Using Dirichlet Marked Hawkes Processes for Insider Threat Detection
Open accessAbstract
Malicious insiders cause significant loss to organizations. Due to an extremely small number of malicious activities from insiders, insider threat is hard to detect. In this article, we present a Dirichlet Marked Hawkes Process (DMHP) to detect malicious activities from insiders in real-time. DMHP combines the Dirichlet process and marked Hawkes processes to model the sequence of user activities. The Dirichlet process is capable of detecting unbounded user modes (patterns) of infinite user activities, while, for each detected user mode, one set of marked Hawkes processes is adopted to model user activities from time and activity type (e.g., WWW visit or send email) information so that different user modes are modeled by different sets of marked Hawkes processes. To achieve real-time malicious insider activity detection, the likelihood of the most recent activity calculated by DMHP is adopted as a score to measure the maliciousness of the activity. Since the majority of user activities are benign, those activities with low likelihoods are labeled as malicious activities. Experimental results on two datasets show the effectiveness of DMHP.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
(2003) · Journal of Machine Learning Research · doi:10.5555/944919.944937 · Cited by 32,337 · see citing works
Spectra of some self-exciting and mutually exciting point processes
Hawkes, A. G. (1971) · Biometrika · doi:10.1093/biomet/58.1.83 · Cited by 2,306 · see citing works
Mixtures of Dirichlet Processes with Applications to Bayesian Nonparametric Problems
Antoniak, C. E. (1974) · The Annals of Statistics · doi:10.1214/aos/1176342871 · Cited by 1,976 · see citing works
Variational inference for Dirichlet process mixtures
Jordan, M. I., & Jordan, M. I. (2006) · Bayesian Analysis · doi:10.1214/06-ba104 · Cited by 1,645 · see citing works
A tutorial on Bayesian nonparametric models
Gershman, S. J., & Blei, D. M. (2011) · Journal of Mathematical Psychology · doi:10.1016/j.jmp.2011.08.004 · Cited by 606 · see citing works
Kriegel, H., Kröger, P., Schubert, E., & Zimek, A. (2009) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/1645953.1646195 · Cited by 493 · see citing works
Detecting and Preventing Cyber Insider Threats: A Survey
Liu, L., Vel, O. D., Han, Q., Zhang, J., & Xiang, Y. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2800740 · Cited by 386 · see citing works
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3363224 · Cited by 319 · see citing works
Deep learning for insider threat detection: Review, challenges and opportunities
Yuan, S., & Wu, X. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102221 · Cited by 271 · see citing works
Self-citationHomoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., & Ochoa, M. (2020) · ACM Computing Surveys · doi:10.1145/3303771 · Cited by 255 · see citing works
A New Take on Detecting Insider Threats: Exploring the Use of Hidden Markov Models
Rashid, T., Agrafiotis, I., & Nurse, J. R. C. (2016) · Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats · doi:10.1145/2995959.2995964 · Cited by 152 · see citing works
Detecting insider threats in a real corporate database of computer usage activity
Senator, T. E., Goldberg, H. G., Memory, A., Young, W. T., Rees, B., Pierce, R., Huang, D., Reardon, M., Bader, D. A., Chow, E., et al. (2013) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2487575.2488213 · Cited by 132 · see citing works
Dirichlet-Hawkes Processes with Applications to Clustering Continuous-Time Document Streams
Du, N., Farajtabar, M., Ahmed, A. A., Smola, A. J., & Song, L. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783411 · Cited by 130 · see citing works
Multi-Domain Information Fusion for Insider Threat Detection
Eldardiry, H., Bart, E., Liu, J., Hanley, J., Price, B., & Brdiczka, O. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.14 · Cited by 100 · see citing works
Kumar, S., Spezzano, F., & Subrahmanian, V. S. (2015) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783367 · Cited by 95 · see citing works
Teh, Y. W. (2010) · Encyclopedia of Machine Learning · doi:10.1007/978-0-387-30164-8_219 · Cited by 95 · see citing works
Insider Attack and Cyber Security
Stolfo, S. J., Bellovin, S. M., Keromytis, A. D., Hershkop, S., Smith, S. W., & Sinclair, S. (2008) · Advances in information security · doi:10.1007/978-0-387-77322-3 · Cited by 85 · see citing works
A Spatio-Temporal Point Process Model for Ambulance Demand
Zhou, Z., Matteson, D. S., Woodard, D. B., Henderson, S. G., & Micheas, A. C. (2014) · Journal of the American Statistical Association · doi:10.1080/01621459.2014.941466 · Cited by 84 · see citing works
A Review of Self-Exciting Spatio-Temporal Point Processes and Their Applications
Reinhart, A. (2018) · Statistical Science · doi:10.1214/17-sts629 · Cited by 70 · see citing works
Classification of Insider Threat Detection Techniques
Sanzgiri, A., & Dasgupta, D. (2016) · Proceedings of the 11th Annual Cyber and Information Security Research Conference · doi:10.1145/2897795.2897799 · Cited by 68 · see citing works
A Tutorial on Hawkes Processes for Events in Social MediaPreprint
Rizoiu, M.-A., Lee, Y., Mishra, S., & Xie, L. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1708.06401 · Cited by 58 · see citing works
Streaming anomaly detection using randomized matrix sketching
