{"id":"https://openalex.org/W4320713315","doi":"https://doi.org/10.1109/tifs.2023.3245413","title":"A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection","display_name":"A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4320713315","doi":"https://doi.org/10.1109/tifs.2023.3245413"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2023.3245413","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3245413","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088015912","display_name":"Ximing Li","orcid":"https://orcid.org/0000-0002-2740-3470"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ximing Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2740-3470","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100673949","display_name":"Xiaoyong Li","orcid":"https://orcid.org/0000-0001-5597-9306"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyong Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-5597-9306","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100405572","display_name":"Jia Jia","orcid":"https://orcid.org/0000-0002-7336-4003"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jia Jia","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-7336-4003","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101967550","display_name":"Linghui Li","orcid":"https://orcid.org/0000-0002-7614-3142"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Linghui Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100732965","display_name":"Jie Yuan","orcid":"https://orcid.org/0000-0002-4456-7987"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jie Yuan","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-4456-7987","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075909729","display_name":"Yali Gao","orcid":"https://orcid.org/0000-0003-0458-8481"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yali Gao","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005228053","display_name":"Shui Yu","orcid":"https://orcid.org/0000-0003-4485-6743"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Shui Yu","raw_affiliation_strings":["School of Computer Science, University of Technology Sydney, Ultimo, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0003-4485-6743","affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Technology Sydney, Ultimo, NSW, Australia","institution_ids":["https://openalex.org/I114017466"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":8.4225,"has_fulltext":false,"cited_by_count":48,"citation_normalized_percentile":{"value":0.9809154,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":"18","issue":null,"first_page":"1638","last_page":"1652"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8503060340881348},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.567789614200592},{"id":"https://openalex.org/keywords/graph-embedding","display_name":"Graph embedding","score":0.5644063353538513},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5359097123146057},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.5347693562507629},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4980344772338867},{"id":"https://openalex.org/keywords/dual","display_name":"Dual (grammatical number)","score":0.48181310296058655},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.4696086347103119},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4585305452346802},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3977739214897156},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3570401668548584},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.3420652747154236},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3341038227081299}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8503060340881348},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.567789614200592},{"id":"https://openalex.org/C75564084","wikidata":"https://www.wikidata.org/wiki/Q5597085","display_name":"Graph embedding","level":3,"score":0.5644063353538513},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5359097123146057},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.5347693562507629},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4980344772338867},{"id":"https://openalex.org/C2780980858","wikidata":"https://www.wikidata.org/wiki/Q110022","display_name":"Dual (grammatical