{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T14:25:17Z","timestamp":1780410317751,"version":"3.54.1"},"reference-count":69,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T00:00:00Z","timestamp":1777420800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Future Generation Computer Systems"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1016\/j.future.2026.108543","type":"journal-article","created":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T05:36:31Z","timestamp":1777527391000},"page":"108543","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Towards trustworthy cybersecurity: Reclassifying insider threat detection using SHAP"],"prefix":"10.1016","volume":"183","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9976-8911","authenticated-orcid":false,"given":"Raddad","family":"Faqihi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5748-155X","authenticated-orcid":false,"given":"Priyadarsi","family":"Nanda","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0258-4586","authenticated-orcid":false,"given":"Manoranjan","family":"Mohanty","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9051-319X","authenticated-orcid":false,"given":"Saleh","family":"Alqahtani","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7393-5355","authenticated-orcid":false,"given":"Bashair","family":"Alrashed","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.future.2026.108543_b1","series-title":"2025 Cost of Insider Risks Global Report","author":"Ponemon","year":"2025"},{"key":"10.1016\/j.future.2026.108543_b2","series-title":"Insider Threat Pulse Report 2025: Trends from 100 Security Leaders","author":"Puzic","year":"2025"},{"key":"10.1016\/j.future.2026.108543_b3","series-title":"From Human to Hybrid: How AI and the Analytics Gap Are Fueling Insider Risk","author":"Exabeam","year":"2025"},{"key":"10.1016\/j.future.2026.108543_b4","series-title":"Insider threats, supercharged by AI, set for explosive growth in Australia","author":"Australian Cyber Security Magazine","year":"2025"},{"key":"10.1016\/j.future.2026.108543_b5","series-title":"Deep learning for insider threat detection: Review, challenges and opportunities","author":"Yuan","year":"2020"},{"key":"10.1016\/j.future.2026.108543_b6","doi-asserted-by":"crossref","first-page":"19214","DOI":"10.1038\/s41598-025-04029-w","article-title":"Research on insider threat detection based on personalized federated learning and behavior log analysis","volume":"15","author":"Ye","year":"2025","journal-title":"Sci. Rep."},{"issue":"15","key":"10.1016\/j.future.2026.108543_b7","doi-asserted-by":"crossref","first-page":"5208","DOI":"10.3390\/app10155208","article-title":"A review of insider threat detection: Classification, machine learning techniques, datasets, open challenges, and recommendations","volume":"10","author":"Homoliak","year":"2020","journal-title":"Appl. Sci."},{"key":"10.1016\/j.future.2026.108543_b8","series-title":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","first-page":"1135","article-title":"\u201cWhy should I trust you?\u201d: Explaining the predictions of any classifier","author":"Ribeiro","year":"2016"},{"key":"10.1016\/j.future.2026.108543_b9","series-title":"Advances in Neural Information Processing Systems 30","first-page":"4765","article-title":"A unified approach to interpreting model predictions","author":"Lundberg","year":"2017"},{"issue":"C","key":"10.1016\/j.future.2026.108543_b10","doi-asserted-by":"crossref","first-page":"184","DOI":"10.1016\/j.ins.2014.08.051","article-title":"SMOTE-IPF","volume":"291","author":"S\u00e1ez","year":"2015","journal-title":"Inf. Sci."},{"issue":"1","key":"10.1016\/j.future.2026.108543_b11","article-title":"A perspective on explainable artificial intelligence methods: SHAP and LIME","volume":"7","author":"Ali","year":"2024","journal-title":"Adv. Intell. Syst."