Doc2vec-Based Insider Threat Detection through Behaviour Analysis of Multi-source Security Logs
Abstract
Since insider attacks have been recognised as one of the most critical cyber security threats to an organisation, detection of malicious insiders has received increasing attention in recent years. Previously, we proposed an approach that performs the detection by analysing various security logs with Word2vec, which not only removes the reliance on prior knowledge but also greatly simplifies the process of decision making and improves the interpretability of the alerts. In this paper, following the similar idea, a new Doc2vec based approach is proposed to overcome the previous approach's limitations: (1) the behaviour metrics can be acquired straightforwardly due to the Doc2vec's capability in inferring unseen texts of any length; (2) other than the temporal metrics, some spatial metrics can also be realised, providing a more comprehensive insight into the unusual behaviours; and (3) a range of corpora are produced by adopting different keywords to aggregate, each of which may be suited to a specific type of behaviour metrics. A large number of numerical experiments are conducted using the same benchmark insider threat database, for the purpose of testing how the corpora, metrics and training parameters impact on the performance and be related to each other. The experiments demonstrate that the proposed approach can achieve a similar performance with greater simplicity and flexibility.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Tokenization is applied to CERT Insider Threat dataset logs to identify anomalous communication patterns in email content or log entries.
“For example, tokenization is applied to CERT Insider Threat dataset logs to identify anomalous communication patterns in email content or log entries [13,66].”
From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [66]
Cites
Distributed Representations of Words and Phrases and their Compositionality
Mikolov, T., Sutskever, I., Chen, K., Corrado, G., & Dean, J. (2013) · arXiv · doi:10.48550/arxiv.1310.4546 · Cited by 24,533 · see citing works
Chandola, V., Banerjee, A., & Kumar, V. (2009) · ACM Computing Surveys · doi:10.1145/1541880.1541882 · Cited by 11,687 · see citing works
Distributed Representations of Sentences and DocumentsPreprint
Le, Q. V., & Mikolov, T. (2014) · International Conference on Machine Learning · doi:10.48550/arxiv.1405.4053 · Cited by 10,307 · see citing works
Software Framework for Topic Modelling with Large Corpora
Rek, R. R. U., & Sojka, P. (2010) · doi:10.13140/2.1.2393.1847 · Cited by 3,766 · see citing works
Detecting and Preventing Cyber Insider Threats: A Survey
Liu, L., Vel, O. D., Han, Q., Zhang, J., & Xiang, Y. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2800740 · Cited by 386 · see citing works
Self-citationBridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
Data-Driven Cybersecurity Incident Prediction: A Survey
Sun, N., Zhang, J., Rimba, P., Gao, S., Zhang, L. Y., & Xiang, Y. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2885561 · Cited by 331 · see citing works
Self-citationNetwork Traffic Classification Using Correlation Information
Zhang, J., Xiang, Y., Wang, Y., Zhou, W., Xiang, Y., & Guan, Y. (2012) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2012.98 · Cited by 329 · see citing works
Self-citationDeep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint
Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 286 · see citing works
Guide to computer security log management
Kent, K., & Souppaya, M. P. (2006) · doi:10.6028/nist.sp.800-92 · Cited by 275 · see citing works
Yen, T.-F., Oprea, A., Onarlıoğlu, K., Leetham, T., Robertson, W., Juels, A., & Kirda, E. (2013) · Annual Computer Security Applications Conference · doi:10.1145/2523649.2523670 · Cited by 270 · see citing works
Wen, S., Haghighi, M. S., Chen, C., Xiang, Y., Zhou, W., & Jia, W. (2014) · IEEE Transactions on Computers · doi:10.1109/tc.2013.2295802 · Cited by 185 · see citing works
Self-citationDetecting insider threats in a real corporate database of computer usage activity
Senator, T. E., Goldberg, H. G., Memory, A., Young, W. T., Rees, B., Pierce, R., Huang, D., Reardon, M., Bader, D. A., Chow, E., et al. (2013) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2487575.2488213 · Cited by 132 · see citing works
Detecting insider threats by monitoring system call activity
Nguyen, N., Reiher, P. L., & Kuenning, G. (2004) · doi:10.1109/smcsia.2003.1232400 · Cited by 123 · see citing works
Data-Driven Cyber Security in Perspective—Intelligent Traffic Analysis
Coulter, R., Han, Q., Pan, L., Zhang, J., & Xiang, Y. (2019) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2019.2940940 · Cited by 112 · see citing works
Self-citationelicit: A System for Detecting Insiders Who Violate Need-to-Know
Maloof, M. A., & Stephens, G. D. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-74320-0_8 · Cited by 101 · see citing works
