{"id":"https://openalex.org/W7118194403","doi":"https://doi.org/10.1109/aiccsa66935.2025.11315452","title":"A Scalable Framework for Insider Threat Detection: Session Modelling and Class Balancing with XGBoost","display_name":"A Scalable Framework for Insider Threat Detection: Session Modelling and Class Balancing with XGBoost","publication_year":2025,"publication_date":"2025-10-19","ids":{"openalex":"https://openalex.org/W7118194403","doi":"https://doi.org/10.1109/aiccsa66935.2025.11315452"},"language":null,"primary_location":{"id":"doi:10.1109/aiccsa66935.2025.11315452","is_oa":false,"landing_page_url":"https://doi.org/10.1109/aiccsa66935.2025.11315452","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE/ACS 22nd International Conference on Computer Systems and Applications (AICCSA)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5027898636","display_name":"Raddad Faqihi","orcid":"https://orcid.org/0000-0002-9976-8911"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Raddad Faqihi","raw_affiliation_strings":["University of Technology Sydney,Faculty of Engineering and Information Technology,Sydney,Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Technology Sydney,Faculty of Engineering and Information Technology,Sydney,Australia","institution_ids":["https://openalex.org/I114017466"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045431254","display_name":"Priyadarsi Nanda","orcid":"https://orcid.org/0000-0002-5748-155X"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Priyadarsi Nanda","raw_affiliation_strings":["University of Technology Sydney,Faculty of Engineering and Information Technology,Sydney,Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Technology Sydney,Faculty of Engineering and Information Technology,Sydney,Australia","institution_ids":["https://openalex.org/I114017466"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121945229","display_name":"Manoranjan Mohanty","orcid":null},"institutions":[{"id":"https://openalex.org/I4210089979","display_name":"Carnegie Mellon University Qatar","ror":"https://ror.org/00az5dt38","country_code":"QA","type":"education","lineage":["https://openalex.org/I4210089979","https://openalex.org/I74973139"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Manoranjan Mohanty","raw_affiliation_strings":["Carnegie Mellon University,School of Information System,Doha,Qatar"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University,School of Information System,Doha,Qatar","institution_ids":["https://openalex.org/I4210089979"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121929643","display_name":"Saleh Alqahtani","orcid":null},"institutions":[{"id":"https://openalex.org/I120238654","display_name":"Saudi Electronic University","ror":"https://ror.org/05ndh7v49","country_code":"SA","type":"education","lineage":["https://openalex.org/I120238654"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Saleh Alqahtani","raw_affiliation_strings":["Saudi Electronic University,College of Computing and Informatics,Riyadh,Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Saudi Electronic University,College of Computing and Informatics,Riyadh,Saudi Arabia","institution_ids":["https://openalex.org/I120238654"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5086258433","display_name":"Bashair Alrashed","orcid":"https://orcid.org/0000-0002-7393-5355"},"institutions":[{"id":"https://openalex.org/I4210099699","display_name":"University of Jeddah","ror":"https://ror.org/015ya8798","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210099699"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Bashair Alrashed","raw_affiliation_strings":["University of Jeddah,Faculty of Computing and Information Technology,Jeddah,Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Jeddah,Faculty of Computing and Information Technology,Jeddah,Saudi Arabia","institution_ids":["https://openalex.org/I4210099699"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.0267,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.918313,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.35760000348091125,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.35760000348091125,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.19670000672340393,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.13179999589920044,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.805400013923645},{"id":"https://openalex.org/keywords/oversampling","display_name":"Oversampling","score":0.7229999899864197},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.6898999810218811},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.632099986076355},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6198999881744385},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.6021000146865845}