Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Open accessAbstract
The threat of malicious insider activity continues to be of paramount concern in both the public and private sectors. Though there is great interest in advancing the state of the art in predicting and stopping these threats, the difficulty of obtaining suitable data for research, development, and testing remains a significant hinderance. We outline the use of synthetic data to enable progress in one research program, while discussing the benefits and limitations of synthetic insider threat data, the meaning of realism in this context, as well as future research directions.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The CMU CERT dataset is a synthetic insider threat dataset developed by the CERT division of Carnegie Mellon University.
“The CMU CERT dataset (Glasser and Lindauer 2013) is a synthetic insider threat dataset developed by the CERT division of Carnegie Mellon University.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
The Introduction describes the authors’ task as generating synthetic data for insider-threat research, and the Acknowledgements link the work to Carnegie Mellon University’s Software Engineering Institute (page numbers unavailable in our copy). The paper does not identify the data as the “CMU CERT dataset” or say it was developed by the CERT division, so those specific attributions are not established. (LLM, conf=0.82)
Experimental — accuracy not yet measuredIn cybersecurity datasets such as CERT and UNSW-NB15, node anomalies often correspond to insider accounts, compromised devices, or misconfigured hosts that diverge from expected interaction patterns.
“In cybersecurity datasets such as CERT [30] and UNSW-NB15 [31], such anomalies often correspond to insider accounts, compromised devices, or misconfigured hosts that diverge from expected interaction patterns.”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
The Decoy Model section (page unavailable) describes synthetic insider-threat incidents embedded alongside normal user activity, supporting the insider-account aspect of the claim. The Introduction cautions that anomalies in synthetic data cannot establish a correlation with malicious insider behavior. Our copy does not describe node anomalies as generally corresponding to compromised devices or misconfigured hosts, or address UNSW-NB15; this verdict concerns the claim attributed to the CERT citation. (LLM, conf=0.84)
Experimental — accuracy not yet measuredCybersecurity graphs often contain millions of nodes and edges that evolve in near real time.
“Cybersecurity graphs often contain millions of nodes and edges that evolve in near real time, yet many existing HGNN architectures remain too computationally expensive for production use [30], [43].”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
The paper’s “Controllable Social Network Topology” section describes a time-varying social network extracted from its synthetic insider-threat data. That supports the idea of an evolving graph, but the section does not say cybersecurity graphs often have millions of nodes and edges or evolve in near real time. (LLM, conf=0.78)
Experimental — accuracy not yet measuredInsider threat events were injected into the normal behavior logs in the CMU CERT v6.2 dataset.
“Insider threat events were injected into the normal behavior logs.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
The Threat Scenarios passage says insider-threat incidents were instantiated as synthetic data in the same form and scope as normal background data, supporting the description of threat events appearing alongside normal activity logs. Our copy does not identify those data as the CMU CERT v6.2 dataset, so it does not support that dataset-specific part of the claim. (LLM, conf=0.85)
Experimental — accuracy not yet measuredThe CMU CERT v6.2 dataset simulates behavior logs of 4,000 employees over 516 days.
“This dataset simulates a series of behavior logs (including login logs, HTTP logs, file logs, email logs, device logs, and so on) of 4,000 employees over 516 days.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
The Introduction (page unavailable) says the authors generated synthetic logs from workstations across a large organization for an approximately 500-day period; the Decoy Model section gives examples of logon and HTTP logs. Our copy does not identify the dataset as CMU CERT v6.2 or substantiate the precise figures of 4,000 employees and 516 days. (LLM, conf=0.85)
Experimental — accuracy not yet measured
The CERT dataset used in the experiments is a synthetic dataset.
“the CERT dataset we used in the experiments is a synthetic dataset.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
Many existing HGNN architectures remain too computationally expensive for production use.
