The DOI matches its Crossref record; 15 of the 17 references it cites were found in a registry or an index.
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Open accessAbstract
The threat of malicious insider activity continues to be of paramount concern in both the public and private sectors. Though there is great interest in advancing the state of the art in predicting and stopping these threats, the difficulty of obtaining suitable data for research, development, and testing remains a significant hinderance. We outline the use of synthetic data to enable progress in one research program, while discussing the benefits and limitations of synthetic insider threat data, the meaning of realism in this context, as well as future research directions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“The CMU CERT dataset (Glasser and Lindauer 2013) is a synthetic insider threat dataset developed by the CERT division of Carnegie Mellon University.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“In cybersecurity datasets such as CERT [30] and UNSW-NB15 [31], such anomalies often correspond to insider accounts, compromised devices, or misconfigured hosts that diverge from expected interaction patterns.”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Cybersecurity graphs often contain millions of nodes and edges that evolve in near real time, yet many existing HGNN architectures remain too computationally expensive for production use [30], [43].”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Insider threat events were injected into the normal behavior logs.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“This dataset simulates a series of behavior logs (including login logs, HTTP logs, file logs, email logs, device logs, and so on) of 4,000 employees over 516 days.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
Experimental — accuracy not yet measured
The cited source says what the claim attributes to it.
In the citing paper
“the CERT dataset we used in the experiments is a synthetic dataset.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Cybersecurity graphs often contain millions of nodes and edges that evolve in near real time, yet many existing HGNN architectures remain too computationally expensive for production use [30], [43].”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
(2003) · Journal of Machine Learning Research · doi:10.5555/944919.944937 · Cited by 32,337
Newman (2005) · doi:10.1080/00107510500052444 · Cited by 5,749
A statistical interpretation of term specificity and its application in retrieval
Jones, K. S. (2021) · J. Documentation · doi:10.1108/eb026526 · Cited by 5,541
Christen, P. (2012) · Springer eBooks · doi:10.1007/978-3-642-31164-2 · Cited by 1,176
Kronecker Graphs: An Approach to Modeling NetworksPreprint
Leskovec, J., Chakrabarti, D., Kleinberg, J. M., Faloutsos, C., & Ghahramani, Z. (2008) · arXiv (Cornell University) · doi:10.48550/arxiv.0812.4905 · Cited by 840
Mount, M. K., Ilieș, R., & Johnson, E. C. (2006) · Personnel Psychology · doi:10.1111/j.1744-6570.2006.00048.x · Cited by 722
Kronecker Graphs: An Approach to Modeling Networks
LeskovecJure, ChakrabartiDeepayan, KleinbergJon, FaloutsosChristos, & GhahramaniZoubin (2010) · Journal of Machine Learning Research · doi:10.5555/1756006.1756039 · Cited by 470
Self-configuring network traffic generation
Sommers, J., & Barford, P. (2004) · ACM SIGCOMM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028798 · Cited by 196
Modeling User Search Behavior for Masquerade Detection
Salem, M. B., & Stolfo, S. J. (2011) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-23644-0_10 · Cited by 129
Weighted graphs and disconnected components
McGlohon, M., Akoglu, L., & Faloutsos, C. (2008) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1401890.1401955 · Cited by 111
Flagged first, then by citations
2 of the 17 references couldn’t be matched to a known paper.
Research works printed but not linked: 5
- stribling, 2013, SCIgen-an Automatic CS Paper Generator
- paxton, 0, Use of synthetic data in testing administrative records systems, Proceedings Federal Committee on Statistical Methodology (FCSM) Washington DC 2012
- schonlau, 2013, "Masquerading User Data" [Online]
- cullen, 0, Annual Conference of the Society for Industrial and Organizational Psychology Chicago IL 2011
- 10.1162/jmlr.2003.3.4-5.993 · DOI
Cited by
Sorted by citations
Items 301–344 of 344
An Education Program for Data Driven Security with Machine Learning Applications
Thuraisingham, B., Jee, K., & Khan, L. R. (2025) · IEEE Conference on Big Data Security on Cloud (BigDataSecurity) · doi:10.1109/bigdatasecurity66063.2025.00033
