Hunting for Insider Threats Using LSTM-Based Anomaly Detection

Villarreal-Vasquez, Miguel; Modelo-Howard, Gaspar; Dube, Simant; Bhargava, Bharat

doi:10.1109/tdsc.2021.3135639

Cited by 53Network Security and Intrusion DetectionAnomaly Detection Techniques and ApplicationsInformation and Cyber Security

Hunting for Insider Threats Using LSTM-Based Anomaly Detection

Villarreal-Vasquez, Miguel, Modelo-Howard, Gaspar, Dube, Simant, Bhargava, Bharat·2023·IEEE Transactions on Dependable and Secure Computing

DOI 10.1109/tdsc.2021.3135639

Open this paper in CoChat — free account

Abstract

Insider threats are one of the most difficult problems to solve, given the privileges and information available to insiders to launch different types of attacks. Current security systems can record and analyze sequences from a deluge of log data, potentially becoming a tool to detect insider threats. The issue is that insiders mix the sequence of attack steps with valid actions, reducing the capacity of security systems to programmatically detect the attacks. To address this shortcoming, we introduce LADOHD, an anomaly detection framework based on Long-Short Term Memory (LSTM) models, which learns the expected event patterns in a computer system to identify attack sequences even when attacks span for a long time. The applicability of the framework is demonstrated on a dataset of 38.9 million events collected from a commercial network of 30 computers over twenty days and where a 4-day long insider threat attack occurs. Results show that LADOHD outperforms the anomaly detection system used to protect the commercial network with a True Positive Rate of 97.29% and a False Positive Rate of 0.38%. Experiments also show that LSTMs have higher prediction precision in variable-length sequences than methods like Hidden Markov Models, a crucial requirement in sequence-analysis-based anomaly detection techniques.

Integrity signals

Registry

Crossref · 10.1109/tdsc.2021.3135639

Cites

42 of 42 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Villarreal-Vasquez et al. (2023) use LSTM to learn the patterns of benign event sequences and predict the probability of each event becoming the next event.
“They then use LSTM to learn the patterns of benign event sequences and predict the probability of each event becoming the next event.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Villarreal-Vasquez et al. (2023)
Villarreal-Vasquez et al. (2023) collect activity datasets from enterprise EDR systems and extract event sequences from the datasets.
“Miguel Villarreal-Vasquez et al. collect activity datasets from enterprise EDR systems and extract event sequences from the datasets.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Villarreal-Vasquez et al. (2023)
For Villarreal-Vasquez et al. (2023), the most repeated probability is considered the threshold; events with probabilities above the threshold are benign, and events with probabilities below the threshold are anomaly events.
“The most repeated probability is considered the threshold.Events with probabilities above the threshold are benign events, while events with probabilities below the threshold are anomaly events.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Villarreal-Vasquez et al. (2023)
Applications to insider threat data include processing CERT Insider Threat datasets (e.g., r4.2 and v6.2) for log examination and behavioral profiling.
“Applications to insider threat data include processing CERT Insider Threat datasets (e.g., r4.2 and v6.2) for log examination and behavioral profiling [5,41,59].”
From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [59]