“Cybersecurity graphs often contain millions of nodes and edges that evolve in near real time, yet many existing HGNN architectures remain too computationally expensive for production use [30], [43].”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
The Introduction discusses generating large graphs for synthetic insider-threat data, and the Implementation section describes models used to generate social-network topologies. Neither addresses HGNN architectures or their computational cost in production; searches for those terms and for graph-neural-network scalability found no relevant passage. No page numbers are available in our copy. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
(2003) · Journal of Machine Learning Research · doi:10.5555/944919.944937 · Cited by 32,337 · see citing works
Newman (2005) · doi:10.1080/00107510500052444 · Cited by 5,749 · see citing works
A statistical interpretation of term specificity and its application in retrieval
Jones, K. S. (2021) · J. Documentation · doi:10.1108/eb026526 · Cited by 5,541 · see citing works
Christen, P. (2012) · Springer eBooks · doi:10.1007/978-3-642-31164-2 · Cited by 1,111 · see citing works
Kronecker Graphs: An Approach to Modeling NetworksPreprint
Leskovec, J., Chakrabarti, D., Kleinberg, J. M., Faloutsos, C., & Zoubin Ghahramani, A. (2008) · arXiv (Cornell University) · doi:10.48550/arxiv.0812.4905 · Cited by 836 · see citing works
Mount, M. K., Ilieș, R., & Johnson, E. C. (2006) · Personnel Psychology · doi:10.1111/j.1744-6570.2006.00048.x · Cited by 722 · see citing works
Kronecker Graphs: An Approach to Modeling Networks
LeskovecJure, ChakrabartiDeepayan, KleinbergJon, FaloutsosChristos, & GhahramaniZoubin (2010) · Journal of Machine Learning Research · doi:10.5555/1756006.1756039 · Cited by 470 · see citing works
Self-configuring network traffic generation
Sommers, J., & Barford, P. (2004) · ACM SIGCOMM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028798 · Cited by 196 · see citing works
Modeling User Search Behavior for Masquerade Detection
Salem, M. B., & Stolfo, S. J. (2011) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-23644-0_10 · Cited by 129 · see citing works
Weighted graphs and disconnected components
McGlohon, M., Akoglu, L., & Faloutsos, C. (2008) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1401890.1401955 · Cited by 111 · see citing works
Swing: Realistic and Responsive Network Traffic Generation
Vishwanath, K. V., & Vahdat, A. M. (2009) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2009.2020830 · Cited by 111 · see citing works
Stochastic natural language generation for spoken dialog systems
Oh, A. H., & Rudnicky, A. I. (2002) · Computer Speech & Language · doi:10.1016/s0885-2308(02)00012-8 · Cited by 73 · see citing works
RTG: A Recursive Realistic Graph Generator Using Random Typing
Akoglu, L., & Faloutsos, C. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04180-8_13 · Cited by 48 · see citing works
Wright, C. V., Connelly, C., Braje, T. M., Rabek, J. C., Rossey, L. M., & Cunningham, R. K. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-15512-3_12 · Cited by 30 · see citing works
Generating realistic environments for cyber operations development, testing, and training
Berk, V. H., Souza, I. G.-D., & Murphy, J. P. (2012) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.924762 · Cited by 5 · see citing works
Flagged first, then by citations
2 of the 17 references couldn’t be matched to a known paper.
Research works printed but not linked: 3
- Cullen, M.J., Russell, S., Bosshardt, M., Juraska, S., Stell- mack, A., Duehr, E., and Jeansonne, K. "Five-factor model of personality and counterproductive cyber behaviors." Poster presented at the annual conference of the Society for Industrial and Organizational Psychology, Chicago, IL, 2011.
- Newman, Mark E. J. "Power laws, Pareto distributions and Zipfs' law." Contemporary Physics, 46 (5):323351, 2005.
- Paxton, K. Bradley, and Hager, Thomas. "Use of synthetic data in testing administrative records systems." Proceedings, Federal Committee on Statistical Methodology (FCSM), Wash- ington, DC, 2012.
