{"id":"https://openalex.org/W2609425150","doi":"https://doi.org/10.1109/pst.2016.7906928","title":"Building robust temporal user profiles for anomaly detection in file system accesses","display_name":"Building robust temporal user profiles for anomaly detection in file system accesses","publication_year":2016,"publication_date":"2016-12-01","ids":{"openalex":"https://openalex.org/W2609425150","doi":"https://doi.org/10.1109/pst.2016.7906928","mag":"2609425150"},"language":"en","primary_location":{"id":"doi:10.1109/pst.2016.7906928","is_oa":false,"landing_page_url":"https://doi.org/10.1109/pst.2016.7906928","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2016 14th Annual Conference on Privacy, Security and Trust (PST)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5032020253","display_name":"Shagufta Mehnaz","orcid":"https://orcid.org/0000-0001-5850-4568"},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shagufta Mehnaz","raw_affiliation_strings":["Department of Computer Science, Purdue University, West Lafayette, IN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Purdue University, West Lafayette, IN, USA","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5061694501","display_name":"Elisa Bertino","orcid":"https://orcid.org/0000-0002-4029-7051"},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elisa Bertino","raw_affiliation_strings":["Department of Computer Science, Purdue University, West Lafayette, IN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Purdue University, West Lafayette, IN, USA","institution_ids":["https://openalex.org/I219193219"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I219193219"],"apc_list":null,"apc_paid":null,"fwci":1.515,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.83489238,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"207","last_page":"210"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8443906307220459},{"id":"https://openalex.org/keywords/timestamp","display_name":"Timestamp","score":0.6464262008666992},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6054710149765015},{"id":"https://openalex.org/keywords/file-system","display_name":"File system","score":0.506799042224884},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.38458818197250366},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3157728612422943},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.1798391044139862}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8443906307220459},{"id":"https://openalex.org/C113954288","wikidata":"https://www.wikidata.org/wiki/Q186885","display_name":"Timestamp","level":2,"score":0.6464262008666992},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6054710149765015},{"id":"https://openalex.org/C2780940931","wikidata":"https://www.wikidata.org/wiki/Q174989","display_name":"File system","level":2,"score":0.506799042224884},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.38458818197250366},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3157728612422943},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1798391044139862}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/pst.2016.7906928","is_oa":false,"landing_page_url":"https://doi.org/10.1109/pst.2016.7906928","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2016 14th Annual Conference on Privacy, Security and Trust (PST)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.4300000071525574,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320307065","display_name":"Schlumberger Foundation","ror":"https://ror.org/03daw3m97"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W76547152","https://openalex.org/W319519186","https://openalex.org/W1506285740","https://openalex.org/W1653505105","https://openalex.org/W1974205438","https://openalex.org/W1995976200","https://openalex.org/W2062293785","https://openalex.org/W2089303860","https://openalex.org/W2123840312","https://openalex.org/W2125227861","https://openalex.org/W2142889610","https://openalex.org/W2147247575","https://openalex.org/W2153567088","https://openalex.org/W2204970668","https://openalex.org/W4237382446","https://openalex.org/W4249961056","https://openalex.org/W6603089473","https://openalex.org/W6611187172","https://openalex.org/W6630198464"],"related_works":["https://openalex.org/W2060561905","https://openalex.org/W1417711376","https://openalex.org/W2032260263","https://openalex.org/W1986883493","https://openalex.org/W2469862403","https://openalex.org/W2166378262","https://openalex.org/W2035891203","https://openalex.org/W4379524643","https://openalex.org/W2011027677","https://openalex.org/W2367807705"],"abstract_inverted_index":{"Protecting":[0],"sensitive":[1,59],"data":[2,24,226],"against":[3],"malicious":[4],"or":[5,28],"compromised":[6],"insiders":[7,15],"is":[8,79,92,121],"a":[9,101,113,122,126,160,223,237],"big":[10],"concern.":[11],"In":[12,151,186],"most":[13,128],"cases,":[14],"have":[16],"authorized":[17],"access":[18,67,87,98,184],"in":[19,55],"file":[20,42,114,169,174,205],"systems":[21],"containing":[22],"such":[23,62],"which":[25],"they":[26],"misuse":[27],"exfiltrate":[29],"for":[30],"financial":[31],"profit.":[32],"Moreover,":[33],"external":[34],"parties":[35],"can":[36],"compromise":[37],"identity":[38],"credentials":[39],"of":[40,47,89,100,109,118,129,168,203,233],"valid":[41],"system":[43,175,206],"users":[44],"by":[45,177,197],"means":[46],"exploiting":[48],"security":[49,64],"vulnerabilities,":[50],"phishing":[51],"attacks":[52],"etc.":[53],"Therefore,":[54],"order":[56],"to":[57,106,142],"protect":[58],"information":[60,202],"from":[61,95,136],"attackers,":[63],"measures,":[65],"e.g.,":[66],"control":[68],"and":[69,146,208,218],"encryption":[70],"are":[71],"often":[72],"combined":[73],"with":[74,112],"anomaly":[75,132],"detection.":[76],"Anomaly":[77],"detection":[78,133],"based":[80],"on":[81,182,236],"the":[82,86,96,107,116,130,164,183,187,200,212,215,231],"key":[83],"observation":[84],"that":[85,140,158,171],"behavior":[88],"an":[90,156],"attacker":[91],"significantly":[93],"different":[94],"regular":[97],"pattern":[99],"benign":[102],"user.":[103],"However,":[104],"due":[105],"complexity":[108],"users'":[110,165,204,216],"interactions":[111],"system,":[115],"modeling":[117],"user":[119,138,195],"profiles":[120,139,196],"challenging":[123],"problem.":[124],"As":[125],"result,":[127],"existing":[131],"techniques":[134],"suffer":[135],"poor":[137],"contribute":[141],"high":[143,147],"false":[144,148],"positive":[145],"negative":[149],"rates.":[150],"this":[152],"paper,":[153],"we":[154,229],"propose":[155],"approach":[157,191,235],"as":[159],"first":[161],"step":[162],"discovers":[163],"tasks":[166,217],"(sets":[167],"accesses":[170,207],"represent":[172],"distinct":[173],"activities)":[176],"applying":[178],"frequent":[179],"sequence":[180],"mining":[181],"log.":[185],"next":[188],"step,":[189],"our":[190,234],"builds":[192],"robust":[193],"temporal":[194,220,225],"extensively":[198],"analyzing":[199],"timestamp":[201],"thus":[209],"precisely":[210],"models":[211],"relation":[213],"between":[214],"their":[219],"properties":[221],"using":[222],"multilevel":[224],"structure.":[227],"Finally,":[228],"evaluate":[230],"performance":[232],"real":[238],"dataset.":[239]},"counts_by_year":[{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}