{"id":"https://openalex.org/W2395792877","doi":"https://doi.org/10.1109/tifs.2016.2571679","title":"Temporal and Spatial Locality: An Abstraction for Masquerade Detection","display_name":"Temporal and Spatial Locality: An Abstraction for Masquerade Detection","publication_year":2016,"publication_date":"2016-05-23","ids":{"openalex":"https://openalex.org/W2395792877","doi":"https://doi.org/10.1109/tifs.2016.2571679","mag":"2395792877"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2016.2571679","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2016.2571679","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5023273591","display_name":"J. Benito Cami\u00f1a","orcid":"https://orcid.org/0000-0002-6195-8226"},"institutions":[{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"J. Benito Camina","raw_affiliation_strings":["Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico"],"raw_orcid":"https://orcid.org/0000-0002-6195-8226","affiliations":[{"raw_affiliation_string":"Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico","institution_ids":["https://openalex.org/I98461037"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045469910","display_name":"Ra\u00fal Monroy","orcid":"https://orcid.org/0000-0002-3465-995X"},"institutions":[{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Raul Monroy","raw_affiliation_strings":["Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico","institution_ids":["https://openalex.org/I98461037"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011568579","display_name":"Luis A. Trejo","orcid":"https://orcid.org/0000-0001-9741-4581"},"institutions":[{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Luis A. Trejo","raw_affiliation_strings":["Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico","institution_ids":["https://openalex.org/I98461037"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5084352657","display_name":"Miguel Angel Medina\u2010P\u00e9rez","orcid":"https://orcid.org/0000-0003-4511-2252"},"institutions":[{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Miguel Angel Medina-Perez","raw_affiliation_strings":["Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Escuela de Ingenier\u00eda y Ciencias, Tecnol\u00f3gico de Monterrey, Atizap\u00e1n, Mexico","institution_ids":["https://openalex.org/I98461037"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I98461037"],"apc_list":null,"apc_paid":null,"fwci":2.7508,"has_fulltext":false,"cited_by_count":21,"citation_normalized_percentile":{"value":0.91096883,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":"11","issue":"9","first_page":"2036","last_page":"2051"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8945510387420654},{"id":"https://openalex.org/keywords/locality","display_name":"Locality","score":0.8592829704284668},{"id":"https://openalex.org/keywords/abstraction","display_name":"Abstraction","score":0.6759674549102783},{"id":"https://openalex.org/keywords/locality-of-reference","display_name":"Locality of reference","score":0.6487380266189575},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.5599575042724609},{"id":"https://openalex.org/keywords/object","display_name":"Object (grammar)","score":0.5444697737693787},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5061494708061218},{"id":"https://openalex.org/keywords/transformation","display_name":"Transformation (genetics)","score":0.49954700469970703},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4612480700016022},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3947224020957947},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3756679892539978},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3549901247024536},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.23078733682632446},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.15512531995773315}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8945510387420654},{"id":"https://openalex.org/C2779808786","wikidata":"https://www.wikidata.org/wiki/Q6664603","display_name":"Locality","level":2,"score":0.8592829704284668},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.6759674549102783},{"id":"https://openalex.org/C27602214","wikidata":"https://www.wikidata.org/wiki/Q1868547","display_name":"Locality of reference","level":3,"score":0.6487380266189575},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.5599575042724609},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.5444697737693787},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5061494708061218},{"id":"https://openalex.org/C204241405","wikidata":"https://www.wikidata.org/wiki/Q461499","display_name":"Transformation (genetics)","level":3,"score":0.49954700469970703},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4612480700016022},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3947224020957947},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3756679892539978},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3549901247024536},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.23078733682632446},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.15512531995773315},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2016.2571679","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2016.2571679","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321739","display_name":"Consejo