Cited by
Sorted by citations
A Unifying Review of Deep and Shallow Anomaly Detection
Ruff, L., Kauffmann, J., Vandermeulen, R. A., Montavon, G., Samek, W., Kloft, M., Dietterich, T. G., & Muller, K.-R. (2021) · Proceedings of the IEEE · doi:10.1109/jproc.2021.3052449 · Cited by 1,080 · see citing works
Cybersecurity data science: an overview from machine learning perspective
Sarker, I. H., Kayes, A. S. M., Badsha, S., Alqahtani, H., Watters, P., & Ng, A. (2020) · Journal of Big Data · doi:10.1186/s40537-020-00318-5 · Cited by 766 · see citing works
A Survey of Deep Learning Methods for Cyber Security
Berman, D. S., Buczak, A. L., Chavis, J. S., & Corbett, C. L. (2019) · Information · doi:10.3390/info10040122 · Cited by 569 · see citing works
AI-Driven Cybersecurity: An Overview, Security Intelligence Modeling and Research Directions
Sarker, I. H., Furhad, M. H., & Nowrozy, R. (2021) · SN Computer Science · doi:10.1007/s42979-021-00557-0 · Cited by 619 · see citing works
Sarker, I. H., Khan, A. I., Abushark, Y. B., & Alsolami, F. J. (2022) · Mobile Networks and Applications · doi:10.1007/s11036-022-01937-3 · Cited by 425 · see citing works
Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective
Sarker, I. H. (2021) · SN Computer Science · doi:10.1007/s42979-021-00535-6 · Cited by 310 · see citing works
Anomaly detection in online social networks
Savage, D., Zhang, X., Yu, X., Chou, P. L., & Wang, Q. (2014) · Social Networks · doi:10.1016/j.socnet.2014.05.002 · Cited by 284 · see citing works
Deep learning for insider threat detection: Review, challenges and opportunities
Yuan, S., & Wu, X. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102221 · Cited by 271 · see citing works
Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., & Ochoa, M. (2020) · ACM Computing Surveys · doi:10.1145/3303771 · Cited by 255 · see citing works
Graph Neural Networks for Intrusion Detection: A Survey
Bilot, T., Madhoun, N. E., Agha, K. A., & Zouaoui, A. (2023) · IEEE Access · doi:10.1109/access.2023.3275789 · Cited by 267 · see citing works
Flow-based network traffic generation using Generative Adversarial Networks
Ring, M., Schlör, D., Landes, D., & Andreas Hotho, A. (2018) · Computers & Security · doi:10.1016/j.cose.2018.12.012 · Cited by 246 · see citing works
Al-Shehari, T., & Alsowail, R. A. (2021) · Entropy · doi:10.3390/e23101258 · Cited by 193 · see citing works
Analyzing Data Granularity Levels for Insider Threat Detection Using Machine Learning
Le, D. C., Zincir-Heywood, N., & Heywood, M. I. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2967721 · Cited by 191 · see citing works
Insider Threat Detection with Deep Neural Network
Yuan, F., Cao, Y., Shang, Y., Liu, Y., Tan, J., & Fang, B. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-93698-7_4 · Cited by 168 · see citing works
Anomaly Detection with Graph Convolutional Networks for Insider Threat and Fraud Detection
Jiang, J., Chen, J., Gu, T., Choo, K.-K. R., Liu, C., Yu, M., Huang, W., & Mohapatra, P. (2019) · MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom47813.2019.9020760 · Cited by 166 · see citing works
Gheyas, I. A., & Abdallah, A. E. (2016) · Big Data Analytics · doi:10.1186/s41044-016-0006-0 · Cited by 150 · see citing works
Anomaly Detection for Insider Threats Using Unsupervised Ensembles
Le, D. C., & Zincir-Heywood, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3071928 · Cited by 147 · see citing works
Systematic construction of anomaly detection benchmarks from real data
Emmott, A., Das, S., Dietterich, T. G., Fern, A., & Wong, W. (2013) · doi:10.1145/2500853.2500858 · Cited by 145 · see citing works
Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
