{"id":"https://openalex.org/W7135045569","doi":"https://doi.org/10.54364/aaiml.2026.62284","title":"Detecting Anomalous States Through File Operations Using Unsupervised Learning Algorithms","display_name":"Detecting Anomalous States Through File Operations Using Unsupervised Learning Algorithms","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7135045569","doi":"https://doi.org/10.54364/aaiml.2026.62284"},"language":null,"primary_location":{"id":"doi:10.54364/aaiml.2026.62284","is_oa":true,"landing_page_url":"https://doi.org/10.54364/aaiml.2026.62284","pdf_url":"https://doi.org/10.54364/aaiml.2026.62284","source":{"id":"https://openalex.org/S4210238872","display_name":"Advances in Artificial Intelligence and Machine Learning","issn_l":"2582-9793","issn":["2582-9793"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Advances in Artificial Intelligence and Machine Learning","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://doi.org/10.54364/aaiml.2026.62284","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5087889749","display_name":"Islambek Saymanov","orcid":"https://orcid.org/0000-0003-3530-4488"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Islambek Saymanov","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109501930","display_name":"Firdavs Muxammadiev","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Firdavs Muxammadiev","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082794613","display_name":"Gayrat Juraev","orcid":"https://orcid.org/0000-0001-8767-2456"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gayrat Juraev","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044390543","display_name":"Yebo Lu","orcid":"https://orcid.org/0000-0002-8995-370X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yebo Lu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060761115","display_name":"Olga Vladimirovna Boiprav","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Olga Boiprav","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128908782","display_name":"Ruhillo Alaev","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ruhillo Alaev","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128840593","display_name":"Obidjon Bozorov","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Obidjon Bozorov","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5118202610","display_name":"Timur Abdullayev","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Timur Abdullayev","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.24355786,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"06","issue":"02","first_page":"5128","last_page":"5141"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.696399986743927,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.696399986743927,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.09319999814033508,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.04320000112056732,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6753000020980835},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.6298999786376953},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.5493999719619751},{"id":"https://openalex.org/keywords/normalization","display_name":"Normalization (sociology)","score":0.5407000184059143},{"id":"https://openalex.org/keywords/outlier","display_name":"Outlier","score":0.4377000033855438},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.43529999256134033},{"id":"https://openalex.org/keywords/sample","display_name":"Sample (material)","score":0.4083999991416931},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.3898000121116638}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7774999737739563},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6753000020980835},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.6298999786376953},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5493999719619751},{"id":"https://openalex.org/C136886441","wikidata":"https://www.wikidata.org/wiki/Q926129","display_name":"Normalization (sociology)","level":2,"score":0.5407000184059143},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.48649999499320984},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4765999913215637},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.47600001096725464},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.4377000033855438},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.43529999256134033},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.4083999991416931},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.3898000121116638},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.3781999945640564},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.328900009393692},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3118000030517578},{"id":"https://openalex.org/C2776145971","wikidata":"https://www.wikidata.org/wiki/Q30673951","display_name":"Labeled data","level":2,"score":0.2921000123023987},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.28940001130104065},{"id":"https://openalex.org/C34872919","wikidata":"https://www.wikidata.org/wiki/Q7092302","display_name":"One-class classification","level":3,"score":0.27810001373291016},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.266400009393692},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2574999928474426},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.2558000087738037},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.2502000033855438}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.54364/aaiml.2026.62284","is_oa":true,"landing_page_url":"https://doi.org/10.54364/aaiml.2026.62284","pdf_url":"https://doi.org/10.54364/aaiml.2026.62284","source":{"id":"https://openalex.org/S4210238872","display_name":"Advances in Artificial Intelligence and Machine Learning","issn_l":"2582-9793","issn":["2582-9793"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Advances in Artificial Intelligence and Machine Learning","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.54364/aaiml.2026.62284","is_oa":true,"landing_page_url":"https://doi.org/10.54364/aaiml.2026.62284","pdf_url":"https://doi.org/10.54364/aaiml.2026.62284","source":{"id":"https://openalex.org/S4210238872","display_name":"Advances in Artificial Intelligence and Machine Learning","issn_l":"2582-9793","issn":["2582-9793"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Advances in Artificial Intelligence and Machine Learning","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6429967880249023,"display_name":"Life in Land","id":"https://metadata.un.org/sdg/15"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7135045569.pdf","grobid_xml":"https://content.openalex.org/works/W7135045569.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"To":[0],"address":[1],"the":[2,64,75,126,132,150,159],"challenge":[3],"of":[4,117,131,135,155],"detecting":[5],"insider":[6,156],"threats,":[7],"this":[8],"study":[9,25,65,148],"proposes":[10],"identifying":[11],"anomalous":[12,119,138],"cases":[13,139],"by":[14,123,144],"analyzing":[15],"user":[16,28,55],"file":[17],"operations":[18,30],"recorded":[19],"in":[20,31,125,158],"organizational":[21],"system":[22,59],"logs.":[23,60],"This":[24,147],"involved":[26],"monitoring":[27],"document":[29],"a":[32,38,83,129],"special":[33],"laboratory":[34],"environment,":[35],"from":[36],"which":[37],"sample":[39],"dataset":[40,85],"was":[41],"systematically":[42],"created":[43],"for":[44,63,95,152,166],"further":[45],"analysis.":[46],"Relevant":[47],"data":[48,79],"sources":[49],"were":[50,66,72,80,101,121,140],"identified":[51],"to":[52],"capture":[53],"file-based":[54],"activities":[56],"through":[57],"operating":[58],"Features":[61],"suitable":[62,94],"selected.":[67],"Cleaning,":[68],"filtering,":[69],"and":[70,86,91,113,172,179],"normalization":[71],"performed":[73,122],"on":[74],"data.":[76],"The":[77,98,161],"cleaned":[78],"consolidated":[81],"into":[82,177],"single":[84],"analyzed":[87],"using":[88],"unsupervised":[89],"learning":[90],"statistical":[92],"methods":[93],"classification":[96],"tasks.":[97],"following":[99],"algorithms":[100],"selected:":[102],"Isolation":[103],"Forest,":[104],"Local":[105],"Outlier":[106],"Factor,":[107],"One-Class":[108],"Support":[109],"Vector":[110],"Machine":[111],"(SVM),":[112],"Z-Score.":[114],"A":[115],"total":[116],"50":[118,137],"actions":[120],"users":[124],"study.":[127],"As":[128],"result":[130],"evaluation,":[133],"36":[134],"these":[136],"consistently":[141],"as":[142],"anomalies":[143],"all":[145],"algorithms.":[146],"demonstrates":[149],"potential":[151],"realtime":[153],"detection":[154],"threats":[157],"future.":[160],"approach":[162],"is":[163],"particularly":[164],"relevant":[165],"organizations":[167],"that":[168],"handle":[169],"sensitive":[170],"data,":[171],"it":[173],"can":[174],"be":[175],"integrated":[176],"UEBA":[178],"DLP":[180],"systems.":[181]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-03-13T00:00:00"}