Nacional de Ciencia y Tecnolog\u00eda","ror":"https://ror.org/059ex5q34"},{"id":"https://openalex.org/F4320323037","display_name":"Instituto Tecnol\u00f3gico y de Estudios Superiores de Monterrey","ror":"https://ror.org/03ayjn504"},{"id":"https://openalex.org/F4320323839","display_name":"Universidad Aut\u00f3noma del Estado de Hidalgo","ror":"https://ror.org/031f8kt38"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W104561821","https://openalex.org/W135638923","https://openalex.org/W168451370","https://openalex.org/W185485033","https://openalex.org/W1186123259","https://openalex.org/W1540045721","https://openalex.org/W1563678058","https://openalex.org/W1653505105","https://openalex.org/W1898491644","https://openalex.org/W1973704753","https://openalex.org/W1977470670","https://openalex.org/W1988199853","https://openalex.org/W1995919426","https://openalex.org/W2010725470","https://openalex.org/W2066453892","https://openalex.org/W2068244095","https://openalex.org/W2085402400","https://openalex.org/W2107589078","https://openalex.org/W2121386169","https://openalex.org/W2136040021","https://openalex.org/W2140177734","https://openalex.org/W2142638723","https://openalex.org/W2149495928","https://openalex.org/W2150847526","https://openalex.org/W2156542272","https://openalex.org/W2204970668","https://openalex.org/W2405480157","https://openalex.org/W2911964244","https://openalex.org/W3120740533","https://openalex.org/W4244939384","https://openalex.org/W4248018214","https://openalex.org/W6604301894","https://openalex.org/W6606840085","https://openalex.org/W6649564924","https://openalex.org/W6652820514","https://openalex.org/W6680581110"],"related_works":["https://openalex.org/W1555349535","https://openalex.org/W2583128298","https://openalex.org/W2053359564","https://openalex.org/W2161159383","https://openalex.org/W1495260638","https://openalex.org/W1511204342","https://openalex.org/W2369125128","https://openalex.org/W2369223577","https://openalex.org/W2010020348","https://openalex.org/W2085845213"],"abstract_inverted_index":{"Most":[0],"studies":[1],"in":[2,35,66,119,126,212],"masquerade":[3,75,188],"detection":[4],"focus":[5],"mainly":[6],"on":[7,169,193],"the":[8,12,36,53,86,140,200,204],"user":[9,60,185],"action,":[10],"ignoring":[11],"object":[13,54],"upon":[14],"which":[15,95],"that":[16,52,109],"action":[17],"is":[18,49,55,152,161],"performed.":[19],"This":[20],"may":[21],"yield":[22],"limited":[23],"models,":[24],"since,":[25],"for":[26,187],"example,":[27],"command":[28],"execution":[29],"(an":[30],"action)":[31],"usually":[32],"ends":[33],"up":[34],"transformation":[37],"of":[38,46,99,142,172,203,210,216],"a":[39,59,62,71,127,170],"file":[40,78],"(the":[41],"object).":[42],"The":[43],"overall":[44],"goal":[45],"this":[47,65,132],"paper":[48],"to":[50,57,74,115,124,144,147,154,164,222],"prove":[51],"paramount":[56],"distinguishing":[58],"from":[61],"masquerade.":[63],"With":[64],"mind,":[67],"we":[68,134],"have":[69,107,175],"developed":[70],"new":[72],"approach":[73,111,195],"detection,":[76],"called":[77,138],"system":[79],"navigation,":[80],"and":[81,88,157],"tested":[82],"our":[83,110,178,194],"ideas":[84],"using":[85],"Windows-Users":[87],"Windows-Intruder":[89],"simulations":[90],"Logs":[91],"Data":[92],"set,":[93],"(WUIL)":[94],"unlike":[96],"other":[97],"datasets":[98],"its":[100],"kind":[101],"includes":[102],"close-to-real":[103],"simulated":[104],"attacks.":[105],"We":[106,174],"shown":[108],"makes":[112],"it":[113,167],"possible":[114],"capture":[116,184],"computer":[117],"behavior":[118,186],"an":[120,136,197,219],"abstract":[121],"way":[122],"difficult":[123],"realize":[125],"purely":[128],"action-based":[129],"approach.":[130],"In":[131],"paper,":[133],"introduce":[135],"abstraction":[137],"locality,":[139],"tendency":[141],"programs":[143],"cluster":[145],"references":[146],"memory.":[148],"While":[149],"temporal":[150],"locality":[151,160],"applicable":[153],"both":[155],"actions":[156],"objects,":[158,165],"spatial":[159],"more":[162],"suitable":[163],"as":[166],"depends":[168],"notion":[171],"position.":[173],"successfully":[176],"validated":[177],"working":[179],"hypothesis:":[180],"locality-based":[181],"features":[182],"better":[183],"detection.":[189],"Particularly,":[190],"results":[191],"based":[192],"report":[196],"Area":[198],"Under":[199],"Curve":[201],"(AUC)":[202],"receiver":[205],"operating":[206],"characteristic":[207],"curve":[208],"value":[209],"0.97":[211],"average":[213],"with":[214],"30%":[215],"users":[217],"having":[218],"AUC":[220],"equal":[221],"or":[223],"above":[224],"0.99.":[225]},"counts_by_year":[{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":2},{"year":2019,"cited_by_count":5},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}