Kim, J., Park, M., Kim, H., Cho, S., & Kang, P. (2019) · Applied Sciences · doi:10.3390/app9194018 · Cited by 134 · see citing works
Detecting insider threats in a real corporate database of computer usage activity
Senator, T. E., Goldberg, H. G., Memory, A., Young, W. T., Rees, B., Pierce, R., Huang, D., Reardon, M., Bader, D. A., Chow, E., et al. (2013) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2487575.2488213 · Cited by 132 · see citing works
Shahin, M., Maghanaki, M., Hosseinzadeh, A., & Chen, F. F. (2024) · Advanced Engineering Informatics · doi:10.1016/j.aei.2024.102685 · Cited by 119 · see citing works
Unified Host and Network Data Set
Turcotte, M., Kent, A. D., & Hash, C. (2018) · Security science and technology · doi:10.1142/9781786345646_001 · Cited by 114 · see citing works
Insider Threat Detection Using Machine Learning Approach
Bin Sarhan, B., & Altwaijry, N. (2022) · Applied Sciences · doi:10.3390/app13010259 · Cited by 111 · see citing works
Böse, B., Avasarala, B., Tirthapura, S., Chung, Y.-Y., & Steiner, D. D. (2017) · IEEE Systems Journal · doi:10.1109/jsyst.2016.2558507 · Cited by 94 · see citing works
A Review of Insider Threat Detection Approaches With IoT Perspective
Kim, A., Oh, J., Ryu, J., & Lee, K. (2020) · IEEE Access · doi:10.1109/access.2020.2990195 · Cited by 93 · see citing works
Mladenovic, D., Antonijević, M., Jovanović, L., Šimić, V., Zivkovic, M. Z., Bačanin, N., Živković, T., & Perišić, J. (2024) · Scientific Reports · doi:10.1038/s41598-024-77240-w · Cited by 84 · see citing works
Ferreira, P. H. G., Le, D. C., & Zincir-Heywood, N. (2019) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm46954.2019.9012708 · Cited by 81 · see citing works
Anomaly-Based Insider Threat Detection Using Deep Autoencoders
Liu, L., De Vel, O., Chen, C., Zhang, J., & Xiang, Y. (2018) · 2018 IEEE International Conference on Data Mining Workshops (ICDMW) · doi:10.1109/icdmw.2018.00014 · Cited by 79 · see citing works
A review on security analysis of cyber physical systems using Machine learning
Jamal, A. A., Majid, A.-A. M., Konev, A. A., Kosachenko, T., & Shelupanov, A. A. (2021) · Materials Today Proceedings · doi:10.1016/j.matpr.2021.06.320 · Cited by 76 · see citing works
Kenyon, A., Deka, L., & Elizondo, D. A. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102022 · Cited by 74 · see citing works
Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security
Wang, C., & Zhu, H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3191493 · Cited by 74 · see citing works
Detecting Insider Threat from Enterprise Social and Online Activity Data
Gavai, G., Sricharan, K., Gunning, D., Rolleston, R., Hanley, J., & Singhal, M. (2015) · Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats · doi:10.1145/2808783.2808784 · Cited by 69 · see citing works
Classification of Insider Threat Detection Techniques
Sanzgiri, A., & Dasgupta, D. (2016) · Proceedings of the 11th Annual Cyber and Information Security Research Conference · doi:10.1145/2897795.2897799 · Cited by 68 · see citing works
Intelligent Techniques for Detecting Network Attacks: Review and Research Directions
Aljabri, M., Aljameel, S. S., Mohammad, R. M. A., Almotiri, S. H., Mirza, S., Anis, F. M., Aboulnour, M., Alomari, D. M., Alhamed, D. H., & Altamimi, H. S. (2021) · Sensors · doi:10.3390/s21217070 · Cited by 74 · see citing works
Adversarial deep learning against intrusion detection classifiers
Rigaki, M. (2017) · Diva portal (Dalarna University Library) · Cited by 68 · see citing works
Evaluating Insider Threat Detection Workflow Using Supervised and Unsupervised Learning
Le, D. C., & Zincir-Heywood, A. N. (2018) · 2018 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00043 · Cited by 66 · see citing works
