{"id":"https://openalex.org/W4396763107","doi":"https://doi.org/10.3389/fdata.2024.1375818","title":"A comprehensive investigation of clustering algorithms for User and Entity Behavior Analytics","display_name":"A comprehensive investigation of clustering algorithms for User and Entity Behavior Analytics","publication_year":2024,"publication_date":"2024-05-09","ids":{"openalex":"https://openalex.org/W4396763107","doi":"https://doi.org/10.3389/fdata.2024.1375818","pmid":"https://pubmed.ncbi.nlm.nih.gov/38784677"},"language":"en","primary_location":{"id":"doi:10.3389/fdata.2024.1375818","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fdata.2024.1375818","pdf_url":"https://www.frontiersin.org/articles/10.3389/fdata.2024.1375818/pdf?isPublishedV2=False","source":{"id":"https://openalex.org/S4210201220","display_name":"Frontiers in Big Data","issn_l":"2624-909X","issn":["2624-909X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Big Data","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.frontiersin.org/articles/10.3389/fdata.2024.1375818/pdf?isPublishedV2=False","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5097082408","display_name":"Pierpaolo Artioli","orcid":"https://orcid.org/0009-0009-7111-5343"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pierpaolo Artioli","raw_affiliation_strings":["Cybersecurity Laboratory, BV TECH S.p.A., Milan, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cybersecurity Laboratory, BV TECH S.p.A., Milan, Italy","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092128322","display_name":"Antonio Maci","orcid":"https://orcid.org/0000-0002-6526-554X"},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Antonio Maci","raw_affiliation_strings":["Cybersecurity Laboratory, BV TECH S.p.A., Milan, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cybersecurity Laboratory, BV TECH S.p.A., Milan, Italy","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070877168","display_name":"Alessio Magr\u00ec","orcid":"https://orcid.org/0000-0001-6207-6404"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Alessio Magr\u00ec","raw_affiliation_strings":["Cybersecurity Laboratory, BV TECH S.p.A., Milan, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cybersecurity Laboratory, BV TECH S.p.A., Milan, Italy","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5092128322"],"corresponding_institution_ids":[],"apc_list":{"value":1285,"currency":"USD","value_usd":1285},"apc_paid":{"value":1285,"currency":"USD","value_usd":1285},"fwci":5.5626,"has_fulltext":true,"cited_by_count":26,"citation_normalized_percentile":{"value":0.96374997,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"7","issue":null,"first_page":"1375818","last_page":"1375818"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4336000084877014,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4336000084877014,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.11900000274181366,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.09290000051259995,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.800190806388855},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.764147162437439},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.68263179063797},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5145972967147827},{"id":"https://openalex.org/keywords/government","display_name":"Government (linguistics)","score":0.43760403990745544},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.43524831533432007},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.35464829206466675},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.339499294757843},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.33251869678497314}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.800190806388855},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.764147162437439},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.68263179063797},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5145972967147827},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.43760403990745544},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.43524831533432007},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35464829206466675},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.339499294757843},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33251869678497314},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.3389/fdata.2024.1375818","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fdata.2024.1375818","pdf_url":"https://www.frontiersin.org/articles/10.3389/fdata.2024.1375818/pdf?isPublishedV2=False","source":{"id":"https://openalex.org/S4210201220","display_name":"Frontiers in Big Data","issn_l":"2624-909X","issn":["2624-909X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Big