CoChat
Sign Up
Cited by 31Network Security and Intrusion DetectionInformation and Cyber SecurityUser Authentication and Security Systems

Insider Threat Identification Using the Simultaneous Neural Learning of Multi-Source Logs

Open access
Liu, Liu, Chen, Chao, Zhang, Jun, De Vel, Olivier, Xiang, Yang·2019·IEEE Access
DOI 10.1109/access.2019.2957055
Open this paper in CoChat — free accountOpen PDF

Abstract

Insider threat detection has drawn increasing attention in recent years. In order to capture a malicious insider’s digital footprints that occur scatteredly across a wide range of audit data sources over a long period of time, existing approaches often leverage a scoring mechanism to orchestrate alerts generated from multiple sub-detectors, or require domain knowledge-based feature engineering to conduct a one-off analysis across multiple types of data. These approaches result in a high deployment complexity and incur additional costs for engaging security experts. In this paper, we present a novel approach that works with a variety of security logs. The security logs are transformed into texts in the same format and then arranged as a corpus. Using the model trained by Word2vec with the corpus, we are enabled to approximate the posterior probabilities for insider behaviours. Accordingly, we label the transformed events as suspicious if their behavioural probabilities are smaller than a given threshold, and a user is labelled as malicious if he/she is associated with multiple suspicious events. The experiments are undertaken with the Carnegie Mellon University (CMU) CERT Programs insider threat database v6.2, which not only demonstrate that the proposed approach is effective and scalable in practical applications but also provide a guidance for tuning the parameters and thresholds.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/access.2019.2957055

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Another hybrid uses LSTM with multi-head attention and Dempster-Shafer theory, reporting 95.79% detection rate and 4.67% FAR.

    “Another hybrid uses LSTM with multi-head attention and Dempster-Shafer theory, reporting 95.79% detection rate and 4.67% FAR [31].”

    From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [31]

    The Introduction (page unavailable) identifies the paper’s proposed method as Word2vec-based detection using multi-source security logs, not an LSTM with multi-head attention and Dempster–Shafer theory. The Performance Results (page unavailable) report parameter settings achieving 100% true-positive rate with a false-positive rate below 10%, rather than the claimed 95.79% detection rate and 4.67% FAR. (LLM, conf=0.90)

    Checked by a reasoning model — may be wrong.

    Experimental — accuracy not yet measured

  • Challenges include high computational costs, as DL models require significant resources for training on large datasets like Los Alamos cybersecurity events, limiting real-time deployment.

    “Challenges include high computational costs, as DL models require significant resources for training on large datasets like Los Alamos cybersecurity events [23,29], limiting real-time deployment [24,31].”

    From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [31]

    The Related Work section says computational cost can be extremely high for machine/deep-learning approaches using many features on large datasets, and the Comparative Study reports that a deep autoencoder took about an hour to train. But the paper uses the CMU insider-threat dataset, not Los Alamos cybersecurity events. The cited passages also do not establish a limitation on real-time deployment. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • High false positive rates in some hybrids (e.g., 9% in LSTM-Autoencoder) require careful tuning, and ensemble overhead may hinder scalability in real-time scenarios.

    “High FPR in some hybrids (e.g., 9% in LSTM-Autoencoder [13]) requires careful tuning, and ensemble overhead may hinder scalability in real-time scenarios [24,31].”

    From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [31]

    The Introduction and Related Work (pages unavailable) say that deploying multiple sub-detectors raises engineering costs and design complexity, supporting the concern about overhead. They do not say that this overhead hinders scalability in real-time scenarios. The 9% LSTM-Autoencoder example is attached to a different citation, [13], and is not assessed here. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

  • Models like LSTM with multi-head attention (95.47% accuracy) require significant preprocessing and training time, which may delay detection in live systems.

    “For instance, the manuscript notes that models like LSTM with multi-head attention (95.47% accuracy [31]) require significant preprocessing and training time, which may delay detection in live systems [14].”

