{"id":"https://openalex.org/W3039513780","doi":"https://doi.org/10.1145/3406601.3406610","title":"User Behavior Analytics for Anomaly Detection Using LSTM Autoencoder - Insider Threat Detection","display_name":"User Behavior Analytics for Anomaly Detection Using LSTM Autoencoder - Insider Threat Detection","publication_year":2020,"publication_date":"2020-07-01","ids":{"openalex":"https://openalex.org/W3039513780","doi":"https://doi.org/10.1145/3406601.3406610","mag":"3039513780"},"language":"en","primary_location":{"id":"doi:10.1145/3406601.3406610","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3406601.3406610","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 11th International Conference on Advances in Information Technology","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068324926","display_name":"Balaram Sharma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Balaram Sharma","raw_affiliation_strings":["LogPoint Lalitpur, Nepal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LogPoint Lalitpur, Nepal","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027316888","display_name":"Prabhat Pokharel","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Prabhat Pokharel","raw_affiliation_strings":["LogPoint Lalitpur, Nepal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LogPoint Lalitpur, Nepal","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5004363210","display_name":"Basanta Joshi","orcid":"https://orcid.org/0000-0003-1648-7776"},"institutions":[{"id":"https://openalex.org/I4210093402","display_name":"Nepal Development Research Institute","ror":"https://ror.org/00fp8n517","country_code":"NP","type":"nonprofit","lineage":["https://openalex.org/I4210093402"]},{"id":"https://openalex.org/I4210129773","display_name":"Institute of Engineering","ror":"https://ror.org/03ny67e60","country_code":"NP","type":"education","lineage":["https://openalex.org/I155028946","https://openalex.org/I4210129773"]}],"countries":["NP"],"is_corresponding":false,"raw_author_name":"Basanta Joshi","raw_affiliation_strings":["Institute of Engineering Lalitpur, Nepal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Engineering Lalitpur, Nepal","institution_ids":["https://openalex.org/I4210093402","https://openalex.org/I4210129773"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":13.3461,"has_fulltext":false,"cited_by_count":119,"citation_normalized_percentile":{"value":0.99541977,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.9307534694671631},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.8831186294555664},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.8260042071342468},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7949213981628418},{"id":"https://openalex.org/keywords/outlier","display_name":"Outlier","score":0.6486083269119263},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5679442882537842},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5664464831352234},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5474250912666321},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.5422843098640442},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.49293017387390137},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.4676612913608551},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.45263350009918213},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.38374119997024536},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.3040390610694885},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.07867026329040527}],"concepts":[{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.9307534694671631},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.8831186294555664},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.8260042071342468},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7949213981628418},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.6486083269119263},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5679442882537842},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5664464831352234},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5474250912666321},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5422843098640442},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.49293017387390137},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.4676612913608551},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.45263350009918213},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.38374119997024536},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3040390610694885},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.07867026329040527},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3406601.3406610","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3406601.3406610","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 11th International Conference on Advances in Information Technology","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7300000190734863}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":11,"referenced_works":["https://openalex.org/W2512189246","https://openalex.org/W2538737552","https://openalex.org/W2583862887","https://openalex.org/W2771022952","https://openalex.org/W2772609275","https://openalex.org/W2787099510","https://openalex.org/W2808709910","https://openalex.org/W2874136421","https://openalex.org/W2884984219","https://openalex.org/W2898943857","https://openalex.org/W2958285686"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3083318772","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049"],"abstract_inverted_index":{"Identifying":[0],"anomalies":[1],"from":[2,95,132],"log":[3],"data":[4,60,98,139],"for":[5,15,24,37,116,154],"insider":[6,110],"threat":[7,111],"detection":[8],"is":[9,21,85,174],"practically":[10],"a":[11,66],"very":[12,22],"challenging":[13],"task":[14],"security":[16],"analysts.":[17],"User":[18],"behavior":[19,35,50,155,163],"modeling":[20,36],"important":[23],"the":[25,58,72,76,79,89,93,96,117,123,138,167,186,189,204,208],"identification":[26],"of":[27,177,194],"these":[28],"anomalies.":[29,107],"This":[30],"paper":[31],"presents":[32],"unsupervised":[33],"user":[34,49],"anomaly":[38,158,165,217],"detection.":[39,159,218],"The":[40,62,100,108,180],"proposed":[41,63,209],"approach":[42,210],"uses":[43],"LSTM":[44,149],"based":[45,51,141],"Autoencoder":[46,150],"to":[47,87,91],"model":[48,168,190],"on":[52,78,142],"session":[53],"activities":[54],"and":[55,82,136,157,199],"thus":[56],"identify":[57],"anomalous":[59],"points.":[61,99],"method":[64],"follows":[65],"two-step":[67],"process.":[68],"First,":[69],"it":[70,84],"calculates":[71],"reconstruction":[73,171],"error":[74,172],"using":[75],"autoencoder":[77],"non-anomalous":[80],"dataset,":[81],"then":[83,104],"used":[86,115,214],"define":[88],"threshold":[90],"separate":[92],"outliers":[94,102],"normal":[97],"identified":[101],"are":[103,126],"classified":[105],"as":[106],"CERT":[109],"dataset":[112],"has":[113,151],"been":[114,152],"research":[118],"work.":[119],"For":[120,160],"each":[121],"user,":[122],"feature":[124],"vectors":[125],"prepared":[127],"by":[128],"extracting":[129],"key":[130],"information":[131],"corresponding":[133],"raw":[134],"events":[135],"aggregating":[137],"points":[140],"users'":[143,147],"actions":[144],"within":[145],"respective":[146],"sessions.":[148],"implemented":[153],"learning":[156],"any":[161],"unseen":[162],"or":[164],"pattern,":[166],"produces":[169],"high":[170],"which":[173],"an":[175,178,192],"indication":[176],"anomaly.":[179],"experimental":[181],"results":[182,205],"show":[183],"that":[184,207],"in":[185,215],"best":[187],"case,":[188],"produced":[191],"Accuracy":[193],"90.17%,":[195],"True":[196],"Positives":[197,201],"91.03%,":[198],"False":[200],"9.84%.":[202],"Thus,":[203],"suggest":[206],"can":[211],"be":[212],"effectively":[213],"automatic":[216]},"counts_by_year":[{"year":2026,"cited_by_count":12},{"year":2025,"cited_by_count":24},{"year":2024,"cited_by_count":26},{"year":2023,"cited_by_count":29},{"year":2022,"cited_by_count":16},{"year":2021,"cited_by_count":11},{"year":2020,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}