{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T05:49:48Z","timestamp":1782107388120,"version":"3.54.5"},"reference-count":33,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100012165","name":"Key Technologies Research and Development Program","doi-asserted-by":"publisher","award":["No.2023YFC2206402"],"award-info":[{"award-number":["No.2023YFC2206402"]}],"id":[{"id":"10.13039\/501100012165","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Insiders threats typically originate from authorized personnel who are familiar with the organization\u2019s insider security measures. They typically hide within vast amounts of normal operational logs, characterized by their covert nature, complexity, and diversity. These attributes make insider threat detection one of the most challenging tasks in cybersecurity protection for enterprises and organizations. Current methods for insider threat detection primarily fall into two categories: traditional machine learning methods and deep learning methods. Machine learning methods typically rely on feature engineering to extract features, which are then processed by shallow models. Deep learning methods typically operate by either feeding user feature vectors into neural networks or by analyzing chronological behavior sequences from user logs with time series models to detect insider threats. However, existing methods frequently ignore the multi-scale periodicity inherent in user behaviors and do not adequately leverage absolute timestamp data from logs. Furthermore, they typically categorize behaviors coarsely as normal or anomalous, which fails to achieve precise identification of distinct insider threat types. To address these limitations, we propose BTITD, a dual-stream network for insider threat detection. BTITD first processes user behavior logs into two parallel sequences: a behavior sequence and a timestamp sequence. The behavior sequence is transformed via Fourier transform, folded into two-dimensional tensors based on key periods, and processed with two-dimensional convolutions to extract multi-scale periodic patterns. Meanwhile, the timestamp sequence is modeled by a BiLSTM network to capture long-range temporal dependencies. Finally, an attention mechanism fuses the representations from both streams to achieve accurate detection. A series of experiments on the CERT 4.2 dataset demonstrate that BTITD outperforms baseline methods in both binary and multi-class detection tasks. BTITD achieves an F1 score of 97.56% for binary detection and a macro-F1 score of 94.66% for multi-class detection.<\/jats:p>","DOI":"10.1186\/s42400-026-00591-6","type":"journal-article","created":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T05:44:13Z","timestamp":1782107053000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["BTITD: an insider threat detection method based on behavior-timestamp dual-stream network"],"prefix":"10.1186","volume":"9","author":[{"given":"Chen","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guang","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tian","family":"Tian","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bo","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhigang","family":"Lu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tao","family":"Guo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,6,22]]},"reference":[{"key":"591_CR1","unstructured":"Costa DL, Albrethsen MJ, Collins ML, Perl SJ, Silowash GJ, Spooner DL (2016) An insider threat indicator ontology. CERT Center and Carnegie Mellon University Software Engineering Institute (http:\/\/resources. sei. cmu. edu\/asset_files\/TechnicalReport\/2016_005_001_454627. pdf)"},{"key":"591_CR2","doi-asserted-by":"publisher","DOI":"10.1016\/j.aei.2025.103622","volume":"68","author":"Y Ding","year":"2025","unstructured":"Ding Y, Li Z, Zhou N (2025) Quantum generative adversarial network based on the quantum born machine. Adv Eng Inform 68:103622","journal-title":"Adv Eng Inform"},{"key":"591_CR3","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.123533","volume":"249","author":"R Gayathri","year":"2024","unstructured":"Gayathri R, Sajjanhar A, Xiang Y (2024) Hybrid deep learning model using spcagan augmentation for insider threat analysis. Expert Syst Appl 249:123533","journal-title":"Expert Syst Appl"},{"issue":"10","key":"591_CR4","doi-asserted-by":"publisher","first-page":"2500224","DOI":"10.1002\/qute.202500224","volume":"8","author":"L-H Gong","year":"2025","unstructured":"Gong L-H, Chen Y-Q, Zhou S, Zeng Q-W (2025) Dual discriminators quantum generation adversarial network based on quantum convolutional neural network. Adv Quant Technol 8(10):2500224","journal-title":"Adv Quant Technol"},{"issue":"2","key":"591_CR5","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1007\/s12293-025-00463-5","volume":"17","author":"X He","year":"2025","unstructured":"He