Image-Based Feature Representation for Insider Threat Classification
Gayathri, R. G., Sajjanhar, A., & Xiang, Y. (2020) · Applied Sciences · doi:10.3390/app10144945 · Cited by 63 · see citing works
Li, X., Li, X., Jia, J., Li, L., Yuan, J., Gao, Y., & Yu, S. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3245413 · Cited by 60 · see citing works
A graph empowered insider threat detection framework based on daily activities
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., Liu, M., & Man, C. (2023) · ISA Transactions · doi:10.1016/j.isatra.2023.06.030 · Cited by 60 · see citing works
Exploring anomalous behaviour detection and classification for insider threat identification
Le, D. C., & Zincir‐Heywood, N. (2021) · International Journal of Network Management · doi:10.1002/nem.2109 · Cited by 56 · see citing works
Levshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 62 · see citing works
TWOS: A Dataset of Malicious Insider Threat Behavior Based on a Gamified Competition
Harilal, A., Toffalini, F., Castellanos, J., Guarnizo, J., Homoliak, I., & Ochoa, M. (2017) · Proceedings of the 2017 International Workshop on Managing Insider Security Threats · doi:10.1145/3139923.3139929 · Cited by 53 · see citing works
Insider threat detection in cyber-physical systems: a systematic literature review
Al-Mhiqani, M. N., Alsboui, T., Al-Shehari, T., Abdulkareem, K. H., Ahmad, R., & Mohammed, M. A. (2024) · Computers and Electrical Engineering · doi:10.1016/j.compeleceng.2024.109489 · Cited by 53 · see citing works
A Deep Learning Approach for Extracting Attributes of ABAC Policies
Alohaly, M., Takabi, H., & Blanco, E. (2018) · ACM Symposium on Access Control Models and Technologies (SACMAT) · doi:10.1145/3205977.3205984 · Cited by 53 · see citing works
Insider threat detection model using anomaly-based Isolation Forest algorithm
Al-Shehari, T., Al-Razgan, M., Alfakih, T., Alsowail, R. A., & Pandiaraj, S. (2023) · IEEE Access · doi:10.1109/access.2023.3326750 · Cited by 52 · see citing works
Al-Shehari, T. A., Rosaci, D., Al-Razgan, M., Alfakih, T., Kadrie, M., Afzal, H., & Nawaz, R. (2024) · IEEE Access · doi:10.1109/access.2024.3373694 · Cited by 51 · see citing works
“The CERT dataset’s creation process is described in great length in [24].”
MethodInsider Threat Detection via Hierarchical Neural Temporal Point Processes
Yuan, S., Zheng, P., Wu, X., & Li, Q. (2019) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata47090.2019.9005589 · Cited by 52 · see citing works
Enhancing false negative and positive rates for efficient insider threat detection
AlSlaiman, M., Salman, M. I., Saleh, M. M., & Wang, B. (2023) · Computers & Security · doi:10.1016/j.cose.2022.103066 · Cited by 49 · see citing works
Robust Anomaly-Based Insider Threat Detection Using Graph Neural Network
Xiao, J., Yang, L., Zhong, F., Wang, X., Chen, H., & Li, D. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3222635 · Cited by 48 · see citing works
Visualizing the insider threat: challenges and tools for identifying malicious user activity
Legg, P. (2015) · IEEE Symposium on Visualization for Cyber Security (VIZSEC) · doi:10.1109/vizsec.2015.7312772 · Cited by 48 · see citing works
BRITD: behavior rhythm insider threat detection with time awareness and user adaptation
Song, S., Gao, N., Zhang, Y., & Ma, C. (2024) · Cybersecurity · doi:10.1186/s42400-023-00190-9 · Cited by 45 · see citing works
“The CERT dataset simulates a series of operational behaviors of internal personnel in a virtual organization system using the relationship graph model, asset graph model, behavior model, psychological model, and topic model (Glasser and Lindauer 2013), Fig.”
