{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,15]],"date-time":"2026-07-15T02:07:30Z","timestamp":1784081250282,"version":"3.55.0"},"reference-count":145,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2018]]},"DOI":"10.1109\/comst.2018.2800740","type":"journal-article","created":{"date-parts":[[2018,2,1]],"date-time":"2018-02-01T19:18:21Z","timestamp":1517512701000},"page":"1397-1417","source":"Crossref","is-referenced-by-count":338,"title":["Detecting and Preventing Cyber Insider Threats: A Survey"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7959-6764","authenticated-orcid":false,"given":"Liu","family":"Liu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Olivier","family":"De Vel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7207-0716","authenticated-orcid":false,"given":"Qing-Long","family":"Han","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5252-0831","authenticated-orcid":false,"given":"Yang","family":"Xiang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2107320"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/NPSEC.2007.4371618"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.07.021"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2013.32"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495972"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/SMCSIA.2003.1232400"},{"key":"ref37","first-page":"139","article-title":"BotMiner: Clustering analysis of network traffic for protocol-and structure-independent botnet detection","volume":"5","author":"gu","year":"2008","journal-title":"Proc Usenix Security Symp"},{"key":"ref36","first-page":"1","article-title":"Peer-to-peer botnets: Overview and case study","volume":"7","author":"grizzard","year":"2007","journal-title":"Proc of HotBots"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.04.007"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CIT.2007.90"},{"key":"ref28","author":"crenshaw","year":"2011","journal-title":"Plug and Prey Malicious USB Devices"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.21236\/ADA610587"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382284"},{"key":"ref20","first-page":"10","article-title":"A case study of the rustock rootkit and spam bot","volume":"7","author":"chiang","year":"2007","journal-title":"Proc of HotBots"},{"key":"ref22","first-page":"6","author":"falliere","year":"2011","journal-title":"W32 stuxnet Dossier"},{"key":"ref21","author":"sikorski","year":"2012","journal-title":"Practical Malware Analysis The Hands-On Guide to Dissecting Malicious Software"},{"key":"ref24","first-page":"4","article-title":"The ghost in the browser: Analysis of Web-based malware","volume":"7","author":"provos","year":"2007","journal-title":"Proc of HotBots"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.10.014"},{"key":"ref101","article-title":"BotSniffer: Detecting botnet command and control channels in network traffic","author":"gu","year":"2008","journal-title":"Proc 15th Annu Netw Distrib Syst Secur Symp"},{"key":"ref26","first-page":"1","article-title":"Designing and implementing malicious hardware","volume":"8","author":"king","year":"2008","journal-title":"Proc lEE"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/ccnc08.2007.112"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/2435349.2435366"},{"key":"ref50","author":"garg","year":"2006","journal-title":"Sysenter Based System Call Mechanism in Linux 2 6"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1996.502675"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2001.932213"},{"key":"ref58","first-page":"52","article-title":"System level user behavior biometrics using fisher features and Gaussian mixture models","author":"song","year":"2013","journal-title":"Proc IEEE Secur Privacy Workshops (SPW)"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2007.70207"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/34.62613"},{"key":"ref55","first-page":"62","article-title":"An approach to UNIX security logging","author":"axelsson","year":"1998","journal-title":"Proc 21st Nat Inf Syst Security Conf"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495997"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/PASSAT\/SocialCom.2011.211"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/52.605929"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/1555349.1555352"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-77322-3_5"},{"key":"ref3","article-title":"An insider threat indicator ontology","author":"costa","year":"2016"},{"key":"ref6","author":"collins","year":"2016","journal-title":"Common Sense Guide to Mitigating Insider Threats"},{"key":"ref5","year":"2014","journal-title":"Unintentional Insider Threats A Review of Phishing and Malware Incidents by Economic Sector"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/2809806"},{"key":"ref7","first-page":"80","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume":"1","author":"hutchins","year":"0"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2013.2295802"},{"key":"ref46","author":"antonakakis","year":"2010","journal-title":"The Command Structure of the Aurora Botnet"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TCC.2014.2359460"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0092-2"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/MITP.2010.52"},{"key":"ref42","first-page":"1","article-title":"Case study of the miner botnet","author":"plohmann","year":"2012","journal-title":"Proc Conf Cyber Conflict"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/1764873.1764877"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2014.2315619"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/1029146.1029154"},{"key":"ref127","year":"2017","journal-title":"The Cert Insider Threat Database | The Cert Division"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1177\/088626000015003006"},{"key":"ref125","doi-asserted-by":"crossref","first-page":"11","DOI":"10.1080\/07421222.2002.11045718","article-title":"Enterprise resource planning","volume":"19","author":"ragowsky","year":"2002","journal-title":"J Manag Inf Syst"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.5038\/1944-0472.4.2.2"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2003.1254307"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/322510.322526"},{"key":"ref129","author":"creech","year":"2013","journal-title":"The ADFA Intrusion Detection Datasets"},{"key":"ref71","first-page":"366","article-title":"An application of machine learning to anomaly detection","volume":"377","author":"lane","year":"1997","journal-title":"Proc 20th Nat Inf Syst Security Conf"},{"key":"ref128","year":"2017","journal-title":"Computer Immune Systems - Data Sets and Software"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.3390\/fi8030029"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1198\/10618600152628068"},{"key":"ref130","year":"2017","journal-title":"UCI Machine Learning Repository UNIX User Data Set"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1016\/S0020-0190(00)00122-8"},{"key":"ref74","first-page":"404","article-title":"A comparison of test statistics for computer intrusion detection based on principal components regression of transition probabilities","author":"dumouchel","year":"1998","journal-title":"Proc Comput Sci Statist"},{"key":"ref75","article-title":"Computer intrusion detection based on Bayes factors for comparing command transition probabilities","author":"dumouchel","year":"1999"},{"key":"ref133","author":"cappelli","year":"2009","journal-title":"Common Sense Guide to Prevention and Detection of Insider Threats 3rd Edition–Version 3 1"},{"key":"ref134","article-title":"Research and development initiatives focused on preventing, detecting, and responding to insider misuse of critical defense information