Qi, Y., An, N., Wang, Z., Yuan, Y., Zhang, C., Zhu, Y. H., & Lü, Z. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033609
Das, D. T., & Walker, J. D. (2025) · International Journal of Cyber Threat Intelligence and Secure Networking · doi:10.55640/ijctisn-v02i01-01
Scenario-Aware Anomaly Detection in Insider Activities Using CT-GAN Data Augmentation
Kamatchi, K., & Uma, E. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-2115-8.ch012
Reviewing Graph Construction Rules in Graph-Based Insider Threat Detection Models
Chung, J. Z. A., Yong, K. S. C., Han, J., & Then, P. (2025) · IEEE Symposium on Computer Applications & Industrial Electronics (ISCAIE) · doi:10.1109/iscaie64985.2025.11081151
Profiling User Behavior to Identify Insider Threats in Enterprise Information Systems
Shantabhushana, B. M., Sudarsanan, D., Kumar, P., Lokesh, L., Mithun, B. M., Sandeep Kumar, S., & Rakesh, V. S. (2025) · ITM Web of Conferences · doi:10.1051/itmconf/20257901012
Behavior Molecule-Level Learning by Behavioral Interior Reconstruction
Wang, C. (2025) · Springer eBooks · doi:10.1007/978-981-95-1013-9_3
SlotITD: Insider Threat Detection Method Using Slot-Based Heterogeneous Graph Neural Network
Zhang, C., Qi, Y., Zhu, Y., Jiang, B., Lu, Z., & Guo, T. (2025) · Communications in computer and information science · doi:10.1007/978-981-95-4100-3_34
Attention-Augmented Visual Representation Learning for Insider Threat DetectionPreprint
Tang, J., YE, X., Cui, H., Wang, W., Jiao, J., Wang, J., & Xiong, X. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5895657
A Review of the Use of Large Language Models to Generate Synthetic Cybersecurity Datasets
Gadsby, J., & Sabrina, F. (2025) · International Telecommunication Networks and Applications Conference (ITNAC) · doi:10.1109/itnac66378.2025.11302633
Mayura: Exploiting Similarities in Motifs for Temporal Co-Mining
Singapuram, S. S. V., Dreslinski, R., & Talati, N. (2025) · Proceedings of the VLDB Endowment · doi:10.14778/3773731.3773736
Parallel Autoencoder for Unsupervised Anomaly Detection in Large Multimodal User Behavior Data
Gorohov, O., Kazachuk, M., Машечкин, И. В., & Petrovskiy, M. I. (2025) · Lobachevskii Journal of Mathematics · doi:10.1134/s1995080225609087
Deep Ensemble-Based Insider Threat Detection Dealing with Small Data
Amadigwe, D., Shi, Q., Yang, Z., Choubey, P., Haidar, A., Shao, S., Lei, T., & Zhangt, W. (2025) · Cyber Awareness and Research Symposium (CARS) · doi:10.1109/cars67163.2025.11337593
Real-Time Anomaly Detection for Event-Based Insider Threat Hunting
Leblanc, T., Baghalizadeh-Moghadam, N., Cuppens, F., & Cuppens-Boulahia, N. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-6419-4_7
LLMBA: Efficient Behavior Analytics via Large Pretrained Models in Zero Trust Networks
Yan, S., Shi, L., Wang, W., Ren, J., Li, Y., & Sun, L. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3666459
Détection d'utilisateurs violents et de menaces dans les réseaux sociaux
Chaabene, N. E. H. B. (2022) · doi:10.70675/6e6517ebze6c9z4bafz8243zfe9d4ddb78a0
LIME-Enhanced Insider Threat Detection for Distributed Security Systems
Faqihi, R., Nanda, P., Mohanty, M., Alqahtani, S., & Alrashed, B. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-8408-6_18
LLMBA: Adapting Large Language Models for Behavior Analytics in Zero Trust Networks
Yan, S., Shi, L., Wang, W., Ren, J., Li, Y., Li, Z., & Sun, L. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11463924
Change-Aware Temporal Alignment on Heterogeneous Graph Snapshots for Insider Threat Detection
Yang, M., Zhou, Y., Wu, D., Pang, G., & Zhu, C. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11461839
kumar, D. A., Vustela, S. T., Budalapati, A. S., & Gude, Y. (2026) · International Conference on Inventive Computation Technologies (ICICT) · doi:10.1109/icict68280.2026.11510946 · Cited by 1
Bhargava, K., & Florence, S. M. (2026) · International Conference on Networking and Communications (ICNWC) · doi:10.1109/icnwc68145.2026.11517994
Behavioral Anomaly–Driven Risk Assessment for Access Control in Enterprise Systems
Pavan Karthick, T., Nair, A. A., & Gnanavel, S. (2026) · International Conference on Research Methodologies in Knowledge Management, Artificial Intelligence and Telecommunication Engineering (RMKMATE) · doi:10.1109/rmkmate69073.2026.11518951
Unsupervised Graph Learning For Insider Threat Detection
Bertrand, S., Germain, P., & Tawbi, N. (2026) · IFIP advances in information and communication technology · doi:10.1007/978-3-032-27993-4_2
Advanced persistent threat detection through multi-modal behavioral analysis
Alshamrani, A. (2026) · PLoS ONE · doi:10.1371/journal.pone.0349607