    From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [31]

    The Comparative Study (page unavailable in our copy) reports that a deep-autoencoder approach required feature-vector preparation and about one hour of training, supporting a general concern about processing and training costs. It does not establish those costs for LSTM with multi-head attention or say that they delay detection in live systems. The 95.47% accuracy figure is attached to a different citation, [31], so it is not assessed here. (LLM, conf=0.83)

    Experimental — accuracy not yet measured

  • They falter on temporal dynamics, delaying detection by 5-10 min in streaming data.

    “falter on temporal dynamics, delaying detection by 5-10 min in streaming data [31]”

    From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [31]

    The Performance Results section reports that generating the corpus and performing detection takes around 5–10 minutes. It does not describe that time as a detection delay caused by difficulty with temporal dynamics or measure it in streaming data; the Dataset section says the detector works on a weekly basis. Our copy provides no page numbers for these passages. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

The citation lists haven’t been fetched yet

References 40 · Cited by 31

Research works printed but not linked: 36

  1. L. Liu, O. de Vel, Q.-L. Han, J. Zhang, and Y. Xiang, ''Detecting and preventing cyber insider threats: A survey,'' IEEE Commun. Surveys Tuts., vol. 20, no. 2, pp. 1397-1417, 2nd Quart., 2018.
  2. Clearswift. (2017). Clearswift Insider Threat Index (CITI). Accessed: Jun. 9, 2018. [Online]. Available: https://www.clearswift. com/about-us/pr/press-releases/insider-threat-74-security-incidents- come-extended-enterprise-not-hacking-groups
  3. A. Azaria, A. Richardson, S. Kraus, and V. S. Subrahmanian, ''Behavioral analysis of insider threat: A survey and bootstrapped prediction in imbal- anced data,'' IEEE Trans. Comput. Social Syst., vol. 1, no. 2, pp. 135-155, Jun. 2014.
  4. M. A. Maloof and G. D. Stephens, ''Elicit: A system for detect- ing insiders who violate need-to-know,'' in Proc. Int. Workshop Recent Adv. Intrusion Detection. Berlin, Germany: Springer, 2007, pp. 146-166.
  5. E. Ted, H. G. Goldberg, A. Memory, W. T. Young, B. Rees, R. Pierce, D. Huang, M. Reardon, D. A. Bader, and E. Chow, ''Detecting insider threats in a real corporate database of computer usage activity,'' in Proc. 19th ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining, 2013, pp. 1393-1401.
  6. W. T. Young, H. G. Goldberg, A. Memory, J. F. Sartain, and T. E. Senator, ''Use of domain knowledge to detect insider threats in computer activities,'' in Proc. IEEE Secur. Privacy Workshops (SPW), May 2013, pp. 60-67.
  7. T.-F. Yen, A. Oprea, K. Onarlioglu, T. Leetham, W. Robertson, A. Juels, and E. Kirda, ''Beehive: Large-scale log analysis for detecting suspicious activity in enterprise networks,'' in Proc. 29th Annu. Comput. Secur. Appl. Conf., 2013, pp. 199-208.
  8. T. Mikolov, I. Sutskever, K. Chen, G. S. Corrado, and J. Dean, ''Distributed representations of words and phrases and their compositionality,'' in Proc. Adv. Neural Inf. Process. Syst., 2013, pp. 3111-3119.