Long Short-Term Memory
Hochreiter, S., & Schmidhuber, J. (1997) · Neural Computation · doi:10.1162/neco.1997.9.8.1735 · Cited by 102,318 · see citing works
Learning Phrase Representations using RNN Encoder–Decoder for Statistical Machine Translation
Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., & Bengio, Y. (2014) · Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.3115/v1/d14-1179 · Cited by 25,545 · see citing works
LSTM: A Search Space Odyssey
Greff, K., Srivastava, R. K., Koutnik, J., Steunebrink, B. R., & Schmidhuber, J. (2017) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2016.2582924 · Cited by 6,955 · see citing works
Error bounds for convolutional codes and an asymptotically optimum decoding algorithm
Viterbi, A. J. (1967) · IEEE Transactions on Information Theory · doi:10.1109/tit.1967.1054010 · Cited by 6,877 · see citing works
Robust Regression and Outlier Detection
Rousseeuw, P. J., & Leroy, A. M. (1987) · Wiley Series in Probability and Statistics · doi:10.1002/0471725382 · Cited by 5,609 · see citing works
SGDR: Stochastic Gradient Descent with Warm Restarts
Loshchilov, I., & Hutter, F. (2016) · arXiv · doi:10.48550/arxiv.1608.03983 · Cited by 5,309 · see citing works
A Survey of Outlier Detection Methodologies
Hodge, V., & Austin, J. (2004) · Artificial Intelligence Review · doi:10.1007/s10462-004-4304-y · Cited by 3,596 · see citing works
Cyclical Learning Rates for Training Neural Networks
Smith, L. N. (2017) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv.2017.58 · Cited by 2,931 · see citing works
A Critical Review of Recurrent Neural Networks for Sequence LearningPreprint
Lipton, Z. C., Berkowitz, J. A., & Elkan, C. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1506.00019 · Cited by 2,711 · see citing works
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection
Sommer, R., & Paxson, V. (2010) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2010.25 · Cited by 2,316 · see citing works
LSTM neural networks for language modeling
Sundermeyer, M., Schlüter, R., & Ney, H. (2012) · Interspeech 2012 · doi:10.21437/interspeech.2012-65 · Cited by 1,963 · see citing works
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835 · see citing works
An overview of anomaly detection techniques: Existing solutions and latest technological trends
Patcha, A., & Park, J.-M. J. (2007) · Computer Networks · doi:10.1016/j.comnet.2007.02.001 · Cited by 1,597 · see citing works
Intrusion detection using sequences of system calls
Hofmeyr, S. A., Forrest, S., & Somayaji, A. (1998) · Journal of Computer Security · doi:10.3233/jcs-980109 · Cited by 1,315 · see citing works
Detecting intrusions using system calls: alternative data models
Warrender, C., Forrest, S., & Pearlmutter, B. A. (2003) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/secpri.1999.766910 · Cited by 1,112 · see citing works
A sense of self for Unix processes
Forrest, S., Hofmeyr, S. A., Somayaji, A. B., & Longstaff, T. A. (2002) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/secpri.1996.502675 · Cited by 878 · see citing works
Mimicry attacks on host-based intrusion detection systems
Wagner, D., & Soto, P. (2002) · Proceedings of the 9th ACM conference on Computer and communications security · doi:10.1145/586110.586145 · Cited by 714 · see citing works
Regularizing and Optimizing LSTM Language Models
Merity, S., Keskar, N. S., & Socher, R. (2017) · arXiv · doi:10.48550/arxiv.1708.02182 · Cited by 697 · see citing works
Grammar as a Foreign Language
Vinyals, O., Kaiser, L., Koo, T., Petrov, S., Sutskever, I., & Hinton, G. (2014) · arXiv · doi:10.48550/arxiv.1412.7449 · Cited by 464 · see citing works
Clustering Sequences with Hidden Markov Models
Smyth, P. (1996) · Cited by 381 · see citing works
A Study on Advanced Persistent Threats
Chen, P., Desmet, L., & Huygens, C. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-44885-4_5 · Cited by 359 · see citing works
Host-based intrusion detection using dynamic and static behavioral models
Yeung, D., & Ding, Y. (2002) · Pattern Recognition · doi:10.1016/s0031-3203(02)00026-2 · Cited by 350 · see citing works
