{"id":"https://openalex.org/W2048072669","doi":"https://doi.org/10.1145/2808783.2808785","title":"Insider Threats","display_name":"Insider Threats","publication_year":2015,"publication_date":"2015-10-06","ids":{"openalex":"https://openalex.org/W2048072669","doi":"https://doi.org/10.1145/2808783.2808785","mag":"2048072669"},"language":"en","primary_location":{"id":"doi:10.1145/2808783.2808785","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2808783.2808785","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://kar.kent.ac.uk/54145/1/MIST15.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5078307880","display_name":"A. Stephen McGough","orcid":"https://orcid.org/0000-0001-5626-0934"},"institutions":[{"id":"https://openalex.org/I190082696","display_name":"Durham University","ror":"https://ror.org/01v29qb04","country_code":"GB","type":"education","lineage":["https://openalex.org/I190082696"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Andrew Stephen McGough","raw_affiliation_strings":["Durham University, Durham, United Kingdom"],"affiliations":[{"raw_affiliation_string":"Durham University, Durham, United Kingdom","institution_ids":["https://openalex.org/I190082696"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045579128","display_name":"David S. Wall","orcid":"https://orcid.org/0000-0002-6003-1592"},"institutions":[{"id":"https://openalex.org/I190082696","display_name":"Durham University","ror":"https://ror.org/01v29qb04","country_code":"GB","type":"education","lineage":["https://openalex.org/I190082696"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"David Wall","raw_affiliation_strings":["Durham University, Durham, United Kingdom"],"affiliations":[{"raw_affiliation_string":"Durham University, Durham, United Kingdom","institution_ids":["https://openalex.org/I190082696"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076722602","display_name":"John Brennan","orcid":"https://orcid.org/0000-0002-7274-5920"},"institutions":[{"id":"https://openalex.org/I190082696","display_name":"Durham University","ror":"https://ror.org/01v29qb04","country_code":"GB","type":"education","lineage":["https://openalex.org/I190082696"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"John Brennan","raw_affiliation_strings":["Durham University, Durham, United Kingdom"],"affiliations":[{"raw_affiliation_string":"Durham University, Durham, United Kingdom","institution_ids":["https://openalex.org/I190082696"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026385930","display_name":"Georgios Theodoropoulos","orcid":"https://orcid.org/0000-0002-7448-5886"},"institutions":[{"id":"https://openalex.org/I190082696","display_name":"Durham University","ror":"https://ror.org/01v29qb04","country_code":"GB","type":"education","lineage":["https://openalex.org/I190082696"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Georgios Theodoropoulos","raw_affiliation_strings":["Durham University, Durham, United Kingdom"],"affiliations":[{"raw_affiliation_string":"Durham University, Durham, United Kingdom","institution_ids":["https://openalex.org/I190082696"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078818591","display_name":"Ed Ruck-Keene","orcid":null},"institutions":[{"id":"https://openalex.org/I190082696","display_name":"Durham University","ror":"https://ror.org/01v29qb04","country_code":"GB","type":"education","lineage":["https://openalex.org/I190082696"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ed Ruck-Keene","raw_affiliation_strings":["Durham University, Durham, United Kingdom"],"affiliations":[{"raw_affiliation_string":"Durham University, Durham, United Kingdom","institution_ids":["https://openalex.org/I190082696"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025663670","display_name":"Budi Arief","orcid":"https://orcid.org/0000-0002-1830-1587"},"institutions":[{"id":"https://openalex.org/I84884186","display_name":"Newcastle University","ror":"https://ror.org/01kj2bm70","country_code":"GB","type":"education","lineage":["https://openalex.org/I84884186"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Budi Arief","raw_affiliation_strings":["Newcastle University, Newcastle upon Tyne, United Kingdom","Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#"],"affiliations":[{"raw_affiliation_string":"Newcastle University, Newcastle upon Tyne, United Kingdom","institution_ids":["https://openalex.org/I84884186"]},{"raw_affiliation_string":"Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#","institution_ids":["https://openalex.org/I84884186"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027746227","display_name":"Carl Gamble","orcid":null},"institutions":[{"id":"https://openalex.org/I84884186","display_name":"Newcastle University","ror":"https://ror.org/01kj2bm70","country_code":"GB","type":"education","lineage":["https://openalex.org/I84884186"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Carl Gamble","raw_affiliation_strings":["Newcastle University, Newcastle upon Tyne, United Kingdom","Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#"],"affiliations":[{"raw_affiliation_string":"Newcastle University, Newcastle upon Tyne, United Kingdom","institution_ids":["https://openalex.org/I84884186"]},{"raw_affiliation_string":"Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#","institution_ids":["https://openalex.org/I84884186"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010908991","display_name":"John Fitzgerald","orcid":"https://orcid.org/0000-0001-7041-1807"},"institutions":[{"id":"https://openalex.org/I84884186","display_name":"Newcastle University","ror":"https://ror.org/01kj2bm70","country_code":"GB","type":"education","lineage":["https://openalex.org/I84884186"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"John