  9. N. Nguyen, P. Reiher, and G. H. Kuenning, ''Detecting insider threats by monitoring system call activity,'' in Proc. IEEE Syst., Man Soc. Inf. Assurance Workshop, Jun. 2003, pp. 45-52.
  10. P. Parveen, J. Evans, B. Thuraisingham, K. W. Hamlen, and L. Khan, ''Insider threat detection using stream mining and graph mining,'' in Proc. IEEE 3rd Int. Conf. Privacy, Secur., Risk Trust, IEEE 3rd Int. Conf. Social Comput., Oct. 2011, pp. 1102-1110.
  11. Y. Song, M. B. Salem, S. Hershkop, and S. J. Stolfo, ''System level user behavior biometrics using Fisher features and Gaussian mixture models,'' in IEEE Security Privacy Workshops, May 2013, pp. 52-59.
  12. A. Tuor, S. Kaplan, B. Hutchinson, N. Nichols, and S. Robinson, ''Deep learning for unsupervised insider threat detection in structured cybersecu- rity data streams,'' in Proc. Workshops 31st AAAI Conf. Artif. Intell., 2017, pp. 224-231.
  13. V. Chandola, A. Banerjee, and V. Kumar, ''Anomaly detection: A survey,'' ACM Comput. Surv., vol. 41, no. 3, p. 15, 2009.
  14. B. Liu, Y. Xiao, P. S. Yu, Z. Hao, and L. Cao, ''An efficient approach for outlier detection with imperfect data labels,'' IEEE Trans. Knowl. Data Eng., vol. 26, no. 7, pp. 1602-1616, Jul. 2014.
  15. B. Liu, Y. Xiao, L. Cao, Z. Hao, and F. Deng, ''SVDD-based outlier detection on uncertain data,'' Knowl. Inf. Syst., vol. 34, no. 3, pp. 597-618, 2013.
  16. B. Lindauer, J. Glasser, M. Rosen, K. C. Wallnau, and L. ExactData, ''Generating test data for insider threat detectors,'' JoWUA, vol. 5, no. 2, pp. 80-94, 2014.
  17. N. Sun, J. Zhang, P. Rimba, S. Gao, Y. Xiang, and L. Y. Zhang, ''Data- driven cybersecurity incident prediction: A survey,'' IEEE Commun. Sur- veys Tuts., vol. 21, no. 2, pp. 1744-1772, 2nd Quart., 2018.
  18. J. Zhang, Y. Xiang, Y. Wang, W. Zhou, Y. Xiang, and Y. Guan, ''Network traffic classification using correlation information,'' IEEE Trans. Parallel Distrib. Syst., vol. 24, no. 1, pp. 104-117, Jan. 2013.
  19. R. Coulter, Q.-L. Han, L. Pan, J. Zhang, and Y. Xiang, ''Data-driven cyber security in perspective-intelligent traffic analysis,'' in IEEE Trans. Cybern., to be published, doi: 10.1109/TCYB.2019.2940940. · DOI
  20. M. Xie, S. Han, B. Tian, and S. Parvin, ''Anomaly detection in wireless sensor networks: A survey,'' J. Netw. Comput. Appl., vol. 34, no. 4, pp. 1302-1325, 2011.
  21. O. Brdiczka, J. Liu, B. Price, J. Shen, A. Patil, R. Chow, E. Bart, and N. Ducheneaut, ''Proactive insider threat detection through graph learning and psychological context,'' in Proc. IEEE Symp. Secur. Privacy Work- shops, May 2012, pp. 142-149.
  22. A. A. E. Ahmed, ''Employee surveillance based on free text detection of keystroke dynamics,'' in Handbook of Research on Social and Organiza- tional Liabilities in Information Security. Hershey, PA, USA: IGI Global, 2009, pp. 47-63.
  23. J. S. Valacich, J. L. Jenkins, J. F. Nunamaker, Jr., S. Hariri, and J. Howie, ''Identifying insider threats through monitoring mouse movements in con- cealed information tests,'' in Proc. Hawaii Int. Conf. Syst. Sci. Deception Detection Symp., 2013.
  24. S. Eberz, K. B. Rasmussen, V. Lenders, and I. Martinovic, ''Looks like eve: Exposing insider threats using eye movement biometrics,'' ACM Trans. Privacy Secur., vol. 19, no. 1, p. 1, 2016.
  25. A. Oliner, A. Ganapathi, and W. Xu, ''Advances and challenges in log analysis,'' Commun. ACM, vol. 55, no. 2, pp. 55-61, Feb. 2012.