A Survey of Insider Attack Detection Research
Salem, M. B., Hershkop, S., & Stolfo, S. J. (2008) · Advances in information security · doi:10.1007/978-0-387-77322-3_5 · Cited by 293 · see citing works
Visualization of navigation patterns on a Web site using model-based clustering
Cadez, I. V., Heckerman, D. E., Meek, C., Smyth, P., & White, S. (2000) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/347090.347151 · Cited by 267 · see citing works
Multi-level Anomaly Detection in Industrial Control Systems via Package Signatures and LSTM Networks
Feng, C., Li, T., & Chana, D. (2017) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2017.34 · Cited by 240 · see citing works
Insiders and Insider Threats:An Overview of Definitions and Mitigation Techniques
Hunker, J., & Probst, C. W. (2011) · Cited by 185 · see citing works
Insider Threat Detection with Deep Neural Network
Yuan, F., Cao, Y., Shang, Y., Liu, Y., Tan, J., & Fang, B. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-93698-7_4 · Cited by 168 · see citing works
A comprehensive survey of numeric and symbolic outlier mining techniques
Agyemang, M., Barker, K., & Alhajj, R. (2006) · Intelligent Data Analysis · doi:10.3233/ida-2006-10604 · Cited by 164 · see citing works
Tiresias
Shen, Y., Mariconti, E., Vervier, P. A., & Stringhini, G. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243811 · Cited by 157 · see citing works
A Comparative Study for Outlier Detection Techniques in Data Mining
Bakar, Z. B. A., Mohemad, R., Ahmad, A., & Deris, M. M. (2006) · IEEE Conference on Cybernetics and Intelligent Systems · doi:10.1109/iccis.2006.252287 · Cited by 152 · see citing works
LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection SystemsPreprint
Kim, G., Yi, H., Lee, J., Paek, Y., & Yoon, S. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.01726 · Cited by 101 · see citing works
Insider Threat Detection with Long Short-Term Memory
Lu, J., & Wong, R. K. (2019) · Australasian Computer Science Week Multiconference (ACSW) · doi:10.1145/3290688.3290692 · Cited by 78 · see citing works
Classification of Insider Threat Detection Techniques
Sanzgiri, A., & Dasgupta, D. (2016) · Proceedings of the 11th Annual Cyber and Information Security Research Conference · doi:10.1145/2897795.2897799 · Cited by 68 · see citing works
Context Sensitive Anomaly Monitoring of Process Control Flow to Detect Mimicry Attacks and Impossible Paths
Xu, H., Du, W. K., & Chapin, S. J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30143-1_2 · Cited by 54 · see citing works
Call-Based Fraud Detection in Mobile Communication Networks Using a Hierarchical Regime-Switching Model
Hollmén, J., & Tresp, V. (1998) · Cited by 48 · see citing works
A Sharper Sense of Self: Probabilistic Reasoning of Program Behaviors for Anomaly Detection with Context Sensitivity
Xu, K., Tian, K., Yao, D. D., & Ryder, B. G. (2016) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2016.49 · Cited by 42 · see citing works
Weak models for insider threat detection
Thompson, P. (2004) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.548178 · Cited by 33 · see citing works
Automated Discovery of Mimicry Attacks
Giffin, J. T., Jha, S., & Miller, B. P. (2006) · Lecture notes in computer science · doi:10.1007/11856214_3 · Cited by 32 · see citing works
Probabilistic Program Modeling for High-Precision Anomaly Classification
Xu, K., Yao, D. D., Ryder, B. G., & Tian, K. (2015) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf.2015.37 · Cited by 29 · see citing works
Masquerade Attack Detection Using a Search-Behavior Modeling Approach
Salem, M. B., & Stolfo, S. J. (2009) · doi:10.7916/d8x63tsv · Cited by 25 · see citing works
Attentive Language Models.
Salton, G. D., Ross, R., & Kelleher, J. D. (2017) · International Joint Conference on Natural Language Processing · Cited by 21 · see citing works
Anomaly Detection as a Service
Yao, D. D., Shu, X., Cheng, L., & Stolfo, S. J. (2018) · Synthesis lectures on information security, privacy, and trust · doi:10.1007/978-3-031-02354-5 · Cited by 13 · see citing works

