{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T02:32:22Z","timestamp":1775788342304,"version":"3.50.1"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031893490","type":"print"},{"value":"9783031893506","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-89350-6_10","type":"book-chapter","created":{"date-parts":[[2025,4,25]],"date-time":"2025-04-25T12:11:23Z","timestamp":1745583083000},"page":"157-172","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Classifying Insider Threat Scenarios Through Explainable Articial Intelligence"],"prefix":"10.1007","author":[{"given":"R\u00e9mi","family":"Grzeczkowicz","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christopher","family":"Neal","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Neda","family":"Baghalizadeh-Moghadam","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nora Boulahia","family":"Cuppens","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fr\u00e9d\u00e9ric","family":"Cuppens","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,4,16]]},"reference":[{"key":"10_CR1","unstructured":"2010s global surveillance disclosures - Wikipedia \u2014 en.wikipedia.org. https:\/\/en.wikipedia.org\/wiki\/2010s_global_surveillance_disclosures. Accessed 13 May 2024"},{"key":"10_CR2","unstructured":"List of data breaches - Wikipedia \u2014 en.wikipedia.org. https:\/\/en.wikipedia.org\/wiki\/List_of_data_breaches. Accessed 13 May 2024"},{"key":"10_CR3","unstructured":"Radial basis function kernel - Wikipedia \u2014 en.wikipedia.org. https:\/\/en.wikipedia.org\/wiki\/Radial_basis_function_kernel. Accessed 12 July 2024"},{"issue":"15","key":"10_CR4","doi-asserted-by":"publisher","first-page":"5208","DOI":"10.3390\/app10155208","volume":"10","author":"MN Al-Mhiqani","year":"2020","unstructured":"Al-Mhiqani, M.N., et al.: A review of insider threat detection: classification, machine learning techniques, datasets, open challenges, and recommendations. Appl. Sci. 10(15), 5208 (2020)","journal-title":"Appl. Sci."},{"key":"10_CR5","doi-asserted-by":"crossref","unstructured":"Al-Shehari, T., Al-Razgan, M., Alfakih, T., Alsowail, R.A., Pandiaraj, S.: Insider threat detection model using anomaly-based isolation forest algorithm. IEEE Access (2023)","DOI":"10.1109\/ACCESS.2023.3326750"},{"key":"10_CR6","doi-asserted-by":"publisher","first-page":"30907","DOI":"10.1109\/ACCESS.2024.3369906","volume":"12","author":"FR Alzaabi","year":"2024","unstructured":"Alzaabi, F.R., Mehmood, A.: A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods. IEEE Access 12, 30907\u201330927 (2024)","journal-title":"IEEE Access"},{"key":"10_CR7","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2023.100965","volume":"24","author":"M Amiri-Zarandi","year":"2023","unstructured":"Amiri-Zarandi, M., Karimipour, H., Dara, R.A.: A federated and explainable approach for insider threat detection in IoT. Internet Things 24, 100965 (2023)","journal-title":"Internet Things"},{"key":"10_CR8","doi-asserted-by":"crossref","unstructured":"Dai, X., Keane, M.T., Shalloo, L., Ruelle, E., Byrne, R.M.: Counterfactual explanations for prediction and diagnosis in XAI. In: Proceedings of the 2022 AAAI\/ACM Conference on AI, Ethics, and Society, AIES 2022, pp. 215\u2013226. Association for Computing Machinery, New York (2022)","DOI":"10.1145\/3514094.3534144"},{"key":"10_CR9","doi-asserted-by":"crossref","unstructured":"Glasser, J., Lindauer, B.: Bridging the gap: a pragmatic approach to generating insider threat data. In: 2013 IEEE Security and Privacy Workshops, pp. 98\u2013104 (2013)","DOI":"10.1109\/SPW.2013.37"},{"key":"10_CR10","doi-asserted-by":"crossref","unstructured":"Hall, A.J., Pitropakis, N., Buchanan, W.J., Moradpoor, N.: Predicting malicious insider threat scenarios using organizational data and a heterogeneous stack-classifier. In: 2018 IEEE International Conference on Big Data (Big Data), pp. 5034\u20135039. IEEE (2018)","DOI":"10.1109\/BigData.2018.8621922"},{"key":"10_CR11","doi-asserted-by":"crossref","unstructured":"Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., Ochoa, M.: Insight into insiders and it: a survey of insider threat taxonomies, analysis, modeling, and countermeasures. ACM Comput. Surv. 52(2) (2019)","DOI":"10.1145\/3303771"},{"issue":"1","key":"10_CR12","doi-asserted-by":"publisher","first-page":"30","DOI":"10.1109\/TNSM.2020.2967721","volume":"17","author":"DC Le","year":"2020","unstructured":"Le, D.C., Zincir-Heywood, N., Heywood, M.I.: Analyzing data granularity levels for insider threat detection using machine learning. IEEE Trans. Netw. Serv. Manage. 