  26. T. Mikolov, K. Chen, G. Corrado, and J. Dean, ''Efficient estimation of word representations in vector space,'' 2013, arXiv:1301.3781. [Online]. Available: https://arxiv.org/pdf/1301.3781.pdf · arXiv
  27. F. Morin and Y. Bengio, ''Hierarchical probabilistic neural network lan- guage model,'' in Proc. Int. workshop Artif. Intell. Statist., vol. 5, 2005, pp. 246-252.
  28. C. Liu, ''The Bayes decision rule induced similarity measures,'' IEEE Trans. Pattern Anal. Mach. Intell., vol. 29, no. 6, pp. 1086-1090, Jun. 2007.
  29. R. Řehůřek and P. Sojka, ''Software Framework for Topic Modelling with Large Corpora,'' in Proc. LREC Workshop New Challenges NLP Frameworks. Valletta, Malta: ELRA, May 2010, pp. 45-50.
  30. S. Wen, M. S. Haghighi, C. Chen, Y. Xiang, W. Zhou, and W. Jia, ''A sword with two edges: Propagation studies on both positive and negative infor- mation in online social networks,'' IEEE Trans. Comput., vol. 64, no. 3, pp. 640-653, Mar. 2015.
  31. X. Chen, C. Li, D. Wang, S. Wen, J. Zhang, S. Nepal, Y. Xiang, and K. Ren, ''Android HIV: A study of repackaging malware for evading machine- learning detection,'' IEEE Trans. Inf. Forensics Security, vol. 15, no. 1, pp. 987-1001, Jul. 2019.
  32. T. Wu, S. Wen, Y. Xiang, and W. Zhou, ''Twitter spam detection: Sur- vey of new approaches and comparative study,'' Comput. Secur., vol. 76, pp. 265-284, Jul. 2018.
  33. J. Jiang, S. Wen, S. Yu, Y. Xiang, and W. Zhou, ''Identifying propaga- tion sources in networks: State-of-the-art and comparative studies,'' IEEE Commun. Surveys Tuts., vol. 19, no. 1, pp. 465-481, 1st Quart., 2017.
  34. M. Xie, J. Hu, S. Han, and H.-H. Chen, ''Scalable hypergrid k-NN- based online anomaly detection in wireless sensor networks,'' IEEE Trans. Parallel Distrib. Syst., vol. 24, no. 8, pp. 1661-1670, Aug. 2013.
  35. I. Homoliak, F. Toffalini, J. Guarnizo, Y. Elovici, and M. Ochoa, ''Insight into insiders and it: A survey of insider threat taxonomies, analysis, mod- eling, and countermeasures,'' ACM Comput. Surv., vol. 52, no. 2, p. 30, 2019.
  36. Q. Le and T. Mikolov, ''Distributed representations of sentences and documents,'' in Proc. Int. Conf. Mach. Learn., 2014, pp. 1188-1196.

Authors
Liu, L., Chen, C., Zhang, J., De Vel, O., & Xiang, Y.
Affiliations
Swinburne University of Technology (AU)
ORCID
Venue
IEEE Access
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2019
Volume
7
Pages
183162-183176
ISSN
2169-3536 (ISSN-L)
DOI
10.1109/access.2019.2957055
OpenAlex
W2993578250
Cited by
31
References
40
Citations by year
2026: 1 · 2025: 3 · 2024: 5 · 2023: 4 · 2022: 3 · 2021: 9 · 2020: 5 · 2019: 1
FWCI
2.46
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Access (publishedVersion, cc-by)
  • ResearchOnline at James Cook University (James Cook University) (submittedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • Figshare (submittedVersion, cc-by)
  • Swinburne figshare (Swinburne University of Technology) (submittedVersion)
Funders
Australia Defence Science and Technology (DST) Group
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
Keywords
insider threat detection, security logs, Word2Vec, posterior probability estimation, malicious user identification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review