{"id":"https://openalex.org/W1458873377","doi":"https://doi.org/10.1109/jsyst.2015.2438442","title":"Automated Insider Threat Detection System Using User and Role-Based Profile Assessment","display_name":"Automated Insider Threat Detection System Using User and Role-Based Profile Assessment","publication_year":2015,"publication_date":"2015-06-17","ids":{"openalex":"https://openalex.org/W1458873377","doi":"https://doi.org/10.1109/jsyst.2015.2438442","mag":"1458873377"},"language":"en","primary_location":{"id":"doi:10.1109/jsyst.2015.2438442","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jsyst.2015.2438442","pdf_url":null,"source":{"id":"https://openalex.org/S95999327","display_name":"IEEE Systems Journal","issn_l":"1932-8184","issn":["1932-8184","1937-9234","2373-7816"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Systems Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://ueaeprints.uea.ac.uk/id/eprint/66157/1/Accepted_manuscript.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053235466","display_name":"Phil Legg","orcid":"https://orcid.org/0000-0003-3460-5609"},"institutions":[{"id":"https://openalex.org/I178535277","display_name":"University of the West of England","ror":"https://ror.org/02nwg5t34","country_code":"GB","type":"education","lineage":["https://openalex.org/I178535277"]},{"id":"https://openalex.org/I40120149","display_name":"University of Oxford","ror":"https://ror.org/052gg0110","country_code":"GB","type":"education","lineage":["https://openalex.org/I40120149"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Philip A. Legg","raw_affiliation_strings":["Cyber Security Centre, University of the West of England, Bristol, U.K","Department of Computer Science, Cyber Security Centre, University of Oxford, University of the West of England, Oxford, Bristol, U.K.U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Centre, University of the West of England, Bristol, U.K","institution_ids":["https://openalex.org/I178535277"]},{"raw_affiliation_string":"Department of Computer Science, Cyber Security Centre, University of Oxford, University of the West of England, Oxford, Bristol, U.K.U.K","institution_ids":["https://openalex.org/I178535277","https://openalex.org/I40120149"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060039967","display_name":"Oliver Buckley","orcid":"https://orcid.org/0000-0003-1502-5721"},"institutions":[{"id":"https://openalex.org/I933054736","display_name":"Defence Academy of the United Kingdom","ror":"https://ror.org/03myaza48","country_code":"GB","type":"education","lineage":["https://openalex.org/I1306956679","https://openalex.org/I2802373619","https://openalex.org/I933054736"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Oliver Buckley","raw_affiliation_strings":["Cyber Security Centre, Defence Academy of the United Kingdom, Wiltshire, U.K","Cyber Security Centre, Centre for Cyber Security and Information Systems, University of Oxford, Cranfield University, Defence Academy of the United Kingdom, Oxford, Cranfield, Wiltshire, U.KU.K.U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Centre, Defence Academy of the United Kingdom, Wiltshire, U.K","institution_ids":["https://openalex.org/I933054736"]},{"raw_affiliation_string":"Cyber Security Centre, Centre for Cyber Security and Information Systems, University of Oxford, Cranfield University, Defence Academy of the United Kingdom, Oxford, Cranfield, Wiltshire, U.KU.K.U.K","institution_ids":["https://openalex.org/I933054736"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063148097","display_name":"Michael Goldsmith","orcid":"https://orcid.org/0000-0001-7808-0600"},"institutions":[{"id":"https://openalex.org/I40120149","display_name":"University of Oxford","ror":"https://ror.org/052gg0110","country_code":"GB","type":"education","lineage":["https://openalex.org/I40120149"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Michael Goldsmith","raw_affiliation_strings":["Cyber Security Centre, University of Oxford, Oxford, U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Centre, University of Oxford, Oxford, U.K","institution_ids":["https://openalex.org/I40120149"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5004437304","display_name":"Sadie Creese","orcid":"https://orcid.org/0000-0002-2414-9657"},"institutions":[{"id":"https://openalex.org/I40120149","display_name":"University of Oxford","ror":"https://ror.org/052gg0110","country_code":"GB","type":"education","lineage":["https://openalex.org/I40120149"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Sadie Creese","raw_affiliation_strings":["Cyber Security Centre, University of