{"id":"https://openalex.org/W4403937240","doi":"https://doi.org/10.1109/tifs.2024.3488527","title":"LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection","display_name":"LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection","publication_year":2024,"publication_date":"2024-01-01","ids":{"openalex":"https://openalex.org/W4403937240","doi":"https://doi.org/10.1109/tifs.2024.3488527"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2024.3488527","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3488527","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057847421","display_name":"Xiangrui Cai","orcid":"https://orcid.org/0000-0001-5039-0922"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiangrui Cai","raw_affiliation_strings":["VCIP, DISSec, TMCC, TBI Center, College of Computer Science, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0001-5039-0922","affiliations":[{"raw_affiliation_string":"VCIP, DISSec, TMCC, TBI Center, College of Computer Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114910511","display_name":"Yang Wang","orcid":"https://orcid.org/0009-0006-6715-2932"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Wang","raw_affiliation_strings":["DISSec, TKLNDST, College of Cyber Science, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0009-0006-6715-2932","affiliations":[{"raw_affiliation_string":"DISSec, TKLNDST, College of Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077412882","display_name":"Sihan Xu","orcid":"https://orcid.org/0000-0002-6887-6231"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sihan Xu","raw_affiliation_strings":["DISSec, TKLNDST, College of Cyber Science, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-6887-6231","affiliations":[{"raw_affiliation_string":"DISSec, TKLNDST, College of Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100324585","display_name":"Hao Li","orcid":"https://orcid.org/0000-0002-9045-561X"},"institutions":[{"id":"https://openalex.org/I4210164386","display_name":"Hebei Science and Technology Department","ror":"https://ror.org/05k812a28","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210164386"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Li","raw_affiliation_strings":["Science and Technology on Communication Networks Laboratory, Shijiazhuang, China"],"raw_orcid":"https://orcid.org/0000-0002-9045-561X","affiliations":[{"raw_affiliation_string":"Science and Technology on Communication Networks Laboratory, Shijiazhuang, China","institution_ids":["https://openalex.org/I4210164386"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100386273","display_name":"Ying Zhang","orcid":"https://orcid.org/0000-0003-4906-5828"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ying Zhang","raw_affiliation_strings":["VCIP, DISSec, TMCC, TBI Center, College of Computer Science, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0003-4906-5828","affiliations":[{"raw_affiliation_string":"VCIP, DISSec, TMCC, TBI Center, College of Computer Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060212061","display_name":"Zheli Liu","orcid":"https://orcid.org/0000-0002-2984-2661"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheli Liu","raw_affiliation_strings":["DISSec, TKLNDST, College of Cyber Science, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-2984-2661","affiliations":[{"raw_affiliation_string":"DISSec, TKLNDST, College of Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5062064974","display_name":"Xiaojie Yuan","orcid":"https://orcid.org/0000-0002-5876-6856"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaojie Yuan","raw_affiliation_strings":["VCIP, DISSec, TMCC, TBI Center, College of Computer Science, Nankai University, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-5876-6856","affiliations":[{"raw_affiliation_string":"VCIP, DISSec, TMCC, TBI Center, College of Computer Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":7.7696,"has_fulltext":false,"cited_by_count":25,"citation_normalized_percentile":{"value":0.9780609,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":"19","issue":null,"first_page":"10157","last_page":"10172"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9909999966621399,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9909999966621399,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.989300012588501,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9732999801635742,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.802656888961792},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.6816748380661011},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4986450672149658},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.41047564148902893},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.328180730342865}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.802656888961792},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.6816748380661011},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4986450672149658},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.41047564148902893},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.328180730342865},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2024.3488527","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3488527","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/13","score":0.4099999964237213,"display_name":"Climate action"}],"awards":[{"id":"https://openalex.org/G212106316","display_name":null,"funder_award_id":"72342017","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3633636046","display_name":null,"funder_award_id":"2022YFB3103202","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G3649502994","display_name":null,"funder_award_id":"23JCQNJC01960","funder_id":"https://openalex.org/F4320323993","funder_display_name":"Natural Science Foundation of Tianjin City"},{"id":"https://openalex.org/G5755501204","display_name":null,"funder_award_id":"62202245","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320323993","display_name":"Natural Science Foundation of Tianjin