Flagged first, then by citations

Sorted by citations

Evolving techniques in cyber threat hunting: A systematic review
Mahboubi, A., Luong, K., Aboutorab, H., Bui, H. T., Jarrad, G., Bahutair, M., Camtepe, S., Pogrebna, G., Ahmed, E., Barry, B., et al. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104004 · Cited by 94 · see citing works
A Survey on Threat Hunting in Enterprise Networks
Nour, B., Pourzandi, M., & Debbabi, M. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3299519 · Cited by 87 · see citing works
BRITD: behavior rhythm insider threat detection with time awareness and user adaptation
Song, S., Gao, N., Zhang, Y., & Ma, C. (2024) · Cybersecurity · doi:10.1186/s42400-023-00190-9 · Cited by 45 · see citing works
Insider threat detection for specific threat scenarios
Tian, T., Zhang, C., Jiang, B., Feng, H., & Lu, Z. (2025) · Cybersecurity · doi:10.1186/s42400-024-00321-w · Cited by 42 · see citing works
Insights into user behavioral-based insider threat detection: systematic review
Kamatchi, K., & Uma, E. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01002-6 · Cited by 35 · see citing works
Daily insider threat detection with hybrid TCN transformer architecture
Ye, X.-Y., Cui, H., Luo, F., Wang, J., Xiong, X.-Y., Zhang, W., Yu, J., & Zhao, W. (2025) · Scientific Reports · doi:10.1038/s41598-025-12063-x · Cited by 19 · see citing works
Insider Threat Detection Using Behavioural Analysis through Machine Learning and Deep Learning Techniques
Prasad, P. S. S., Nayak, S. K., & Krishna, M. V. (2025) · International Research Journal of Multidisciplinary Technovation · doi:10.54392/irjmt2527 · Cited by 18 · see citing works
M-EOS: Modified equilibrium optimization based stacked CNN for insider threat detection
Anju, A., & Krishnamurthy, M. (2024) · Wireless Networks · doi:10.1007/s11276-024-03678-5 · Cited by 17 · see citing works
Exploiting Spatial-Temporal Behavior Patterns for Fraud Detection in Telecom Networks
Chu, G., Wang, J., Qi, Q., Sun, H., Tao, S., Yang, H., Liao, J., & Han, Z. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3228797 · Cited by 17 · see citing works
SENTINEL: Insider Threat Detection Based on Multi-Timescale User Behavior Interaction Graph Learning
Xiao, F., Chen, S., Chen, S. J., Ma, Y., He, H., & Yang, J. (2024) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2024.3519155 · Cited by 15 · see citing works
HyperEye: A Lightweight Features Fusion Model for Unknown Encrypted Malware Traffic Detection
Zang, X., Zheng, Z., Zheng, H., Liu, X., Khan, M. K., & Jiang, W. (2025) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2025.3558353 · Cited by 15 · see citing works
AUTOMA: Automated Generation of Attack Hypotheses and Their Variants for Threat Hunting Using Knowledge Discovery
Nour, B., Pourzandi, M., Qureshi, R. K., & Debbabi, M. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3378972 · Cited by 14 · see citing works
Diagnosis of Malicious Bitstreams in Cloud Computing FPGAs
Chaudhuri, J., & Chakrabarty, K. (2023) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2023.3272268 · Cited by 13 · see citing works
An Adaptive Fuzzy SIR Model for Real-Time Malware Spread Prediction in Industrial Internet of Things Networks
Zheng, Y., Na, Z., Ji, W., & Lu, Y. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3550671 · Cited by 13 · see citing works
AI-Based Embedded Framework for Cyber-Attack Detection Through Signal Processing and Anomaly Analysis
Drăguşin, S., Boştinaru, R.-N., Bizon, N., & Iana, G. (2026) · Applied Sciences · doi:10.3390/app16031416 · Cited by 12 · see citing works
AUTH: An Adversarial Autoencoder Based Unsupervised Insider Threat Detection Scheme for Multisource Logs
Zhu, X., Dong, J., Qi, J., Zhou, Z., Dong, Z., Sun, Y., & Moyu, W. (2024) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2024.3393491 · Cited by 12 · see citing works
EventMon: Real-Time Event-Based Streaming Network Monitoring Data Recovery
Li, Y., Liang, W., Xie, K., Zhang, D., Li, K., & Xiong, N. N. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3519197 · Cited by 11 · see citing works
Anomaly Detection in Event-Triggered Traffic Time Series via Similarity Learning
Dou, S., Yang, K., Jiao, Y., Qiu, C., & Ren, K. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3418906 · Cited by 10 · see citing works
