{"id":"https://openalex.org/W4285612255","doi":"https://doi.org/10.1109/tifs.2022.3191493","title":"Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security","display_name":"Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security","publication_year":2022,"publication_date":"2022-01-01","ids":{"openalex":"https://openalex.org/W4285612255","doi":"https://doi.org/10.1109/tifs.2022.3191493"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2022.3191493","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3191493","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100417007","display_name":"Cheng Wang","orcid":"https://orcid.org/0000-0002-4752-0316"},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]},{"id":"https://openalex.org/I1327237609","display_name":"Ministry of Education of the People's Republic of China","ror":"https://ror.org/01mv9t934","country_code":"CN","type":"government","lineage":["https://openalex.org/I1327237609","https://openalex.org/I4210127390"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cheng Wang","raw_affiliation_strings":["Department of Computer Science and Engineering, Tongji University, Shanghai, China","Key Laboratory of Embedded System and Service Computing, Ministry of Education, China"],"raw_orcid":"https://orcid.org/0000-0002-4752-0316","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]},{"raw_affiliation_string":"Key Laboratory of Embedded System and Service Computing, Ministry of Education, China","institution_ids":["https://openalex.org/I1327237609"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5054508795","display_name":"Hangyu Zhu","orcid":"https://orcid.org/0000-0001-7221-9130"},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]},{"id":"https://openalex.org/I1327237609","display_name":"Ministry of Education of the People's Republic of China","ror":"https://ror.org/01mv9t934","country_code":"CN","type":"government","lineage":["https://openalex.org/I1327237609","https://openalex.org/I4210127390"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hangyu Zhu","raw_affiliation_strings":["Department of Computer Science and Engineering, Tongji University, Shanghai, China","Key Laboratory of Embedded System and Service Computing, Ministry of Education, China"],"raw_orcid":"https://orcid.org/0000-0001-7221-9130","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]},{"raw_affiliation_string":"Key Laboratory of Embedded System and Service Computing, Ministry of Education, China","institution_ids":["https://openalex.org/I1327237609"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.7051,"has_fulltext":false,"cited_by_count":69,"citation_normalized_percentile":{"value":0.97456774,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":"17","issue":null,"first_page":"2703","last_page":"2718"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/behavioral-modeling","display_name":"Behavioral modeling","score":0.7451735138893127},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7210921049118042},{"id":"https://openalex.org/keywords/behavioral-pattern","display_name":"Behavioral pattern","score":0.6708511114120483},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.646904706954956},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6339001655578613},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.48966506123542786},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4679977297782898},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.4430193305015564},{"id":"https://openalex.org/keywords/property","display_name":"Property (philosophy)","score":0.4101719856262207},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.40317025780677795},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3512982726097107},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.35039621591567993},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3408064842224121},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.27955684065818787}],"concepts":[{"id":"https://openalex.org/C78639753","wikidata":"https://www.wikidata.org/wiki/Q3318160","display_name":"Behavioral modeling","level":2,"score":0.7451735138893127},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7210921049118042},{"id":"https://openalex.org/C83804111","wikidata":"https://www.wikidata.org/wiki/Q1063558","display_name":"Behavioral pattern","level":2,"score":0.6708511114120483},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.646904706954956},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6339001655578613},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.48966506123542786},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4679977297782898},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.4430193305015564},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.4101719856262207},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.40317025780677795},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3512982726097107},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35039621591567993},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3408064842224121},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.27955684065818787},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2022.3191493","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3191493","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7799999713897705}],"awards":[{"id":"https://openalex.org/G1754873590","display_name":"\u9762\u5411\u7ebf\u4e0a\u8eab\u4efd\u8ba4\u8bc1\u7684\u7528\u6237\u5408\u6210\u884c\u4e3a\u5efa\u6a21\u53ca\u6027\u80fd\u57fa\u672c\u6781\u9650\u7814\u7a76","funder_award_id":"61972287","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2290276069","display_name":null,"funder_award_id":"22120210524","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null},{"id":"https://openalex.org/F4320335796","display_name":"Program