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.805400013923645},{"id":"https://openalex.org/C197323446","wikidata":"https://www.wikidata.org/wiki/Q331222","display_name":"Oversampling","level":3,"score":0.7229999899864197},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7202000021934509},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6984000205993652},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.6898999810218811},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.632099986076355},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6198999881744385},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.6021000146865845},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5958999991416931},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.5691999793052673},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.3594000041484833},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2946000099182129},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.27390000224113464},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.2705000042915344},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26930001378059387},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.2531000077724457},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.25040000677108765}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/aiccsa66935.2025.11315452","is_oa":false,"landing_page_url":"https://doi.org/10.1109/aiccsa66935.2025.11315452","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE/ACS 22nd International Conference on Computer Systems and Applications (AICCSA)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.5589074492454529,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W1991210879","https://openalex.org/W3009500417","https://openalex.org/W3010384713","https://openalex.org/W3014071235","https://openalex.org/W3039513780","https://openalex.org/W3041713512","https://openalex.org/W3111255485","https://openalex.org/W3194445456","https://openalex.org/W3202156390","https://openalex.org/W3216671775","https://openalex.org/W4206342677","https://openalex.org/W4224069059","https://openalex.org/W4226078906","https://openalex.org/W4293204578","https://openalex.org/W4306160043","https://openalex.org/W4312222414","https://openalex.org/W4313372151","https://openalex.org/W4328028541","https://openalex.org/W4328053447","https://openalex.org/W4366818322","https://openalex.org/W4387122051","https://openalex.org/W4387886031","https://openalex.org/W4389937376","https://openalex.org/W4390343272","https://openalex.org/W4393900885","https://openalex.org/W4403937240","https://openalex.org/W4405200190","https://openalex.org/W4405361295","https://openalex.org/W4406457967","https://openalex.org/W4407360999","https://openalex.org/W4407929715"],"related_works":[],"abstract_inverted_index":{"Insider":[0],"threats":[1],"remain":[2],"a":[3,24,77],"persistent":[4],"challenge":[5],"in":[6,42,119,138],"cybersecurity":[7],"due":[8],"to":[9,34],"the":[10,48,57,92,116,127],"deceptive":[11],"nature":[12],"of":[13,53,108,113],"malicious":[14],"activities":[15],"conducted":[16],"under":[17],"legitimate":[18],"user":[19],"accounts.":[20],"This":[21],"paper":[22],"presents":[23],"session-based":[25],"detection":[26],"framework":[27,58],"integrating":[28],"SMOTE-IPF":[29],"oversampling":[30,63],"and":[31,39,101,110,122],"XGBoost":[32,79],"classification":[33],"address":[35],"temporal":[36],"context":[37],"limitations":[38],"class":[40,50,68],"imbalance":[41,51],"insider":[43,54],"threat":[44,55,89,132],"datasets.":[45],"To":[46],"mitigate":[47],"extreme":[49],"characteristic":[52],"datasets,":[56],"integrates":[59],"SMOTE-IPF,":[60],"an":[61,111],"advanced":[62],"technique":[64],"that":[65],"maintains":[66],"minority":[67],"structure":[69],"while":[70,134],"reducing":[71],"overfitting.":[72],"The":[73],"model,":[74],"trained":[75],"with":[76],"GPU-accelerated":[78],"classifier,":[80],"achieves":[81],"notable":[82],"performance":[83],"improvements:":[84],"$50":[85],"\\%$":[86],"recall":[87],"for":[88,98],"instances":[90],"at":[91],"F1-optimal":[93],"threshold,":[94],"99.995":[95],"%":[96],"accuracy":[97],"normal":[99],"activity,":[100],"only":[102],"four":[103],"false":[104],"positives.":[105],"An":[106],"ROC-AUC":[107],"0.9429":[109],"F1score":[112],"0.5263":[114],"demonstrate":[115],"model\u2019s":[117],"effectiveness":[118],"balancing":[120],"precision":[121],"recall.":[123],"These":[124],"results":[125],"indicate":[126],"proposed":[128],"approach":[129],"can":[130],"enhance":[131],"identification":[133],"maintaining":[135],"operational":[136],"feasibility":[137],"high-stakes":[139],"security":[140],"environments.":[141]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-01-08T20:05:33.558190","created_date":"2026-01-05T00:00:00"}