{"id":"https://openalex.org/W3033732703","doi":"https://doi.org/10.1108/ics-12-2019-0141","title":"Discovering \u201cInsider IT Sabotage\u201d based on human behaviour","display_name":"Discovering \u201cInsider IT Sabotage\u201d based on human behaviour","publication_year":2020,"publication_date":"2020-06-04","ids":{"openalex":"https://openalex.org/W3033732703","doi":"https://doi.org/10.1108/ics-12-2019-0141","mag":"3033732703"},"language":"en","primary_location":{"id":"doi:10.1108/ics-12-2019-0141","is_oa":false,"landing_page_url":"https://doi.org/10.1108/ics-12-2019-0141","pdf_url":null,"source":{"id":"https://openalex.org/S4210195545","display_name":"Information and Computer Security","issn_l":"2056-4961","issn":["2056-4961","2056-497X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information & Computer Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5012504690","display_name":"Antonia Michael","orcid":null},"institutions":[{"id":"https://openalex.org/I69552723","display_name":"University of Pretoria","ror":"https://ror.org/00g0p6g84","country_code":"ZA","type":"education","lineage":["https://openalex.org/I69552723"]}],"countries":["ZA"],"is_corresponding":true,"raw_author_name":"Antonia Michael","raw_affiliation_strings":["Department of Computer Science, University of Pretoria, Pretoria, South Africa"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Pretoria, Pretoria, South Africa","institution_ids":["https://openalex.org/I69552723"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5088421729","display_name":"Jan H. P. Eloff","orcid":"https://orcid.org/0000-0003-4683-2198"},"institutions":[{"id":"https://openalex.org/I69552723","display_name":"University of Pretoria","ror":"https://ror.org/00g0p6g84","country_code":"ZA","type":"education","lineage":["https://openalex.org/I69552723"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Jan Eloff","raw_affiliation_strings":["Department of Computer Science, University of Pretoria, Pretoria, South Africa"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Pretoria, Pretoria, South Africa","institution_ids":["https://openalex.org/I69552723"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5012504690"],"corresponding_institution_ids":["https://openalex.org/I69552723"],"apc_list":null,"apc_paid":null,"fwci":0.5338,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":{"value":0.73820407,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":96},"biblio":{"volume":"28","issue":"4","first_page":"575","last_page":"589"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.9549779891967773},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.8556606769561768},{"id":"https://openalex.org/keywords/harm","display_name":"Harm","score":0.7268434762954712},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6573386788368225},{"id":"https://openalex.org/keywords/originality","display_name":"Originality","score":0.5555230379104614},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.5109759569168091},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4750552177429199},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.474033385515213},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4524936378002167},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4495113492012024},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.38505983352661133},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.38366568088531494},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.12778839468955994},{"id":"https://openalex.org/keywords/social-psychology","display_name":"Social psychology","score":0.08169901371002197}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.9549779891967773},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.8556606769561768},{"id":"https://openalex.org/C2777363581","wikidata":"https://www.wikidata.org/wiki/Q15098235","display_name":"Harm","level":2,"score":0.7268434762954712},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6573386788368225},{"id":"https://openalex.org/C2776950860","wikidata":"https://www.wikidata.org/wiki/Q2914681","display_name":"Originality","level":3,"score":0.5555230379104614},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5109759569168091},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4750552177429199},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.474033385515213},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4524936378002167},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4495113492012024},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.38505983352661133},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.38366568088531494},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.12778839468955994},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.08169901371002197},{"id":"https://openalex.org/C11012388","wikidata":"https://www.wikidata.org/wiki/Q170658","display_name":"Creativity","level":2,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1108/ics-12-2019-0141","is_oa":false,"landing_page_url":"https://doi.org/10.1108/ics-12-2019-0141","pdf_url":null,"source":{"id":"https://openalex.org/S4210195545","display_name":"Information