systems","author":"anderson","year":"1999"},{"key":"ref131","author":"tavallaee","year":"2009","journal-title":"NSL-KDD | Dataset | Research | Canadian Institute for Cybersecurity | UNB"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2002.1028903"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-94"},{"key":"ref79","first-page":"3","article-title":"Detecting masqueraders: A comparison of one-class bag-of-words user behavior modeling techniques","volume":"1","author":"salem","year":"2010","journal-title":"J Wireless Mobile Netw Ubiquitous Comput Dependable Appl"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/TCE.2004.1309441"},{"key":"ref135","first-page":"4","article-title":"Insiders and insider threats–an overview of definitions and mitigation techniques","volume":"2","author":"hunker","year":"2011","journal-title":"J Wireless Mobile Netw Ubiquitous Comput Dependable Appl"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180418"},{"key":"ref137","first-page":"147","article-title":"Addressing insider threat using ‘where you are’ as fourth factor authentication","author":"choi","year":"2012","journal-title":"Security Technology (ICCST)"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2009.4804323"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-7133-3_8"},{"key":"ref62","first-page":"51","article-title":"Learning program behavior profiles for intrusion detection","author":"ghosh","year":"1999","journal-title":"Proc Workshop on Intrusion Detection and Network Monitoring Proceedings"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.1998.738646"},{"key":"ref63","first-page":"137","article-title":"Deep learning for classification of malware system call sequences","author":"kolosnjaji","year":"2016","journal-title":"Proc Aust Joint Conf Artif Intell"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/QRS.2015.26"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.08.001"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(02)00514-X"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2013.138"},{"key":"ref66","first-page":"51","article-title":"Using text categorization techniques for intrusion detection","volume":"12","author":"liao","year":"2002","journal-title":"Proc Usenix Security Symp"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/NCIA.2013.6725337"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11698-3_44"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1023\/A:1009761603038"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/FSKD.2014.6980972"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1016\/j.ress.2012.12.021"},{"key":"ref2","year":"2015","journal-title":"Clearswift Insider Threat Index (CITI)"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-980109"},{"key":"ref145","year":"2017","journal-title":"CIM | DMTF"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2017.10.009"},{"key":"ref109","author":"villeneuve","year":"2012","journal-title":"Detecting APT Activity With Network Traffic Analysis"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1002\/047120644X"},{"key":"ref108","author":"binde","year":"2011","journal-title":"Assessing Outbound Traffic to Uncover Advanced Persistent Threat"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523670"},{"key":"ref107","article-title":"ExFILD: A tool for the detection of data exfiltration using entropy and encryption characteristics of network traffic","author":"fawcett","year":"2010"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2013.32"},{"key":"ref106","first-page":"1","article-title":"SIDD: A framework for detecting sensitive data exfiltration by an insider attack","author":"liu","year":"2009","journal-title":"Proc Syst Sci"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/2487575.2488213"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420969"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2012.98"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2012.6461004"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcss.2012.11.004"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_1"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2006.322100"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2014.2320577"},{"key":"ref112","year":"1999","journal-title":"KDD Cup 1999 Computer network intrusion detection"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/1978672.1978682"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-8667.2004.00360.x"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/637209.637210"},{"key":"ref96","author":"so-in","year":"2009","journal-title":"A Survey of Network Traffic Monitoring and Analysis Tools"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1145\/1030194.1015492"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15152-1_3"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2012.29"},{"key":"ref12","author":"kim","year":"2016","journal-title":"Fundamentals of Information Security"},{"key":"ref13","year":"2016","journal-title":"Penetration Testing Intelligence Gathering"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1093\/comjnl\/bxr035"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/0-387-24230-9_9"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1145\/1558607.1558670"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.27"},{"key":"ref82","first-page":"5","article-title":"Predicting sequences of user actions","author":"davison","year":"1998","journal-title":"Proc Notes AAAI\/ICML Workshop Predict Future AI Approaches Time-Series Anal"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.21236\/ADA610463"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/PRDC.2007.55"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-015-1669-6"},{"key":"ref18","author":"hadnagy","year":"2010","journal-title":"Social Engineering The Art of Human Hacking"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014084"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1080\/19361610.2011.529413"},{"key":"ref19","author":"shamir","year":"2015","journal-title":"The 7 ‘Most Common’ Rats in Use Today"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-0135-2_34"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2012.2223675"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-23461-8_6"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1002\/sec.311"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2013.307"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.24251\/HICSS.2017.319"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30143-1_11"},{"key":"ref121","article-title":"Deep learning for unsupervised insider threat detection in structured cybersecurity data streams","author":"tuor","year":"2017","journal-title":"Proc AI Cybersecurity Workshop AAAI"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74320-0_8"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2011.231"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/2808769.2808773"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/65.283931"},{"key":"ref87","first-page":"229","article-title":"Snort–lightweight intrusion detection for networks","volume":"99","author":"roesch","year":"1999","journal-title":"Proc LISA"},{"key":"ref88","author":"northcutt","year":"2002","journal-title":"Network Intrusion Detection"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/8362823\/08278157.pdf?arnumber=8278157","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,12]],"date-time":"2022-01-12T16:11:38Z","timestamp":1642003898000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8278157\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018]]},"references-count":145,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/comst.2018.2800740","relation":{},"ISSN":["1553-877X"],"issn-type":[{"value":"1553-877X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018]]}}}