number)","level":2,"score":0.48181310296058655},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.4696086347103119},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4585305452346802},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3977739214897156},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3570401668548584},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.3420652747154236},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3341038227081299},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C142362112","wikidata":"https://www.wikidata.org/wiki/Q735","display_name":"Art","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C124952713","wikidata":"https://www.wikidata.org/wiki/Q8242","display_name":"Literature","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2023.3245413","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3245413","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6600000262260437}],"awards":[{"id":"https://openalex.org/G2994044281","display_name":null,"funder_award_id":"62002028","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5884991085","display_name":null,"funder_award_id":"62102040","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7289417769","display_name":null,"funder_award_id":"62202066","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W1242748811","https://openalex.org/W1859925930","https://openalex.org/W1967024415","https://openalex.org/W1991210879","https://openalex.org/W2144182447","https://openalex.org/W2190692258","https://openalex.org/W2558460151","https://openalex.org/W2560934771","https://openalex.org/W2755572540","https://openalex.org/W2767094836","https://openalex.org/W2782500360","https://openalex.org/W2784814091","https://openalex.org/W2790664081","https://openalex.org/W2889727957","https://openalex.org/W2891432086","https://openalex.org/W2907492528","https://openalex.org/W2912868009","https://openalex.org/W2945848398","https://openalex.org/W2963066159","https://openalex.org/W2963673968","https://openalex.org/W2964321699","https://openalex.org/W2986944522","https://openalex.org/W2998249317","https://openalex.org/W3008932301","https://openalex.org/W3011124515","https://openalex.org/W3103553961","https://openalex.org/W3128443161","https://openalex.org/W3197991612","https://openalex.org/W4288083473","https://openalex.org/W6637178625","https://openalex.org/W6726873649","https://openalex.org/W6738964360","https://openalex.org/W6743841043","https://openalex.org/W6743866659","https://openalex.org/W6745040976","https://openalex.org/W6745537798","https://openalex.org/W6748799445","https://openalex.org/W6757713970","https://openalex.org/W6760001035","https://openalex.org/W6762445188","https://openalex.org/W6766978945","https://openalex.org/W6771621015"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"Insider":[0],"threat":[1,65],"is":[2,70,104,151],"destructive":[3],"and":[4,23,62,75,87,91,113,136,169,180,207,211],"concealable,":[5],"making":[6],"addressing":[7],"it":[8],"a":[9,55,99,216],"challenging":[10],"task":[11],"in":[12,34,42,81,163],"cybersecurity.":[13],"Most":[14],"existing":[15],"methods":[16],"transform":[17],"user":[18,25,73,89],"behavior":[19,26,90,142],"into":[20,78,93,144],"sequential":[21],"information":[22,30,77,143,203,209],"analyze":[24],"while":[27],"neglecting":[28],"structural":[29,76,205],"among":[31,116],"users,":[32],"resulting":[33],"high":[35,60],"false":[36],"positives.":[37],"To":[38,96],"solve":[39],"this":[40,43,97],"problem,":[41],"paper,":[44],"we":[45],"propose":[46],"Dual-Domain":[47],"Graph":[48],"Convolutional":[49],"Network":[50],"(referred":[51],"to":[52,71,106,120,153,174,183],"as":[53,119],"DD-GCN),":[54],"graph-based":[56],"modularized":[57],"method":[58],"for":[59],"accuracy":[61,214],"adaptive":[63,156],"insider":[64],"detection.":[66],"The":[67,167],"central":[68],"idea":[69],"convert":[72,141],"features":[74,162],"heterogeneous":[79],"graphs":[80],"the":[82,108,122,132,155,160,164,176,181,200],"light":[83],"of":[84,111,159],"various":[85],"relationships":[86],"take":[88],"relationship":[92],"account":[94],"together.":[95],"end,":[98],"weighted":[100],"feature":[101,109,208],"similarity":[102,110],"mechanism":[103,150],"applied":[105,152],"balance":[107],"users":[112],"original":[114,133],"linkages":[115],"them":[117],"so":[118],"generate":[121],"fused":[123,137],"structure.":[124],"Next,":[125],"specific":[126],"graph":[127],"embeddings":[128],"are":[129,172],"extracted":[130],"from":[131,204],"topology":[134,206],"structure":[135,138],"simultaneously,":[139],"which":[140],"high-level":[145],"representations.":[146],"Furthermore,":[147],"an":[148],"attention":[149],"learn":[154],"importance":[157],"weights":[158],"user\u2019s":[161],"corresponding":[165],"embedding.":[166],"combination":[168],"difference":[170],"constraints":[171],"proposed":[173,197],"enhance":[175],"learned":[177],"embeddings\u2019":[178],"commonality":[179],"ability":[182],"capture":[184],"different":[185],"information.":[186],"Extensive":[187],"experiments":[188],"on":[189],"two":[190],"real-world":[191],"datasets":[192],"clearly":[193],"show":[194],"that":[195],"our":[196],"DD-GCN":[198],"extracts":[199],"most":[201],"correlated":[202],"substantially,":[210],"achieves":[212],"improved":[213],"with":[215],"clear":[217],"margin.":[218]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":25},{"year":2024,"cited_by_count":15},{"year":2023,"cited_by_count":4}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}