and Computer Security","issn_l":"2056-4961","issn":["2056-4961","2056-497X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information & Computer Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7699999809265137}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W1965961515","https://openalex.org/W1991534804","https://openalex.org/W1992826718","https://openalex.org/W1993967377","https://openalex.org/W2051131064","https://openalex.org/W2069101931","https://openalex.org/W2126189917","https://openalex.org/W2140124448","https://openalex.org/W2147296295","https://openalex.org/W2148404854","https://openalex.org/W2206700814","https://openalex.org/W2551827541","https://openalex.org/W2562810336","https://openalex.org/W2574069427","https://openalex.org/W2613526883","https://openalex.org/W2886188386","https://openalex.org/W2912721768","https://openalex.org/W2914692020","https://openalex.org/W2989743612"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"Purpose":[0],"Malicious":[1,83],"activities":[2],"conducted":[3],"by":[4,158],"disgruntled":[5,153],"employees":[6,36,154],"via":[7],"an":[8,16,29],"email":[9,106,110,188,206,246],"platform":[10],"can":[11,155,215,237],"cause":[12],"profound":[13],"damage":[14],"to":[15,41,48,62,100,116,127,228,248],"organization":[17],"such":[18,210],"as":[19,28],"financial":[20],"and":[21,66,98,176,181,185],"reputational":[22],"losses.":[23],"This":[24,34,191,222],"threat":[25,133],"is":[26,59,113,140,144],"known":[27],"\u201cInsider":[30],"IT":[31,74,91,243],"Sabotage\u201d":[32],"threat.":[33],"involves":[35],"misusing":[37],"their":[38],"access":[39],"rights":[40],"harm":[42],"the":[43,49,63,70,89,167,174,179,205,231,239,250],"organization.":[44],"Events":[45],"leading":[46],"up":[47],"attack":[50],"are":[51,96,125,208],"not":[52],"technical":[53],"but":[54],"rather":[55],"behavioural.":[56],"The":[57,135,164],"problem":[58],"that":[60,86,102,149,211,230,236],"owing":[61],"high":[64],"volume":[65],"complexity":[67],"of":[68,72,119,130,137,152,160,166,178,187,193,204,233,241],"emails,":[69],"risk":[71,251],"insider":[73,90,132,242],"sabotage":[75,92,244],"cannot":[76],"be":[77,156,199,216],"diminished":[78],"with":[79],"rule-based":[80],"approaches.":[81],"Design/methodology/approach":[82],"human":[84],"behaviours":[85],"insiders":[87],"within":[88,245,252],"category":[93],"would":[94,103],"possess":[95],"studied":[97],"mapped":[99],"phrases":[101,180],"appear":[104],"in":[105,146,196],"communications.":[107],"A":[108],"large":[109],"data":[111,207],"set":[112],"classified":[114],"according":[115],"behavioural":[117],"characteristics":[118],"these":[120,138],"employees.":[121],"Machine":[122],"learning":[123,169],"algorithms":[124],"used":[126],"identify":[128],"occurrences":[129],"this":[131,147],"type.":[134],"accuracy":[136],"approaches":[139],"measured.":[141],"Findings":[142],"It":[143],"shown":[145],"paper":[148],"suspicious":[150],"behaviour":[151,182],"discovered,":[157],"means":[159],"machine":[161,168],"intelligence":[162],"techniques.":[163],"output":[165],"classifier":[170],"depends":[171],"mainly":[172],"on":[173],"depth":[175],"quality":[177],"analysis,":[183],"cleansing":[184],"number":[186],"attributes":[189,203],"examined.":[190],"process":[192],"labelling":[194],"content":[195],"isolation":[197],"could":[198],"improved":[200],"if":[201],"other":[202],"included,":[209],"a":[212,225,234],"confidence":[213],"score":[214],"computed":[217],"for":[218],"each":[219],"user.":[220],"Originality/value":[221],"research":[223],"presents":[224],"novel":[226],"approach":[227],"show":[229],"creation":[232],"prototype":[235],"automate":[238],"detection":[240],"systems":[247],"mitigate":[249],"organizations.":[253]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2021,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}