X, Gong L, Zhou N (2025) Image denoising with hybrid classical-quantum convolutional neural network: X. he et al. Memetic Comput 17(2):23","journal-title":"Memetic Comput"},{"issue":"19","key":"591_CR6","doi-asserted-by":"publisher","first-page":"4018","DOI":"10.3390\/app9194018","volume":"9","author":"J Kim","year":"2019","unstructured":"Kim J, Park M, Kim H, Cho S, Kang P (2019) Insider threat detection based on user behavior modeling and anomaly detection algorithms. Appl Sci 9(19):4018","journal-title":"Appl Sci"},{"key":"591_CR7","doi-asserted-by":"crossref","unstructured":"Kong K, Jin X, Liu D, Xu S, Liu Z, Geng G (2025) Dpi-itd: A dual-perspective information-driven framework for insider threat detection in iot systems. IEEE Internet of Things Journal","DOI":"10.1109\/JIOT.2025.3589636"},{"issue":"1","key":"591_CR8","doi-asserted-by":"publisher","first-page":"207","DOI":"10.1038\/s41598-024-84673-w","volume":"15","author":"HM Kotb","year":"2025","unstructured":"Kotb HM, Gaber T, AlJanah S, Zawbaa HM, Alkhathami M (2025) A novel deep synthesis-based insider intrusion detection (ds-iid) model for malicious insiders and ai-generated threats. Sci Rep 15(1):207","journal-title":"Sci Rep"},{"issue":"1","key":"591_CR9","doi-asserted-by":"publisher","first-page":"30","DOI":"10.1109\/TNSM.2020.2967721","volume":"17","author":"DC Le","year":"2020","unstructured":"Le DC, Zincir-Heywood N, Heywood MI (2020) Analyzing data granularity levels for insider threat detection using machine learning. IEEE Trans Netw Serv Manage 17(1):30\u201344","journal-title":"IEEE Trans Netw Serv Manage"},{"key":"591_CR10","doi-asserted-by":"crossref","unstructured":"Legg PA, Buckley O, Goldsmith M, Creese S (2015) Caught in the act of an insider attack: detection and assessment of insider threat. In: 2015 IEEE International Symposium on Technologies for Homeland Security (HST), 1\u20136. IEEE","DOI":"10.1109\/THS.2015.7446229"},{"key":"591_CR11","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104387","volume":"154","author":"H Liu","year":"2025","unstructured":"Liu H, Liu M, Han L, Sun H, Fu C (2025) Ripple2detect: a semantic similarity learning based framework for insider threat multi-step evidence detection. Computers & Security 154:104387","journal-title":"Computers & Security"},{"key":"591_CR12","doi-asserted-by":"crossref","unstructured":"Ma Q, Rastogi N (2020) Dante: Predicting insider threat using lstm on system logs. In: 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 1151\u20131156. IEEE","DOI":"10.1109\/TrustCom50675.2020.00153"},{"key":"591_CR13","unstructured":"Nie Y, Nguyen NH, Sinthong P, Kalagnanam J (2022) A time series is worth 64 words: Long-term forecasting with transformers. arXiv preprint arXiv:2211.14730"},{"key":"591_CR14","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.119925","volume":"224","author":"P Pal","year":"2023","unstructured":"Pal P, Chattopadhyay P, Swarnkar M (2023) Temporal feature aggregation with attention for insider threat detection from activity logs. Expert Syst Appl 224:119925","journal-title":"Expert Syst Appl"},{"key":"591_CR15","doi-asserted-by":"crossref","unstructured":"Rauf U, Wei Z, Mohsen F (2023) Employee watcher: a machine learning-based hybrid insider threat detection framework. In: 2023 7th Cyber Security in Networking Conference (CSNet), 39\u201345. IEEE","DOI":"10.1109\/CSNet59123.2023.10339777"},{"key":"591_CR16","unstructured":"Securonix: 2024 INSIDER THREAT REPORT. https:\/\/www.cybersecurity-insiders.com\/portfolio\/2024-insider-threat-report-securonix\/"},{"key":"591_CR17","doi-asserted-by":"crossref","unstructured":"Sharma B, Pokharel P, Joshi B (2020) User behavior analytics for anomaly detection using lstm autoencoder-insider threat detection. In: Proceedings of the 11th International Conference on Advances in Information Technology, 1\u20139","DOI":"10.1145\/3406601.3406610"},{"key":"591_CR18","unstructured":"Song C, Zheng J (2025) Insight-llm: Llm-enhanced multi-view fusion in insider threat detection. arXiv preprint arXiv:2509.01509"},{"key":"591_CR19","unstructured":"Song S, Zhang Y, Gao N (2025) Confront insider threat: Precise anomaly detection in behavior logs based on llm fine-tuning. In: Proceedings of the 31st International Conference on Computational Linguistics, 8589\u20138601"},{"issue":"1","key":"591_CR20","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1186\/s42400-023-00190-9","volume":"7","author":"S Song","year":"2024","unstructured":"Song S, Gao N, Zhang Y, Ma C (2024) Britd: behavior rhythm insider threat detection with time awareness and user adaptation. Cybersecurity 7(1):2","journal-title":"Cybersecurity"},{"key":"591_CR21","doi-asserted-by":"crossref","unstructured":"Sudha D, Anju A, Ezhilarasi K (2025) Enhanced deep learning and quantum variational classifier for large-scale data analysis. Knowledge-Based