{"id":"https://openalex.org/W4386399048","doi":"https://doi.org/10.1186/s42400-023-00167-8","title":"Detecting compromised email accounts via login behavior characterization","display_name":"Detecting compromised email accounts via login behavior characterization","publication_year":2023,"publication_date":"2023-09-04","ids":{"openalex":"https://openalex.org/W4386399048","doi":"https://doi.org/10.1186/s42400-023-00167-8"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-023-00167-8","is_oa":true,"landing_page_url":"http://dx.doi.org/10.1186/s42400-023-00167-8","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00167-8","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00167-8","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5112796980","display_name":"Jianjun Zhao","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianjun Zhao","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037447241","display_name":"Can Yang","orcid":"https://orcid.org/0000-0003-4249-4670"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Can Yang","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101879533","display_name":"Di Wu","orcid":"https://orcid.org/0000-0002-4418-5946"},"institutions":[{"id":"https://openalex.org/I4210160629","display_name":"China Information Technology Security Evaluation Center","ror":"https://ror.org/053cexp66","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210160629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Di Wu","raw_affiliation_strings":["China Cybersecurity Review Technology and Certification Center, Beijing, 100013, China","China Cybersecurity Review Technology and Certification Center, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Cybersecurity Review Technology and Certification Center, Beijing, 100013, China","institution_ids":["https://openalex.org/I4210160629"]},{"raw_affiliation_string":"China Cybersecurity Review Technology and Certification Center, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020641983","display_name":"Yaqin Cao","orcid":"https://orcid.org/0000-0002-2568-2517"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yaqin Cao","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100672380","display_name":"Yuling Liu","orcid":"https://orcid.org/0000-0001-8018-8020"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuling Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5055905208","display_name":"Xiang Cui","orcid":"https://orcid.org/0000-0003-4779-4365"},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiang Cui","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, 100089, China","Zhongguancun Laboratory, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, 100089, China","institution_ids":["https://openalex.org/I125839683"]},{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5004834139","display_name":"Qixu Liu","orcid":"https://orcid.org/0000-0003-0895-9585"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Qixu Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5004834139"],"corresponding_institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404","https://openalex.org/I4210165038"],"apc_list":null,"apc_paid":null,"fwci":0.8805,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.8058251,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"6","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/login","display_name":"Login","score":0.9764046669006348},{"id":"https://openalex.org/keywords/subnet","display_name":"Subnet","score":0.868085503578186},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7977848052978516},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.5137289762496948},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4461171627044678},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36888980865478516},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.35939180850982666},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.20686137676239014}],"concepts":[{"id":"https://openalex.org/C113324615","wikidata":"https://www.wikidata.org/wiki/Q472302","display_name":"Login","level":2,"score":0.9764046669006348},{"id":"https://openalex.org/C21099817","wikidata":"https://www.wikidata.org/wiki/Q7631721","display_name":"Subnet","level":2,"score":0.868085503578186},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7977848052978516},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.5137289762496948},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4461171627044678},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36888980865478516},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.35939180850982666},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.20686137676239014},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-023-00167-8","is_oa":true,"landing_page_url":"http://dx.doi.org/10.1186/s42400-023-00167-8","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00167-8","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:2907ef399537429481f16b72fc3651d5","is_oa":true,"landing_page_url":"https://doaj.org/article/2907ef399537429481f16b72fc3651d5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 