{"id":"https://openalex.org/W7128423286","doi":"https://doi.org/10.1186/s42400-026-00555-w","title":"FusionITD: enhanced cross-modal insider threat perception framework via behavior-semantic fusion","display_name":"FusionITD: enhanced cross-modal insider threat perception framework via behavior-semantic fusion","publication_year":2026,"publication_date":"2026-02-09","ids":{"openalex":"https://openalex.org/W7128423286","doi":"https://doi.org/10.1186/s42400-026-00555-w"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-026-00555-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00555-w","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00555-w.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00555-w.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125448861","display_name":"Lu Yuan","orcid":null},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lu Yuan","raw_affiliation_strings":["Information Engineering University, Zhengzhou, 450001, China"],"affiliations":[{"raw_affiliation_string":"Information Engineering University, Zhengzhou, 450001, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Dexian Chang","orcid":null},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dexian Chang","raw_affiliation_strings":["Information Engineering University, Zhengzhou, 450001, China"],"affiliations":[{"raw_affiliation_string":"Information Engineering University, Zhengzhou, 450001, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125467064","display_name":"Hao Hu","orcid":null},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Hu","raw_affiliation_strings":["Information Engineering University, Zhengzhou, 450001, China"],"affiliations":[{"raw_affiliation_string":"Information Engineering University, Zhengzhou, 450001, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057560325","display_name":"Yi Jiang","orcid":"https://orcid.org/0000-0003-2055-680X"},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yingchang Jiang","raw_affiliation_strings":["Information Engineering University, Zhengzhou, 450001, China"],"affiliations":[{"raw_affiliation_string":"Information Engineering University, Zhengzhou, 450001, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125458671","display_name":"Heyu Chang","orcid":null},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Heyu Chang","raw_affiliation_strings":["Information Engineering University, Zhengzhou, 450001, China"],"affiliations":[{"raw_affiliation_string":"Information Engineering University, Zhengzhou, 450001, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057857180","display_name":"Liguo Fang","orcid":null},"institutions":[{"id":"https://openalex.org/I169689159","display_name":"PLA Information Engineering University","ror":"https://ror.org/00mm1qk40","country_code":"CN","type":"education","lineage":["https://openalex.org/I169689159"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Liguo Fang","raw_affiliation_strings":["Information Engineering University, Zhengzhou, 450001, China"],"affiliations":[{"raw_affiliation_string":"Information Engineering University, Zhengzhou, 450001, China","institution_ids":["https://openalex.org/I169689159"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5125472865","display_name":"Yuling Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuling Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China"],"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5057857180"],"corresponding_institution_ids":["https://openalex.org/I169689159"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.2349746,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.15639999508857727,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.15639999508857727,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.15440000593662262,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.056299999356269836,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.781000018119812},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.4814999997615814},{"id":"https://openalex.org/keywords/cosine-similarity","display_name":"Cosine similarity","score":0.4341000020503998},{"id":"https://openalex.org/keywords/login","display_name":"Login","score":0.4000000059604645},{"id":"https://openalex.org/keywords/weighting","display_name":"Weighting","score":0.3955000042915344},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.38190001249313354},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.3628999888896942},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.3628000020980835},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.34950000047683716},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.3301999866962433}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.809499979019165},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.781000018119812},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5378999710083008},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.4814999997615814},{"id":"https://openalex.org/C2780762811","wikidata":"https://www.wikidata.org/wiki/Q1784941","display_name":"Cosine similarity","level":3,"score":0.4341000020503998},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.40619999170303345},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.40529999136924744},{"id":"https://openalex.org/C113324615","wikidata":"https://www.wikidata.org/wiki/Q472302","display_name":"Login","level":2,"score":0.4000000059604645},{"id":"https://openalex.org/C183115368","wikidata":"https://www.wikidata.org/wiki/Q856577","display_name":"Weighting","level":2,"score":0.3955000042915344},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.38370001316070557},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.38190001249313354},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3628999888896942},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3628000020980835},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.34950000047683716},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.3301999866962433},{"id":"https://openalex.org/C130318100","wikidata":"https://www.wikidata.org/wiki/Q2268914","display_name":"Semantic similarity","level":2,"score":0.33009999990463257},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.32359999418258667},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.32249999046325684},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.31380000710487366},{"id":"https://openalex.org/C78639753","wikidata":"https://www.wikidata.org/wiki/Q3318160","display_name":"Behavioral modeling","level":2,"score":0.3118000030517578},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3077999949455261},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.2879999876022339},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.2847999930381775},{"id":"https://openalex.org/C2781122975","wikidata":"https://www.wikidata.org/wiki/Q16928266","display_name":"Semantic