{"id":"https://openalex.org/W2790664081","doi":"https://doi.org/10.1109/comst.2018.2800740","title":"Detecting and Preventing Cyber Insider Threats: A Survey","display_name":"Detecting and Preventing Cyber Insider Threats: A Survey","publication_year":2018,"publication_date":"2018-01-01","ids":{"openalex":"https://openalex.org/W2790664081","doi":"https://doi.org/10.1109/comst.2018.2800740","mag":"2790664081"},"language":"en","primary_location":{"id":"doi:10.1109/comst.2018.2800740","is_oa":false,"landing_page_url":"https://doi.org/10.1109/comst.2018.2800740","pdf_url":null,"source":{"id":"https://openalex.org/S23688054","display_name":"IEEE Communications Surveys & Tutorials","issn_l":"1553-877X","issn":["1553-877X","2373-745X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Communications Surveys & Tutorials","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://figshare.com/articles/journal_contribution/Detecting_and_preventing_cyber_insider_threats_a_survey/20812669","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010171381","display_name":"Liu Liu","orcid":"https://orcid.org/0000-0001-7959-6764"},"institutions":[{"id":"https://openalex.org/I57093077","display_name":"Swinburne University of Technology","ror":"https://ror.org/031rekg67","country_code":"AU","type":"education","lineage":["https://openalex.org/I57093077"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Liu Liu","raw_affiliation_strings":["School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0001-7959-6764","affiliations":[{"raw_affiliation_string":"School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia","institution_ids":["https://openalex.org/I57093077"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026180696","display_name":"Olivier De Vel","orcid":"https://orcid.org/0000-0001-5179-3707"},"institutions":[{"id":"https://openalex.org/I1303474014","display_name":"Defence Science and Technology Group","ror":"https://ror.org/05ddrvt52","country_code":"AU","type":"government","lineage":["https://openalex.org/I1303474014","https://openalex.org/I2801453606","https://openalex.org/I3139952251"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Olivier De Vel","raw_affiliation_strings":["Department of Defence, Defence Science and Technology Group, Edinburgh, SA, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Defence, Defence Science and Technology Group, Edinburgh, SA, Australia","institution_ids":["https://openalex.org/I1303474014"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083874423","display_name":"Qing\u2010Long Han","orcid":"https://orcid.org/0000-0002-7207-0716"},"institutions":[{"id":"https://openalex.org/I57093077","display_name":"Swinburne University of Technology","ror":"https://ror.org/031rekg67","country_code":"AU","type":"education","lineage":["https://openalex.org/I57093077"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Qing-Long Han","raw_affiliation_strings":["School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0002-7207-0716","affiliations":[{"raw_affiliation_string":"School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia","institution_ids":["https://openalex.org/I57093077"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044019139","display_name":"Jun Zhang","orcid":"https://orcid.org/0000-0002-2189-7801"},"institutions":[{"id":"https://openalex.org/I57093077","display_name":"Swinburne University of Technology","ror":"https://ror.org/031rekg67","country_code":"AU","type":"education","lineage":["https://openalex.org/I57093077"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Jun Zhang","raw_affiliation_strings":["School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia","institution_ids":["https://openalex.org/I57093077"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100666554","display_name":"Yang Xiang","orcid":"https://orcid.org/0000-0001-5252-0831"},"institutions":[{"id":"https://openalex.org/I57093077","display_name":"Swinburne University of Technology","ror":"https://ror.org/031rekg67","country_code":"AU","type":"education","lineage":["https://openalex.org/I57093077"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yang Xiang","raw_affiliation_strings":["School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0001-5252-0831","affiliations":[{"raw_affiliation_string":"School of Software and Electrical Engineering, Swinburne University of Technology, Hawthorn, VIC, Australia","institution_ids":["https://openalex.org/I57093077"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":32.896,"has_fulltext":false,"cited_by_count":387,"citation_normalized_percentile":{"value":0.9981772,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"20","issue":"2","first_page":"1397","last_page":"1417"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.8870689868927002},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.8161095380783081},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7738368511199951},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7263984680175781},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.6133324503898621},{"id":"https://openalex.org/keywords/data-breach","display_name":"Data breach","score":0.48702841997146606},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.45597517490386963},{"id":"https://openalex.org/keywords/perspective","display_name":"Perspective (graphical)","score":0.41547566652297974},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.3649587631225586},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.2637999653816223}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.8870689868927002},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.8161095380783081},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7738368511199951},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7263984680175781},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.6133324503898621},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.48702841997146606},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.45597517490386963},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.41547566652297974},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3649587631225586},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2637999653816223},{"id":"https://openalex.org/C121955636","wikidata":"https://www.wikidata.org/wiki/Q4116214","display_name":"Accounting","level":1,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/comst.2018.2800740","is_oa":false,"landing_page_url":"https://doi.org/10.1109/comst.2018.2800740","pdf_url":null,"source":{"id":"https://openalex.org/S23688054","display_name":"IEEE Communications Surveys & Tutorials","issn_l":"1553-877X","issn":["1553-877X","2373-745X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Communications Surveys & Tutorials","raw_type":"journal-article"},{"id":"pmh:oai:dro.deakin.edu.au:DU:30113165","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4306402457","display_name":"Deakin Research Online (Deakin University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I149704539","host_organization_name":"Deakin University","host_organization_lineage":["https://openalex.org/I149704539"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Journal Article"},{"id":"pmh:oai:figshare.com:article/20812669","is_oa":true,"landing_page_url":"https://figshare.com/articles/journal_contribution/Detecting_and_preventing_cyber_insider_threats_a_survey/20812669","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"},{"id":"pmh:oai:researchbank.swinburne.edu.au:0a13991b-8876-40b8-8b21-0e299e4c1c14/1","is_oa":false,"landing_page_url":"http://hdl.handle.net/1959.3/442248","pdf_url":null,"source":{"id":"https://openalex.org/S4306401157","display_name":"Swinburne Research Bank (Swinburne University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I57093077","host_organization_name":"Swinburne University of Technology","host_organization_lineage":["https://openalex.org/I57093077"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Communications Surveys and Tutorials, Vol. 20, no. 2 (2018), pp. 1397-1417","raw_type":null}],"best_oa_location":{"id":"pmh:oai:figshare.com:article/20812669","is_oa":true,"landing_page_url":"https://figshare.com/articles/journal_contribution/Detecting_and_preventing_cyber_insider_threats_a_survey/20812669","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.8199999928474426,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":151,"referenced_works":["https://openalex.org/W33933511","https://openalex.org/W61807067","https://openalex.org/W148217933","https://openalex.org/W172558989","https://openalex.org/W181041240","https://openalex.org/W187875600","https://openalex.org/W248959849","https://openalex.org/W606780114","https://openalex.org/W1442696580","https://openalex.org/W1491237615","https://openalex.org/W1499963479","https://openalex.org/W1536465007","https://openalex.org/W1539745582","https://openalex.org/W1541663547","https://openalex.org/W1572811218","https://openalex.org/W1583098994","https://openalex.org/W1590824348","https://openalex.org/W1592090113","https://openalex.org/W1612155886","https://openalex.org/W1639956611","https://openalex.org/W1644589732","https://openalex.org/W1674877186","https://openalex.org/W1775772884","https://openalex.org/W1909494783","https://openalex.org/W1941427975","https://openalex.org/W1964676527","https://openalex.org/W1964723226","https://openalex.org/W1965857701","https://openalex.org/W1972544015","https://openalex.org/W1973980104","https://openalex.org/W1975843001","https://openalex.org/W1977838479","https://openalex.org/W1979931683","https://openalex.org/W1984233424","https://openalex.org/W1985008394","https://openalex.org/W1985663105","https://openalex.org/W1989168465","https://openalex.org/W1990089904","https://openalex.org/W1992713826","https://openalex.org/W1995919426","https://openalex.org/W1995976200","https://openalex.org/W1999489595","https://openalex.org/W2002537105","https://openalex.org/W2013745554","https://openalex.org/W2013946142","https://openalex.org/W2017735590","https://openalex.org/W2024826024","https://openalex.org/W2025827699","https://openalex.org/W2026621111","https://openalex.org/W2038166792","https://openalex.org/W2038254631","https://openalex.org/W2040403168","https://openalex.org/W2040564948","https://openalex.org/W2051000513","https://openalex.org/W2053003065","https://openalex.org/W2053193445","https://openalex.org/W2061358509","https://openalex.org/W2061455058","https://openalex.org/W2065890363","https://openalex.org/W2070403470","https://openalex.org/W2073836631","https://openalex.org/W2082600559","https://openalex.org/W2083254762","https://openalex.org/W2087671069","https://openalex.org/W2092756033","https://openalex.org/W2093197020","https://openalex.org/W2099940443","https://openalex.org/W2101916222","https://openalex.org/W2112965356","https://openalex.org/W2114092087","https://openalex.org/W2114996745","https://openalex.org/W2115408253","https://openalex.org/W2116065364","https://openalex.org/W2119227347","https://openalex.org/W2122