{"id":"https://openalex.org/W2056765730","doi":"https://doi.org/10.1109/isi.2013.6578795","title":"Modeling and detecting anomalous topic access","display_name":"Modeling and detecting anomalous topic access","publication_year":2013,"publication_date":"2013-06-01","ids":{"openalex":"https://openalex.org/W2056765730","doi":"https://doi.org/10.1109/isi.2013.6578795","mag":"2056765730"},"language":"en","primary_location":{"id":"doi:10.1109/isi.2013.6578795","is_oa":false,"landing_page_url":"https://doi.org/10.1109/isi.2013.6578795","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2013 IEEE International Conference on Intelligence and Security Informatics","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073959131","display_name":"Siddharth Gupta","orcid":"https://orcid.org/0000-0003-4671-9822"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Siddharth Gupta","raw_affiliation_strings":["Department of Computer Science, University of Illinois at Urbana-Champaign, USA"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Illinois at Urbana-Champaign, USA","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039623693","display_name":"Casey Hanson","orcid":"https://orcid.org/0000-0001-7818-6552"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Casey Hanson","raw_affiliation_strings":["Department of Computer Science, University of Illinois at Urbana-Champaign, USA"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Illinois at Urbana-Champaign, USA","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031954035","display_name":"Carl A. Gunter","orcid":"https://orcid.org/0009-0006-6943-0684"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Carl A Gunter","raw_affiliation_strings":["Department of Computer Science and Medicine, University of Illinois at Urbana-Champaign, USA"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Medicine, University of Illinois at Urbana-Champaign, USA","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074477294","display_name":"Mario Frank","orcid":"https://orcid.org/0000-0001-8888-7475"},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mario Frank","raw_affiliation_strings":["Department of Computer Science, University of California, Berkeley, USA"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Berkeley, USA","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050508920","display_name":"David Liebovitz","orcid":"https://orcid.org/0000-0002-2518-5940"},"institutions":[{"id":"https://openalex.org/I111979921","display_name":"Northwestern University","ror":"https://ror.org/000e0be47","country_code":"US","type":"education","lineage":["https://openalex.org/I111979921"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"David Liebovitz","raw_affiliation_strings":["Department of Medicine, Northwestern University, USA"],"affiliations":[{"raw_affiliation_string":"Department of Medicine, Northwestern University, USA","institution_ids":["https://openalex.org/I111979921"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5090647314","display_name":"Bradley Malin","orcid":"https://orcid.org/0000-0003-3040-5175"},"institutions":[{"id":"https://openalex.org/I200719446","display_name":"Vanderbilt University","ror":"https://ror.org/02vm5rt34","country_code":"US","type":"education","lineage":["https://openalex.org/I200719446"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bradley Malin","raw_affiliation_strings":["Department of Biomedical Informatics, Vanderbilt University, USA"],"affiliations":[{"raw_affiliation_string":"Department of Biomedical Informatics, Vanderbilt University, USA","institution_ids":["https://openalex.org/I200719446"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5073959131"],"corresponding_institution_ids":["https://openalex.org/I157725225"],"apc_list":null,"apc_paid":null,"fwci":2.5571,"has_fulltext":false,"cited_by_count":22,"citation_normalized_percentile":{"value":0.90513691,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"100","last_page":"105"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8396085500717163},{"id":"https://openalex.org/keywords/automatic-summarization","display_name":"Automatic summarization","score":0.670962929725647},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6039049029350281},{"id":"https://openalex.org/keywords/latent-dirichlet-allocation","display_name":"Latent Dirichlet allocation","score":0.589542806148529},{"id":"https://openalex.org/keywords/topic-model","display_name":"Topic model","score":0.5891209244728088},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.5325735211372375},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5211668014526367},{"id":"https://openalex.org/keywords/random-access","display_name":"Random access","score":0.5015475749969482},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4113865792751312},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.39933642745018005},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.3880437910556793},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.35260313749313354}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8396085500717163},{"id":"https://openalex.org/C170858558","wikidata":"https://www.wikidata.org/wiki/Q1394144","display_name":"Automatic