{"id":"https://openalex.org/W3011330084","doi":"https://doi.org/10.1109/milcom47813.2019.9020931","title":"Warder: Online Insider Threat Detection System Using Multi-Feature Modeling and Graph-Based Correlation","display_name":"Warder: Online Insider Threat Detection System Using Multi-Feature Modeling and Graph-Based Correlation","publication_year":2019,"publication_date":"2019-11-01","ids":{"openalex":"https://openalex.org/W3011330084","doi":"https://doi.org/10.1109/milcom47813.2019.9020931","mag":"3011330084"},"language":"en","primary_location":{"id":"doi:10.1109/milcom47813.2019.9020931","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom47813.2019.9020931","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102722080","display_name":"Jianguo Jiang","orcid":"https://orcid.org/0000-0002-0947-9500"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianguo Jiang","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030204749","display_name":"Jiuming Chen","orcid":null},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiuming Chen","raw_affiliation_strings":["Department of Computer Science, University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109946639","display_name":"Tianbo Gu","orcid":null},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tianbo Gu","raw_affiliation_strings":["Department of Computer Science, University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001746807","display_name":"Kim\u2010Kwang Raymond Choo","orcid":"https://orcid.org/0000-0001-9208-5336"},"institutions":[{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kim-Kwang Raymond Choo","raw_affiliation_strings":["Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, USA","University of Texas at San Antonio,Department of Information Systems and Cyber Security,San Antonio,TX,USA,78249"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, USA","institution_ids":["https://openalex.org/I45438204"]},{"raw_affiliation_string":"University of Texas at San Antonio,Department of Information Systems and Cyber Security,San Antonio,TX,USA,78249","institution_ids":["https://openalex.org/I45438204"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100701272","display_name":"Chao Liu","orcid":"https://orcid.org/0000-0001-6253-0304"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chao Liu","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081445180","display_name":"Min Yu","orcid":"https://orcid.org/0000-0003-4371-7864"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yu","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101637573","display_name":"Weiqing Huang","orcid":"https://orcid.org/0000-0002-9155-4177"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiqing Huang","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5086439160","display_name":"Prasant Mohapatra","orcid":"https://orcid.org/0000-0002-2768-5308"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Prasant Mohapatra","raw_affiliation_strings":["Department of Computer Science, University of California, Davis, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of California, Davis, CA, USA","institution_ids":["https://openalex.org/I84218800"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":14,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9965000152587891,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10994","display_name":"Terrorism, Counterterrorism, and Political Violence","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.8918545842170715},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8406083583831787},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.6742922067642212},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.6166254281997681},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.5970754623413086},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5219130516052246},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5071604251861572},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.49921298027038574},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.45373740792274475},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.44601231813430786},{"id":"https://openalex.org/keywords/database-transaction","display_name":"Database transaction","score":0.41471365094184875},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.38483762741088867},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3401133418083191},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.10615554451942444},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.09643936157226562}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.8918545842170715},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8406083583831787},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.6742922067642212},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.6166254281997681},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5970754623413086},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5219130516052246},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5071604251861572},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.49921298027038574},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.45373740792274475},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.44601231813430786},{"id":"https://openalex.org/C75949130","wikidata":"https://www.wikidata.org/wiki/Q848010","display_name":"Database transaction","level":2,"score":0.41471365094184875},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38483762741088867},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3401133418083191},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.10615554451942444},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.09643936157226562},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/milcom47813.2019.9020931","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom47813.2019.9020931","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.8100000023841858,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W1458873377","https://openalex.org/W1971756996","https://openalex.org/W1991210879","https://openalex.org/W2025519999","https://openalex.org/W2034794430","https://openalex.org/W2488112254","https://openalex.org/W2564461987","https://openalex.org/W2794292457","https://openalex.org/W2885040798","https://openalex.org/W2885724973","https://openalex.org/W2886566865","https://openalex.org/W2887742767","https://openalex.org/W2888160480","https://openalex.org/W2903781571","https://openalex.org/W2906774965"],"related_works":["https://openalex.org/W4205304595","https://openalex.org/W1499596878","https://openalex.org/W2075012963","https://openalex.org/W2600341711","https://openalex.org/W2984824917","https://openalex.org/W2161754059","https://openalex.org/W1489373009","https://openalex.org/W2001702225","https://openalex.org/W2411226021","https://openalex.org/W2147780605"],"abstract_inverted_index":{"Existing":[0],"insider":[1,36,92],"threat":[2,37,93,120,124,136,156],"detection":[3,38,82,94],"models":[4],"and":[5,11,45,68,80,106,109,155,180],"frameworks":[6],"generally":[7],"focus":[8,55],"on":[9,56],"characterizing":[10],"detecting":[12],"malicious":[13],"insiders,":[14],"for":[15,71],"example":[16],"by":[17],"fusing":[18],"behavioral":[19,61],"analysis,":[20],"machine":[21],"learning,":[22],"psychological":[23],"characters,":[24],"management":[25],"measures,":[26],"etc.":[27],"However,":[28],"it":[29],"remains":[30],"challenging":[31],"to":[32,112,118,130,138],"design":[33],"a":[34,48,89,114],"practical":[35],"scheme":[39],"that":[40,173,188],"can":[41,146],"be":[42,148],"efficiently":[43],"implemented":[44],"deployed":[46],"in":[47,76],"real-world":[49],"system.":[50],"For":[51],"example,":[52],"existing":[53],"approaches":[54,175],"extracting":[57],"features":[58,111,154],"from":[59,176,184],"user":[60],"activities":[62,134],"but":[63],"they":[64],"lack":[65],"in-depth":[66],"correlation":[67],"decision":[69],"making":[70],"suspected":[72],"alerts;":[73],"thus,":[74],"resulting":[75],"high":[77],"false":[78],"positives":[79],"low":[81],"accuracy.":[83],"In":[84,143],"this":[85],"work,":[86],"we":[87],"propose":[88],"novel":[90],"online":[91],"system,":[95],"Warder,":[96],"which":[97],"leverages":[98],"diverse":[99],"feature":[100,126],"dimensions":[101],"(using":[102],"neural":[103],"language":[104],"processing)":[105],"fuses":[107],"content":[108],"behavior":[110],"create":[113],"user's":[115],"daily":[116],"profile":[117],"facilitate":[119],"detection.":[121],"Besides,":[122],"hypergraph-based":[123],"scenario":[125],"tree":[127],"is":[128],"designed":[129],"correlate":[131],"suspicious":[132],"users'":[133],"with":[135],"scenarios":[137],"further":[139],"screen":[140],"the":[141,160,165,177,185,191],"users.":[142],"practice,":[144],"Warder":[145,163,189],"also":[147],"constantly":[149],"updated":[150],"using":[151,164],"newly":[152],"discovered":[153],"scenarios.":[157],"We":[158],"evaluate":[159],"performance":[161],"of":[162,174],"public":[166],"CMU":[167,181],"CERT":[168],"dataset,":[169],"as":[170,172],"well":[171],"Oxford":[178],"group":[179],"group.":[182],"Findings":[183],"evaluation":[186],"demonstrate":[187],"outperforms":[190],"other":[192],"two":[193],"competing":[194],"approaches.":[195]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}