City","ror":null},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":78,"referenced_works":["https://openalex.org/W1859925930","https://openalex.org/W1924770834","https://openalex.org/W2064675550","https://openalex.org/W2096632950","https://openalex.org/W2110485445","https://openalex.org/W2152575748","https://openalex.org/W2156718197","https://openalex.org/W2157331557","https://openalex.org/W2342408547","https://openalex.org/W2766428736","https://openalex.org/W2767094836","https://openalex.org/W2767106145","https://openalex.org/W2796431263","https://openalex.org/W2803592732","https://openalex.org/W2891432086","https://openalex.org/W2896457183","https://openalex.org/W2908510526","https://openalex.org/W2909135150","https://openalex.org/W2914623161","https://openalex.org/W2962745591","https://openalex.org/W2963469388","https://openalex.org/W2963673968","https://openalex.org/W2964015378","https://openalex.org/W2966610483","https://openalex.org/W2986944522","https://openalex.org/W2988217457","https://openalex.org/W2994850640","https://openalex.org/W2998702515","https://openalex.org/W3000429356","https://openalex.org/W3008932301","https://openalex.org/W3011124515","https://openalex.org/W3014071235","https://openalex.org/W3093545390","https://openalex.org/W3130625521","https://openalex.org/W3133849783","https://openalex.org/W3153493802","https://openalex.org/W3169066865","https://openalex.org/W3190213853","https://openalex.org/W3212868562","https://openalex.org/W4200292123","https://openalex.org/W4220974940","https://openalex.org/W4225697716","https://openalex.org/W4226412712","https://openalex.org/W4283711508","https://openalex.org/W4285612255","https://openalex.org/W4310736693","https://openalex.org/W4312451223","https://openalex.org/W4313372151","https://openalex.org/W4317767731","https://openalex.org/W4320713315","https://openalex.org/W4324007053","https://openalex.org/W4362659486","https://openalex.org/W4380091476","https://openalex.org/W4383103607","https://openalex.org/W4385245566","https://openalex.org/W4386768606","https://openalex.org/W4387011098","https://openalex.org/W4387850712","https://openalex.org/W4388505134","https://openalex.org/W4389524049","https://openalex.org/W4389524555","https://openalex.org/W4391128584","https://openalex.org/W4391655576","https://openalex.org/W4393153298","https://openalex.org/W4394597915","https://openalex.org/W4396833115","https://openalex.org/W6640212811","https://openalex.org/W6677730197","https://openalex.org/W6689213722","https://openalex.org/W6745040976","https://openalex.org/W6752054533","https://openalex.org/W6754558403","https://openalex.org/W6755207826","https://openalex.org/W6757423643","https://openalex.org/W6757817989","https://openalex.org/W6761839128","https://openalex.org/W6779462361","https://openalex.org/W6842774535"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W4387194049","https://openalex.org/W26305611","https://openalex.org/W4399147188"],"abstract_inverted_index":{"Enterprises":[0],"and":[1,53,122,126,141,175,202,206,222,232,252,265,274],"organizations":[2],"are":[3,88],"faced":[4],"with":[5,148],"potential":[6],"threats":[7,101],"from":[8,172,178,284],"insider":[9,20,100],"employees":[10],"that":[11],"may":[12,43,59],"lead":[13],"to":[14,72,153,241],"serious":[15],"consequences.":[16],"Previous":[17],"studies":[18],"on":[19,26,194,229,256],"threat":[21],"detection":[22,80],"(ITD)":[23],"mainly":[24,89],"focus":[25],"detecting":[27],"abnormal":[28,31,74,179],"users":[29,75],"or":[30,37,76],"time":[32,103],"periods":[33],"(e.g.,":[34],"a":[35,38,41,56,65,68,124,163,182],"week":[36],"day).":[39],"However,":[40],"user":[42],"have":[44],"hundreds":[45],"of":[46,48,62,192,212,271],"thousands":[47,61],"activities":[49,63,77,145,174,180],"in":[50,102,159,224,254,276],"the":[51,79,83,113,134,142,155,190,210,260,269],"log,":[52],"even":[54],"within":[55,137],"day":[57],"there":[58],"exist":[60],"for":[64,185,226],"user,":[66],"requiring":[67],"high":[69],"investigation":[70],"budget":[71],"verify":[73],"given":[78],"results.":[81],"On":[82],"other":[84],"hand,":[85],"existing":[86],"works":[87],"post-hoc":[90,242],"methods":[91],"rather":[92],"than":[93],"real-time":[94,117,227],"detection,":[95],"which":[96,168],"can":[97,237,281],"not":[98],"report":[99],"before":[104],"they":[105],"cause":[106],"loss.":[107],"In":[108],"this":[109],"paper,":[110],"we":[111,161],"conduct":[112],"first":[114],"study":[115],"towards":[116],"ITD":[118,228],"at":[119,219,249],"activity":[120,139],"level,":[121],"present":[123],"fine-grained":[125],"efficient":[127],"framework":[128],"LAN.":[129,277],"Specifically,":[130],"LAN":[131,193,236],"simultaneously":[132],"learns":[133],"temporal":[135],"dependencies":[136],"an":[138],"sequence":[140],"relationships":[143],"between":[144],"across":[146],"sequences":[147],"graph":[149],"structure":[150],"learning.":[151],"Moreover,":[152,235],"mitigate":[154],"data":[156],"imbalance":[157],"problem":[158],"ITD,":[160,243],"propose":[162],"novel":[164],"hybrid":[165],"prediction":[166],"loss,":[167],"integrates":[169],"self-supervision":[170],"signals":[171,177],"normal":[173],"supervision":[176],"into":[181],"unified":[183],"loss":[184],"anomaly":[186],"detection.":[187],"We":[188],"evaluate":[189,268],"performance":[191],"two":[195,257],"widely":[196],"used":[197],"datasets,":[198],"i.e.,":[199],"CERT":[200,203,230],"r4.2":[201,231],"r5.2.":[204],"Extensive":[205],"comparative":[207],"experiments":[208],"demonstrate":[209],"superiority":[211],"LAN,":[213],"outperforming":[214],"9":[215],"state-of-the-art":[216],"baselines":[217,247],"by":[218,248],"least":[220,250],"8.43%":[221],"6.35%":[223],"AUC":[225,255],"r5.2,":[233],"respectively.":[234],"be":[238,282],"also":[239],"applied":[240],"surpassing":[244],"8":[245],"competitive":[246],"7.70%":[251],"4.03%":[253],"datasets.":[258],"Finally,":[259],"ablation":[261],"study,":[262],"parameter":[263],"analysis,":[264],"compatibility":[266],"analysis":[267],"impact":[270],"each":[272],"module":[273],"hyper-parameter":[275],"The":[278],"source":[279],"code":[280],"obtained":[283],"<uri":[285],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[286],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">https://github.com/Li1Neo/LAN</uri>.":[287]},"counts_by_year":[{"year":2026,"cited_by_count":7},{"year":2025,"cited_by_count":16},{"year":2024,"cited_by_count":2}],"updated_date":"2026-06-14T07:44:22.658603","created_date":"2025-10-10T00:00:00"}