Oxford, Oxford, U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Centre, University of Oxford, Oxford, U.K","institution_ids":["https://openalex.org/I40120149"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":37.003,"has_fulltext":true,"cited_by_count":142,"citation_normalized_percentile":{"value":0.9956736,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":"11","issue":"2","first_page":"503","last_page":"512"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.695900022983551,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.695900022983551,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.047600001096725464,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.027699999511241913,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.9285058975219727},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6382814645767212},{"id":"https://openalex.org/keywords/profiling","display_name":"Profiling (computer programming)","score":0.6288871765136719},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.5775660872459412},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5742565393447876},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5634363889694214},{"id":"https://openalex.org/keywords/reputation","display_name":"Reputation","score":0.557488203048706},{"id":"https://openalex.org/keywords/visual-analytics","display_name":"Visual analytics","score":0.44982922077178955},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.44138988852500916},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.3696625828742981},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.297349214553833},{"id":"https://openalex.org/keywords/visualization","display_name":"Visualization","score":0.28514212369918823}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.9285058975219727},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6382814645767212},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.6288871765136719},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5775660872459412},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5742565393447876},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5634363889694214},{"id":"https://openalex.org/C48798503","wikidata":"https://www.wikidata.org/wiki/Q877546","display_name":"Reputation","level":2,"score":0.557488203048706},{"id":"https://openalex.org/C59732488","wikidata":"https://www.wikidata.org/wiki/Q2528440","display_name":"Visual analytics","level":3,"score":0.44982922077178955},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.44138988852500916},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3696625828742981},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.297349214553833},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.28514212369918823},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/jsyst.2015.2438442","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jsyst.2015.2438442","pdf_url":null,"source":{"id":"https://openalex.org/S95999327","display_name":"IEEE Systems Journal","issn_l":"1932-8184","issn":["1932-8184","1937-9234","2373-7816"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Systems Journal","raw_type":"journal-article"},{"id":"pmh:oai:ueaeprints.uea.ac.uk:66157","is_oa":true,"landing_page_url":"https://ueaeprints.uea.ac.uk/id/eprint/66157/1/Accepted_manuscript.pdf","pdf_url":"https://ueaeprints.uea.ac.uk/id/eprint/66157/1/Accepted_manuscript.pdf","source":{"id":"https://openalex.org/S4306400384","display_name":"UEA Digital Repository (University of East Anglia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1118541","host_organization_name":"University of East Anglia","host_organization_lineage":["https://openalex.org/I1118541"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"pmh:oai:eprints.uwe.ac.uk:25809","is_oa":true,"landing_page_url":"http://eprints.uwe.ac.uk/25809/1/anomaly_ieee_may2015.pdf","pdf_url":"http://eprints.uwe.ac.uk/25809/1/anomaly_ieee_may2015.pdf","source":{"id":"https://openalex.org/S4306401464","display_name":"UWE Research Repository (UWE Bristol)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I178535277","host_organization_name":"University of the West of England","host_organization_lineage":["https://openalex.org/I178535277"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article"}],"best_oa_location":{"id":"pmh:oai:ueaeprints.uea.ac.uk:66157","is_oa":true,"landing_page_url":"https://ueaeprints.uea.ac.uk/id/eprint/66157/1/Accepted_manuscript.pdf","pdf_url":"https://ueaeprints.uea.ac.uk/id/eprint/66157/1/Accepted_manuscript.pdf","source":{"id":"https://openalex.org/S4306400384","display_name":"UEA Digital Repository (University of East