{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T15:39:45Z","timestamp":1772120385458,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":28,"publisher":"ACM","license":[{"start":{"date-parts":[[2013,8,11]],"date-time":"2013-08-11T00:00:00Z","timestamp":1376179200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2013,8,11]]},"DOI":"10.1145\/2487575.2488213","type":"proceedings-article","created":{"date-parts":[[2013,8,13]],"date-time":"2013-08-13T12:31:21Z","timestamp":1376397081000},"page":"1393-1401","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":84,"title":["Detecting insider threats in a real corporate database of computer usage activity"],"prefix":"10.1145","author":[{"given":"Ted E.","family":"Senator","sequence":"first","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"Henry G.","family":"Goldberg","sequence":"additional","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"Alex","family":"Memory","sequence":"additional","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"William T.","family":"Young","sequence":"additional","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"Brad","family":"Rees","sequence":"additional","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"Robert","family":"Pierce","sequence":"additional","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"Daniel","family":"Huang","sequence":"additional","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"Matthew","family":"Reardon","sequence":"additional","affiliation":[{"name":"SAIC, Arlington, VA, USA"}]},{"given":"David A.","family":"Bader","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Edmond","family":"Chow","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Irfan","family":"Essa","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Joshua","family":"Jones","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Vinay","family":"Bettadapura","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Duen Horng","family":"Chau","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Oded","family":"Green","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Oguz","family":"Kaya","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Anita","family":"Zakrzewska","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Erica","family":"Briscoe","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Rudolph IV L.","family":"Mappus","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Robert","family":"McColl","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Lora","family":"Weiss","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Thomas G.","family":"Dietterich","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}]},{"given":"Alan","family":"Fern","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}]},{"given":"Weng--Keen","family":"Wong","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}]},{"given":"Shubhomoy","family":"Das","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}]},{"given":"Andrew","family":"Emmott","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}]},{"given":"Jed","family":"Irvine","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}]},{"given":"Jay-Yoon","family":"Lee","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}]},{"given":"Danai","family":"Koutra","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}]},{"given":"Christos","family":"Faloutsos","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}]},{"given":"Daniel","family":"Corkill","sequence":"additional","affiliation":[{"name":"University of Massachusetts, Amherst, MA, USA"}]},{"given":"Lisa","family":"Friedland","sequence":"additional","affiliation":[{"name":"University of Massachusetts, Amherst, MA, USA"}]},{"given":"Amanda","family":"Gentzel","sequence":"additional","affiliation":[{"name":"University of Massachusetts, Amherst, MA, USA"}]},{"given":"David","family":"Jensen","sequence":"additional","affiliation":[{"name":"University of Massachusetts, Amherst, MA, USA"}]}],"member":"320","published-online":{"date-parts":[[2013,8,11]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Technical Report","author":"Bader D.A.","year":"2009","unstructured":"Bader , D.A. , 2009 . STINGER: Spatio-Temporal Interaction Networks and Graphs (STING) Extensible Representation . Technical Report , May 8, 2009. Bader, D.A., et al. 2009. STINGER: Spatio-Temporal Interaction Networks and Graphs (STING) Extensible Representation. Technical Report, May 8, 2009."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2013.338"},{"key":"e_1_3_2_1_3_1","unstructured":"Capelli D. Moore A. and Trzeciak R. 2012. The CERT Guide to Insider Threats. Addison Wesley Boston MA   Capelli D. Moore A. and Trzeciak R. 2012. The CERT Guide to Insider Threats. Addison Wesley Boston MA"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1978942.1978967"},{"key":"e_1_3_2_1_5_1","volume-title":"Anomaly Detection with Ensembles of Statistical Models","author":"Das S.","unstructured":"Das , S. , Emmott , A. , Dietterich , T. G. , Wong , W-K , Fern , A. 2013. Anomaly Detection with Ensembles of Statistical Models . Technical Report , Oregon State University . Das, S., Emmott, A., Dietterich, T. G., Wong, W-K, Fern, A. 2013. Anomaly Detection with Ensembles of Statistical Models. Technical Report, Oregon State University."},{"key":"e_1_3_2_1_6_1","volume-title":"Anomaly Detection at Multiple Scales","author":"Defense Advanced Research Projects Agency 2010.","unstructured":"Defense Advanced Research Projects Agency 2010. Anomaly Detection at Multiple Scales ( ADAMS) Broad Agency Announcement DARPA-BAA- 11-04. Arlington VA. Defense Advanced Research Projects Agency 2010. Anomaly Detection at Multiple Scales (ADAMS) Broad Agency Announcement DARPA-BAA-11-04. Arlington VA."