Multi-Domain Information Fusion for Insider Threat Detection
Open accessAbstract
Malicious insiders pose significant threats to information security, and yet the capability of detecting malicious insiders is very limited. Insider threat detection is known to be a difficult problem, presenting many research challenges. In this paper we report our effort on detecting malicious insiders from large amounts of work practice data. We propose novel approaches to detect two types of insider activities: (1) blend-in anomalies, where malicious insiders try to behave similar to a group they do not belong to, and (2) unusual change anomalies, where malicious insiders exhibit changes in their behavior that are dissimilar to their peers' behavioral changes. Our first contribution focuses on detecting blend-in malicious insiders. We propose a novel approach by examining various activity domains, and detecting behavioral inconsistencies across these domains. Our second contribution is a method for detecting insiders with unusual changes in behavior. The key strength of this proposed approach is that it avoids flagging common changes that can be mistakenly detected by typical temporal anomaly detection mechanisms. Our third contribution is a method that combines anomaly indicators from multiple sources of information.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Applications to insider threat data include processing CERT Insider Threat datasets (e.g., r4.2 and v6.2) for log examination and behavioral profiling.
“Applications to insider threat data include processing CERT Insider Threat datasets (e.g., r4.2 and v6.2) for log examination and behavioral profiling [5,41,59].”
From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [5]
The A. Datasets section (page unavailable) describes processing logon, file, web, device, and email activity records, and the paper models changes in user behavior. It identifies its data only as a synthetic dataset of 1,000 users and a real dataset of about 4,600 users; our copy does not identify either as a CERT Insider Threat dataset or mention r4.2 or v6.2 (searched: CERT, r4.2, and dataset descriptions). (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Social Network Analysis: Methods and Applications
Wasserman, S. S., & Faust, K. (1994) · Cited by 18,005 · see citing works
Social Network Analysis: Methods and Applications
Wasserman, S., & Faust, K. (1994) · doi:10.1017/cbo9780511815478 · Cited by 17,557 · see citing works
Structural Holes: The Social Structure of Competition
Lazega, E., & Burt, R. S. (1995) · Revue Française de Sociologie · doi:10.2307/3322456 · Cited by 7,970 · see citing works
Structural Holes: The Social Structure of Competition.
Andrews, S. B., & Burt, R. S. (1995) · Administrative Science Quarterly · doi:10.2307/2393644 · Cited by 987 · see citing works
The application of network analysis to criminal intelligence: An assessment of the prospects
Sparrow, M. K. (1991) · Social Networks · doi:10.1016/0378-8733(91)90008-h · Cited by 569 · see citing works
Honeypots: catching the insider threat
Spitzner, L. (2004) · Annual Computer Security Applications Conference · doi:10.1109/csac.2003.1254322 · Cited by 365 · see citing works
A Survey of Insider Attack Detection Research
Salem, M. B., Hershkop, S., & Stolfo, S. J. (2008) · Advances in information security · doi:10.1007/978-0-387-77322-3_5 · Cited by 293 · see citing works
Baiting Inside Attackers Using Decoy Documents
Bowen, B. M., Hershkop, S., Keromytis, A. D., & Stolfo, S. J. (2009) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-642-05284-2_4 · Cited by 203 · see citing works
Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis
Band, S. R., Cappelli, D. M., Fischer, L. F., et al. (2006) · Figshare · doi:10.1184/r1/6572663.v1 · Cited by 98 · see citing works
Analysis and Detection of Malicious Insiders
Maybury, M. T., Chase, P., Cheikes, B. A., Brackney, D., Matzner, S., Hetherington, T., Wood, B. J., Sibley, C., Marin, J., & Longstaff, T. (2005) · Cited by 94 · see citing works
Espionage Against the United States by American Citizens 1947-2001
Herbig, K. L., & Wiskoff, M. F. (2002) · doi:10.21236/ada411004 · Cited by 81 · see citing works
Destabilizing Terrorist Networks
Carley, K. M., Reminga, J., & Kamneva, N. (2018) · doi:10.1184/r1/6621938.v1 · Cited by 79 · see citing works
Weak models for insider threat detection
Thompson, P. (2004) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.548178 · Cited by 33 · see citing works
Baiting Inside Attackers using Decoy Documents
Bowen, B. M., Hershkop, S., Keromytis, A. D., et al. (2008) · doi:10.21236/ada500672 · Cited by 33 · see citing works
Changes in Espionage by Americans: 1947-2007
Herbig, K. L. (2008) · doi:10.21236/ada479254 · Cited by 31 · see citing works
A Layered Approach to Insider Threat Detection and Proactive Forensics