Spatio-Temporal Outlier Detection in Large Databases
Birant, D., & Kut, A. (2006) · Journal of Computing and Information Technology · doi:10.2498/cit.2006.04.04 · Cited by 99 · see citing works
Anomaly-Based Insider Threat Detection Using Deep Autoencoders
Liu, L., De Vel, O., Chen, C., Zhang, J., & Xiang, Y. (2018) · 2018 IEEE International Conference on Data Mining Workshops (ICDMW) · doi:10.1109/icdmw.2018.00014 · Cited by 79 · see citing works
Self-citationXie, M., Hu, J., Guo, S., & Zomaya, A. Y. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2016.2603961 · Cited by 72 · see citing works
Insider Threat Detection Using Stream Mining and Graph Mining
Parveen, P., Evans, J., Thuraisingham, B. M., Hamlen, K. W., & Khan, L. R. (2011) · doi:10.1109/passat/socialcom.2011.211 · Cited by 69 · see citing works
Xie, M., Hu, J., & Guo, S. (2014) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2014.2308198 · Cited by 54 · see citing works
System Level User Behavior Biometrics using Fisher Features and Gaussian Mixture Models
Song, Y., Salem, M. B., Hershkop, S., & Stolfo, S. J. (2013) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2013.33 · Cited by 49 · see citing works
Use of Domain Knowledge to Detect Insider Threats in Computer Activities
Young, W. T., Goldberg, H. G., Memory, A., Sartain, J. F., & Senator, T. E. (2013) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2013.32 · Cited by 44 · see citing works
Insider Threat Identification Using the Simultaneous Neural Learning of Multi-Source Logs
Liu, L., Chen, C., Zhang, J., De Vel, O., & Xiang, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2957055 · Cited by 31 · see citing works
Self-citationHanley, M., & Montelibano, J. (2011) · doi:10.21236/ada610463 · Cited by 27 · see citing works
Hanley, M., & Montelibano, J. (2011) · doi:10.1184/r1/6574472.v1 · Cited by 19 · see citing works
Unsupervised Insider Detection Through Neural Feature Learning and Model Optimisation
Liu, L., Chen, C., Zhang, J., Vel, O. D., & Xiang, Y. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-36938-5_2 · Cited by 17 · see citing works
Self-citationProactive Detection of Insider Threats with Graph Analysis and Learning (PRODIGAL)
Reardon, M., Goldberg, H. G., & Phillips, B. J. (2017) · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
Levshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 62 · see citing works
Robust Anomaly-Based Insider Threat Detection Using Graph Neural Network
Xiao, J., Yang, L., Zhong, F., Wang, X., Chen, H., & Li, D. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3222635 · Cited by 48 · see citing works
Padmavathi, G., Shanmugapriya, D., & Asha, S. (2022) · 2022 9th International Conference on Computing for Sustainable Global Development (INDIACom) · doi:10.23919/indiacom54597.2022.9763205 · Cited by 15 · see citing works
A systematic review on insider threat detection using natural language processing
Kundiya, K., & Haribhakta, Y. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01145-6 · Cited by 9 · see citing works
Insider Threat Detection Based on User and Entity Behavior Analysis with a Hybrid Model
Song, Y., & Yuan, J. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-75764-8_17 · Cited by 6 · see citing works
Memory-Augmented Insider Threat Detection with Temporal-Spatial Fusion
Li, D., Yang, L., Zhang, H., Wang, X., & Ma, L. (2022) · Security and Communication Networks · doi:10.1155/2022/6418420 · Cited by 6 · see citing works
(2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00004
CIA-EBE: Class Imbalance-Aware Event-Based Embedding for SOC Log Screening
Ndichu, S., Ban, T., Takahashi, T., & Kasama, T. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825261
Behavioral analysis across multiple domains using machine learning and deep learning models
Suryakant, S., & K, K. P. (2026) · Indonesian Journal of Electrical Engineering and Computer Science · doi:10.11591/ijeecs.v41.i3.pp1124-1133
- Authors
- Liu, L., Chen, C., Zhang, J., De Vel, O., & Xiang, Y.
- Affiliations
- Swinburne University of Technology (AU)
- James Cook University (AU)
- Defence Science and Technology Group, Australia
- Venue
- 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)
- Publisher
- IEEE
- Published
- 2020-12
- Pages
- 301-309
- OpenAlex
- W3124281509
- Cited by
- 9
- References
- 28
- Citations by year
- 2025: 1 · 2024: 3 · 2023: 1 · 2022: 3 · 2020: 1
- FWCI
- 1.05
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (publishedVersion)
- ResearchOnline - JCU (James Cook University) (submittedVersion)
- Figshare (submittedVersion)
- Funders
- Defence Science and Technology (DST) Group
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Keywords
- insider threat detection, malicious insiders, Doc2Vec, security logs, behavior analysis, Word2Vec, spatial metrics, temporal metrics, cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
