{"id":"https://openalex.org/W2198162823","doi":"https://doi.org/10.1109/milcom.2015.7357409","title":"Insider attack detection using weak indicators over network flow data","display_name":"Insider attack detection using weak indicators over network flow data","publication_year":2015,"publication_date":"2015-10-01","ids":{"openalex":"https://openalex.org/W2198162823","doi":"https://doi.org/10.1109/milcom.2015.7357409","mag":"2198162823"},"language":"en","primary_location":{"id":"doi:10.1109/milcom.2015.7357409","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom.2015.7357409","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2015 - 2015 IEEE Military Communications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088888665","display_name":"Roberto Pagliari","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Roberto Pagliari","raw_affiliation_strings":["Applied Communication Sciences Basking Ridge, NJ, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Communication Sciences Basking Ridge, NJ, U.S.A","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109224190","display_name":"Abhrajit Ghosh","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abhrajit Ghosh","raw_affiliation_strings":["Applied Communication Sciences Basking Ridge, NJ, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Communication Sciences Basking Ridge, NJ, U.S.A","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045936266","display_name":"Yitzchak M. Gottlieb","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yitzchak M. Gottlieb","raw_affiliation_strings":["Applied Communication Sciences Basking Ridge, NJ, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Communication Sciences Basking Ridge, NJ, U.S.A","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103911831","display_name":"Ritu Chadha","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ritu Chadha","raw_affiliation_strings":["Applied Communication Sciences Basking Ridge, NJ, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Communication Sciences Basking Ridge, NJ, U.S.A","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110277651","display_name":"Akshay Vashist","orcid":null},"institutions":[{"id":"https://openalex.org/I4210086062","display_name":"Otsuka (United States)","ror":"https://ror.org/00ew4na22","country_code":"US","type":"company","lineage":["https://openalex.org/I114030911","https://openalex.org/I4210086062"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Akshay Vashist","raw_affiliation_strings":["Otsuka Pharmaceuticals Development Corporation Princeton Junction, NJ, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Otsuka Pharmaceuticals Development Corporation Princeton Junction, NJ, U.S.A","institution_ids":["https://openalex.org/I4210086062"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5108530188","display_name":"Gregory Hadynski","orcid":null},"institutions":[{"id":"https://openalex.org/I1280414376","display_name":"United States Air Force Research Laboratory","ror":"https://ror.org/02e2egq70","country_code":"US","type":"facility","lineage":["https://openalex.org/I1280414376","https://openalex.org/I1330347796","https://openalex.org/I4210102105","https://openalex.org/I4389425425"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Gregory Hadynski","raw_affiliation_strings":["Air Force Research Laboratory, Rome, NY, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air Force Research Laboratory, Rome, NY, U.S.A","institution_ids":["https://openalex.org/I1280414376"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":7,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"2","issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7881604433059692},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7526364326477051},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6037030220031738},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.561165452003479},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5575729012489319},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.5339722633361816},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.4989333152770996},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.48470377922058105},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.47189080715179443},{"id":"https://openalex.org/keywords/network-topology","display_name":"Network topology","score":0.44621992111206055},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.4367876648902893},{"id":"https://openalex.org/keywords/granularity","display_name":"Granularity","score":0.4355012774467468},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.37406471371650696},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3516254127025604},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.3412589430809021},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.21766459941864014},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.11283740401268005}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7881604433059692},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7526364326477051},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6037030220031738},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.561165452003479},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5575729012489319},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.5339722633361816},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.4989333152770996},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.48470377922058105},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.47189080715179443},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.44621992111206055},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.4367876648902893},{"id":"https://openalex.org/C177774035","wikidata":"https://www.wikidata.org/wiki/Q1246948","display_name":"Granularity","level":2,"score":0.4355012774467468},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37406471371650696},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3516254127025604},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.3412589430809021},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.21766459941864014},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.11283740401268005},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/milcom.2015.7357409","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom.2015.7357409","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2015 - 2015 IEEE Military Communications Conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W1489073918","https://openalex.org/W1543388142","https://openalex.org/W1556344493","https://openalex.org/W1562135275","https://openalex.org/W1968114659","https://openalex.org/W1971022913","https://openalex.org/W1988741337","https://openalex.org/W2094224753","https://openalex.org/W2120617515","https://openalex.org/W2122646361","https://openalex.org/W2131904035","https://openalex.org/W2140711496","https://openalex.org/W2146082061","https://openalex.org/W6632547301","https://openalex.org/W6633228498","https://openalex.org/W6679539681"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"Insider":[0],"attack":[1,61],"detection":[2,64,151],"in":[3,80],"an":[4,112],"enterprise":[5,81],"network":[6,33,97,130,138],"environment":[7],"is":[8,43,90,134,142,172],"a":[9,20,85,159,169],"critical":[10],"problem":[11,71],"that":[12,114,141,171],"currently":[13],"has":[14],"no":[15],"promising":[16],"solution.":[17],"It":[18],"represents":[19],"significant":[21],"challenge":[22],"since":[23],"host":[24],"availability":[25],"and":[26,51,95,122,145],"performance":[27],"requirements":[28,38],"cannot":[29],"be":[30,40],"ignored.":[31],"A":[32],"based":[34],"approach":[35,113,133,157],"allows":[36,158],"these":[37],"to":[39,78,102,106,125,148,162],"met":[41],"but":[42],"limited":[44],"by":[45,176],"the":[46,52,68,116,164,167],"granularity":[47],"of":[48,55,72,120,129,166,179],"data":[49,140],"available":[50],"near":[53],"impossibility":[54],"defining":[56],"exact":[57],"signatures":[58],"for":[59,137],"known":[60,70],"types.":[62],"Anomaly":[63],"approaches":[65,105],"suffer":[66],"from":[67],"well":[69,135],"false":[73,87],"positives":[74],"making":[75],"them":[76],"hard":[77,101],"apply":[79,103],"environments":[82],"where":[83],"even":[84],"moderate":[86],"positive":[88],"rate":[89],"not":[91,146,174],"acceptable.":[92],"Sophisticated":[93],"attacks":[94],"complex":[96],"topologies":[98],"make":[99],"it":[100],"simplistic":[104,149,177],"anomaly":[107,150],"detection.":[108],"This":[109,132],"paper":[110],"presents":[111],"applies":[115],"unsupervised":[117,180],"learning":[118],"techniques":[119],"bi-clustering":[121],"one-class":[123],"SVM":[124],"so-called":[126],"weak":[127],"indicators":[128],"attacks.":[131],"suited":[136],"flow":[139],"coarse":[143],"grained":[144],"amenable":[147],"or":[152],"signature-based":[153],"techniques.":[154],"Further,":[155],"our":[156],"security":[160],"analyst":[161],"determine":[163],"cause":[165],"anomaly,":[168],"capability":[170],"typically":[173],"supportable":[175],"applications":[178],"learning.":[181]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2020,"cited_by_count":2},{"year":2019,"cited_by_count":1},{"year":2016,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}