A systematic review on insider threat detection using natural language processing
Kundiya, K., & Haribhakta, Y. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01145-6 · Cited by 9 · see citing works
ATHITD: Attention-based temporal heterogeneous graph neural network for insider threat detection
Qi, Y., Yan, C., Wang, Z., Zhang, C., Liu, S., Lü, Z., & Jiang, B. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104587 · Cited by 8 · see citing works
Application of Machine Learning and Deep Learning Techniques for Enhanced Insider Threat Detection in Cybersecurity: Bibliometric Review
Ofori, H. K., Bell-Dzide, K., Brown-Acquaye, W. L., Lempogo, F., Frimpong, S. O., Agbehadji, I. E., & Millham, R. C. (2025) · Symmetry · doi:10.3390/sym17101704 · Cited by 7 · see citing works
Insider Threat Detection Using Knowledge Graphs and RiskScore-Guided Graph Neural Networks
Thi, V. D., Duc, T. T., Nguyen, T. M., & Luong, H.-M. P. (2026) · Engineering Technology & Applied Science Research · doi:10.48084/etasr.17187 · Cited by 5 · see citing works
Human Factors In Security Management: Understanding And Mitigating Insider Threats
Asasfeh, A., Alnawayseh, S. E. A., Alomoush, R. A., & Salahat, M. (2024) · International Conference on Cyber Resilience (ICCR) · doi:10.1109/iccr61006.2024.10532956 · Cited by 5 · see citing works
EAGLEEYE: Attention to Unveil Malicious Event Sequences From Provenance Graphs
Gysel, P., Wüest, C., Nwafor, K., Jašek, O., Ustyuzhanin, A., & Divakaran, D. M. (2024) · APWG Symposium on Electronic Crime Research (eCrime) · doi:10.1109/ecrime66200.2024.00009 · Cited by 6 · see citing works
Anomaly Detection in Key-Management Activities Using Metadata: A Case Study and Framework
Baee, M. A. R., Simpson, L. R., & Armstrong, W. (2024) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2024.3407547 · Cited by 4 · see citing works
Towards Automated and Explainable Threat Hunting with Generative AI
Purba, M. D., Chu, B., & French, W. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00067 · Cited by 4 · see citing works
Insider Threat Detection using Explainable Machine Learning Models in Corporate Networks
Bhatnagar, P., Mandru, S. K., Sharma, P., Singh, V., Singh, J. P., & Katheria, S. (2025) · International Conference on Electronics, Communication and Aerospace Technology (ICECA) · doi:10.1109/iceca66444.2025.11383006 · Cited by 3 · see citing works
Anomaly Detection in the Key-Management Interoperability Protocol Using Metadata
Baee, M. A. R., Simpson, L. R., & Armstrong, W. (2024) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2024.3386715 · Cited by 4 · see citing works
A SIEM-Integrated Cybersecurity Prototype for Insider Threat Anomaly Detection Using Enterprise Logs and Behavioural Biometrics
Mohamed, M. S., & Arabo, A. (2026) · Electronics · doi:10.3390/electronics15010248 · Cited by 2 · see citing works
DDCC: Synergizing Denoising Diffusion Probabilistic Models and Curriculum-Based Complexity Control for Insider Threat Detection
Dong, J., Wei, J., Hu, X., Dong, Z., Chen, F., Hu, X. Y., & Qi, J. (2025) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2025.3574417 · Cited by 2 · see citing works
ISFL-AE: Insider-Specific Feature Learning Autoencoder for Lightweight Insider Threat Detection
Kim, Y., & Kim, Y.-G. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3659000 · Cited by 1 · see citing works
A Scalable Framework for Insider Threat Detection: Session Modelling and Class Balancing with XGBoost
Faqihi, R., Nanda, P., Mohanty, M., Alqahtani, S., & Alrashed, B. (2025) · IEEE/ACS International Conference on Computer Systems and Applications (AICCSA) · doi:10.1109/aiccsa66935.2025.11315452 · Cited by 1 · see citing works
Multi-feature unsupervised time series anomaly detection based on memory-augmented autoencoder - One-Class support vector machine
Hao, G., Ruan, H., Li, Y., Liu, Q., Liu, C., Wang, Z., Li, X., Yu, J., & Juan, G. (2026) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2026.114124 · Cited by 1 · see citing works
Prediction, Detection and Control of Insider Threats in Organizations
Esparza, E., Diéguez, M., & Hochstetter-Diez, J. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-84078-4_26 · Cited by 1 · see citing works
A SIEM-Integrated Cybersecurity Prototype for Insider Threat Anomaly Detection Using Enterprise Logs and Behavioural Biometrics
