{"id":"https://openalex.org/W3011124515","doi":"https://doi.org/10.1109/milcom47813.2019.9020760","title":"Anomaly Detection with Graph Convolutional Networks for Insider Threat and Fraud Detection","display_name":"Anomaly Detection with Graph Convolutional Networks for Insider Threat and Fraud Detection","publication_year":2019,"publication_date":"2019-11-01","ids":{"openalex":"https://openalex.org/W3011124515","doi":"https://doi.org/10.1109/milcom47813.2019.9020760","mag":"3011124515"},"language":"en","primary_location":{"id":"doi:10.1109/milcom47813.2019.9020760","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom47813.2019.9020760","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5000562106","display_name":"Jianguo Jiang","orcid":"https://orcid.org/0000-0002-0074-040X"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianguo Jiang","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030204749","display_name":"Jiuming Chen","orcid":null},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiuming Chen","raw_affiliation_strings":["Department of Computer Science, University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109946639","display_name":"Tianbo Gu","orcid":null},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tianbo Gu","raw_affiliation_strings":["Department of Computer Science, University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001746807","display_name":"Kim\u2010Kwang Raymond Choo","orcid":"https://orcid.org/0000-0001-9208-5336"},"institutions":[{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kim-Kwang Raymond Choo","raw_affiliation_strings":["Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, USA","institution_ids":["https://openalex.org/I45438204"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101686991","display_name":"Chao Liu","orcid":"https://orcid.org/0000-0003-1773-3756"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chao Liu","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081445180","display_name":"Min Yu","orcid":"https://orcid.org/0000-0003-4371-7864"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yu","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101637573","display_name":"Weiqing Huang","orcid":"https://orcid.org/0000-0002-9155-4177"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiqing Huang","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5086439160","display_name":"Prasant Mohapatra","orcid":"https://orcid.org/0000-0002-2768-5308"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Prasant Mohapatra","raw_affiliation_strings":["Department of Computer Science, University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":157,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"109","last_page":"114"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.768133282661438},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7530568242073059},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.6961086392402649},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.6907357573509216},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.6140019297599792},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5341220498085022},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5201235413551331},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4976859390735626},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.45560070872306824},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.43548792600631714},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4212725758552551},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4079245328903198},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.38799625635147095},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.3584681749343872},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.18740570545196533}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.768133282661438},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7530568242073059},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.6961086392402649},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.6907357573509216},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.6140019297599792},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5341220498085022},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5201235413551331},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4976859390735626},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.45560070872306824},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.43548792600631714},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4212725758552551},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4079245328903198},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.38799625635147095},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.3584681749343872},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.18740570545196533},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/milcom47813.2019.9020760","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom47813.2019.9020760","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7400000095367432,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W1458873377","https://openalex.org/W1991210879","https://openalex.org/W2122646361","https://openalex.org/W2190692258","https://openalex.org/W2533835508","https://openalex.org/W2560934771","https://openalex.org/W2585284559","https://openalex.org/W2761599262","https://openalex.org/W2767094836","https://openalex.org/W2885040798","https://openalex.org/W2885724973","https://openalex.org/W2887742767","https://openalex.org/W2903781571","https://openalex.org/W2906774965","https://openalex.org/W2914648904","https://openalex.org/W2963673968","https://openalex.org/W2964015378","https://openalex.org/W6726873649","https://openalex.org/W6733151841","https://openalex.org/W6745040976"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2792608345","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W4387194049","https://openalex.org/W2018332730"],"abstract_inverted_index":{"Anomaly":[0],"detection":[1,18,74,106,163],"generally":[2],"involves":[3],"the":[4,14,41,52,102,122,136,153],"extraction":[5],"of":[6,16,43,54,80,113],"features":[7],"from":[8],"entities'":[9,30,91],"or":[10,23,47],"users'":[11],"properties,":[12],"and":[13,57,82,93,115,150],"design":[15,66],"anomaly":[17,73,105,162],"models":[19],"using":[20,125],"machine":[21],"learning":[22,25],"deep":[24],"algorithms.":[26],"However,":[27],"only":[28],"considering":[29,45],"property":[31],"information":[32,95],"could":[33,89],"lead":[34],"to":[35,76,108,160],"high":[36],"false":[37],"positives.":[38],"We":[39,119],"posit":[40],"importance":[42],"also":[44,157],"connections":[46],"relationships":[48],"between":[49,96],"entities":[50],"in":[51,62],"detecting":[53],"anomalous":[55,78,111,117],"behaviors":[56,79,112],"associated":[58,116],"threat":[59,84,129],"groups.":[60,85,118],"Therefore,":[61],"this":[63],"paper,":[64],"we":[65],"a":[67,126],"GCN":[68,87,103],"(graph":[69],"convolutional":[70],"networks)":[71],"based":[72,104],"model":[75,88,107,124,138,155],"detect":[77,109],"users":[81],"malicious":[83],"The":[86,132],"characterize":[90],"properties":[92],"structural":[94],"them":[97],"into":[98],"graphs.":[99],"This":[100],"allows":[101],"both":[110],"individuals":[114],"then":[120],"evaluate":[121],"proposed":[123,137,154],"real-world":[127],"insider":[128],"data":[130],"set.":[131],"results":[133],"show":[134],"that":[135],"outperforms":[139],"several":[140],"state-of-art":[141],"baseline":[142],"methods":[143],"(i.e.,":[144],"random":[145],"forest,":[146],"logistic":[147],"regression,":[148],"SVM,":[149],"CNN).":[151],"Moreover,":[152],"can":[156],"be":[158],"applied":[159],"other":[161],"applications.":[164]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":28},{"year":2024,"cited_by_count":37},{"year":2023,"cited_by_count":21},{"year":2022,"cited_by_count":27},{"year":2021,"cited_by_count":27},{"year":2020,"cited_by_count":13}],"updated_date":"2026-07-17T09:13:05.818461","created_date":"2025-10-10T00:00:00"}