Anglia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1118541","host_organization_name":"University of East Anglia","host_organization_lineage":["https://openalex.org/I1118541"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"sustainable_development_goals":[{"score":0.7900000214576721,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320320276","display_name":"University of Leicester","ror":"https://ror.org/04h699437"},{"id":"https://openalex.org/F4320320290","display_name":"University of Oxford","ror":"https://ror.org/052gg0110"},{"id":"https://openalex.org/F4320320350","display_name":"Cardiff University","ror":"https://ror.org/03kk7td41"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W1458873377.pdf","grobid_xml":"https://content.openalex.org/works/W1458873377.grobid-xml"},"referenced_works_count":28,"referenced_works":["https://openalex.org/W168451370","https://openalex.org/W1492667596","https://openalex.org/W1603920809","https://openalex.org/W1859925930","https://openalex.org/W1967847731","https://openalex.org/W1969795119","https://openalex.org/W1983068751","https://openalex.org/W1995976200","https://openalex.org/W2013946142","https://openalex.org/W2023509821","https://openalex.org/W2033640190","https://openalex.org/W2038254631","https://openalex.org/W2053003065","https://openalex.org/W2100407515","https://openalex.org/W2101173463","https://openalex.org/W2113997717","https://openalex.org/W2122823095","https://openalex.org/W2123521920","https://openalex.org/W2135415614","https://openalex.org/W2140910804","https://openalex.org/W2144584907","https://openalex.org/W2165532165","https://openalex.org/W2255638286","https://openalex.org/W2397127666","https://openalex.org/W2542582667","https://openalex.org/W3099514962","https://openalex.org/W6629711124","https://openalex.org/W6678124170"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"Organizations":[0],"are":[1,24,66],"experiencing":[2],"an":[3,42,78,85,96,204],"ever-growing":[4],"concern":[5],"of":[6,29,57,71,91,108,127,134,146,181],"how":[7,188],"to":[8,20,41,54,122,199],"identify":[9,174],"and":[10,36,50,59,114,118,168],"defend":[11],"against":[12,156],"insider":[13,93],"threats.":[14],"Those":[15],"who":[16,74],"have":[17,160],"authorized":[18],"access":[19],"sensitive":[21],"organizational":[22],"data":[23],"placed":[25],"in":[26],"a":[27,100,124,131,182],"position":[28],"power":[30],"that":[31,88,104,129,148,170,177],"could":[32,37,45],"well":[33],"be":[34,140,179,193],"abused":[35],"cause":[38],"significant":[39],"damage":[40],"organization.":[43,79,97],"This":[44],"range":[46],"from":[47],"financial":[48],"theft":[49,53],"intellectual":[51],"property":[52,58],"the":[55,106,135,144,171],"destruction":[56],"business":[60],"reputation.":[61],"Traditional":[62],"intrusion":[63],"detection":[64,190],"systems":[65],"neither":[67],"designed":[68],"nor":[69],"capable":[70,90],"identifying":[72],"those":[73],"act":[75],"maliciously":[76],"within":[77,95],"In":[80],"this":[81,121],"paper,":[82],"we":[83],"describe":[84],"automated":[86],"system":[87,172,191],"is":[89],"detecting":[92],"threats":[94],"We":[98,159,185],"define":[99],"tree-structure":[101],"profiling":[102],"approach":[103],"incorporates":[105],"details":[107],"activities":[109],"conducted":[110],"by":[111,203],"each":[112,115,149],"user":[113,150],"job":[116],"role":[117],"then":[119],"use":[120],"obtain":[123],"consistent":[125],"representation":[126],"features":[128],"provide":[130],"rich":[132],"description":[133],"user's":[136],"behavior.":[137],"Deviation":[138],"can":[139,173,192],"assessed":[141],"based":[142],"on":[143],"amount":[145],"variance":[147],"exhibits":[151],"across":[152],"multiple":[153],"attributes,":[154],"compared":[155],"their":[157],"peers.":[158],"performed":[161],"experimentation":[162],"using":[163],"ten":[164],"synthetic":[165],"data-driven":[166],"scenarios":[167],"found":[169],"anomalous":[175],"behavior":[176],"may":[178],"indicative":[180],"potential":[183],"threat.":[184],"also":[186],"show":[187],"our":[189],"combined":[194],"with":[195],"visual":[196],"analytics":[197],"tools":[198],"support":[200],"further":[201],"investigation":[202],"analyst.":[205]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":13},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":15},{"year":2022,"cited_by_count":10},{"year":2021,"cited_by_count":15},{"year":2020,"cited_by_count":21},{"year":2019,"cited_by_count":14},{"year":2018,"cited_by_count":18},{"year":2017,"cited_by_count":7},{"year":2016,"cited_by_count":7},{"year":2015,"cited_by_count":2}],"updated_date":"2026-08-19T15:00:24.278416","created_date":"2025-10-10T00:00:00"}