},{"key":"10.1016\/j.future.2026.108543_b12","doi-asserted-by":"crossref","first-page":"37370","DOI":"10.1109\/ACCESS.2024.3422319","article-title":"A comparative analysis of LIME and SHAP interpreters with explainable ML-based diabetes predictions","volume":"13","author":"Ahmed","year":"2025","journal-title":"IEEE Access"},{"issue":"1","key":"10.1016\/j.future.2026.108543_b13","doi-asserted-by":"crossref","first-page":"10","DOI":"10.1186\/s40708-024-00222-1","article-title":"Interpreting artificial intelligence models: A systematic review on the application of LIME and SHAP in Alzheimer\u2019s disease detection","volume":"11","author":"Vimbi","year":"2024","journal-title":"Brain Inform."},{"key":"10.1016\/j.future.2026.108543_b14","doi-asserted-by":"crossref","DOI":"10.3389\/frai.2025.1526221","article-title":"A systematic review on the integration of explainable artificial intelligence in intrusion detection systems to enhancing transparency and interpretability in cybersecurity","volume":"8","author":"Mohale","year":"2025","journal-title":"Front. Artif. Intell."},{"issue":"4","key":"10.1016\/j.future.2026.108543_b15","doi-asserted-by":"crossref","first-page":"935","DOI":"10.1016\/j.icte.2024.05.007","article-title":"Explainable AI for cybersecurity automation, intelligence and trustworthiness in digital twin: Methods, taxonomy, challenges and prospects","volume":"10","author":"Sarker","year":"2024","journal-title":"ICT Express"},{"issue":"1","key":"10.1016\/j.future.2026.108543_b16","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1038\/s42256-019-0138-9","article-title":"From local explanations to global understanding with explainable AI for trees","volume":"2","author":"Lundberg","year":"2020","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.future.2026.108543_b17","doi-asserted-by":"crossref","DOI":"10.7717\/peerj-cs.880","article-title":"GPUTreeShap: Massively parallel exact calculation of SHAP scores for tree ensembles","volume":"8","author":"Mitchell","year":"2022","journal-title":"PeerJ Comput. Sci."},{"issue":"21","key":"10.1016\/j.future.2026.108543_b18","doi-asserted-by":"crossref","DOI":"10.3390\/s24216776","article-title":"A novel hybrid XAI solution for autonomous vehicles: Real-time interpretability through LIME\u2013SHAP integration","volume":"24","author":"Tahir","year":"2024","journal-title":"Sensors"},{"key":"10.1016\/j.future.2026.108543_b19","series-title":"2025 IEEE\/ACS 22nd International Conference on Computer Systems and Applications","first-page":"1","article-title":"A scalable framework for insider threat detection: Session modelling and class balancing with xgboost","author":"Faqihi","year":"2025"},{"key":"10.1016\/j.future.2026.108543_b20","series-title":"Algorithms and Architectures for Parallel Processing","first-page":"337","article-title":"LIME-enhanced insider threat detection for distributed security systems","author":"Faqihi","year":"2026"},{"key":"10.1016\/j.future.2026.108543_b21","doi-asserted-by":"crossref","first-page":"30907","DOI":"10.1109\/ACCESS.2024.3369906","article-title":"A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods","volume":"12","author":"Alzaabi","year":"2024","journal-title":"IEEE Access"},{"key":"10.1016\/j.future.2026.108543_b22","series-title":"2024 5th International Conference on Data Intelligence and Cognitive Informatics","first-page":"46","article-title":"Comprehensive review of insider threat detection: Models, datasets, and metrics for effective threat identification","author":"Satya Prasad","year":"2024"},{"key":"10.1016\/j.future.2026.108543_b23","series-title":"2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications","first-page":"2010","article-title":"NLP and neural networks for insider threat detection","author":"Baghalizadeh-Moghadam","year":"2024"},{"key":"10.1016\/j.future.2026.108543_b24","doi-asserted-by":"crossref","first-page":"24715","DOI":"10.1038\/s41598-024-73510-9","article-title":"Comparative evaluation of data imbalance addressing techniques for CNN-based insider threat detection","volume":"14","author":"Al-Shehari","year":"2024","journal-title":"Sci. Rep."