A Review of Insider Threat Detection Approaches With IoT Perspective
Open accessAbstract
Security professionals, government agencies, and corporate organizations have found an inherent need to prevent or mitigate attacks from insider threats. Accordingly, active research on insider threat detection has been conducted to prevent and mitigate adverse effects such as leakage of valuable information that may be caused by insiders. Along with the growth of Internet-of-Things (IoT), new security challenges arise in the existing security frameworks. Attack surfaces are significantly enlarged which could cause a severe risk in terms of company insider threat management. In this work, we provide a generalization of aspects of insider threats with IoT and analyze the surveyed literature based on both private and public sources. We then examine data sources considering IoT environments based on the characteristics and the structure of IoT (perceptual, network, and application layers). The result of reviewing the study shows that using the data source of the network and application layer is more suitable than the perceptual layer in the IoT environment. We also categorized each layer's data sources according to their features, and we investigated research objectives and methods for each category. Finally, the potential for utilization and limitations under the IoT environment are presented at the end of each layer examination.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Employee resistance or skepticism toward intrusive monitoring can undermine the effectiveness of insider threat detection systems.
“Considering the human factor is imperative, as employee resistance or skepticism toward intrusive monitoring can undermine the effectiveness of detection systems. Technical solutions must be transparent, privacy-aware, and supported by a culture of security awareness, with clear communication regarding the purpose and benefits of the insider threat detection system [91].”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [91]
Cites
The Psychological Meaning of Words: LIWC and Computerized Text Analysis Methods
Tausczik, Y. R., & Pennebaker, J. W. (2010) · Journal of Language and Social Psychology · doi:10.1177/0261927x09351676 · Cited by 5,774 · see citing works
Varga, A. (2010) · Modeling and Tools for Network Simulation · doi:10.1007/978-3-642-12331-3_3 · Cited by 449 · see citing works
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
Insider Threat Detection with Deep Neural Network
Yuan, F., Cao, Y., Shang, Y., Liu, Y., Tan, J., & Fang, B. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-93698-7_4 · Cited by 168 · see citing works
Scenario-Based Insider Threat Detection From Cyber Activities
Chattopadhyay, P., Wang, L., & Tan, Y.-P. (2018) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2018.2857473 · Cited by 115 · see citing works
Deep Learning Based Attribute Classification Insider Threat Detection for Data Security
Meng, F., Lou, F., Fu, Y., & Tian, Z. (2018) · 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) · doi:10.1109/dsc.2018.00092 · Cited by 74 · see citing works
Detecting insider threats through language change.
Taylor, P. J., Dando, C. J., Ormerod, T. C., Ball, L. J., Jenkins, M. C., Sandham, A., & Menacere, T. (2013) · Law and Human Behavior · doi:10.1037/lhb0000032 · Cited by 59 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
“In an enterprise environment, security data often resides in disparate systems such as network logs, endpoint detection and response (EDR) solutions, user behavior analytics (UBA) platforms, and identity and access management (IAM) systems [91].”
BackgroundAl-Shehari, T., & Alsowail, R. A. (2021) · Entropy · doi:10.3390/e23101258 · Cited by 193 · see citing works
Zero Trust Architecture in Cloud Networks: Application, Challenges and Future Opportunities
Ahmadi, S. (2024) · Journal of Engineering Research and Reports · doi:10.9734/jerr/2024/v26i21083 · Cited by 79 · see citing works
Detecting Insider Threat via a Cyber-Security Culture Framework
Georgiadou, A., Mouzakitis, S., & Askounis, D. (2022) · Journal of Computer Information Systems · doi:10.1080/08874417.2021.1903367 · Cited by 65 · see citing works
Insider threat detection using supervised machine learning algorithms
Manoharan, P., Yin, J., Wang, H., Zhang, Y., & Ye, W. (2024) · Telecommunication Systems · doi:10.1007/s11235-023-01085-3 · Cited by 34 · see citing works
Integrating Human Factors into Insider Threat Detection – A Systematic Review
Pathirana, N., Roberts, R., Kalutarage, H., & McDermott, C. D. (2026) · ACM Computing Surveys · doi:10.1145/3798089 · Cited by 1 · see citing works
“The Enron dataset [68] consists of 500,000 emails from 150 Enron employees, mainly senior management and it is a traitor based dataset.”
Influential
- Authors
- Kim, A., Oh, J., Ryu, J., & Lee, K.
- Affiliations
- Korea Institute of Nuclear Nonproliferation & Control (KR)
- Korea University (KR)
- Venue
- IEEE Access
- Published
- 2020
- Volume
- 8
- Pages
- 78847-78867
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W3019933808
- Cited by
- 93
- References
- 7
- Citations by year
- 2026: 16 · 2025: 13 · 2024: 19 · 2023: 21 · 2022: 10 · 2021: 9 · 2020: 5
- FWCI
- 5.29
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Nuclear Safety and Security Commission (10.13039/501100003630)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- insider threat detection, Internet of Things security, IoT layers, network layer, application layer, data sources, information leakage, attack surface expansion
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