Data","raw_type":"journal-article"},{"id":"pmid:38784677","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/38784677","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in big data","raw_type":null},{"id":"pmh:oai:pubmedcentral.nih.gov:11112065","is_oa":true,"landing_page_url":"https://www.ncbi.nlm.nih.gov/pmc/articles/11112065","pdf_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC11112065/pdf/fdata-07-1375818.pdf","source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Front Big Data","raw_type":"Text"},{"id":"pmh:oai:doaj.org/article:72f6c9bc5ffe4db68db5391fc4a25cfd","is_oa":true,"landing_page_url":"https://doaj.org/article/72f6c9bc5ffe4db68db5391fc4a25cfd","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Frontiers in Big Data, Vol 7 (2024)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3389/fdata.2024.1375818","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fdata.2024.1375818","pdf_url":"https://www.frontiersin.org/articles/10.3389/fdata.2024.1375818/pdf?isPublishedV2=False","source":{"id":"https://openalex.org/S4210201220","display_name":"Frontiers in Big Data","issn_l":"2624-909X","issn":["2624-909X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Big Data","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1888088267","display_name":null,"funder_award_id":"2014-2020\u2019","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"}],"funders":[{"id":"https://openalex.org/F4320335322","display_name":"European Regional Development Fund","ror":"https://ror.org/00k4n6c32"}],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4396763107.pdf"},"referenced_works_count":130,"referenced_works":["https://openalex.org/W66443818","https://openalex.org/W151377110","https://openalex.org/W1494525627","https://openalex.org/W1763504508","https://openalex.org/W1801564767","https://openalex.org/W1855593863","https://openalex.org/W1986218267","https://openalex.org/W1991210879","https://openalex.org/W1995450389","https://openalex.org/W2003217181","https://openalex.org/W2011301426","https://openalex.org/W2100060407","https://openalex.org/W2101234009","https://openalex.org/W2108399535","https://openalex.org/W2142838865","https://openalex.org/W2206700814","https://openalex.org/W2310481857","https://openalex.org/W2408574227","https://openalex.org/W2461480626","https://openalex.org/W2462358393","https://openalex.org/W2474983390","https://openalex.org/W2571254578","https://openalex.org/W2583862887","https://openalex.org/W2601243251","https://openalex.org/W2744498396","https://openalex.org/W2749090445","https://openalex.org/W2766417346","https://openalex.org/W2773825811","https://openalex.org/W2789410825","https://openalex.org/W2900404321","https://openalex.org/W2901285969","https://openalex.org/W2916699464","https://openalex.org/W2940317904","https://openalex.org/W2946254251","https://openalex.org/W2949320318","https://openalex.org/W2949537827","https://openalex.org/W2949647805","https://openalex.org/W2950766322","https://openalex.org/W2954312269","https://openalex.org/W2976051608","https://openalex.org/W2976552083","https://openalex.org/W2978237347","https://openalex.org/W2978499895","https://openalex.org/W2979590797","https://openalex.org/W2982673782","https://openalex.org/W2989630706","https://openalex.org/W3000429356","https://openalex.org/W3003372411","https://openalex.org/W3014988774","https://openalex.org/W3039513780","https://openalex.org/W3041286073","https://openalex.org/W3041802901","https://openalex.org/W3045880080","https://openalex.org/W3048644634","https://openalex.org/W3068758478","https://openalex.org/W3108890911","https://openalex.org/W3111749540","https://openalex.org/W3116565634","https://openalex.org/W3125204069","https://openalex.org/W3135028703","https://openalex.org/W3136603773","https://openalex.org/W3145543370","https://openalex.org/W3147914029","https://openalex.org/W3150635270","https://openalex.org/W3161650714","https://openalex.org/W3165577760","https://openalex.org/W3169815615","https://openalex.org/W3170155579","https://openalex.org/W3177379628","https://openalex.org/W3179245071","https://openalex.org/W3183177628","https://openalex.org/W3194186453","https://openalex.org/W3202164597","https://openalex.org/W3205033750","https://openalex.org/W3205142248","https://openalex.org/W4205663290","https://openalex.org/W4206353983","https://openalex.org/W4210954769","https://openalex.org/W4213418104","https://openalex.org/W4220668486","https://openalex.org/W4221006043","https://openalex.org/W4231029117","https://openalex.org/W4234094714","https://openalex.org/W4247105055","https://openalex.org/W4281757528","https://openalex.org/W4283711193","https://openalex.org/W4285058206","https://openalex.org/W4285172224","https