Bradford, P. G., & Hu, N. (2005) · Cited by 31 · see citing works
Masquerade Attack Detection Using a Search-Behavior Modeling Approach
Salem, M. B., & Stolfo, S. J. (2009) · doi:10.7916/d8x63tsv · Cited by 25 · see citing works
An analysis of how ensembles of collective classifiers improve predictions in graphs
Eldardiry, H., & Neville, J. (2012) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/2396761.2396793 · Cited by 9 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Deep learning for insider threat detection: Review, challenges and opportunities
Yuan, S., & Wu, X. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102221 · Cited by 271 · see citing works
Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., & Ochoa, M. (2020) · ACM Computing Surveys · doi:10.1145/3303771 · Cited by 255 · see citing works
Al-Shehari, T., & Alsowail, R. A. (2021) · Entropy · doi:10.3390/e23101258 · Cited by 193 · see citing works
Analyzing Data Granularity Levels for Insider Threat Detection Using Machine Learning
Le, D. C., Zincir-Heywood, N., & Heywood, M. I. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2967721 · Cited by 191 · see citing works
Anomaly Detection for Insider Threats Using Unsupervised Ensembles
Le, D. C., & Zincir-Heywood, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3071928 · Cited by 147 · see citing works
Scenario-Based Insider Threat Detection From Cyber Activities
Chattopadhyay, P., Wang, L., & Tan, Y.-P. (2018) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2018.2857473 · Cited by 115 · see citing works
Detecting Insider Threat from Enterprise Social and Online Activity Data
Gavai, G., Sricharan, K., Gunning, D., Rolleston, R., Hanley, J., & Singhal, M. (2015) · Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats · doi:10.1145/2808783.2808784 · Cited by 69 · see citing works
Self-citationClassification of Insider Threat Detection Techniques
Sanzgiri, A., & Dasgupta, D. (2016) · Proceedings of the 11th Annual Cyber and Information Security Research Conference · doi:10.1145/2897795.2897799 · Cited by 68 · see citing works
Temporal feature aggregation with attention for insider threat detection from activity logs
Pal, P., Chattopadhyay, P., & Swarnkar, M. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.119925 · Cited by 52 · see citing works
Al-Shehari, T. A., Rosaci, D., Al-Razgan, M., Alfakih, T., Kadrie, M., Afzal, H., & Nawaz, R. (2024) · IEEE Access · doi:10.1109/access.2024.3373694 · Cited by 51 · see citing works
“In [10], a hybrid anomaly method was proposed for detecting blend-in outliers and unusual change anomalies.”
MethodSmart Insiders: Exploring the Threat from Insiders Using the Internet-of-Things
Nurse, J. R. C., Erola, A., Agrafiotis, I., Goldsmith, M., & Creese, S. (2015) · 2015 International Workshop on Secure Internet of Things (SIoT) · doi:10.1109/siot.2015.10 · Cited by 47 · see citing works
Empirical Detection Techniques of Insider Threat Incidents
Alsowail, R. A., & Al-Shehari, T. (2020) · IEEE Access · doi:10.1109/access.2020.2989739 · Cited by 41 · see citing works
Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning
Zhang, C., Wang, S., Zhan, D., Yu, T., Wang, T., & Yin, M. (2021) · Security and Communication Networks · doi:10.1155/2021/4148441 · Cited by 30 · see citing works
Exploring Adversarial Properties of Insider Threat Detection
Le, D. C., & Zincir-Heywood, N. (2020) · 2020 IEEE Conference on Communications and Network Security (CNS) · doi:10.1109/cns48642.2020.9162254 · Cited by 17 · see citing works
A systematic review on insider threat detection using natural language processing
Kundiya, K., & Haribhakta, Y. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01145-6 · Cited by 9 · see citing works
Using Dirichlet Marked Hawkes Processes for Insider Threat Detection
Zheng, P., Yuan, S., & Wu, X. (2022) · Digital Threats: Research and Practice · doi:10.1145/3457908 · Cited by 6 · see citing works
- Authors
- Eldardiry, H., Bart, E., Liu, J., Hanley, J., Price, B., & Brdiczka, O.
- Affiliations
- Palo Alto Research Center (US)
- ORCID
- Eldardiry, Hoda
- Venue
- 2013 IEEE Security and Privacy Workshops
- Publisher
- IEEE
- Published
- 2013-05
- Pages
- 45-51
- OpenAlex
- W2113997717
- Semantic Scholar
- bcb9f4ec2bbb64437f072746c3f9911c01689d44
- Cited by
- 100
- References
- 18
- Citations by year
- 2026: 3 · 2025: 2 · 2024: 14 · 2023: 5 · 2022: 7 · 2021: 9 · 2020: 13 · 2019: 4 · 2018: 11 · 2017: 11 · 2016: 6 · 2015: 11 · 2014: 2 · 2013: 2
- FWCI
- 5.36
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Security and Privacy Workshops (SPW) (publishedVersion)
- Funders
- Defense Advanced Research Projects Agency
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- insider threat detection, malicious insiders, behavioral inconsistency, temporal anomaly detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