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.2517-6161.1977.tb01600.x"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.5555\/648054.743935"},{"key":"e_1_3_2_1_9_1","volume-title":"STINGER: High Performance Data Structure for Streaming Graphs. IEEE High Performance Extreme Computing Conference (HPEC)","author":"Ediger D.","year":"2012","unstructured":"Ediger , D. , 2012 . STINGER: High Performance Data Structure for Streaming Graphs. IEEE High Performance Extreme Computing Conference (HPEC) , Waltham, MA , September 10-12, 2012. Ediger, D., et al. 2012. STINGER: High Performance Data Structure for Streaming Graphs. IEEE High Performance Extreme Computing Conference (HPEC), Waltham, MA, September 10-12, 2012."},{"key":"e_1_3_2_1_10_1","volume-title":"Faster Betweenness Centrality Based on Data Structure Experimentation. 13th International Conference on Computational Science (ICCS).","author":"Green O.","year":"2013","unstructured":"Green , O. , Bader , D.A. 2013 . Faster Betweenness Centrality Based on Data Structure Experimentation. 13th International Conference on Computational Science (ICCS). Green, O., Bader, D.A. 2013. Faster Betweenness Centrality Based on Data Structure Experimentation. 13th International Conference on Computational Science (ICCS)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SocialCom-PASSAT.2012.37"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.artint.2009.05.002"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"crossref","unstructured":"Hastie T. Tibshirani R. and Friedman J. 2008 The Elements of Statistical Learning (2nd edition). Springer-Verlag.  Hastie T. Tibshirani R. and Friedman J. 2008 The Elements of Statistical Learning (2nd edition). Springer-Verlag.","DOI":"10.1007\/978-0-387-84858-7"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.5555\/3120828.3120883"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2013.37"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"crossref","unstructured":"Mappus R. and Briscoe E. 2013. Layered Behavioral Trace Modeling for Threat Detection. IEEE Intelligence and Security Informatics.  Mappus R. and Briscoe E. 2013. Layered Behavioral Trace Modeling for Threat Detection. IEEE Intelligence and Security Informatics.","DOI":"10.1109\/ISI.2013.6578813"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/1248547.1248582"},{"key":"e_1_3_2_1_19_1","volume-title":"Proceedings of the Workshop on Activity Context System Architectures","author":"Memory A.","unstructured":"Memory , A. et al. 2013. Context-Aware Insider Threat Detection . Proceedings of the Workshop on Activity Context System Architectures . Bellevue, WA. Memory, A. et al. 2013. Context-Aware Insider Threat Detection. Proceedings of the Workshop on Activity Context System Architectures. Bellevue, WA."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"crossref","unstructured":"Neal R. and Hinton G. E. 1998. A view of the EM algorithm that justifies incremental sparse and other variants. In Learning in Graphical Models (pp. 355--368) Kluwer Academic Publishers.   Neal R. and Hinton G. E. 1998. A view of the EM algorithm that justifies incremental sparse and other variants. In Learning in Graphical Models (pp. 355--368) Kluwer Academic Publishers.","DOI":"10.1007\/978-94-011-5014-9_12"},{"key":"e_1_3_2_1_21_1","unstructured":"Raytheon Corporation 2010. SureView\u2122 Proactive Endpoint Information Protection DOI= http:\/\/www.raytheon.com\/capabilities\/rtnwcm\/groups\/iis\/documents\/content\/rtn_iis_sureview_datasheet.pdf  Raytheon Corporation 2010. SureView\u2122 Proactive Endpoint Information Protection DOI= http:\/\/www.raytheon.com\/capabilities\/rtnwcm\/groups\/iis\/documents\/content\/rtn_iis_sureview_datasheet.pdf"},{"key":"e_1_3_2_1_22_1","unstructured":"Ridgeway G. 2005. Generalized boosted models: A guide to the gbm package. DOI= http:\/\/cran.r-project.org\/web\/packages\/gbm\/vignettes\/gbm.pdf.  Ridgeway G. 2005. Generalized boosted models: A guide to the gbm package. DOI= http:\/\/cran.r-project.org\/web\/packages\/gbm\/vignettes\/gbm.pdf."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPSW.2013.229"},{"key":"e_1_3_2_1_24_1","unstructured":"Riedy J. Bader et al. 2011 Detecting Communities from Given Seeds in Social Networks. CSE Technical Report GA Inst. of Technology.  Riedy J. Bader et al. 2011 Detecting Communities from Given Seeds in Social Networks. CSE Technical Report GA Inst. of Technology."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPSW.2012.203"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2005.102"},{"key":"e_1_3_2_1_27_1","volume-title":"Presidential Memorandum -- National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs. Retrieved","author":"The White House","year":"2013","unstructured":"The White House 2012. Presidential Memorandum -- National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs. Retrieved February 1, 2013 from http:\/\/www.whitehouse.gov\/the-press-office\/2012\/11\/21\/presidential-memorandum-national-insider-threat-policy-and-minimum-stand The White House 2012. Presidential Memorandum -- National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs. Retrieved February 1, 2013 from http:\/\/www.whitehouse.gov\/the-press-office\/2012\/11\/21\/presidential-memorandum-national-insider-threat-policy-and-minimum-stand"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2013.32"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1201\/b12207"}],"event":{"name":"KDD' 13: The 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","location":"Chicago Illinois USA","acronym":"KDD' 13","sponsor":["SIGMOD ACM Special Interest Group on Management of Data","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data"]},"container-title":["Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2487575.2488213","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2487575.2488213","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T08:39:29Z","timestamp":1750235969000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2487575.2488213"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,8,11]]},"references-count":28,"alternative-id":["10.1145\/2487575.2488213","10.1145\/2487575"],"URL":"https:\/\/doi.org\/10.1145\/2487575.2488213","relation":{},"subject":[],"published":{"date-parts":[[2013,8,11]]},"assertion":[{"value":"2013-08-11","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}