},{"key":"10.1016\/j.future.2026.108543_b25","series-title":"Proceedings of the 16th International Conference on Agents and Artificial Intelligence - Volume 3: ICAART","first-page":"283","article-title":"SMOTE: Are we learning to classify or to detect synthetic data?","author":"Boudegzdame","year":"2024"},{"key":"10.1016\/j.future.2026.108543_b26","series-title":"SMOTE: Synthetic minority over-sampling technique","author":"Chawla","year":"2011"},{"key":"10.1016\/j.future.2026.108543_b27","doi-asserted-by":"crossref","first-page":"18726","DOI":"10.1109\/ACCESS.2025.3531662","article-title":"Imbalanced data problem in machine learning: A review","volume":"13","author":"Altalhan","year":"2025","journal-title":"IEEE Access"},{"key":"10.1016\/j.future.2026.108543_b28","doi-asserted-by":"crossref","DOI":"10.1155\/2021\/4148441","article-title":"Detecting insider threat from behavioral logs based on ensemble and self-supervised learning","volume":"2021","author":"Zhang","year":"2021","journal-title":"Secur. Commun. Netw."},{"key":"10.1016\/j.future.2026.108543_b29","series-title":"Insider threat detection via hierarchical neural temporal point processes","author":"Yuan","year":"2019"},{"key":"10.1016\/j.future.2026.108543_b30","series-title":"2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications","first-page":"1249","article-title":"TGCN-DA: A temporal graph convolutional network with data augmentation for high accuracy insider threat detection","author":"Li","year":"2023"},{"key":"10.1016\/j.future.2026.108543_b31","series-title":"2024 International Conference on Engineering and Emerging Technologies","first-page":"1","article-title":"Classifying malicious insider threats based on user activity and behavioral profile using machine learning","author":"Alzaabi","year":"2024"},{"issue":"24","key":"10.1016\/j.future.2026.108543_b32","doi-asserted-by":"crossref","first-page":"13021","DOI":"10.3390\/app132413021","article-title":"Insider threat detection based on deep clustering of multi-source behavioral events","volume":"13","author":"Prasad","year":"2023","journal-title":"Appl. Sci."},{"key":"10.1016\/j.future.2026.108543_b33","series-title":"2022 International Conference on Advances in Computing, Communication and Applied Informatics","first-page":"1","article-title":"Detecting an insider threat and analysis of xgboost using hyperparameter tuning","author":"Mamidanna","year":"2022"},{"key":"10.1016\/j.future.2026.108543_b34","doi-asserted-by":"crossref","first-page":"4741","DOI":"10.1109\/TIFS.2024.3372771","article-title":"Double-layer detection of internal threat in enterprise systems based on deep learning","volume":"19","author":"He","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.future.2026.108543_b35","series-title":"Out-of-core GPU gradient boosting","author":"Ou","year":"2020"},{"key":"10.1016\/j.future.2026.108543_b36","series-title":"A controlled experiment on the impact of intrusion detection false alarm rate on analyst performance","author":"Haq","year":"2023"},{"issue":"4","key":"10.1016\/j.future.2026.108543_b37","doi-asserted-by":"crossref","first-page":"1494","DOI":"10.3390\/s22041494","article-title":"Cyber-attack prediction based on network intrusion detection systems for alert correlation techniques: A survey","volume":"22","author":"Islam","year":"2022","journal-title":"Sensors"},{"key":"10.1016\/j.future.2026.108543_b38","series-title":"Alert fatigue: How to fix SOC overload","author":"Cymulate","year":"2025"},{"issue":"1","key":"10.1016\/j.future.2026.108543_b39","doi-asserted-by":"crossref","DOI":"10.1093\/cybsec\/tyaf041","article-title":"On the fog\u2019s frontline: a federated machine learning approach for industrial network threat detection and intrusion prevention","volume":"11","author":"Ali","year":"2025","journal-title":"J. Cybersecur."},{"key":"10.1016\/j.future.2026.108543_b40","series-title":"Interpretable Machine Learning: A Guide for Making Black Box Models Explainable","author":"Molnar","year":"2022"},{"issue":"8","key":"10.1016\/j.future.2026.108543_b41","first-page":"1","article-title":"Post-hoc interpretability for neural NLP: A survey","volume":"55","author":"Doshi-Velez","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.future.2026.108543_b42","doi-asserted-by":"crossref","DOI":"10.1016\/j.cogsys.2024.101243","article-title":"Post-hoc vs ante-hoc explanations: xAI design guidelines for data scientists","volume":"86","author":"Retzlaff","year":"2024","journal-title":"Cogn. Syst. Res."