Fitzgerald","raw_affiliation_strings":["Newcastle University, Newcastle upon Tyne, United Kingdom","Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#"],"affiliations":[{"raw_affiliation_string":"Newcastle University, Newcastle upon Tyne, United Kingdom","institution_ids":["https://openalex.org/I84884186"]},{"raw_affiliation_string":"Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#","institution_ids":["https://openalex.org/I84884186"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072969450","display_name":"Aad van Moorsel","orcid":"https://orcid.org/0000-0001-7233-6943"},"institutions":[{"id":"https://openalex.org/I84884186","display_name":"Newcastle University","ror":"https://ror.org/01kj2bm70","country_code":"GB","type":"education","lineage":["https://openalex.org/I84884186"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Aad van Moorsel","raw_affiliation_strings":["Newcastle University, Newcastle upon Tyne, United Kingdom","Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#"],"affiliations":[{"raw_affiliation_string":"Newcastle University, Newcastle upon Tyne, United Kingdom","institution_ids":["https://openalex.org/I84884186"]},{"raw_affiliation_string":"Newcastle University , Newcastle upon Tyne, United Kingdom#TAB#","institution_ids":["https://openalex.org/I84884186"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5075227197","display_name":"Sujeewa Alwis","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sujeewa Alwis","raw_affiliation_strings":["Insighlytics Ltd, York, United Kingdom"],"affiliations":[{"raw_affiliation_string":"Insighlytics Ltd, York, United Kingdom","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":10,"corresponding_author_ids":["https://openalex.org/A5078307880"],"corresponding_institution_ids":["https://openalex.org/I190082696"],"apc_list":null,"apc_paid":null,"fwci":2.2331,"has_fulltext":true,"cited_by_count":12,"citation_normalized_percentile":{"value":0.90389935,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"12"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10799","display_name":"Data Visualization and Analytics","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/workaround","display_name":"Workaround","score":0.962928295135498},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7501474022865295},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.7123982906341553},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.5728840231895447},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.5334689021110535},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.5307564735412598},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5248727202415466},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5077899098396301},{"id":"https://openalex.org/keywords/memory-footprint","display_name":"Memory footprint","score":0.5034636855125427},{"id":"https://openalex.org/keywords/footprint","display_name":"Footprint","score":0.4874577522277832},{"id":"https://openalex.org/keywords/troubleshooting","display_name":"Troubleshooting","score":0.4397468864917755},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.18768179416656494},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.10967773199081421}],"concepts":[{"id":"https://openalex.org/C194541083","wikidata":"https://www.wikidata.org/wiki/Q457174","display_name":"Workaround","level":2,"score":0.962928295135498},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7501474022865295},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.7123982906341553},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5728840231895447},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.5334689021110535},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.5307564735412598},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5248727202415466},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5077899098396301},{"id":"https://openalex.org/C74912251","wikidata":"https://www.wikidata.org/wiki/Q6815727","display_name":"Memory footprint","level":2,"score":0.5034636855125427},{"id":"https://openalex.org/C132943942","wikidata":"https://www.wikidata.org/wiki/Q2562511","display_name":"Footprint","level":2,"score":0.4874577522277832},{"id":"https://openalex.org/C147494362","wikidata":"https://www.wikidata.org/wiki/Q2078905","display_name":"Troubleshooting","level":2,"score":0.4397468864917755},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.18768179416656494},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.10967773199081421},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/2808783.2808785","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2808783.2808785","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats","raw_type":"proceedings-article"},{"id":"pmh:oai:kar.kent.ac.uk:54145","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2808783.2808785>)","pdf_url":"https://kar.kent.ac.uk/54145/1/MIST15.pdf","source":{"id":"https://openalex.org/S4377196264","display_name":"Kent Academic Repository (University of Kent)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I20581793","host_organization_name":"University of Kent","host_organization_lineage":["https://openalex.org/I20581793"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"},{"id":"pmh:oai:dro.dur.ac.uk.OAI2:16946","is_oa":false,"landing_page_url":"http://dro.dur.ac.uk/16946/","pdf_url":null,"source":{"id":"https://openalex.org/S4377196258","display_name":"Durham Research Online (Durham University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I190082696","host_organization_name":"Durham University","host_organization_lineage":["https://openalex.org/I190082696"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"(2015). 