CoChat
Sign Up
Cited by 22Network Security and Intrusion DetectionInformation and Cyber SecurityUser Authentication and Security Systems

Insider Threats Detection Using CNN-LSTM Model

Saaudi, Ahmed, Al-Ibadi, Zaid, Tong, Yan, Farkas, Csilla·2018·2018 International Conference on Computational Science and Computational Intelligence (CSCI)
DOI 10.1109/csci46756.2018.00025
Open this paper in CoChat — free account

Abstract

Malicious insider activities threaten various govern-ment agencies and private organizations. This paper presents a novel approach to detect malicious behaviors. We propose the use of a granularity level to represent users' log data: textual session-based data samples. The user's behaviors are modeled using character embeddings and a deep learning model that consists of CNN and LSTM. Character embeddings are used to represent the input samples. Then, a convolution layer is used to capture local tri-gram features from the input samples, followed by an LSTM layer to consider the order of these given features (tri-grams). We conduct experiments using several variations of model architectures with no handcrafted features. The proposed model is evaluated with a subset of CERT Insider Threat dataset, r4.2. The result shows that performance improved with high precision and recall values.

Integrity signals

Registry

Crossref · 10.1109/csci46756.2018.00025

Cites

15 of 15 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • This period marked the first evidence of LSTM-based model proposals, indicating a move toward temporal behavior modeling techniques.

    “This period also marked the first evidence of LSTM-based model proposals, indicating a move toward temporal behavior modeling techniques, with notable publications like [25,37].”

    From Application of Machine Learning and Deep Learning Techniques for Enhanced Insider Threat Detection in Cybersecurity: Bibliometric Review (2025) · cites this paper as [37]

  • Saaudi et al. (2018) presented a deep learning approach modeling user behaviours through character embeddings, CNN, and LSTM, achieving 100% accuracy in detecting malicious behaviours from textual session-based log data.

    “Saaudi et al. (2018) [57] presented a deep learning approach that models user behaviours through character embeddings, CNN, and LSTM, achieving near-perfect accuracy of 100% in detecting malicious behaviours by capturing and analyzing textual session-based log data.”

    From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [57]

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Saaudi, A., Al-Ibadi, Z., Tong, Y., & Farkas, C.
Affiliations
University of South Carolina (US)
ORCID
Venue
2018 International Conference on Computational Science and Computational Intelligence (CSCI)
Publisher
IEEE
Published
2018-12
Pages
94-99
DOI
10.1109/csci46756.2018.00025
OpenAlex
W2996799748
Cited by
22
References
15
Citations by year
2025: 8 · 2024: 4 · 2023: 6 · 2022: 2 · 2021: 1 · 2020: 1
FWCI
0.41
Type
conference paper
Language
en
Open access
closed
Locations
International Conference on Computational Science and Computational Intelligence (CSCI) (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
Keywords
insider threat detection, user log data, character embeddings, CNN-LSTM, CERT insider threat dataset, user behavior modeling

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review