},{"key":"10.1016\/j.future.2026.108543_b43","series-title":"LIME: Local interpretable model-agnostic explanations","author":"C3.ai","year":"2024"},{"key":"10.1016\/j.future.2026.108543_b44","series-title":"Which LIME should I trust? Concepts, challenges, and solutions","author":"Laugel","year":"2025"},{"issue":"13","key":"10.1016\/j.future.2026.108543_b45","doi-asserted-by":"crossref","first-page":"7329","DOI":"10.3390\/app15137329","article-title":"Explainable AI for forensic analysis: A comparative study of SHAP and LIME in intrusion detection models","volume":"15","author":"Hermosilla","year":"2025","journal-title":"Appl. Sci."},{"key":"10.1016\/j.future.2026.108543_b46","series-title":"2024 Cyber Awareness and Research Symposium","first-page":"1","article-title":"Analysis of network intrusion detection via explainable artificial intelligence: Applications with SHAP and LIME","author":"Uysal","year":"2024"},{"issue":"6","key":"10.1016\/j.future.2026.108543_b47","first-page":"1452","article-title":"AI-driven malware classification using static and dynamic analysis","volume":"13","author":"Sahil","year":"2024","journal-title":"Int. J. Sci. Res."},{"key":"10.1016\/j.future.2026.108543_b48","series-title":"Proceedings of the 2024 15th International Conference on Computing Communication and Networking Technologies","first-page":"1","article-title":"Enhancing online safety: Phishing URL detection using machine learning and explainable AI","author":"Khan","year":"2024"},{"key":"10.1016\/j.future.2026.108543_b49","series-title":"Proceedings of the 11th International Conference on Networking, Systems, and Security","first-page":"179","article-title":"Can features for phishing URL detection be trusted across diverse datasets? A case study with explainable AI","author":"Mia","year":"2024"},{"key":"10.1016\/j.future.2026.108543_b50","series-title":"2025 International Conference on Advanced Computing Technologies","first-page":"1","article-title":"Explainable AI (XAI) using SHAP and LIME for financial fraud detection and credit scoring","author":"Chavakula","year":"2025"},{"key":"10.1016\/j.future.2026.108543_b51","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2025.104326","article-title":"Next-generation AI for advanced threat detection and security enhancement in DNS over HTTPS","volume":"244","author":"Ali","year":"2025","journal-title":"J. Netw. Comput. Appl."},{"issue":"3","key":"10.1016\/j.future.2026.108543_b52","doi-asserted-by":"crossref","first-page":"1154","DOI":"10.3390\/s22031154","article-title":"Classification and explanation for intrusion detection system based on ensemble trees and SHAP method","volume":"22","author":"Lee","year":"2022","journal-title":"Sensors"},{"key":"10.1016\/j.future.2026.108543_b53","doi-asserted-by":"crossref","first-page":"23954","DOI":"10.1109\/ACCESS.2024.3365140","article-title":"E-XAI: Evaluating black-box explainable AI frameworks for network intrusion detection","volume":"12","author":"Arreche","year":"2024","journal-title":"IEEE Access"},{"key":"10.1016\/j.future.2026.108543_b54","doi-asserted-by":"crossref","DOI":"10.7717\/peerj-cs.2289","article-title":"Enhancing intrusion detection performance using explainable ensemble deep learning","volume":"10","author":"Ben Ncir","year":"2024","journal-title":"PeerJ Comput. Sci."},{"key":"10.1016\/j.future.2026.108543_b55","doi-asserted-by":"crossref","first-page":"4512","DOI":"10.1038\/s41467-022-31384-3","article-title":"Explaining a series of models by propagating Shapley values","volume":"13","author":"Chen","year":"2022","journal-title":"Nat. Commun."},{"key":"10.1016\/j.future.2026.108543_b56","doi-asserted-by":"crossref","first-page":"84992","DOI":"10.1109\/ACCESS.2025.3567038","article-title":"Adversarial threats to cloud IDS: Robust defense with adversarial training and feature selection","volume":"13","author":"Holla","year":"2025","journal-title":"IEEE Access"},{"key":"10.1016\/j.future.2026.108543_b57","series-title":"Explaining anomalies detected by autoencoders using SHAP","author":"Anari","year":"2020"},{"key":"10.1016\/j.future.2026.108543_b58","doi-asserted-by":"crossref","first-page":"532","DOI":"10.1037\/a0015808","article-title":"An effect size primer: A guide for clinicians and researchers","volume":"40","author":"J.","year":"2009","journal-title":"Prof. Psychol.: Res. Pr."