Huang, H., & Kasiviswanathan, S. P. (2015) · Proceedings of the VLDB Endowment · doi:10.14778/2850583.2850593 · Cited by 48 · see citing works
2014 IEEE Security and Privacy Workshops
(2014) · doi:10.1109/spw32927.2014 · Cited by 40 · see citing works
Lecture Notes: Temporal Point Processes and the Conditional Intensity FunctionPreprint
Rasmussen, J. G. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.00221 · Cited by 36 · see citing works
Few-shot Insider Threat Detection
Yuan, S., Zheng, P., Wu, X., & Tong, H. (2020) · Proceedings of the 29th ACM International Conference on Information & Knowledge Management · doi:10.1145/3340531.3412161 · Cited by 36 · see citing works
Self-citationModeling the Dynamics of Learning Activity on the Web
Mavroforakis, C., Valera, I., & Gomez-Rodriguez, M. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3038912.3052669 · Cited by 33 · see citing works
Deep Learning for Insider Threat Detection: Review, Challenges and OpportunitiesPreprint
Yuan, S., & Wu, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.12433 · Cited by 19 · see citing works
Self-citationA New Anomaly Detection Algorithm Based on Quantum Mechanics
Huang, H., Qin, H., Yoo, S., & Yu, D. (2012) · Proceedings · doi:10.1109/icdm.2012.127 · Cited by 13 · see citing works
Seonwoo, Y., Oh, A. H., & Park, S. (2018) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d18-1369 · Cited by 12 · see citing works
Point process modeling and optimization of social networks
Farajtabar, M. (2018) · SMARTech Repository (Georgia Institute of Technology) · Cited by 9 · see citing works
Online chinese restaurant process
Liu, C., Tsai, T.-H., & Lee, C.-H. (2014) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2623330.2623636 · Cited by 5 · see citing works
Flagged first, then by citations
Research works printed but not linked: 7
- [14]14. Hans-Peter Kriegel, Peer Kröger, Erich Schubert, and Arthur Zimek. 2009. LoOP: Local outlier probabilities. In 18th ACM Conference on Information and Knowledge Management. ACM, 1649-1652.
- [15]15. Srijan Kumar, Francesca Spezzano, and V. S. Subrahmanian. 2015. Vews: A Wikipedia vandal early warning system. In 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining.
- [19]19. Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. 2008. Isolation forest. In 2008 8th IEEE International Conference on Data Mining. IEEE, 413-422.
- [31]31. L. Spitzner. 2003. Honeypots: Catching the insider threat. In 19th Annual Computer Security Applications Conference.
- [33]33. Yee W. Teh, Michael I. Jordan, Matthew J. Beal, and David M. Blei. 2005. Sharing clusters among related groups: Hierarchical Dirichlet processes. In Advances in Neural Information Processing Systems. 1385-1392.
- [34]34. Aaron Tuor, Samuel Kaplan, Brian Hutchinson, Nicole Nichols, and Sean Robinson. 2017. Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In AI for Cyber Security Workshop.
- [35]35. Hongteng Xu and Hongyuan Zha. 2017. A Dirichlet mixture model of Hawkes processes for event sequence clustering. In Advances in Neural Information Processing Systems. 1354-1363.
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
“For privacy-sensitive scenarios, federated learning facilitates collaborative learning across decentralized datasets without compromising individual data privacy [4], [8].”
BackgroundResearch Opportunity of Insider Threat Detection based on Machine Learning Methods
Prajitno, N. T. M., Hadiyanto, H., & Rochim, A. F. (2023) · International Conference on Artificial Intelligence in Information and Communication (ICAIIC) · doi:10.1109/icaiic57133.2023.10067010 · Cited by 6 · see citing works
One-Class Adversarial Fraud Detection Nets with Class Specific Representations
Peng, H., Zhao, J., Li, L., Ren, Y., & Zhao, S. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3273543 · Cited by 5 · see citing works
Polat, O., Doğan, F., Türkoğlu, M., Yolcu, F., & Baturay, M. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112540 · Cited by 3 · see citing works
Statistical Cybersecurity: A Brief Discussion of Challenges, Data Structures, and Future Directions
Passino, F. S., Adams, N. M., Cohen, E. A. K., Evangelou, M., & Heard, N. A. (2023) · Harvard Data Science Review · doi:10.1162/99608f92.240383c7 · Cited by 1 · see citing works
BSR-CLIP: Background-Calibrated Structural Reasoning for Zero-Shot Visual-Language Anomaly Detection
Wang, S., Han, Y., Xue, Y., Li, J., Tan, S., Zhang, Y., Wang, L., & Zheng, P. (2026) · International Conference on Multimedia Retrieval · doi:10.1145/3805622.3810675
Self-citation
- Authors
- Zheng, P., Yuan, S., & Wu, X.
- Affiliations
- Amazon (United States) (US)
- Utah State University (US)
- University of Arkansas at Fayetteville (US)
- Venue
- Digital Threats: Research and Practice
- Published
- 2021-10-22
- Volume
- 3
- Issue
- 1
- Pages
- 1-19
- ISSN
- 2576-5337 (ISSN-L)
- 2692-1626
- OpenAlex
- W3156711466
- Cited by
- 6
- References
- 31
- Citations by year
- 2026: 2 · 2024: 1 · 2023: 3
- FWCI
- 0.45
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Locations
- Digital Threats Research and Practice (publishedVersion)
- Funders
- NSF (1564250 and 2103829)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- insider threat detection, Dirichlet process, marked Hawkes process, user activity modeling, malicious activity detection, real-time anomaly detection, network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
