The DOI matches its Crossref record; 15 of the 17 references it cites were found in a registry or an index.
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Open accessAbstract
The threat of malicious insider activity continues to be of paramount concern in both the public and private sectors. Though there is great interest in advancing the state of the art in predicting and stopping these threats, the difficulty of obtaining suitable data for research, development, and testing remains a significant hinderance. We outline the use of synthetic data to enable progress in one research program, while discussing the benefits and limitations of synthetic insider threat data, the meaning of realism in this context, as well as future research directions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“The CMU CERT dataset (Glasser and Lindauer 2013) is a synthetic insider threat dataset developed by the CERT division of Carnegie Mellon University.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“In cybersecurity datasets such as CERT [30] and UNSW-NB15 [31], such anomalies often correspond to insider accounts, compromised devices, or misconfigured hosts that diverge from expected interaction patterns.”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Cybersecurity graphs often contain millions of nodes and edges that evolve in near real time, yet many existing HGNN architectures remain too computationally expensive for production use [30], [43].”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Insider threat events were injected into the normal behavior logs.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“This dataset simulates a series of behavior logs (including login logs, HTTP logs, file logs, email logs, device logs, and so on) of 4,000 employees over 516 days.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
Experimental — accuracy not yet measured
The cited source says what the claim attributes to it.
In the citing paper
“the CERT dataset we used in the experiments is a synthetic dataset.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Glasser and Lindauer 2013
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Cybersecurity graphs often contain millions of nodes and edges that evolve in near real time, yet many existing HGNN architectures remain too computationally expensive for production use [30], [43].”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [30]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
(2003) · Journal of Machine Learning Research · doi:10.5555/944919.944937 · Cited by 32,337
Newman (2005) · doi:10.1080/00107510500052444 · Cited by 5,749
A statistical interpretation of term specificity and its application in retrieval
Jones, K. S. (2021) · J. Documentation · doi:10.1108/eb026526 · Cited by 5,541
Christen, P. (2012) · Springer eBooks · doi:10.1007/978-3-642-31164-2 · Cited by 1,176
Kronecker Graphs: An Approach to Modeling NetworksPreprint
Leskovec, J., Chakrabarti, D., Kleinberg, J. M., Faloutsos, C., & Ghahramani, Z. (2008) · arXiv (Cornell University) · doi:10.48550/arxiv.0812.4905 · Cited by 840
Mount, M. K., Ilieș, R., & Johnson, E. C. (2006) · Personnel Psychology · doi:10.1111/j.1744-6570.2006.00048.x · Cited by 722
Kronecker Graphs: An Approach to Modeling Networks
LeskovecJure, ChakrabartiDeepayan, KleinbergJon, FaloutsosChristos, & GhahramaniZoubin (2010) · Journal of Machine Learning Research · doi:10.5555/1756006.1756039 · Cited by 470
Self-configuring network traffic generation
Sommers, J., & Barford, P. (2004) · ACM SIGCOMM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028798 · Cited by 196
Modeling User Search Behavior for Masquerade Detection
Salem, M. B., & Stolfo, S. J. (2011) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-23644-0_10 · Cited by 129
Weighted graphs and disconnected components
McGlohon, M., Akoglu, L., & Faloutsos, C. (2008) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1401890.1401955 · Cited by 111
Flagged first, then by citations
2 of the 17 references couldn’t be matched to a known paper.
Research works printed but not linked: 5
- stribling, 2013, SCIgen-an Automatic CS Paper Generator
- paxton, 0, Use of synthetic data in testing administrative records systems, Proceedings Federal Committee on Statistical Methodology (FCSM) Washington DC 2012
- schonlau, 2013, "Masquerading User Data" [Online]
- cullen, 0, Annual Conference of the Society for Industrial and Organizational Psychology Chicago IL 2011
- 10.1162/jmlr.2003.3.4-5.993 · DOI
Cited by
Sorted by citations
A Unifying Review of Deep and Shallow Anomaly Detection
Ruff, L., Kauffmann, J., Vandermeulen, R. A., Montavon, G., Samek, W., Kloft, M., Dietterich, T. G., & Muller, K.-R. (2021) · Proceedings of the IEEE · doi:10.1109/jproc.2021.3052449 · Cited by 1,184
Cybersecurity data science: an overview from machine learning perspective
Sarker, I. H., Kayes, A. S. M., Badsha, S., Alqahtani, H., Watters, P., & Ng, A. (2020) · Journal of Big Data · doi:10.1186/s40537-020-00318-5 · Cited by 766
A Survey of Deep Learning Methods for Cyber Security
Berman, D. S., Buczak, A. L., Chavis, J. S., & Corbett, C. L. (2019) · Information · doi:10.3390/info10040122 · Cited by 569
AI-Driven Cybersecurity: An Overview, Security Intelligence Modeling and Research Directions
Sarker, I. H., Furhad, M. H., & Nowrozy, R. (2021) · SN Computer Science · doi:10.1007/s42979-021-00557-0 · Cited by 663
Sarker, I. H., Khan, A. I., Abushark, Y. B., & Alsolami, F. J. (2022) · Mobile Networks and Applications · doi:10.1007/s11036-022-01937-3 · Cited by 445
Metadata
- Authors
- Glasser, J., & Lindauer, B.
- Affiliations
- Software Engineering Institute (US)
- Venue
- 2013 IEEE Security and Privacy Workshops
- Publisher
- IEEE
- Published
- 2013-05
- Pages
- 98-104
- OpenAlex
- W1991210879
- Cited by
- 344
- References
- 17
- Citations by year
- 2026: 39 · 2025: 43 · 2024: 45 · 2023: 37 · 2022: 31 · 2021: 32 · 2020: 34 · 2019: 21 · 2018: 26 · 2017: 12 · 2016: 5 · 2015: 7 · 2014: 9 · 2013: 3
- FWCI
- 6.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Security and Privacy Workshops (SPW) (publishedVersion)
- Funders
- U.S. Department of Defense (FA8721-05-C-0003, Contract No. FA8721-05-C-0003)
- Carnegie Mellon University
- Defense Advanced Research Projects Agency
- Advanced Research Projects Agency
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- insider threats, synthetic data, insider threat detection, data scarcity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
