Understanding Insider Threat Attacks Using Natural Language Processing: Automatically Mapping Organic Narrative Reports to Existing Insider Threat Frameworks
Open accessThe claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
An LSTM model achieved a True Positive Rate of 97.29% and false positive rate of 0.38% on CERT datasets.
“For example, an LSTM model achieved a True Positive Rate (TPR) of 97.29% and FPR of 0.38% on CERT datasets [61], while another with Word2vec reported 73.4% accuracy [3].”
From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [61]
Section 3.3 describes an unsupervised LDA topic model trained on insider-threat news reports, and Section 4 discusses mapping narrative sentences to a framework. Searches for the stated TPR and FPR, LSTM, and CERT datasets found no passage reporting the claimed evaluation; the available passages do not establish where those figures came from. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
(2003) · Journal of Machine Learning Research · doi:10.5555/944919.944937 · Cited by 32,337 · see citing works
Foundations of statistical natural language processing
Manning, C. D., & Schütze, H. (1999) · Cited by 9,816 · see citing works
Confirmation Bias: A Ubiquitous Phenomenon in Many Guises
Nickerson, R. S. (1998) · Review of General Psychology · doi:10.1037/1089-2680.2.2.175 · Cited by 7,267 · see citing works
Griffiths, T. L., & Steyvers, M. (2004) · Proceedings of the National Academy of Sciences · doi:10.1073/pnas.0307752101 · Cited by 6,049 · see citing works
Advances in natural language processing
Hirschberg, J., & Manning, C. D. (2015) · Science · doi:10.1126/science.aaa8685 · Cited by 1,712 · see citing works
On Finding the Natural Number of Topics with Latent Dirichlet Allocation: Some Observations
Arun, R., Suresh, V., Madhavan, C. E. V., & Murthy, M. N. N. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13657-3_43 · Cited by 756 · see citing works
Quantitative analysis of large amounts of journalistic texts using topic modelling
Jacobi, C., van Atteveldt, W., & Welbers, K. (2015) · Digital Journalism · doi:10.1080/21670811.2015.1093271 · Cited by 532 · see citing works
Verizon: 2019 Data Breach Investigations Report
(2019) · Computer Fraud & Security · doi:10.1016/s1361-3723(19)30060-0 · Cited by 263 · see citing works
Understanding Insider Threat: A Framework for Characterising Attacks
Nurse, J. R. C., Buckley, O., Legg, P. A., Goldsmith, M., Creese, S., Wright, G. R. T., & Whitty, M. (2014) · 2014 IEEE Security and Privacy Workshops · doi:10.1109/spw.2014.38 · Cited by 212 · see citing works
Self-citationDispositional and situational factors: influences on information security policy violations
Johnston, A. C., Warkentin, M. E., McBride, M., & Carter, L. D. (2016) · European Journal of Information Systems · doi:10.1057/ejis.2015.15 · Cited by 186 · see citing works
Cappelli, D. M., Moore, A. P., & Trzeciak, R. F. (2012) · Addison-Wesley Professional eBooks · Cited by 175 · see citing works
Insider Threat Prediction Tool: Evaluating the probability of IT misuse
Magklaras, G., & Furnell, S. (2001) · Computers & Security · doi:10.1016/s0167-4048(02)00109-8 · Cited by 151 · see citing works
Automatically Building a Stopword List for an Information Retrieval System.
Lo, R. T.-W., He, B., & Ounis, I. (2005) · Journal of Digital Information Management · Cited by 148 · see citing works
TopicTiling: A Text Segmentation Algorithm based on LDA
Riedl, M. J., & Biemann, C. (2012) · Cited by 147 · see citing works
An Insider Threat Prediction Model
Kandias, M., Mylonas, A., Virvilis, N., Theocharidou, M., & Gritzalis, D. A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-15152-1_3 · Cited by 133 · see citing works
Modeling Human Behavior to Anticipate Insider Attacks
Greitzer, F. L., & Hohimer, R. E. (2011) · Journal of Strategic Security · doi:10.5038/1944-0472.4.2.2 · Cited by 121 · see citing works
Insider Threat Detection Using a Graph-Based Approach
Eberle, W., Graves, J. A., & Holder, L. B. (2010) · Journal of Applied Security Research · doi:10.1080/19361610.2011.529413 · Cited by 119 · see citing works
Insider Threats in Cyber Security
Probst, C. W., Bishop, M., Gollmann, D., & Hunker, J. (2010) · Advances in information security · doi:10.1007/978-1-4419-7133-3 · Cited by 85 · see citing works
Maasberg, M., Warren, J., & Beebe, N. L. (2015) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2015.423 · Cited by 82 · see citing works
Using NLP or NLP Resources for Information Retrieval Tasks
Smeaton, A. F. (1999) · Text, speech and language technology · doi:10.1007/978-94-017-2388-6_4 · Cited by 82 · see citing works
Deep Learning Based Attribute Classification Insider Threat Detection for Data Security
Meng, F., Lou, F., Fu, Y., & Tian, Z. (2018) · 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) · doi:10.1109/dsc.2018.00092 · Cited by 74 · see citing works
Detecting Insider Threat from Enterprise Social and Online Activity Data
Gavai, G., Sricharan, K., Gunning, D., Rolleston, R., Hanley, J., & Singhal, M. (2015) · Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats · doi:10.1145/2808783.2808784 · Cited by 69 · see citing works