MethodUse of Domain Knowledge to Detect Insider Threats in Computer Activities
Young, W. T., Goldberg, H. G., Memory, A., Sartain, J. F., & Senator, T. E. (2013) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2013.32 · Cited by 44 · see citing works
Alohaly, M., Takabi, H., & Blanco, E. (2019) · Cybersecurity · doi:10.1186/s42400-018-0019-2 · Cited by 42 · see citing works
Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research
Anjum, M. M., Iqbal, S., & Hamelin, B. (2021) · ACM Symposium on Access Control Models and Technologies (SACMAT) · doi:10.1145/3450569.3463573 · Cited by 41 · see citing works
Anomaly Detection as a Service: Challenges, Advances, and Opportunities
Yao, D. D., Shu, X., Cheng, L., & Stolfo, S. J. (2017) · Synthesis lectures on information security, privacy, and trust · doi:10.2200/s00800ed1v01y201709spt022 · Cited by 40 · see citing works
A Chronological Edge-Driven Approach to Temporal Subgraph Isomorphism
Mackey, P., Porterfield, K., Fitzhenry, E., Choudhury, S., & Chin, G. (2018) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2018.8622100 · Cited by 40 · see citing works
Cyberattack Detection Framework Using Machine Learning and User Behavior Analytics
Alshehri, A., Khan, N. A., Alowayr, A. S., & Alghamdi, M. Y. (2022) · Computer Systems Science and Engineering · doi:10.32604/csse.2023.026526 · Cited by 42 · see citing works
A Secure and Privacy-Preserving E-Government Framework Using Blockchain and Artificial Immunity
Elisa, N., Yang, L., Chao, F., Naik, N., & Boongoen, T. (2023) · IEEE Access · doi:10.1109/access.2023.3239814 · Cited by 50 · see citing works
A Trust Aware Unsupervised Learning Approach for Insider Threat Detection
Aldairi, M., Karimi, L., & Joshi, J. B. D. (2019) · IEEE International Conference on Information Reuse and Integration (IRI) · doi:10.1109/iri.2019.00027 · Cited by 40 · see citing works
Generating Test Data for Insider Threat Detectors.
Lindauer, B., Glasser, J., Rosen, M., & Wallnau, K. (2014) · Journal of Wireless Mobile Networks Ubiquitous Computing and Dependable Applications · Cited by 37 · see citing works
Self-citationData Augmentation for Insider Threat Detection with GAN
Yuan, F., Shang, Y., Liu, Y., Cao, Y., & Tan, J. (2020) · IEEE International Conference on Tools with Artificial Intelligence (ICTAI) · doi:10.1109/ictai50040.2020.00102 · Cited by 37 · see citing works
Metamorphic Malware and Obfuscation: A Survey of Techniques, Variants, and Generation Kits
Brezinski, K., & Ferens, K. (2023) · Security and Communication Networks · doi:10.1155/2023/8227751 · Cited by 45 · see citing works
Towards Insider Threat Detection Using Psychophysiological Signals
Hashem, Y., Takabi, H., GhasemiGol, M., & Dantu, R. (2015) · ACM CCS International Workshop on Managing Insider Security Threats (MIST) · doi:10.1145/2808783.2808792 · Cited by 36 · see citing works
Few-shot Insider Threat Detection
Yuan, S., Zheng, P., Wu, X., & Tong, H. (2020) · Proceedings of the 29th ACM International Conference on Information & Knowledge Management · doi:10.1145/3340531.3412161 · Cited by 36 · see citing works
Detecting Unknown Insider Threat Scenarios
Young, W. T., Memory, A., Goldberg, H. G., & Senator, T. E. (2014) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2014.42 · Cited by 35 · see citing works
Insider threat detection using supervised machine learning algorithms
Manoharan, P., Yin, J., Wang, H., Zhang, Y., & Ye, W. (2024) · Telecommunication Systems · doi:10.1007/s11235-023-01085-3 · Cited by 34 · see citing works
Advanced Persistent Threat Attack Detection Systems: A Review of Approaches, Challenges, and Trends
Buchta, R., Gkoktsis, G., Heine, F., & Kleiner, C. (2024) · Digital Threats Research and Practice · doi:10.1145/3696014 · Cited by 43 · see citing works
Graph Intelligence Enhanced Bi-Channel Insider Threat Detection