Mohamed, M. S. M., & Arabo, A. (2025) · doi:10.20944/preprints202511.1003.v1
Detection and Mitigation of Insider Attacks in Financial Systems
Pradesh, G., Sangeetha, D., Kishore, V. R., & Sharan, L. (2024) · International Conference on Advances in Computing, Communication and Applied Informatics (ACCAI) · doi:10.1109/accai61061.2024.10602199
Overview of Universal Behavior Computing
Wang, C., & Zhu, H. (2024) · Springer eBooks · doi:10.1007/978-981-97-9014-2_1
MITD: A Multi-Dimensional Insider Threat Detection Framework Based On Deep Learning
Peng, L., Feng, J., Huang, Y., Zhou, H., Qin, H., & Qiu, F. (2024) · International Congress on Image and Signal Processing (CISP) · doi:10.1109/cisp-bmei64163.2024.10906151
DMFI: A Dual-Modality Log Analysis Framework for Insider Threat Detection with LoRA-Tuned Language Models
Kong, K., Liu, D., Jin, X., Geng, G., Li, Z., & Weng, J. (2025) · Proceedings · doi:10.1109/icdm65498.2025.00046
SENTRY: an adversarial robust anomaly detection approach in system log based on pattern unit extraction and time-step masking
Geng, B., Chen, J., Cai, S., Lu, J., & Liu, Y. (2026) · Automated Software Engineering · doi:10.1007/s10515-026-00637-6
Contrastive Learning with Knowledge-Enhanced Prompts for Insider Threat Detection
Yu, H., Guo, Y., Wang, J., Zhu, M., Xu, Y., & Li, Z. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11229300
Smart Scan: A Next-Gen Android Vulnerability Framework Powered by CVE Intelligence
Kalita, S., Kiran, A., Kumar, A., Soni, S., & Kothapalli, V. S. R. T. (2025) · International Conference on Sustainability, Innovation & Technology (ICSIT) · doi:10.1109/icsit65336.2025.11295152
Mitigating Insider-Facilitated Advanced Persistent Threat: A Three-Player Differential Game Approach
Qin, Y., Yang, L., Yang, X., Li, G., & Doss, R. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3675443
347Quantum-Enhanced AI for Autonomous Threat Detection and Self-Detection in Cybersecurity
Chakraborty, P., Paul, T., Dutta, S., Poddar, A., & Das, S. (2025) · De Gruyter eBooks · doi:10.1515/9783112212158-013
Behavioural Biometrics and Session-Level Risk Monitoring for Insider Threat Detection in Enterprise Networks
Kuldeyev, N., Mamyrbayev, O., Аkhmediyarova, A., & Yerzhan, A. (2026) · Electronics · doi:10.3390/electronics15112400
A session-based insider threat detection approach leveraging the CERT and SPEDIA datasets
Muñoz, A. M., Larriva-Novo, X. A., Sánchez-Zas, C., Álvarez-Campana, M., & Villagrá, V. A. (2026) · Machine Learning with Applications · doi:10.1016/j.mlwa.2026.100946
Insider Threat Detection and Evidence-Grounded Triage Using a Heterogeneous Dual-Branch Network and a Constrained LLM Agent
Cheng, K., Li, D., Tang, W., Shu, Y., & Qiang, W. (2026) · Applied Sciences · doi:10.3390/app16147054
One-Class LSTM Behavioral Modeling for Insider Threat Detection in Zero Trust Architectures
Robu, R. C., Marian, C. V., & Cioponea, A. P. (2026) · International Conference on Electronics, Computers and Artificial Intelligence (ECAI) · doi:10.1109/ecai69016.2026.11613700
Multi‐Agent Real‐Time Detection of Insider Threats via Collaborative Reasoning
Cheng, K., Li, D., Tang, W., Tan, L., Xiang, K., Liu, T., & Qiang, W. (2026) · Security and Privacy · doi:10.1002/spy2.70243
MINDSET-XAI: Multi-Level Explainable Insider Threat Detection Using Temporal Behavioral Modeling and LLM-Assisted Forensic Reasoning
Kundiya, K., & Haribhakta, Y. V. (2026) · IEEE Access · doi:10.1109/access.2026.3726811
A systematic review of federated learning applications in mitigating insider threats
Mdaghri, A. A., Alae, A., & Hilali, A. A. (2026) · Applied Soft Computing · doi:10.1016/j.asoc.2026.116478
Explainable Behavioral Analytics for Users and Entities Using Hybrid AI Models: A MUEBA-XAI Framework Integrating LSTM, Isolation Forest, SHAP, and LIME
Hashmi, A. S., Munib, S., Hussain, H., & Kiani, A. A. (2026) · International Journal of Innovations in Science and Technology · doi:10.33411/ijist/2033
Bayesian Hierarchical Temporal Model for the Early Prediction of Insider Threats
Радівілова, Т., Kirichenko, L., Мулеса, О. Ю., Добринін, І. С., Snihurov, A., & Pantelieiev, V. (2026) · International Conference on Advanced Computer Information Technologies (ACIT) · doi:10.1109/acit69831.2026.11699940