17(1), 30\u201344 (2020)","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10_CR13","unstructured":"Liashchynskyi, P., Liashchynskyi, P.: Grid search, random search, genetic algorithm: a big comparison for NAS. arXiv preprint arXiv:1912.06059 (2019)"},{"key":"10_CR14","doi-asserted-by":"crossref","unstructured":"Liu, F.T., Ting, K.M., Zhou, Z.H.: Isolation forest. In: 2008 Eighth IEEE International Conference on Data Mining, pp. 413\u2013422. IEEE (2008)","DOI":"10.1109\/ICDM.2008.17"},{"key":"10_CR15","doi-asserted-by":"crossref","unstructured":"Liu, L., De\u00a0Vel, O., Chen, C., Zhang, J., Xiang, Y.: Anomaly-based insider threat detection using deep autoencoders. In: 2018 IEEE International Conference on Data Mining Workshops (ICDMW), pp. 39\u201348. IEEE (2018)","DOI":"10.1109\/ICDMW.2018.00014"},{"key":"10_CR16","unstructured":"Lundberg, S.M., Lee, S.I.: A unified approach to interpreting model predictions. In: Advances in Neural Information Processing Systems, vol. 30 (2017)"},{"key":"10_CR17","doi-asserted-by":"crossref","unstructured":"Padmavathi, G., Shanmugapriya, D., Asha, S.: A framework to detect the malicious insider threat in cloud environment using supervised learning methods. In: 2022 9th International Conference on Computing for Sustainable Global Development (INDIACom), pp. 354\u2013358. IEEE (2022)","DOI":"10.23919\/INDIACom54597.2022.9763205"},{"key":"10_CR18","doi-asserted-by":"crossref","unstructured":"Raut, M., Dhavale, S., Singh, A., Mehra, A.: Insider threat detection using deep learning: a review. In: 2020 3rd International Conference on Intelligent Sustainable Systems (ICISS), pp. 856\u2013863. IEEE (2020)","DOI":"10.1109\/ICISS49785.2020.9315932"},{"key":"10_CR19","doi-asserted-by":"crossref","unstructured":"Ribeiro, M.T., Singh, S., Guestrin, C.: \u201cwhy should i trust you?\u201d: explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD 2016, pp. 1135\u20131144. Association for Computing Machinery, New York (2016)","DOI":"10.1145\/2939672.2939778"},{"key":"10_CR20","unstructured":"Shrikumar, A., Greenside, P., Kundaje, A.: Learning important features through propagating activation differences. In: Precup, D., Teh, Y.W. (eds.) Proceedings of the 34th International Conference on Machine Learning. Proceedings of Machine Learning Research, vol.\u00a070, pp. 3145\u20133153. PMLR (2017)"},{"key":"10_CR21","unstructured":"Verizon: 2024 Data Breach Investigations Report (2024)"},{"key":"10_CR22","unstructured":"Wright, R.: Interpreting black-box machine learning models using partial dependence and individual conditional expectation plots. Exploring SAS\u00ae Enterprise Miner Special Collection, vol. 1950 (2018)"},{"key":"10_CR23","doi-asserted-by":"crossref","unstructured":"Yang, G., Cai, L., Yu, A., Meng, D.: A general and expandable insider threat detection system using baseline anomaly detection and scenario-driven alarm filters. In: 2018 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications\/12th IEEE International Conference on Big Data Science and Engineering (TrustCom\/BigDataSE), pp. 763\u2013773 (2018)","DOI":"10.1109\/TrustCom\/BigDataSE.2018.00110"},{"key":"10_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102221","volume":"104","author":"S Yuan","year":"2021","unstructured":"Yuan, S., Wu, X.: Deep learning for insider threat detection: review, challenges and opportunities. Comput. Secur. 104, 102221 (2021)","journal-title":"Comput. Secur."},{"key":"10_CR25","first-page":"1","volume":"2021","author":"C Zhang","year":"2021","unstructured":"Zhang, C., Wang, S., Zhan, D., Yu, T., Wang, T., Yin, M.: Detecting insider threat from behavioral logs based on ensemble and self-supervised learning. Secur. Commun. Netw. 2021, 1\u201311 (2021)","journal-title":"Secur. Commun. Netw."},{"key":"10_CR26","series-title":"Smart Innovation, Systems and Technologies","doi-asserted-by":"publisher","first-page":"391","DOI":"10.1007\/978-981-13-9710-3_41","volume-title":"Advances in Intelligent Information Hiding and Multimedia Signal Processing","author":"Z Zhang","year":"2020","unstructured":"Zhang, Z., Wang, S., Lu, G.: An internal threat detection model based on denoising autoencoders. In: Pan, J.-S., Li, J., Tsai, P.-W., Jain, L.C. (eds.) Advances in Intelligent Information Hiding and Multimedia Signal Processing. SIST, vol. 157, pp. 391\u2013400. Springer, Singapore (2020). https:\/\/doi.org\/10.1007\/978-981-13-9710-3_41"}],"container-title":["Lecture Notes in Computer Science","Risks and Security of Internet and Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-89350-6_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,25]],"date-time":"2025-04-25T12:11:51Z","timestamp":1745583111000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-89350-6_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031893490","9783031893506"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-89350-6_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"16 April 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"CRiSIS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Risks and Security of Internet and Systems","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Aix-en-Provence","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 November 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"28 November 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"crisis2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}