7th ACM CCS International Workshop on Managing Insider Security Threats, MIST '15, 12-16 October 2015, Denver, Colorado ; proceedings. New York: Association for Computing Machinery (ACM), pp. 1-12","raw_type":"Book chapter"},{"id":"pmh:oai:durham-repository.worktribe.com:1152422","is_oa":true,"landing_page_url":"https://durham-repository.worktribe.com/output/1152422","pdf_url":null,"source":{"id":"https://openalex.org/S4306400188","display_name":"Durham Research Online (Durham University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I190082696","host_organization_name":"Durham University","host_organization_lineage":["https://openalex.org/I190082696"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"acceptedVersion"}],"best_oa_location":{"id":"pmh:oai:kar.kent.ac.uk:54145","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2808783.2808785>)","pdf_url":"https://kar.kent.ac.uk/54145/1/MIST15.pdf","source":{"id":"https://openalex.org/S4377196264","display_name":"Kent Academic Repository (University of Kent)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I20581793","host_organization_name":"University of Kent","host_organization_lineage":["https://openalex.org/I20581793"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.6499999761581421}],"awards":[{"id":"https://openalex.org/G1559650014","display_name":null,"funder_award_id":"EP/K03345X/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G2562238522","display_name":null,"funder_award_id":"EP/L002213/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G3688699135","display_name":null,"funder_award_id":"EP/M020576/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G533782904","display_name":null,"funder_award_id":"EP/K006568/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G5631461310","display_name":null,"funder_award_id":"EP/K003410/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320332972","display_name":"Defence Science and Technology Laboratory","ror":"https://ror.org/04jswqb94"},{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"},{"id":"https://openalex.org/F4320335334","display_name":"Defence Science and Technology Group","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2048072669.pdf","grobid_xml":"https://content.openalex.org/works/W2048072669.grobid-xml"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W1486472792","https://openalex.org/W1560776233","https://openalex.org/W1572811218","https://openalex.org/W1602239585","https://openalex.org/W1603962791","https://openalex.org/W1970088130","https://openalex.org/W1973585406","https://openalex.org/W1988002966","https://openalex.org/W2013946142","https://openalex.org/W2061210554","https://openalex.org/W2068241209","https://openalex.org/W2101173463","https://openalex.org/W2123521920","https://openalex.org/W2126298371","https://openalex.org/W2131998781","https://openalex.org/W2156392926","https://openalex.org/W2156909104","https://openalex.org/W2166311720","https://openalex.org/W3126074005","https://openalex.org/W4285719527"],"related_works":["https://openalex.org/W4381612620","https://openalex.org/W2950380533","https://openalex.org/W2998499456","https://openalex.org/W2893207040","https://openalex.org/W3127868735","https://openalex.org/W1840516357","https://openalex.org/W2753986652","https://openalex.org/W2409624269","https://openalex.org/W3137434606","https://openalex.org/W4372263373"],"abstract_inverted_index":{"In":[0],"this":[1,29],"paper,":[2],"we":[3,81],"present":[4,135],"the":[5,43,47,124,139,142,171,180,184],"concept":[6],"of":[7,15,46,99,138,141,153,170,179,183],"\"Ben-ware\"":[8],"as":[9,94],"a":[10,21,95,148],"beneficial":[11],"software":[12],"system":[13,97,144],"capable":[14],"identifying":[16],"anomalous":[17],"human":[18,83],"behaviour":[19,30,84],"within":[20,147],"'closed'":[22],"organisation's":[23],"IT":[24],"infrastructure.":[25],"We":[26,134],"note":[27],"that":[28],"may":[31,128],"be":[32],"malicious":[33,75],"(for":[34,55],"example,":[35,56],"an":[36,57,136],"employee":[37,58],"is":[38,59,166],"seeking":[39],"to":[40,63,159],"act":[41],"against":[42],"best":[44],"interest":[45],"organisation":[48],"by":[49],"stealing":[50],"confidential":[51],"information)":[52],"or":[53],"benign":[54],"applying":[60],"some":[61],"workaround":[62],"complete":[64],"their":[65],"job).":[66],"To":[67],"help":[68],"distinguish":[69],"between":[70],"users":[71],"who":[72,78],"are":[73,79],"intentionally":[74],"and":[76,109,131,156,176],"those":[77],"benign,":[80],"use":[82],"modelling":[85],"along":[86],"with":[87,120],"Artificial":[88],"Intelligence.":[89],"Ben-ware":[90,143],"has":[91],"been":[92],"developed":[93],"distributed":[96],"comprising":[98,152],"probes":[100],"for":[101,106,112,117,145],"data":[102,107,113],"collection,":[103],"intermediate":[104],"nodes":[105,111],"routing":[108],"higher":[110],"analysis.":[114],"This":[115,164],"allows":[116],"real-time":[118],"analysis":[119,137,165],"low":[121],"impact":[122],"on":[123],"overall":[125],"infrastructure,":[126],"which":[127],"contain":[129],"legacy":[130,157],"low-power":[132],"resources.":[133],"appropriateness":[140],"deployment":[146],"large":[149],"closed":[150],"organisation,":[151],"both":[154],"new":[155],"hardware,":[158],"protect":[160],"its":[161],"essential":[162],"information.":[163],"performed":[167],"in":[168],"terms":[169],"memory":[172],"footprint,":[173],"disk":[174],"footprint":[175],"processing":[177],"requirements":[178],"different":[181],"parts":[182],"system.":[185]},"counts_by_year":[{"year":2022,"cited_by_count":2},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":2},{"year":2015,"cited_by_count":1}],"updated_date":"2026-03-20T23:20:44.827607","created_date":"2016-06-24T00:00:00"}