{"id":"https://openalex.org/W4416017905","doi":"https://doi.org/10.1145/3746252.3761520","title":"An LLM-based Behavior Modeling Framework for Malicious User Detection","display_name":"An LLM-based Behavior Modeling Framework for Malicious User Detection","publication_year":2025,"publication_date":"2025-11-08","ids":{"openalex":"https://openalex.org/W4416017905","doi":"https://doi.org/10.1145/3746252.3761520"},"language":null,"primary_location":{"id":"doi:10.1145/3746252.3761520","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3746252.3761520","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th ACM International Conference on Information and Knowledge Management","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5096970193","display_name":"Meng Jiang","orcid":"https://orcid.org/0009-0001-9163-8979"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Meng Jiang","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0009-0001-9163-8979","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100368524","display_name":"Wenjie Wang","orcid":"https://orcid.org/0000-0002-5199-1428"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenjie Wang","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-5199-1428","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068892996","display_name":"Chongming Gao","orcid":"https://orcid.org/0000-0002-5187-9196"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chongming Gao","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-5187-9196","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059240498","display_name":"Shaofeng Hu","orcid":"https://orcid.org/0000-0003-3056-4440"},"institutions":[{"id":"https://openalex.org/I4210110199","display_name":"Vision Medicals (China)","ror":"https://ror.org/01z86wn38","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210110199"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shaofeng Hu","raw_affiliation_strings":["WeChat, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-3056-4440","affiliations":[{"raw_affiliation_string":"WeChat, Guangzhou, China","institution_ids":["https://openalex.org/I4210110199"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120301773","display_name":"Kaishen Ou","orcid":"https://orcid.org/0009-0002-9237-2110"},"institutions":[{"id":"https://openalex.org/I4210110199","display_name":"Vision Medicals (China)","ror":"https://ror.org/01z86wn38","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210110199"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaishen Ou","raw_affiliation_strings":["WeChat, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0002-9237-2110","affiliations":[{"raw_affiliation_string":"WeChat, Guangzhou, China","institution_ids":["https://openalex.org/I4210110199"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101799777","display_name":"Hui Lin","orcid":"https://orcid.org/0000-0003-0190-969X"},"institutions":[{"id":"https://openalex.org/I4210130112","display_name":"China Academy of Information and Communications Technology","ror":"https://ror.org/038dte259","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210130112","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hui Lin","raw_affiliation_strings":["China Academy of Electronics and Information Technology, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-0190-969X","affiliations":[{"raw_affiliation_string":"China Academy of Electronics and Information Technology, Beijing, China","institution_ids":["https://openalex.org/I4210130112"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5051925942","display_name":"Fuli Feng","orcid":"https://orcid.org/0000-0002-5828-9842"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fuli Feng","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-5828-9842","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"5755","last_page":"5762"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.8134999871253967,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.8134999871253967,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.031700000166893005,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.014399999752640724,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.6265000104904175},{"id":"https://openalex.org/keywords/user-modeling","display_name":"User modeling","score":0.48080000281333923},{"id":"https://openalex.org/keywords/behavioral-pattern","display_name":"Behavioral pattern","score":0.36160001158714294},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.35600000619888306},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.34630000591278076},{"id":"https://openalex.org/keywords/user-generated-content","display_name":"User-generated content","score":0.320499986410141}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7590000033378601},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6265000104904175},{"id":"https://openalex.org/C67712803","wikidata":"https://www.wikidata.org/wiki/Q7901853","display_name":"User modeling","level":3,"score":0.48080000281333923},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3959999978542328},{"id":"https://openalex.org/C83804111","wikidata":"https://www.wikidata.org/wiki/Q1063558","display_name":"Behavioral pattern","level":2,"score":0.36160001158714294},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.35600000619888306},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.34630000591278076},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34439998865127563},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.32679998874664307},{"id":"https://openalex.org/C101293273","wikidata":"https://www.wikidata.org/wiki/Q579716","display_name":"User-generated content","level":3,"score":0.320499986410141},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.3070000112056732},{"id":"https://openalex.org/C2989277270","wikidata":"https://www.wikidata.org/wiki/Q168338","display_name":"Behavioral analysis","level":2,"score":0.2962000072002411},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28630000352859497},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C2777622855","wikidata":"https://www.wikidata.org/wiki/Q7901844","display_name":"User information","level":3,"score":0.2705000042915344},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26579999923706055},{"id":"https://openalex.org/C2984870255","wikidata":"https://www.wikidata.org/wiki/Q5196451","display_name":"User engagement","level":2,"score":0.26460000872612},{"id":"https://openalex.org/C201025465","wikidata":"https://www.wikidata.org/wiki/Q11248500","display_name":"User experience design","level":2,"score":0.2596000134944916}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3746252.3761520","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3746252.3761520","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th ACM International Conference on Information and Knowledge Management","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5104534126","display_name":null,"funder_award_id":"62272437","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":7,"referenced_works":["https://openalex.org/W2904890881","https://openalex.org/W2962946486","https://openalex.org/W3093550423","https://openalex.org/W4391136507","https://openalex.org/W4393073787","https://openalex.org/W4393158667","https://openalex.org/W4409348705"],"related_works":[],"abstract_inverted_index":{"Malicious":[0],"users":[1],"pose":[2],"significant":[3],"threats":[4],"to":[5,15,61,73,79],"social":[6],"platforms.":[7],"Extensive":[8],"efforts":[9],"have":[10],"leveraged":[11],"user":[12,27,68,76,82,105],"behavior":[13,33,37,69,83,91],"sequences":[14,92],"model":[16,63],"relationships":[17],"between":[18],"various":[19],"actions":[20],"and":[21,65,98],"capture":[22],"behavioral":[23],"patterns":[24,88],"for":[25,49],"malicious":[26,51,75,81,104],"detection;":[28],"however,":[29],"they":[30],"rely":[31],"on":[32],"IDs,":[34],"ignoring":[35],"valuable":[36],"content":[38,66],"such":[39],"as":[40],"self-introductions":[41],"in":[42,67,102],"friend":[43],"requests,":[44],"which":[45],"offer":[46],"crucial":[47],"clues":[48],"detecting":[50],"user.":[52],"We":[53],"thus":[54],"propose":[55],"leveraging":[56],"Large":[57],"Language":[58],"Models":[59],"(LLMs)":[60],"jointly":[62],"IDs":[64],"sequences.":[70],"The":[71],"key":[72],"effective":[74],"detection":[77,106],"is":[78],"infer":[80],"patterns.":[84],"However,":[85],"inferring":[86],"these":[87],"from":[89,94],"labeled":[90],"suffers":[93],"poor":[95],"data":[96],"efficiency":[97],"limited":[99],"generalization,":[100],"resulting":[101],"suboptimal":[103],"performance.":[107]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-11-08T00:00:00"}