646361","https://openalex.org/W2122823095","https://openalex.org/W2123521920","https://openalex.org/W2123941465","https://openalex.org/W2124808847","https://openalex.org/W2129500618","https://openalex.org/W2133664981","https://openalex.org/W2134816978","https://openalex.org/W2137052698","https://openalex.org/W2138001464","https://openalex.org/W2138209477","https://openalex.org/W2139233264","https://openalex.org/W2139731313","https://openalex.org/W2140564944","https://openalex.org/W2142619341","https://openalex.org/W2142638723","https://openalex.org/W2144016831","https://openalex.org/W2144584907","https://openalex.org/W2148323889","https://openalex.org/W2148675241","https://openalex.org/W2149086123","https://openalex.org/W2152725427","https://openalex.org/W2158877422","https://openalex.org/W2161251616","https://openalex.org/W2167075285","https://openalex.org/W2167489506","https://openalex.org/W2168248885","https://openalex.org/W2170196582","https://openalex.org/W2171644977","https://openalex.org/W2215296484","https://openalex.org/W2278098104","https://openalex.org/W2292408133","https://openalex.org/W2401432994","https://openalex.org/W2411226021","https://openalex.org/W2468321486","https://openalex.org/W2486441280","https://openalex.org/W2537594758","https://openalex.org/W2541511557","https://openalex.org/W2542582667","https://openalex.org/W2557513839","https://openalex.org/W2580290980","https://openalex.org/W2678934292","https://openalex.org/W2761599262","https://openalex.org/W2762155482","https://openalex.org/W2803592732","https://openalex.org/W2884060864","https://openalex.org/W2963673968","https://openalex.org/W3105682467","https://openalex.org/W3106397135","https://openalex.org/W3136767761","https://openalex.org/W3151800125","https://openalex.org/W3161677312","https://openalex.org/W4236135181","https://openalex.org/W4241808888","https://openalex.org/W4246524285","https://openalex.org/W4248986893","https://openalex.org/W6602518401","https://openalex.org/W6602994750","https://openalex.org/W6607494380","https://openalex.org/W6607594771","https://openalex.org/W6629287744","https://openalex.org/W6632363105","https://openalex.org/W6632480037","https://openalex.org/W6634779276","https://openalex.org/W6635409250","https://openalex.org/W6636751753","https://openalex.org/W6638021444","https://openalex.org/W6649564924","https://openalex.org/W6676840324","https://openalex.org/W6678124170","https://openalex.org/W6680068259","https://openalex.org/W6688666038","https://openalex.org/W6697110839","https://openalex.org/W6713532223","https://openalex.org/W6730629760","https://openalex.org/W6745040976","https://openalex.org/W6752054533"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W4385461189"],"abstract_inverted_index":{"Information":[0],"communications":[1],"technology":[2],"systems":[3,54],"are":[4,17,132,185,193],"facing":[5],"an":[6],"increasing":[7],"number":[8],"of":[9,15,69,91],"cyber":[10],"security":[11,27],"threats,":[12,166],"the":[13,25,36,101,114,135,139,168,173,179,197,200],"majority":[14],"which":[16,118],"originated":[18],"by":[19],"insiders.":[20],"As":[21],"insiders":[22],"reside":[23],"behind":[24],"enterprise-level":[26],"defence":[28],"mechanisms":[29],"and":[30,39,46,53,96,129,156,177,188,203,207],"often":[31],"have":[32,55],"privileged":[33],"access":[34],"to":[35,58,79,121,152],"network,":[37,147],"detecting":[38],"preventing":[40],"insider":[41,60,92,124,165],"threats":[42,61,117,131],"is":[43,159,170],"a":[44,104,122],"complex":[45],"challenging":[47],"problem.":[48],"In":[49],"fact,":[50],"many":[51],"schemes":[52],"been":[56],"proposed":[57],"address":[59],"from":[62,103,172,199],"different":[63],"perspectives,":[64],"such":[65],"as":[66,145],"intent,":[67],"type":[68],"threat,":[70],"or":[71,148],"available":[72],"audit":[73,153],"data":[74,105,154,175],"source.":[75],"This":[76],"survey":[77,110],"attempts":[78],"line":[80],"up":[81],"these":[82],"works":[83,141,184,202],"together":[84],"with":[85],"only":[86],"three":[87],"most":[88],"common":[89],"types":[90],"namely":[93],"traitor,":[94],"masquerader,":[95],"unintentional":[97],"perpetrator,":[98],"while":[99],"reviewing":[100],"countermeasures":[102],"analytics":[106],"perspective.":[107],"Uniquely,":[108],"this":[109],"takes":[111],"into":[112],"account":[113],"early":[115],"stage":[116],"may":[119],"lead":[120],"malicious":[123],"rising":[125],"up.":[126],"When":[127],"direct":[128],"indirect":[130],"put":[133],"on":[134,196],"same":[136],"page,":[137],"all":[138],"relevant":[140],"can":[142],"be":[143],"categorised":[144],"host,":[146],"contextual":[149],"data-based":[150],"according":[151],"source":[155],"each":[157],"work":[158],"reviewed":[160,201],"for":[161],"its":[162],"capability":[163],"against":[164],"how":[167],"information":[169],"extracted":[171],"engaged":[174],"sources,":[176],"what":[178],"decision-making":[180],"algorithm":[181],"is.":[182],"The":[183],"also":[186],"compared":[187],"contrasted.":[189],"Finally,":[190],"some":[191],"issues":[192],"raised":[194],"based":[195],"observations":[198],"new":[204],"research":[205],"gaps":[206],"challenges":[208],"identified.":[209]},"counts_by_year":[{"year":2026,"cited_by_count":18},{"year":2025,"cited_by_count":40},{"year":2024,"cited_by_count":47},{"year":2023,"cited_by_count":49},{"year":2022,"cited_by_count":41},{"year":2021,"cited_by_count":61},{"year":2020,"cited_by_count":60},{"year":2019,"cited_by_count":54},{"year":2018,"cited_by_count":17}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}