Attention-Based LSTM for Insider Threat Detection
Yuan, F., Shang, Y., Liu, Y., Cao, Y., & Tan, J. (2019) · Communications in computer and information science · doi:10.1007/978-981-15-0871-4_15 · Cited by 23 · see citing works
Insider Threat Detection with Long Short-Term Memory
Lu, J., & Wong, R. K. (2019) · Australasian Computer Science Week Multiconference (ACSW) · doi:10.1145/3290688.3290692 · Cited by 78 · see citing works
Detecting the Insider Threat with Long Short Term Memory (LSTM) Neural Networks
Lopez, E., & Sartipi, K. (2020) · arXiv · doi:10.48550/arxiv.2007.11956 · Cited by 1 · see citing works
Attention-Enhanced Bidirectional LSTM for Intelligent Insider Threat Detection in Enterprise Networks
Wrona, O. J., & Malinowska, Z. (2026) · Data Engineering and Applications · doi:10.64972/dea.2026.v5i1.1602d:15-29
Anomaly Detection for Insider Threats : Comparative Evaluation of LSTM Autoencoders, Isolation Forest, and Elasticsearch on Two Datasets.
Fagerlund, M. (2024) · KTH Publication Database DiVA (KTH Royal Institute of Technology)

Authors: Villarreal-Vasquez, M., Modelo-Howard, G., Dube, S., & Bhargava, B.
Affiliations: Purdue University West Lafayette (US)
Palo Alto Networks (United States) (US)
Broadcom (United States) (US)
ORCID: Villarreal-Vasquez, Miguel
Modelo-Howard, Gaspar
Dube, Simant
Bhargava, Bharat
Venue: IEEE Transactions on Dependable and Secure Computing
Publisher: Institute of Electrical and Electronics Engineers (IEEE)
Published: 2023-01-01
Volume: 20
Issue: 1
Pages: 451-462
ISSN: 1545-5971 (ISSN-L)
1941-0018
2160-9209
DOI: 10.1109/tdsc.2021.3135639
OpenAlex: W4206342677
Cited by: 52
References: 42
Citations by year: 2026: 16 · 2025: 18 · 2024: 15 · 2023: 2 · 2022: 1
FWCI: 2.02
Type: journal article
Language: en
Open access: closed
Licence: ieeexplore.ieee.org/Xplorehelp/downloads/license-information/IEEE.html (vor)
doi.org/10.15223/policy-029 (stm-asf)
doi.org/10.15223/policy-037 (stm-asf)
Locations: IEEE Transactions on Dependable and Secure Computing (publishedVersion)
Funders: Northrop Grumman Cybersecurity Research Consortium
Topics: Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords: insider threats, anomaly detection, long short-term memory, log analysis, event sequence modeling, network security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Hunting for Insider Threats Using LSTM-Based Anomaly Detection

Abstract

Integrity signals

Claims the paper makes

Claims other papers make about this one

Cites

Cited by

Related

Record

About these checks