{"id":"https://openalex.org/W4390486486","doi":"https://doi.org/10.1186/s42400-023-00190-9","title":"BRITD: behavior rhythm insider threat detection with time awareness and user adaptation","display_name":"BRITD: behavior rhythm insider threat detection with time awareness and user adaptation","publication_year":2024,"publication_date":"2024-01-02","ids":{"openalex":"https://openalex.org/W4390486486","doi":"https://doi.org/10.1186/s42400-023-00190-9"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-023-00190-9","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-023-00190-9","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00190-9","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00190-9","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100731554","display_name":"Shuang Song","orcid":"https://orcid.org/0000-0002-3490-9752"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shuang Song","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072074260","display_name":"Neng Gao","orcid":"https://orcid.org/0000-0002-0870-5692"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Neng Gao","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-0870-5692","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]},{"raw_affiliation_string":"State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100386949","display_name":"Yifei Zhang","orcid":"https://orcid.org/0000-0003-4745-3771"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifei Zhang","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]},{"raw_affiliation_string":"State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5068853698","display_name":"Cunqing Ma","orcid":"https://orcid.org/0009-0000-6475-9524"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cunqing Ma","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]},{"raw_affiliation_string":"State Key of Laboratory of Information Security, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5072074260"],"corresponding_institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"],"apc_list":null,"apc_paid":null,"fwci":9.7465,"has_fulltext":true,"cited_by_count":34,"citation_normalized_percentile":{"value":0.9850652,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"7","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9954000115394592,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.993399977684021,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.946739673614502},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7907184958457947},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.7527241706848145},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5603303909301758},{"id":"https://openalex.org/keywords/adaptation","display_name":"Adaptation (eye)","score":0.5095289349555969},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.45020169019699097},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.4178137481212616},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.37796658277511597},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3455731272697449},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3408227860927582}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.946739673614502},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7907184958457947},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.7527241706848145},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5603303909301758},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.5095289349555969},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.45020169019699097},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.4178137481212616},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37796658277511597},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3455731272697449},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3408227860927582},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-023-00190-9","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-023-00190-9","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00190-9","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:2ee99f6b4d0c4683b34beea1368dcff8","is_oa":true,"landing_page_url":"https://doaj.org/article/2ee99f6b4d0c4683b34beea1368dcff8","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 7, Iss 1, Pp 1-20 (2024)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-023-00190-9","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-023-00190-9","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00190-9","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"No poverty","score":0.6000000238418579,"id":"https://metadata.un.org/sdg/1"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4390486486.pdf"},"referenced_works_count":43,"referenced_works":["https://openalex.org/W1969795119","https://openalex.org/W1991210879","https://openalex.org/W2005221715","https://openalex.org/W2025519999","https://openalex.org/W2122646361","https://openalex.org/W2538737552","https://openalex.org/W2555811065","https://openalex.org/W2564461987","https://openalex.org/W2576753210","https://openalex.org/W2766648797","https://openalex.org/W2771022952","https://openalex.org/W2807140409","https://openalex.org/W2888160480","https://openalex.org/W2897960084","https://openalex.org/W2912868009","https://openalex.org/W2914623161","https://openalex.org/W2947189214","https://openalex.org/W2976972209","https://openalex.org/W2986944522","https://openalex.org/W2999925232","https://openalex.org/W3008932301","https://openalex.org/W3011124515","https://openalex.org/W3013077068","https://openalex.org/W3013148769","https://openalex.org/W3081528862","https://openalex.org/W3093545390","https://openalex.org/W3109130759","https://openalex.org/W3119802848","https://openalex.org/W3125731384","https://openalex.org/W3130625521","https://openalex.org/W3132199788","https://openalex.org/W3151659441","https://openalex.org/W3175686153","https://openalex.org/W3178677157","https://openalex.org/W3202156390","https://openalex.org/W3202733154","https://openalex.org/W3212868562","https://openalex.org/W3217083123","https://openalex.org/W4205515017","https://openalex.org/W4206342677","https://openalex.org/W4220688075","https://openalex.org/W4288083473","https://openalex.org/W4316136028"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"Abstract":[0,148],"Researchers":[1],"usually":[2],"detect":[3],"insider":[4,27,100,116,123],"threats":[5],"by":[6],"analyzing":[7],"user":[8,14],"behavior.":[9],"The":[10],"time":[11,37,61],"information":[12,62],"of":[13,35,131,136],"behavior":[15],"is":[16,111],"an":[17,129],"important":[18],"concern":[19],"in":[20,63],"internal":[21],"threat":[22,28,101,117,124],"detection.":[23],"Existing":[24],"works":[25],"on":[26],"detection":[29,44,102,125],"fail":[30],"to":[31,41,79,84,95,114],"make":[32,80],"full":[33],"use":[34,69],"the":[36,64,139],"information,":[38],"which":[39,143],"leads":[40],"their":[42],"poor":[43],"performance.":[45],"In":[46],"this":[47],"paper,":[48],"we":[49,57],"propose":[50],"a":[51,70,97,134],"novel":[52],"behavioral":[53,65],"feature":[54,66,71],"extraction":[55],"scheme:":[56],"implicitly":[58],"encode":[59],"absolute":[60],"sequences":[67],"and":[68,91,119,133],"sequence":[72],"construction":[73],"method":[74],"taking":[75],"covariance":[76],"into":[77],"account":[78],"our":[81],"scheme":[82],"adaptive":[83],"users.":[85],"We":[86],"select":[87],"Stacked":[88],"Bidirectional":[89],"LSTM":[90],"Feedforward":[92],"Neural":[93],"Network":[94],"build":[96],"deep":[98],"learning-based":[99],"model:":[103],"Behavior":[104],"Rhythm":[105],"Insider":[106],"Threat":[107],"Detection":[108],"(BRITD).":[109],"BRITD":[110],"universally":[112],"applicable":[113],"various":[115],"scenarios,":[118],"it":[120,127],"has":[121],"good":[122],"performance:":[126],"achieves":[128],"AUC":[130],"0.9730":[132],"precision":[135],"0.8072":[137],"with":[138],"CMU":[140],"CERT":[141],"dataset,":[142],"exceeds":[144],"all":[145],"baselines.":[146],"Graphical":[147]},"counts_by_year":[{"year":2026,"cited_by_count":13},{"year":2025,"cited_by_count":14},{"year":2024,"cited_by_count":7}],"updated_date":"2026-07-04T07:58:01.006859","created_date":"2025-10-10T00:00:00"}