feature","level":2,"score":0.28360000252723694},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.2833000123500824},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.28189998865127563},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.2808000147342682},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.27869999408721924},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C2778751112","wikidata":"https://www.wikidata.org/wiki/Q835016","display_name":"Window (computing)","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C105002631","wikidata":"https://www.wikidata.org/wiki/Q4833645","display_name":"Subject-matter expert","level":3,"score":0.2605000138282776},{"id":"https://openalex.org/C2777622855","wikidata":"https://www.wikidata.org/wiki/Q7901844","display_name":"User information","level":3,"score":0.2599000036716461},{"id":"https://openalex.org/C511149849","wikidata":"https://www.wikidata.org/wiki/Q7449051","display_name":"Semantic computing","level":3,"score":0.25200000405311584},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.2500999867916107}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-026-00555-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00555-w","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00555-w.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:e427b2f9c8d74d3ebc45a6209bb2a48b","is_oa":true,"landing_page_url":"https://doaj.org/article/e427b2f9c8d74d3ebc45a6209bb2a48b","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 9, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-026-00555-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00555-w","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00555-w.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5161973834037781,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1128774352","display_name":null,"funder_award_id":"No. 252102211040","funder_id":"https://openalex.org/F4320336593","funder_display_name":"Henan Provincial Science and Technology Research Project"}],"funders":[{"id":"https://openalex.org/F4320336593","display_name":"Henan Provincial Science and Technology Research Project","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7128423286.pdf","grobid_xml":"https://content.openalex.org/works/W7128423286.grobid-xml"},"referenced_works_count":32,"referenced_works":["https://openalex.org/W1458873377","https://openalex.org/W1567808143","https://openalex.org/W2040467972","https://openalex.org/W2767094836","https://openalex.org/W2891432086","https://openalex.org/W2947189214","https://openalex.org/W2962703433","https://openalex.org/W2964236337","https://openalex.org/W2986944522","https://openalex.org/W2994850640","https://openalex.org/W3000429356","https://openalex.org/W3112185317","https://openalex.org/W3130498974","https://openalex.org/W4312938817","https://openalex.org/W4320713315","https://openalex.org/W4380367456","https://openalex.org/W4385336214","https://openalex.org/W4390871511","https://openalex.org/W4391934197","https://openalex.org/W4398151663","https://openalex.org/W4398239377","https://openalex.org/W4399567567","https://openalex.org/W4400728137","https://openalex.org/W4402638818","https://openalex.org/W4403937240","https://openalex.org/W4405488412","https://openalex.org/W4408253824","https://openalex.org/W4410702627","https://openalex.org/W4412086250","https://openalex.org/W4414803744","https://openalex.org/W4417345320","https://openalex.org/W6959882703"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"In":[1],"recent":[2],"years,":[3],"insider":[4,23,56,68],"threat":[5,24,69,256],"incidents":[6],"have":[7],"occurred":[8],"with":[9,97],"increasing":[10],"frequency,":[11],"leading":[12],"to":[13,41,145,149,163,175,200,221,240],"severe":[14],"data":[15,139,178],"breaches":[16],"and":[17,36,52,79,93,105,142,168,204,209,219,281],"substantial":[18],"economic":[19],"losses.":[20],"Most":[21],"existing":[22],"detection":[25,121,225],"methods":[26,270],"rely":[27],"primarily":[28],"on":[29,74,130,159,237,261],"single-modal":[30],"features,":[31,167],"such":[32,89,215],"as":[33,90,216],"system":[34],"logs":[35],"registry":[37],"data,":[38],"while":[39],"failing":[40],"fully":[42],"exploit":[43],"the":[44,60,75,98,125,131,137,146,170,177,243,246,251,262],"rich":[45],"semantic":[46,80,99,193,202],"information":[47,100],"embedded":[48],"in":[49,276],"instant":[50],"messaging":[51],"email":[53,106],"content":[54],"of":[55,77,134,245],"users.":[57],"To":[58],"address":[59,176],"above":[61],"issues,":[62],"we":[63,188,230],"propose":[64,156,189],"FusionITD,":[65],"a":[66,151,190,273,278,282],"cross-modal":[67],"perception":[70],"enhancement":[71],"framework":[72,83],"based":[73,129,158,236],"fusion":[76],"behavioral":[78,87,166,207],"features.":[81],"This":[82],"combines":[84],"users\u2019":[85],"temporal":[86,132,165],"characteristics":[88],"file":[91],"operations":[92],"login":[94],"device":[95],"patterns":[96],"derived":[101],"from":[102,113,124],"web":[103],"browsing":[104],"content.":[107],"By":[108],"modeling":[109],"user":[110,135,152,227],"behavior":[111,138,153,185],"baselines":[112],"multiple":[114],"dimensions,":[115],"FusionITD":[116,267],"enables":[117],"more":[118],"accurate":[119],"anomaly":[120,224],"when":[122],"deviations":[123],"baseline":[126],"occur.":[127],"Firstly,":[128],"distribution":[133],"behaviors,":[136],"is":[140],"segmented":[141],"aggregated":[143],"according":[144],"time":[147],"window":[148],"form":[150],"graph.":[154],"We":[155,196,212],"WR-GNN":[157],"graph":[160],"representation":[161],"learning":[162],"capture":[164],"introduce":[169],"Focal":[171],"MSE":[172],"loss":[173],"function":[174],"imbalance":[179],"problem":[180],"caused":[181],"by":[182,271],"sparse":[183],"abnormal":[184],"data.":[186],"Secondly,":[187],"retrieval-augmented":[191],"generation-based":[192],"analysis":[194],"algorithm.":[195],"use":[197],"cosine":[198],"similarity":[199],"perform":[201],"matching":[203],"ranking":[205],"between":[206],"contents":[208],"historical":[210],"behaviors.":[211],"extract":[213],"features":[214],"emotion,":[217],"intention,":[218],"focus":[220],"achieve":[222],"fine-grained":[223],"for":[226,254],"behavior.":[228],"Finally,":[229],"designed":[231],"an":[232],"adaptive":[233],"weighting":[234],"mechanism":[235],"logistic":[238],"regression":[239],"dynamically":[241],"integrate":[242],"outputs":[244],"previous":[247],"two":[248],"parts,":[249],"enhancing":[250],"generalization":[252],"ability":[253],"different":[255],"scenarios.":[257],"Experimental":[258],"results":[259],"conducted":[260],"CERT":[263],"datasets":[264],"show":[265],"that":[266],"outperforms":[268],"other":[269],"achieving":[272],"5%":[274],"increase":[275],"AUC,":[277],"higher":[279],"TPR,":[280],"lower":[283],"false":[284],"positive":[285],"rate.":[286]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2026-02-10T00:00:00"}