summarization","level":2,"score":0.670962929725647},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6039049029350281},{"id":"https://openalex.org/C500882744","wikidata":"https://www.wikidata.org/wiki/Q269236","display_name":"Latent Dirichlet allocation","level":3,"score":0.589542806148529},{"id":"https://openalex.org/C171686336","wikidata":"https://www.wikidata.org/wiki/Q3532085","display_name":"Topic model","level":2,"score":0.5891209244728088},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5325735211372375},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5211668014526367},{"id":"https://openalex.org/C101722063","wikidata":"https://www.wikidata.org/wiki/Q218825","display_name":"Random access","level":2,"score":0.5015475749969482},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4113865792751312},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39933642745018005},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3880437910556793},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35260313749313354},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/isi.2013.6578795","is_oa":false,"landing_page_url":"https://doi.org/10.1109/isi.2013.6578795","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2013 IEEE International Conference on Intelligence and Security Informatics","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/17","display_name":"Partnerships for the goals","score":0.4399999976158142}],"awards":[],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320309151","display_name":"Vanderbilt University","ror":"https://ror.org/02vm5rt34"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https://openalex.org/W266111510","https://openalex.org/W1760565668","https://openalex.org/W1880262756","https://openalex.org/W2087615914","https://openalex.org/W2097712921","https://openalex.org/W2106353924","https://openalex.org/W2115345989","https://openalex.org/W2120269359","https://openalex.org/W2137061487","https://openalex.org/W2156542272","https://openalex.org/W4237791300","https://openalex.org/W6609965286","https://openalex.org/W6637902766"],"related_works":["https://openalex.org/W4385393260","https://openalex.org/W2093597205","https://openalex.org/W2389846579","https://openalex.org/W4320024195","https://openalex.org/W4289781928","https://openalex.org/W2292447176","https://openalex.org/W2321135545","https://openalex.org/W3106840321","https://openalex.org/W2370554703","https://openalex.org/W4372080466"],"abstract_inverted_index":{"There":[0],"has":[1],"been":[2],"considerable":[3],"success":[4,212],"in":[5,12,199],"developing":[6],"strategies":[7],"to":[8,42,53,122,151,190],"detect":[9],"insider":[10],"threats":[11],"information":[13],"systems":[14],"based":[15,115,213],"on":[16,94,116,214],"what":[17],"one":[18],"might":[19],"call":[20],"the":[21,124,149,188,197,200,218],"random":[22,71,89,156,159],"object":[23],"access":[24,37,73,81,161],"model":[25,74,102,125],"or":[26,75,163],"ROA.":[27],"This":[28],"approach":[29],"models":[30],"illegitimate":[31,84],"users":[32,79,157,245],"as":[33,140],"ones":[34],"who":[35],"randomly":[36],"records.":[38],"The":[39],"goal":[40],"is":[41,86,92,103,120],"use":[43,138],"statistics,":[44],"machine":[45],"learning,":[46],"knowledge":[47],"of":[48,109,155,170,202,211,221],"workflows":[49],"and":[50,68,111,126,143,186,217],"other":[51],"techniques":[52],"support":[54],"an":[55,141],"anomaly":[56],"detection":[57,130,162,185],"framework":[58,146],"that":[59,100,119,228],"finds":[60],"such":[61],"users.":[62],"In":[63,223],"this":[64,101,135],"paper":[65],"we":[66,137,166,207],"introduce":[67],"study":[69],"a":[70,106,113,145,168,178,238],"topic":[72,117,160],"RTA":[76],"aimed":[77],"at":[78],"whose":[80],"may":[82],"be":[83],"but":[85,241],"not":[87],"fully":[88],"because":[90],"it":[91,225],"focused":[93],"common":[95],"semantic":[96],"themes.":[97],"We":[98,195],"argue":[99],"appropriate":[104],"for":[105,132,147,175,183,233],"meaningful":[107],"range":[108],"attacks":[110],"develop":[112],"system":[114],"summarization":[118],"able":[121],"formalize":[123],"provide":[127],"anomalous":[128],"user":[129,215],"effectively":[131],"it.":[133],"To":[134],"end,":[136],"healthcare":[139],"example":[142],"propose":[144],"evaluating":[148],"ability":[150,189],"recognize":[152],"various":[153],"types":[154],"called":[158],"RTAD.":[164],"Specifically,":[165],"utilize":[167],"combination":[169],"Latent":[171],"Dirichlet":[172],"Allocation":[173],"(LDA),":[174],"feature":[176],"extraction,":[177],"k-nearest":[179],"neighbor":[180],"(k-NN)":[181],"algorithm":[182],"outlier":[184],"evaluate":[187],"identify":[191],"different":[192],"adversarial":[193],"types.":[194],"validate":[196],"technique":[198],"context":[201],"hospital":[203],"audit":[204],"logs":[205],"where":[206],"show":[208],"varying":[209],"degrees":[210],"roles":[216,234],"anticipated":[219],"characteristics":[220],"attackers.":[222],"particular,":[224],"was":[226],"found":[227],"RTAD":[229],"exhibits":[230],"strong":[231],"performance":[232,243],"are":[235,246],"described":[236],"by":[237],"few":[239],"topics,":[240],"weaker":[242],"when":[244],"more":[247],"topic-agnostic.":[248]},"counts_by_year":[{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":6},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":1},{"year":2015,"cited_by_count":3},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}