6, Iss 1, Pp 1-21 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-023-00167-8","is_oa":true,"landing_page_url":"http://dx.doi.org/10.1186/s42400-023-00167-8","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00167-8","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.5199999809265137,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G3390532264","display_name":null,"funder_award_id":"XDC02040100","funder_id":"https://openalex.org/F4320321133","funder_display_name":"Chinese Academy of Sciences"},{"id":"https://openalex.org/G529307786","display_name":null,"funder_award_id":"2019163","funder_id":"https://openalex.org/F4320322847","funder_display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences"},{"id":"https://openalex.org/G8058437614","display_name":null,"funder_award_id":"XDC02040100","funder_id":"https://openalex.org/F4320322847","funder_display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences"},{"id":"https://openalex.org/G8701658582","display_name":null,"funder_award_id":"No.2019163","funder_id":"https://openalex.org/F4320322847","funder_display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences"}],"funders":[{"id":"https://openalex.org/F4320321133","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35"},{"id":"https://openalex.org/F4320322847","display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences","ror":"https://ror.org/031141b54"},{"id":"https://openalex.org/F4320335892","display_name":"Youth Innovation Promotion Association","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4386399048.pdf","grobid_xml":"https://content.openalex.org/works/W4386399048.grobid-xml"},"referenced_works_count":10,"referenced_works":["https://openalex.org/W2074842062","https://openalex.org/W2134199473","https://openalex.org/W2187846933","https://openalex.org/W2230089931","https://openalex.org/W2416111155","https://openalex.org/W2498166457","https://openalex.org/W2799844162","https://openalex.org/W2898395483","https://openalex.org/W2945101777","https://openalex.org/W3010831033"],"related_works":["https://openalex.org/W2356206668","https://openalex.org/W2131631951","https://openalex.org/W2130707537","https://openalex.org/W2105155969","https://openalex.org/W4362683600","https://openalex.org/W1977409556","https://openalex.org/W2361602549","https://openalex.org/W3200778902","https://openalex.org/W2390667963","https://openalex.org/W4386399048"],"abstract_inverted_index":{"Abstract":[0],"The":[1],"illegal":[2],"use":[3],"of":[4,47,118,125,135],"compromised":[5,19,57,78],"email":[6,20,32,79,159],"accounts":[7,21,33,58,160],"by":[8,59,122,165],"adversaries":[9],"can":[10,156],"have":[11,34,162],"severe":[12],"consequences":[13],"for":[14,147],"enterprises":[15],"and":[16,41,64,88,93,114,143,170],"society.":[17],"Detecting":[18],"is":[22],"more":[23],"challenging":[24],"than":[25],"in":[26],"the":[27,45,111,133,178],"social":[28],"network":[29],"field,":[30],"where":[31],"only":[35],"a":[36,52,77,116,145],"few":[37],"interaction":[38],"events":[39],"(sending":[40],"receiving).":[42],"To":[43],"address":[44],"issue":[46],"insufficient":[48],"features,":[49],"we":[50,75],"propose":[51,76],"novel":[53],"approach":[54,131],"to":[55,67,103,110,140,180],"detecting":[56],"combining":[60],"time":[61],"zone":[62],"differences":[63],"alternate":[65],"logins":[66,105],"identify":[68,104],"abnormal":[69,127],"behavior.":[70],"Based":[71],"on":[72,85],"this":[73],"approach,":[74],"account":[80,112],"detection":[81],"framework":[82,99,176],"that":[83,106,138,153,161],"relies":[84],"widely":[86],"available":[87],"less":[89],"sensitive":[90],"login":[91,101,128],"logs":[92],"does":[94],"not":[95,108],"require":[96],"labels.":[97],"Our":[98,150],"characterizes":[100],"behaviors":[102],"do":[107],"belong":[109],"owner":[113],"outputs":[115],"list":[117],"account-subnet":[119,136],"pairs":[120,137],"ranked":[121],"their":[123],"likelihood":[124],"having":[126],"relationships.":[129],"This":[130],"reduces":[132],"number":[134],"need":[139],"be":[141],"investigated":[142],"provides":[144],"reference":[146],"investigation":[148],"priority.":[149],"evaluation":[151],"demonstrates":[152],"our":[154,175],"method":[155],"detect":[157],"most":[158],"been":[163],"accessed":[164],"disclosed":[166],"malicious":[167,183],"IP":[168,184],"addresses":[169],"outperforms":[171],"similar":[172],"research.":[173],"Additionally,":[174],"has":[177],"capability":[179],"uncover":[181],"undisclosed":[182],"addresses.":[185]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}