","https://openalex.org/W3134549072","https://openalex.org/W3135550350","https://openalex.org/W3144543375","https://openalex.org/W3159435845","https://openalex.org/W3164680333","https://openalex.org/W3170808115","https://openalex.org/W3181765133","https://openalex.org/W3182848996","https://openalex.org/W3186975389","https://openalex.org/W3197739494","https://openalex.org/W3204296935","https://openalex.org/W3204721671","https://openalex.org/W3208103085","https://openalex.org/W3210597955","https://openalex.org/W4220771867","https://openalex.org/W4224242615","https://openalex.org/W4281293626","https://openalex.org/W4281741082","https://openalex.org/W4285158373","https://openalex.org/W4285612255","https://openalex.org/W4292002663","https://openalex.org/W4295954021","https://openalex.org/W4300942734"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"This":[0,72],"study":[1,73,86,113],"is":[2,19,62],"a":[3,52,102],"systematic":[4],"literature":[5],"review":[6],"on":[7],"anomaly-based":[8],"intrusion":[9,46,95],"detection":[10,96],"methods":[11],"specially":[12],"to":[13,20,64,80,105,124],"detect":[14,106,125],"insider":[15,94],"attacks.":[16],"The":[17,48,59,85,112],"focus":[18],"enumerate":[21],"the":[22,33,42,56,69,82,88,99,116,126],"techniques":[23],"for":[24],"modeling":[25],"host-based":[26],"and":[27,97,121],"network-based":[28],"anomaly":[29],"detection.":[30,47],"By":[31],"leveraging":[32],"sequential":[34],"characteristics":[35],"of":[36,44,55,90,101,118],"network":[37],"data,":[38],"we":[39],"further":[40],"discuss":[41],"concept":[43],"event-based":[45,91],"research":[49,77],"starts":[50],"with":[51],"bibliometric":[53],"analysis":[54],"broader":[57],"topic.":[58],"PRISMA":[60],"methodology":[61],"implemented":[63],"analyze":[65],"papers":[66],"selected":[67],"after":[68],"primary":[70],"search.":[71],"revolves":[74],"around":[75],"four":[76],"questions":[78],"formed":[79],"serve":[81],"purpose":[83],"defined.":[84],"unveils":[87],"opportunity":[89],"models":[92,123],"in":[93],"identifies":[98],"possibility":[100],"combined":[103],"model":[104],"insiders":[107],"as":[108,110],"early":[109],"possible.":[111],"recommends":[114],"incorporating":[115],"strengths":[117],"anomaly-based,":[119],"signature-based":[120],"knowledge-based":[122],"attacks":[127],"proactively.":[128]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":1}],"updated_date":"2026-08-15T07:11:24.734988","created_date":"2023-02-15T00:00:00"}