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., & Liu, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-23020-2_5 · Cited by 34 · see citing works
Benchmarking evolutionary computation approaches to insider threat detection
Le, D. C., Khanchi, S., Zincir-Heywood, N., & Heywood, M. I. (2018) · Genetic and Evolutionary Computation Conference (GECCO) · doi:10.1145/3205455.3205612 · Cited by 33 · see citing works
Al‐Shehari, T., Kadrie, M., Al‐Mhiqani, M. N., Alfakih, T. M., AlSalman, H., Uddin, M., Ullah, S. S., & Dandoush, A. (2024) · Scientific Reports · doi:10.1038/s41598-024-73510-9 · Cited by 32 · see citing works
Wei, Y., Chow, K.-P., & Yiu, S.-M. (2021) · Forensic Science International: Digital Investigation · doi:10.1016/j.fsidi.2021.301126 · Cited by 32 · see citing works
Adversarial Robustness of Phishing Email Detection Models
Gholampour, P. M., & Verma, R. M. (2023) · ACM International Workshop on Security and Privacy Analytics (IWSPA) · doi:10.1145/3579987.3586567 · Cited by 38 · see citing works
Modeling and Verification of Insider Threats Using Logical Analysis
Kammüller, F., & Probst, C. W. (2015) · IEEE Systems Journal · doi:10.1109/jsyst.2015.2453215 · Cited by 32 · see citing works
Insider Threat Identification Using the Simultaneous Neural Learning of Multi-Source Logs
Liu, L., Chen, C., Zhang, J., De Vel, O., & Xiang, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2957055 · Cited by 31 · see citing works
Ensemble Strategy for Insider Threat Detection from User Activity Logs
Zou, S., Sun, H., Xu, G., & Quan, R. (2020) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2020.09649 · Cited by 31 · see citing works
Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective
Sarker, I. H. (2021) · doi:10.20944/preprints202102.0340.v1 · Cited by 295 · see citing works
Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning
Zhang, C., Wang, S., Zhan, D., Yu, T., Wang, T., & Yin, M. (2021) · Security and Communication Networks · doi:10.1155/2021/4148441 · Cited by 30 · see citing works
Nurse, J. R. C., Legg, P., Buckley, O. E., Agrafiotis, I., Wright, G., Whitty, M. T., Upton, D. M., Goldsmith, M. H., & Creese, S. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-07620-1_24 · Cited by 30 · see citing works
A comprehensive investigation of clustering algorithms for User and Entity Behavior Analytics
Artioli, P., Maci, A., & Magrì, A. (2024) · Frontiers in Big Data · doi:10.3389/fdata.2024.1375818 · Cited by 38 · see citing works
Insights into user behavioral-based insider threat detection: systematic review
Kamatchi, K., & Uma, E. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01002-6 · Cited by 35 · see citing works
DeepMIT: A Novel Malicious Insider Threat Detection Framework based on Recurrent Neural Network
Sun, D., Liu, M., Li, M., Shi, Z., Liu, P., & Wang, X. (2021) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd49262.2021.9437887 · Cited by 28 · see citing works
Integrating Cyber Deception Into Attribute-Based Access Control (ABAC) for Insider Threat Detection
Alohaly, M., Balogun, O., & Takabi, D. (2022) · IEEE Access · doi:10.1109/access.2022.3213645 · Cited by 28 · see citing works
Insider Threat Detection using Deep Learning: A Review
Raut, M., Dhavale, S., Singh, A., & Mehra, A. (2020) · 2020 3rd International Conference on Intelligent Sustainable Systems (ICISS) · doi:10.1109/iciss49785.2020.9315932 · Cited by 27 · see citing works
Combining Generated Data Models with Formal Invalidation for Insider Threat Analysis
Kammüller, F., & Probst, C. W. (2014) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2014.45 · Cited by 26 · see citing works
Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection
Peccatiello, R. B., Gondim, J. J. C., & Garcia, L. P. F. (2023) · IEEE Access · doi:10.1109/access.2023.3293825 · Cited by 25 · see citing works
Al-Shehari, T., & Alsowail, R. A. (2023) · International Journal of Information Security · doi:10.1007/s10207-022-00651-1 · Cited by 25 · see citing works