Systems, 114611","DOI":"10.1016\/j.knosys.2025.114611"},{"key":"591_CR22","doi-asserted-by":"crossref","unstructured":"Sun D, Liu M, Li M, Shi Z, Liu P, Wang X (2021) Deepmit: a novel malicious insider threat detection framework based on recurrent neural network. In: 2021 IEEE 24th International Conference on Computer Supported Cooperative Work in Design (CSCWD), 335\u2013341. IEEE","DOI":"10.1109\/CSCWD49262.2021.9437887"},{"issue":"5","key":"591_CR23","doi-asserted-by":"publisher","first-page":"1680","DOI":"10.1007\/s11036-020-01656-7","volume":"29","author":"Z Tian","year":"2024","unstructured":"Tian Z, Shi W, Tan Z, Qiu J, Sun Y, Jiang F, Liu Y (2024) Deep learning and dempster-shafer theory based insider threat detection. Mobile Netw Appl 29(5):1680\u20131689","journal-title":"Mobile Netw Appl"},{"key":"591_CR24","unstructured":"Tuor A, Kaplan S, Hutchinson B, Nichols N, Robinson S (2017) Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. arxiv 2017. arXiv preprint arXiv:1710.00811"},{"key":"591_CR25","unstructured":"Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser \u0141, Polosukhin I (2017) Attention is all you need. Advances in neural information processing systems 30"},{"key":"591_CR26","doi-asserted-by":"publisher","first-page":"114013","DOI":"10.1109\/ACCESS.2023.3324371","volume":"11","author":"ZQ Wang","year":"2023","unstructured":"Wang ZQ, El Saddik A (2023) Dtitd: an intelligent insider threat detection framework based on digital twin and self-attention based deep learning models. IEEE access 11:114013\u2013114030","journal-title":"IEEE access"},{"key":"591_CR27","unstructured":"Wu H, Hu T, Liu Y, Zhou H, Wang J, Long M (2022) Timesnet: Temporal 2d-variation modeling for general time series analysis. arXiv preprint arXiv:2210.02186"},{"key":"591_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103665","volume":"138","author":"H Xiao","year":"2024","unstructured":"Xiao H, Zhu Y, Zhang B, Lu Z, Du D, Liu Y (2024) Unveiling shadows: a comprehensive framework for insider threat detection based on statistical and sequential analysis. Computers & Security 138:103665","journal-title":"Computers & Security"},{"issue":"1","key":"591_CR29","doi-asserted-by":"publisher","first-page":"17","DOI":"10.5391\/IJFIS.2020.20.1.17","volume":"20","author":"X Ye","year":"2020","unstructured":"Ye X, Hong S-S, Han M-M (2020) Feature engineering method using double-layer hidden markov model for insider threat detection. International J Fuzzy Logic Intell Syst 20(1):17\u201325","journal-title":"International J Fuzzy Logic Intell Syst"},{"key":"591_CR30","doi-asserted-by":"crossref","unstructured":"Yuan S, Zheng P, Wu X, Li Q (2019) Insider threat detection via hierarchical neural temporal point processes. In: 2019 IEEE International Conference on Big Data (big Data), 1343\u20131350. IEEE","DOI":"10.1109\/BigData47090.2019.9005589"},{"key":"591_CR31","unstructured":"Zhang Y, Yan J (2023) Crossformer: Transformer utilizing cross-dimension dependency for multivariate time series forecasting. In: The Eleventh International Conference on Learning Representations"},{"key":"591_CR32","doi-asserted-by":"crossref","unstructured":"Zhou H, Zhang S, Peng J, Zhang S, Li J, Xiong H, Zhang W (2021) Informer: Beyond efficient transformer for long sequence time-series forecasting. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, pp. 11106\u201311115","DOI":"10.1609\/aaai.v35i12.17325"},{"key":"591_CR33","doi-asserted-by":"publisher","first-page":"12677","DOI":"10.52202\/068431-0921","volume":"35","author":"T Zhou","year":"2022","unstructured":"Zhou T, Ma Z, Wen Q, Sun L, Yao T, Yin W, Jin R et al (2022) Film: Frequency improved legendre memory model for long-term time series forecasting. Adv Neural Inf Process Syst 35:12677\u201312690","journal-title":"Adv Neural Inf Process Syst"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-026-00591-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-026-00591-6","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-026-00591-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T05:44:49Z","timestamp":1782107089000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-026-00591-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,22]]},"references-count":33,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["591"],"URL":"https:\/\/doi.org\/10.1186\/s42400-026-00591-6","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,22]]},"assertion":[{"value":"19 October 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 April 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 June 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"We declare that there are no competing interests that could be perceived as affecting the objectivity or impartiality of this research.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing Interests"}}],"article-number":"179"}}