},{"key":"10.1016\/j.future.2026.108543_b59","doi-asserted-by":"crossref","DOI":"10.1111\/opo.12131","article-title":"When to use the Bonferroni correction","volume":"34","author":"Armstrong","year":"2014","journal-title":"Ophthalmic Physiol. Opt."},{"key":"10.1016\/j.future.2026.108543_b60","doi-asserted-by":"crossref","first-page":"863","DOI":"10.3389\/fpsyg.2013.00863","article-title":"Calculating and reporting effect sizes to facilitate cumulative science: a practical primer for t-tests and ANOVAs","volume":"4","author":"Lakens","year":"2013","journal-title":"Front. Psychol."},{"key":"10.1016\/j.future.2026.108543_b61","series-title":"Common Sense Guide to Mitigating Insider Threats","author":"CERT Insider Threat Center","year":"2016"},{"key":"10.1016\/j.future.2026.108543_b62","doi-asserted-by":"crossref","first-page":"277","DOI":"10.1016\/j.ssresearch.2014.12.004","article-title":"The power of a paired t-test with a covariate","volume":"50","author":"Hedberg","year":"2015","journal-title":"Soc. Sci. Res."},{"key":"10.1016\/j.future.2026.108543_b63","doi-asserted-by":"crossref","first-page":"91","DOI":"10.1186\/1471-2288-13-91","article-title":"The McNemar test for binary matched-pairs data: Mid-p and asymptotic are better than exact conditional","volume":"13","author":"Fagerland","year":"2013","journal-title":"BMC Med. Res. Methodol."},{"key":"10.1016\/j.future.2026.108543_b64","series-title":"2025 8th International Conference on Trends in Electronics and Informatics","first-page":"1254","article-title":"A hybrid deep learning approach to network traffic anomaly detection enhanced by SHAP and LIME interpretability","author":"Verma","year":"2025"},{"key":"10.1016\/j.future.2026.108543_b65","article-title":"Proactive and privacy-preserving defense for DNS over HTTPS via federated AI attestation (PAFA-DoH)","volume":"196","author":"Ali","year":"2026","journal-title":"Neural Netw."},{"issue":"35","key":"10.1016\/j.future.2026.108543_b66","article-title":"Neuromorphic quantum adversarial learning (NQAL): a bio-inspired paradigm for DNS over HTTPS threat detection","volume":"2025","author":"Ali","year":"2025","journal-title":"EURASIP J. Inf. Secur."},{"key":"10.1016\/j.future.2026.108543_b67","doi-asserted-by":"crossref","DOI":"10.1016\/j.ijar.2023.109112","article-title":"On the failings of Shapley values for explainability","volume":"171","author":"Huang","year":"2024","journal-title":"Internat. J. Approx. Reason."},{"key":"10.1016\/j.future.2026.108543_b68","doi-asserted-by":"crossref","first-page":"1","DOI":"10.23919\/JSEE.2026.000049","article-title":"AIGC video detection based on the fusion of spatial-frequency-optical flow multimodal features","volume":"PP","author":"Sheng","year":"2026","journal-title":"J. Syst. Eng. Electron."},{"key":"10.1016\/j.future.2026.108543_b69","series-title":"Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence","article-title":"Diff-LMM: diffusion teacher-guided spatio-temporal perception for video large multimodal models","author":"Dang","year":"2025"}],"container-title":["Future Generation Computer Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X26001779?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X26001779?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T13:48:29Z","timestamp":1780408109000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167739X26001779"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":69,"alternative-id":["S0167739X26001779"],"URL":"https:\/\/doi.org\/10.1016\/j.future.2026.108543","relation":{},"ISSN":["0167-739X"],"issn-type":[{"value":"0167-739X","type":"print"}],"subject":[],"published":{"date-parts":[[2026,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Towards trustworthy cybersecurity: Reclassifying insider threat detection using SHAP","name":"articletitle","label":"Article Title"},{"value":"Future Generation Computer Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.future.2026.108543","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"108543"}}