Unintentional Insider Threat: Contributing Factors, Observables, and Mitigation Strategies
Greitzer, F. L., Strozer, J., Cohen, S. G., Bergey, J., Cowley, J. A., Moore, A. P., & Mundie, D. A. (2014) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2014.256 · Cited by 52 · see citing works
Psychosocial Modeling of Insider Threat Risk Based on Behavioral and Word Use Analysis
Greitzer, Kangas, Noonan, Brown, & Ferryman (2013) · e-Service Journal · doi:10.2979/eservicej.9.1.106 · Cited by 47 · see citing works
Identifying attack patterns for insider threat detection
Agrafiotis, I., Nurse, J. R. C., Buckley, O. E., Legg, P., Creese, S., & Goldsmith, M. H. (2015) · Computer Fraud & Security · doi:10.1016/s1361-3723(15)30066-x · Cited by 44 · see citing works
Self-citationInsider Threat and Information Security Management
Coles-Kemp, L., & Theocharidou, M. (2010) · Advances in information security · doi:10.1007/978-1-4419-7133-3_3 · Cited by 44 · see citing works
Predicting Insider Threat Risks through Linguistic Analysis of Electronic Communication
Brown, C. R., Watkins, A., & Greitzer, F. L. (2013) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2013.453 · Cited by 40 · see citing works
Insider threats in information security categories and approaches
Elmrabit, N., Yang, S., & Yang, L. (2015) · International Conference on Automation and Computing (ICAC) · doi:10.1109/iconac.2015.7313979 · Cited by 29 · see citing works
Demystifying Insider Threat: Language-Action Cues in Group Dynamics
Ho, S. M., Hancock, J. T., Booth, C., Burmester, M. V. D., Liu, X., & Timmarajus, S. S. (2016) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2016.343 · Cited by 22 · see citing works
Developing an Insider Threat Model Using Functional Decomposition
Butts, J. W., Mills, R. F., & Baldwin, R. O. (2005) · Lecture notes in computer science · doi:10.1007/11560326_32 · Cited by 13 · see citing works
(2019) · Network Security · doi:10.1016/s1353-4858(19)30068-6 · Cited by 5 · see citing works
Flagged first, then by citations
Research works printed but not linked: 2
- [28]28. Paxton-Fear, K., Hodges, D., Buckley, O.: Corpus expansion using topic modelling: Creating a library of insider threat attacks. Human-centric Computing and Infor- mation Systems (In Review)
- [31]31. Trilla, A.: Natural language processing techniques in text-to-speech synthesis and automatic speech recognition. Departament de Tecnologies Media pp. 1-5 (2009)
Cited by
Sorted by citations
Integrating Cyber Deception Into Attribute-Based Access Control (ABAC) for Insider Threat Detection
Alohaly, M., Balogun, O., & Takabi, D. (2022) · IEEE Access · doi:10.1109/access.2022.3213645 · Cited by 28 · see citing works
Moallem, A., & Bertino, E. (2020) · Interacción · doi:10.1007/978-3-030-50309-3 · Cited by 3 · see citing works
A systematic review on insider threat detection using natural language processing
Kundiya, K., & Haribhakta, Y. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01145-6 · Cited by 9 · see citing works
Survey on Deep Learning Approaches for Detection of Email Security Threat
Saeed, M. M., & Aghbari, Z. A. (2023) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.036894 · Cited by 5 · see citing works
Experience Paper: Uncovering a Privileged Insider Threat in Action
Gopalakrishna, R., & Bhaskaran, R. (2025) · 2025 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw67616.2025.00080 · Cited by 1 · see citing works
Human and machine partnership: natural language processing of army insider threat hub data
Ali, S., Deverill, H., Lindquist, J. M., & Roginski, J. W. (2025) · International Journal of Applied Decision Sciences · doi:10.1504/ijads.2025.146569 · Cited by 1 · see citing works
Faqihi, R., Nanda, P., Mohanty, M., Alqahtani, S., & Alrashed, B. (2025) · IEEE/ACS International Conference on Computer Systems and Applications (AICCSA) · doi:10.1109/aiccsa66935.2025.11315452 · Cited by 1 · see citing works
Jangir, K., & Mahato, D. P. (2024) · Communications in computer and information science · doi:10.1007/978-3-031-64064-3_1
- Authors
- Paxton-Fear, K., Hodges, D., & Buckley, O.
- Affiliations
- Cranfield University (GB)
- University of East Anglia (GB)
- Corresponding author
- Paxton-Fear, Katie
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2020
- Pages
- 619-636
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W3041713512
- Semantic Scholar
- 2f6f6c21500211dedf84392c0ae4e9aa12228230
- Cited by
- 9
- References
- 31
- Citations by year
- 2025: 4 · 2024: 1 · 2023: 2 · 2022: 1 · 2020: 1
- FWCI
- 0.76
- Type
- conference paper
- Language
- en
- Open access
- green
- ueaeprints.uea.ac.uk
- Licence
- Locations
- Lecture notes in computer science (publishedVersion)
- e-space (Manchester Metropolitan University) (acceptedVersion)
- UEA Digital Repository (University of East Anglia) (submittedVersion)
- CERES (Cranfield University) (submittedVersion, cc-by-nc)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
- Keywords
- insider threats, incident reporting, narrative reports
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