Jahan, A. M., Worthy, I. J., & Hissan, F. A. (2026) · IEEE International Conference on Quantum Photonics, Artificial Intelligence & Networking (QPAIN) · doi:10.1109/qpain69676.2026.11546056
Pahari, A., Adhikari, A., Olukola, O., Sherif, A., & Rahimi, N. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-29003-8_13
Adaptive Hybrid Insider Threat Detection with Machine Learning and Explainable AI
Namsey, T., Vijayaraghavan, S., Paramesh, G., & Kumar, K. K. (2026) · International Conference on AI-Driven Innovations & Applications (IC-AIDA) · doi:10.1109/ic-aida68291.2026.11564173
Jurišić, M., Tomičić, I., & Bernik, A. (2026) · Signals · doi:10.3390/signals7040059
Maltsev, V. (2026) · Modeling Information Systems and Technologies · doi:10.58168/mist2026_951-962
A Comprehensive Bibliometric Analysis of Insider Threat Scholarship
Osterritter, L. J., & Carley, K. M. (2026) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2026.3705576
Cheng, K., Li, D., Tang, W., Shu, Y., & Qiang, W. (2026) · Applied Sciences · doi:10.3390/app16147054
Slim, A., Charef, M., & Maazouzi, F. (2026) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-026-11520-7
Behavioral Fingerprint Analysis for Insider Threat Detection
Devika, D., Dharshana, K. S., & Mohanraj, K. C. (2026) · IEEE International Conference on Intelligent Technologies for a Sustainable and Inclusive Future (ICITSIF) · doi:10.1109/icitsif69060.2026.11608956
One-Class LSTM Behavioral Modeling for Insider Threat Detection in Zero Trust Architectures
Robu, R. C., Marian, C. V., & Cioponea, A. P. (2026) · International Conference on Electronics, Computers and Artificial Intelligence (ECAI) · doi:10.1109/ecai69016.2026.11613700
Fine-Grained Insider Threat Detection Based on BDI and Scenario-Aware DBLOF
Xing, L., Zhang, H., Liu, Y., & Wang, X. (2026) · International Conference on Artificial Intelligence, Big Data and Algorithms (CAIBDA) · doi:10.1109/caibda70336.2026.11621199
Multi‐Agent Real‐Time Detection of Insider Threats via Collaborative Reasoning
Cheng, K., Li, D., Tang, W., Tan, L., Xiang, K., Liu, T., & Qiang, W. (2026) · Security and Privacy · doi:10.1002/spy2.70243
Leveraging LLMs for Sequential Data Augmentation in Insider Threat Detection
Chung, J. Z. A., Yong, K. S. C., Han, J., & Then, P. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-25638-6_18
Explainable Graph-Based Threat Attribution and Root-Cause Analysis
Amajuoyi, P. C., Nwokocha, L. C., Ogedengbe, M. D., Folorunsho, O. B., Njubigbo, U. I., Owolabi, O., Agbo, C., Sikiru, O., & Adebola, N. T. (2026) · IEEE International Conference on Big Data and Artificial Intelligence (BDAI) · doi:10.1109/bdai70753.2026.11655165
Machine Learning-Based Anomaly Detection on a Labelled Cyber-Crime Forensic Dataset
Okyay, T. M., & Şimşek, M. (2026) · Turkish Journal of Forensic Medicine · doi:10.61970/adlitip.2007916
Explainable Transformer Models for Insider Threat Detection in Enterprise Systems
Al-Dhaqm, A., Bamasoud, D. M., Brnawy, R., Bamaqa, A., Alharbi, A. A., & Aljubayri, I. (2026) · Engineering Technology & Applied Science Research · doi:10.48084/etasr.21281
Efficient Isolation Forest for Anomaly Detection in System Logs using Behavioral Feature Fusion
Khan, P. S., Amanulla, S., Chimaladinne, J. J. V., & Kanumuri, N. (2026) · International Conference on Soft Computing for Security Applications (ICSCSA) · doi:10.1109/icscsa69367.2026.11708154
PrivGuardAI for adaptive privacy preserving sensitive data protection in cloud environments
Racha, S. R., & Karri, G. R. (2026) · Discover Computing · doi:10.1007/s10791-026-10472-8
A Locality-Aware Temporal Motif Mining Accelerator with Chunk-Based Search Tree Expansion
Hou, Y., Qi, H., Zhao, J., Zhang, Y., Lu, Y., Yu, H., Lin, L., Jiang, W., Liao, X., & Jin, H. (2026) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1145/3770743.3803933
Metadata
- Authors
- Glasser, J., & Lindauer, B.
- Affiliations
- Software Engineering Institute (US)
- Venue
- 2013 IEEE Security and Privacy Workshops
- Publisher
- IEEE
- Published
- 2013-05
- Pages
- 98-104
- OpenAlex
- W1991210879
- Cited by
- 344
- References
- 17
- Citations by year
- 2026: 39 · 2025: 43 · 2024: 45 · 2023: 37 · 2022: 31 · 2021: 32 · 2020: 34 · 2019: 21 · 2018: 26 · 2017: 12 · 2016: 5 · 2015: 7 · 2014: 9 · 2013: 3
- FWCI
- 6.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Security and Privacy Workshops (SPW) (publishedVersion)
- Funders
- U.S. Department of Defense (FA8721-05-C-0003, Contract No. FA8721-05-C-0003)
- Carnegie Mellon University
- Defense Advanced Research Projects Agency
- Advanced Research Projects Agency
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- insider threats, synthetic data, insider threat detection, data scarcity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