of Shanghai Academic Research Leader","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":52,"referenced_works":["https://openalex.org/W1670263352","https://openalex.org/W1991210879","https://openalex.org/W2008224380","https://openalex.org/W2110953678","https://openalex.org/W2154868463","https://openalex.org/W2158698691","https://openalex.org/W2187846933","https://openalex.org/W2267339884","https://openalex.org/W2274083067","https://openalex.org/W2564068158","https://openalex.org/W2614763420","https://openalex.org/W2723293840","https://openalex.org/W2739747431","https://openalex.org/W2767774008","https://openalex.org/W2783272285","https://openalex.org/W2793768763","https://openalex.org/W2799947440","https://openalex.org/W2808771744","https://openalex.org/W2896429681","https://openalex.org/W2907492528","https://openalex.org/W2914998214","https://openalex.org/W2930110112","https://openalex.org/W2945996535","https://openalex.org/W2949848919","https://openalex.org/W2950317798","https://openalex.org/W2954152666","https://openalex.org/W2962975498","https://openalex.org/W2964296635","https://openalex.org/W2966779056","https://openalex.org/W2979743032","https://openalex.org/W2986944522","https://openalex.org/W2997668353","https://openalex.org/W2998895714","https://openalex.org/W3012650537","https://openalex.org/W3023056190","https://openalex.org/W3029610479","https://openalex.org/W3040389479","https://openalex.org/W3080169369","https://openalex.org/W3100821813","https://openalex.org/W3104030692","https://openalex.org/W3119160111","https://openalex.org/W3136205675","https://openalex.org/W3137205257","https://openalex.org/W3153421894","https://openalex.org/W3170720134","https://openalex.org/W3211888892","https://openalex.org/W6745537798","https://openalex.org/W6748102297","https://openalex.org/W6760203611","https://openalex.org/W6767098714","https://openalex.org/W6796927292","https://openalex.org/W6799892437"],"related_works":["https://openalex.org/W3153493802","https://openalex.org/W3039513780","https://openalex.org/W2898158700","https://openalex.org/W2152238375","https://openalex.org/W3088948716","https://openalex.org/W432535052","https://openalex.org/W2488112254","https://openalex.org/W4210491229","https://openalex.org/W4384559558","https://openalex.org/W4285612255"],"abstract_inverted_index":{"The":[0],"so-calledbehavioral":[1],"anomaly":[2,120,164],"detection(BAD)":[3],"is":[4,155,180],"expected":[5],"to":[6,52,159],"solve":[7],"effectively":[8],"a":[9,27,89,104,113,173],"variety":[10],"of":[11,22,77,98,108,117,128,151,170],"security":[12,185],"issues":[13],"by":[14,46,88,166,182],"detecting":[15],"the":[16,60,73,95,115,125,149,156],"deviances":[17],"from":[18],"normal":[19],"behavioral":[20,30,56,61,68,81,96,109,119,130,140,146,161],"patterns":[21,97],"protected":[23],"agents.":[24],"We":[25],"propose":[26],"new":[28],"graph-based":[29],"modeling":[31,162],"paradigm":[32],"for":[33,112,163],"BAD":[34],"problem,":[35],"namedbehavioral":[36],"identification":[37],"graph(BIG),":[38],"which":[39,134],"has":[40],"distinct":[41],"advantages":[42],"over":[43],"existing":[44],"methods":[45],"mining":[47],"deeply":[48],"theproperty-level(as":[49],"an":[50],"enhancement":[51],"theevent-level)":[53],"associations":[54,66,169],"in":[55,67],"data.":[57],"Under":[58],"BIG,":[59],"properties":[62,82,133,141],"and":[63,75,83,94,132,142,176],"their":[64],"co-occurrence":[65],"data":[69],"are":[70,85,100],"modeled":[71],"as":[72,103],"entities":[74],"relationships":[76],"graph,":[78],"respectively;":[79],"furthermore,":[80],"events":[84],"both":[86,136],"vectorized":[87],"devised":[90],"event-property":[91],"composite":[92],"model,":[93],"agents":[99],"finally":[101],"represented":[102],"multidimensional":[105],"spatial":[106,126],"distribution":[107],"properties.":[110],"Consequently,":[111],"behavior,":[114],"intensity":[116],"its":[118,129],"can":[121],"be":[122],"transformed":[123],"into":[124,172],"decentrality":[127],"agent":[131],"contain":[135],"fine-grained":[137],"information":[138,144,205],"between":[139,145],"coarse-grained":[143],"events.":[147],"To":[148],"best":[150],"our":[152],"knowledge,":[153],"this":[154],"first":[157],"work":[158],"improve":[160],"detection":[165],"integratinginter(event-level)":[167],"andintra(property-level)":[168],"behaviors":[171],"unified":[174],"graph":[175],"space.":[177],"Our":[178],"method":[179],"validated":[181],"four":[183],"representative":[184],"issues,":[186],"i.e.,fraud":[187],"detectionin":[188,195,203,211],"online":[189],"payment":[190],"services":[191,198,214],"(by":[192,199,207,215],"transaction":[193],"behaviors),intrusion":[194],"network":[196],"communication":[197],"traffic":[200],"behaviors),insider":[201],"threat":[202],"organizational":[204],"systems":[206],"system":[208],"behaviors),":[209],"andcompromise":[210],"social":[212],"networking":[213],"trajectory":[216],"behaviors).":[217]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":25},{"year":2024,"cited_by_count":23},{"year":2023,"cited_by_count":10},{"year":2022,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}