{"id":"https://openalex.org/W4400728137","doi":"https://doi.org/10.1109/tifs.2024.3430106","title":"GMFITD: Graph Meta-Learning for Effective Few-Shot Insider Threat Detection","display_name":"GMFITD: Graph Meta-Learning for Effective Few-Shot Insider Threat Detection","publication_year":2024,"publication_date":"2024-01-01","ids":{"openalex":"https://openalex.org/W4400728137","doi":"https://doi.org/10.1109/tifs.2024.3430106"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2024.3430106","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3430106","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088015912","display_name":"Ximing Li","orcid":"https://orcid.org/0000-0002-2740-3470"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ximing Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2740-3470","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101967550","display_name":"Linghui Li","orcid":"https://orcid.org/0000-0002-7614-3142"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Linghui Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-7614-3142","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100673949","display_name":"Xiaoyong Li","orcid":"https://orcid.org/0000-0001-5597-9306"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyong Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-5597-9306","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050671370","display_name":"Binsi Cai","orcid":"https://orcid.org/0000-0002-7084-5952"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Binsi Cai","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-7084-5952","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100405572","display_name":"Jia Jia","orcid":"https://orcid.org/0000-0002-7336-4003"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jia Jia","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-7336-4003","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075909729","display_name":"Yali Gao","orcid":"https://orcid.org/0000-0003-0458-8481"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yali Gao","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-0458-8481","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005228053","display_name":"Shui Yu","orcid":"https://orcid.org/0000-0003-4485-6743"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Shui Yu","raw_affiliation_strings":["School of Computer Science, University of Technology Sydney, Ultimo, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0003-4485-6743","affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Technology Sydney, Ultimo, NSW, Australia","institution_ids":["https://openalex.org/I114017466"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.5006,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":{"value":0.90468239,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"19","issue":null,"first_page":"7161","last_page":"7175"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9818999767303467,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9818999767303467,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9794999957084656,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9790999889373779,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8137457370758057},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.7998204827308655},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.6118554472923279},{"id":"https://openalex.org/keywords/shot","display_name":"Shot (pellet)","score":0.4994015693664551},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.49691346287727356},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4802663326263428},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3811471462249756},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.2417866587638855}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8137457370758057},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.7998204827308655},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.6118554472923279},{"id":"https://openalex.org/C2778344882","wikidata":"https://www.wikidata.org/wiki/Q278938","display_name":"Shot (pellet)","level":2,"score":0.4994015693664551},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.49691346287727356},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4802663326263428},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3811471462249756},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2417866587638855},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C178790620","wikidata":"https://www.wikidata.org/wiki/Q11351","display_name":"Organic chemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2024.3430106","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3430106","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1856290498","display_name":null,"funder_award_id":"62302056","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4562745535","display_name":null,"funder_award_id":"62002011","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7289417769","display_name":null,"funder_award_id":"62202066","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":56,"referenced_works":["https://openalex.org/W1242748811","https://openalex.org/W1991210879","https://openalex.org/W2000412498","https://openalex.org/W2130354913","https://openalex.org/W2144182447","https://openalex.org/W2190692258","https://openalex.org/W2560934771","https://openalex.org/W2755572540","https://openalex.org/W2766542353","https://openalex.org/W2782500360","https://openalex.org/W2962849793","https://openalex.org/W2964583308","https://openalex.org/W2966149470","https://openalex.org/W2976972209","https://openalex.org/W2984323660","https://openalex.org/W2984824917","https://openalex.org/W2986944522","https://openalex.org/W2989953367","https://openalex.org/W2997532515","https://openalex.org/W3000429356","https://openalex.org/W3010384713","https://openalex.org/W3011124515","https://openalex.org/W3034637015","https://openalex.org/W3035739162","https://openalex.org/W3046698617","https://openalex.org/W3094094218","https://openalex.org/W3103553961","https://openalex.org/W3167347940","https://openalex.org/W3217083123","https://openalex.org/W4205277845","https://openalex.org/W4205711848","https://openalex.org/W4205942400","https://openalex.org/W4281292970","https://openalex.org/W4283802263","https://openalex.org/W4284672876","https://openalex.org/W4285066127","https://openalex.org/W4288083473","https://openalex.org/W4312442417","https://openalex.org/W4312886953","https://openalex.org/W4320060387","https://openalex.org/W4323338513","https://openalex.org/W4385342974","https://openalex.org/W4391047086","https://openalex.org/W4400034193","https://openalex.org/W6717697761","https://openalex.org/W6726873649","https://openalex.org/W6729448088","https://openalex.org/W6730091202","https://openalex.org/W6736057607","https://openalex.org/W6745537798","https://openalex.org/W6754979576","https://openalex.org/W6762814303","https://openalex.org/W6766891640","https://openalex.org/W6767095891","https://openalex.org/W6771257427","https://openalex.org/W6861129039"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"Insider":[0,73],"threats":[1],"represent":[2],"a":[3,42,56,66,81,87,107],"significant":[4],"challenge":[5,43],"in":[6,51,183],"both":[7],"corporate":[8],"and":[9,34,98,194],"governmental":[10],"sectors.":[11],"Most":[12],"existing":[13],"supervised":[14],"learning":[15,58,123,144],"based":[16],"detection":[17],"methods":[18,182],"that":[19,85,176],"rely":[20],"on":[21,141],"transforming":[22],"user":[23],"behavior":[24],"into":[25],"sequential":[26],"data":[27,50],"do":[28],"not":[29],"fully":[30],"utilize":[31],"structural":[32,82,96],"information":[33,97],"require":[35],"extensive":[36],"labeled":[37,49,148,192],"data.":[38],"This":[39],"reliance":[40],"poses":[41],"due":[44],"to":[45,55,94,117,157,170],"the":[46,128,153],"scarcity":[47],"of":[48,135,155],"real-world":[52],"scenarios,":[53],"leading":[54],"few-shot":[57,122,143],"situation.":[59],"To":[60],"address":[61],"these":[62],"limitations,":[63],"we":[64,105],"propose":[65],"novel":[67],"Graph":[68],"modularized-based":[69],"Meta-learning":[70],"Framework":[71],"for":[72,121],"Threat":[74],"Detection,":[75],"named":[76],"GMFITD.":[77],"Specifically,":[78],"GMFITD":[79,156,179],"utilizes":[80],"reconstruction":[83],"mechanism":[84,93],"combines":[86],"graph-based":[88],"autoencoder":[89],"with":[90,146,190],"an":[91,161],"attention":[92],"explore":[95],"infer":[99],"potential":[100],"relationships":[101],"between":[102],"users.":[103],"Additionally,":[104],"employ":[106],"graph":[108],"prototype":[109],"construction":[110],"method":[111,130],"coupling":[112],"episodic":[113],"meta-learning":[114],"principle":[115],"(MAML)":[116],"compute":[118],"representative":[119],"embeddings":[120],"scenarios.":[124],"By":[125],"leveraging":[126],"MAML,":[127],"proposed":[129,178],"can":[131],"capture":[132],"prior":[133],"knowledge":[134],"insider":[136,184],"threat":[137,185],"classification":[138],"by":[139],"training":[140],"similar":[142],"tasks":[145],"few":[147],"samples.":[149],"We":[150],"further":[151],"enhance":[152],"resilience":[154],"adversarial":[158,196],"attacks":[159],"through":[160],"edge":[162],"importance":[163],"estimation":[164],"mechanism,":[165],"which":[166],"assigns":[167],"higher":[168,188],"weights":[169],"relevant":[171],"edges.":[172],"Extensive":[173],"experiments":[174],"demonstrate":[175],"our":[177],"outperforms":[180],"state-of-the-art":[181],"detection,":[186],"achieving":[187],"accuracy":[189],"fewer":[191],"samples":[193],"resisting":[195],"attacks.":[197]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":6}],"updated_date":"2025-12-26T23:08:49.675405","created_date":"2025-10-10T00:00:00"}