A federated and explainable approach for insider threat detection in IoT
Amiri-Zarandi, M., Karimipour, H., & Dara, R. A. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100965 · Cited by 26 · see citing works
LAC: LSTM AUTOENCODER with Community for Insider Threat Detection
Paul, S., & Mishra, S. (2020) · International Conference Big Data Research · doi:10.1145/3445945.3445958 · Cited by 24 · see citing works
Jiang, J., Chen, J., Choo, K. R., Liu, K., Liu, C., Yu, M., & Mohapatra, P. (2018) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2018.8599790 · Cited by 24 · see citing works
Attention-Based LSTM for Insider Threat Detection
Yuan, F., Shang, Y., Liu, Y., Cao, Y., & Tan, J. (2019) · Communications in computer and information science · doi:10.1007/978-981-15-0871-4_15 · Cited by 23 · see citing works
Sovilj, D., Budnarain, P., Sanner, S., Salmon, G., & Rao, M. (2020) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.113577 · Cited by 23 · see citing works
Insider Threat Detection: A Solution in Search of a Problem
Schoenherr, J. R., & Thomson, R. (2020) · International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecurity49315.2020.9138862 · Cited by 23 · see citing works
Image-Based Insider Threat Detection via Geometric Transformation
Li, D., Yang, L., Zhang, H., Wang, X., Ma, L., & Xiao, J. (2021) · Security and Communication Networks · doi:10.1155/2021/1777536 · Cited by 22 · see citing works
Insider Threats Detection Using CNN-LSTM Model
Saaudi, A., Al-Ibadi, Z., Tong, Y., & Farkas, C. (2018) · 2018 International Conference on Computational Science and Computational Intelligence (CSCI) · doi:10.1109/csci46756.2018.00025 · Cited by 22 · see citing works
Zhang, B., Gao, Y., Kuang, B., Yu, C., Fu, A., & Susilo, W. (2024) · ACM Computing Surveys · doi:10.1145/3700749 · Cited by 26 · see citing works
Data adjusting strategy and optimized XGBoost algorithm for novel insider threat detection model
Kan, X., Fan, Y., Zheng, J., Chi, C., Song, W., & Kudreyko, A. A. (2023) · Journal of the Franklin Institute · doi:10.1016/j.jfranklin.2023.09.004 · Cited by 22 · see citing works
LaAeb: A comprehensive log-text analysis based approach for insider threat detection
Fei, K., Zhou, J., Zhou, Y., Gu, X., Fan, H., Li, B., Wang, W., & Chen, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104126 · Cited by 22 · see citing works
Statistics and Data Science for Cybersecurity
Hero, A. O., Kar, S., Moura, J. M. F., Neil, J., Poor, H. V., Turcotte, M., & Xi, B. (2023) · Harvard Data Science Review · doi:10.1162/99608f92.a42024d0 · Cited by 21 · see citing works
Insider Threat Detection in PRODIGAL
Goldberg, H. G., Young, W., Reardon, M., Phillips, B., & Senator, T. E. (2017) · Hawaii International Conference on System Sciences (HICSS) · doi:10.24251/hicss.2017.320 · Cited by 21 · see citing works
Rauf, U., Mohsen, F., & Wei, Z. (2023) · Journal of Cyber Security and Mobility · doi:10.13052/jcsm2245-1439.1225 · Cited by 20 · see citing works
- Authors
- Glasser, J., & Lindauer, B.
- Affiliations
- Software Engineering Institute (US)
- Venue
- 2013 IEEE Security and Privacy Workshops
- Publisher
- IEEE
- Published
- 2013-05
- Pages
- 98-104
- OpenAlex
- W1991210879
- Cited by
- 344
- References
- 17
- Citations by year
- 2026: 39 · 2025: 43 · 2024: 45 · 2023: 37 · 2022: 31 · 2021: 32 · 2020: 34 · 2019: 21 · 2018: 26 · 2017: 12 · 2016: 5 · 2015: 7 · 2014: 9 · 2013: 3
- FWCI
- 6.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Security and Privacy Workshops (SPW) (publishedVersion)
- Funders
- U.S. Department of Defense (FA8721-05-C-0003, Contract No. FA8721-05-C-0003)
- Carnegie Mellon University
- Defense Advanced Research Projects Agency
- Advanced Research Projects Agency
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- insider threats, synthetic data, insider threat detection, data scarcity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