://openalex.org/W4301045096","https://openalex.org/W4308505715","https://openalex.org/W4310494058","https://openalex.org/W4312220220","https://openalex.org/W4312384107","https://openalex.org/W4313245390","https://openalex.org/W4313245578","https://openalex.org/W4315782929","https://openalex.org/W4316077341","https://openalex.org/W4318211321","https://openalex.org/W4365453589","https://openalex.org/W4366674740","https://openalex.org/W4380082195","https://openalex.org/W4380450641","https://openalex.org/W4381569470","https://openalex.org/W4382317959","https://openalex.org/W4385625655","https://openalex.org/W4385797708","https://openalex.org/W4385969470","https://openalex.org/W4386211288","https://openalex.org/W4387163317","https://openalex.org/W4387458640","https://openalex.org/W4387520474","https://openalex.org/W4388043443","https://openalex.org/W4391877241","https://openalex.org/W4392529044","https://openalex.org/W6637131181","https://openalex.org/W6668990524","https://openalex.org/W6675354045","https://openalex.org/W6678914141","https://openalex.org/W6705080202","https://openalex.org/W6709229757","https://openalex.org/W6719103970","https://openalex.org/W6764087698","https://openalex.org/W6766014833","https://openalex.org/W6768699172","https://openalex.org/W6797959750","https://openalex.org/W6804609149","https://openalex.org/W6848585066","https://openalex.org/W6849124195","https://openalex.org/W6853550247","https://openalex.org/W6855733573"],"related_works":["https://openalex.org/W4298130764","https://openalex.org/W2804364458","https://openalex.org/W2132641928","https://openalex.org/W4310225030","https://openalex.org/W2090259340","https://openalex.org/W2393816671","https://openalex.org/W2158836806","https://openalex.org/W2083665254","https://openalex.org/W1926736923","https://openalex.org/W2942177010"],"abstract_inverted_index":{"Introduction:":[0],"Government":[1],"agencies":[2],"are":[3,116],"now":[4],"encouraging":[5],"industries":[6],"to":[7,12,17,61,123,135,206],"enhance":[8],"their":[9],"security":[10,24],"systems":[11,36],"detect":[13],"and":[14,51,72,85,130,151,167,179,188],"respond":[15],"proactively":[16],"cybersecurity":[18,63],"incidents.":[19],"Consequently,":[20],"equipping":[21],"with":[22,35,201],"a":[23,43,66,70,90,146,202],"operation":[25],"center":[26],"that":[27,78],"combines":[28],"the":[29,80,109,125,138,176,184,194,207],"analytical":[30],"capabilities":[31],"of":[32,82,140,149,209],"human":[33],"experts":[34],"based":[37,107],"on":[38,108,193],"Machine":[39],"Learning":[40],"(ML)":[41],"plays":[42],"critical":[44],"role.":[45],"In":[46,94],"this":[47],"setting,":[48],"Security":[49],"Information":[50],"Event":[52],"Management":[53],"(SIEM)":[54],"platforms":[55],"can":[56],"effectively":[57],"handle":[58],"network-related":[59],"events":[60],"trigger":[62],"alerts.":[64],"Furthermore,":[65],"SIEM":[67],"may":[68],"include":[69],"User":[71],"Entity":[73],"Behavior":[74],"Analytics":[75],"(UEBA)":[76],"engine":[77],"examines":[79],"behavior":[81],"both":[83],"users":[84],"devices,":[86],"or":[87],"entities,":[88],"within":[89],"corporate":[91],"network.":[92],"Methods:":[93],"recent":[95],"literature,":[96],"several":[97],"contributions":[98],"have":[99],"employed":[100],"ML":[101],"algorithms":[102,154],"for":[103,155],"UEBA,":[104,156],"especially":[105],"those":[106],"unsupervised":[110],"learning":[111],"paradigm,":[112],"because":[113],"anomalous":[114],"behaviors":[115],"usually":[117],"not":[118],"known":[119],"in":[120],"advance.":[121],"However,":[122],"shorten":[124],"gap":[126],"between":[127],"research":[128],"advances":[129],"practice,":[131],"it":[132],"is":[133],"necessary":[134],"comprehensively":[136],"analyze":[137],"effectiveness":[139],"these":[141],"methodologies.":[142],"This":[143],"paper":[144],"proposes":[145],"thorough":[147],"investigation":[148],"traditional":[150],"emerging":[152],"clustering":[153,181],"considering":[157],"multiple":[158],"application":[159],"contexts,":[160],"i.e.,":[161],"different":[162],"user-entity":[163],"interaction":[164],"scenarios.":[165],"Results":[166],"discussion:":[168],"Our":[169],"study":[170],"involves":[171],"three":[172],"datasets":[173],"sourced":[174],"from":[175],"existing":[177],"literature":[178],"fifteen":[180],"algorithms.":[182],"Among":[183],"compared":[185],"techniques,":[186],"HDBSCAN":[187],"DenMune":[189],"showed":[190],"promising":[191],"performance":[192],"state-of-the-art":[195],"CERT":[196],"behavior-related":[197],"dataset,":[198],"producing":[199],"groups":[200],"density":[203],"very":[204],"close":[205],"number":[208],"users.":[210]},"counts_by_year":[{"year":2026,"cited_by_count":11},{"year":2025,"cited_by_count":15}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}