Zeadally S, Yu B, Jeong D H, et al. Detecting insider threats: solutions and trends[J]. Information Security Journal: A Global Perspective, 2012, 21(4): 183-192.
 Thuraisingham B, Parveen P, Masud M M, et al. Big data analy-tics with applications in insider threat detection[M]. [S.l.]: Auer-bach Publications, 2017.
 Ransbotham S, Mitra S. Choice and chance: a conceptual model of paths to information security compromise[J]. Information Systems Research, 2009, 20(1): 121-139.
 Homoliak I, Toffalini F, Guarnizo J, et al. Insight into insi-ders and it: a survey of insider threat taxonomies, analysis, modeling, and countermeasures[J]. ACM Computing Surveys, 2019, 52(2): 30.
 Teixeira C H C, Fonseca A J, Serafini M, et al. Arabesque: a system for distributed graph mining-extended version[J]. arXiv: 1510.04233, 2015.
 Savage D, Zhang X Z, Yu X H, et al. Anomaly detection in online social networks[J]. Social Networks, 2014, 39: 62-70.
 Slimani T, Lazzez A. Efficient analysis of pattern and associa-tion rule mining approaches[J]. arXiv:1402.2892, 2014.
 Gheyas I A, Abdallah A E. Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis[J]. Big Data Analytics, 2016, 1(1): 6.
 Kuang F J, Xu W D, Zhang S Y. A novel hybrid KPCA and SVM with GA model for intrusion detection[J]. Applied Soft Computing, 2014, 18: 178-184.
 Zhang J, Chen Y, Ju A K. Insider threat detection of adaptive optimization DBN for behavior logs[J]. Turkish Journal of Electrical Engineering & Computer Sciences, 2018, 26(2): 792-802.
 Liu L, De Vel O Y, Han Q L, et al. Detecting and preventing cyber insider threats: a survey[J]. IEEE Communications Surveys & Tutorials, 2018, 20(2): 1397-1417.
 Rudd E M, Rozsa A, Günther M, et al. A survey of stealth malware attacks, mitigation measures, and steps toward autonomous open world solutions[J]. IEEE Communications Surveys & Tutorials, 2017, 19(2): 1145-1172.
 Mishra P, Pilli E S, Varadharajan V, et al. Intrusion detection techniques in cloud environment: a survey[J]. Journal of Network and Computer Applications, 2017, 77: 18-47.
 Sun X, Dai J, Liu P, et al. Using Bayesian networks for pro-babilistic identification of zero-day attack paths[J]. IEEE Transactions on Information Forensics and Security, 2018, 13(10): 2506-2521.
 Sharif M I, Lee W, Cui W D, et al. Secure in-VM monitoring using hardware virtualization[C]//Proceedings of the 2009 ACM Conference on Computer and Communications Security, Chi-cago, Nov 9-13, 2009. New York: ACM, 2009: 477-487.
 Azaria A, Richardson A, Kraus S, et al. Behavioral analysis of insider threat: a survey and bootstrapped prediction in imba-lanced data[J]. IEEE Transactions on Computational Social Systems, 2014, 1(2): 135-155.
 Stephens G D, Maloof M A. Insider threat detection: U.S. Patent 8707431[P]. 2014-04-22.
 Das S, Liu Y, Zhang W, et al. Semantics-based online malware detection: towards efficient real-time protection against malware[J]. IEEE Transactions on Information Forensics and Security, 2017, 11(2): 289-302.
 Campos G O, Zimek A, Sander J, et al. On the evaluation of unsupervised outlier detection: measures, datasets, and an empirical study[J]. Data Mining and Knowledge Discovery, 2016, 30(4): 891-927.
 Akoglu L, Tong H H, Koutra D. Graph based anomaly detec-tion and description: a survey[J]. Data Mining and Knowledge Discovery, 2015, 29(3): 626-688.
 Buczak A L, Guven E. A survey of data mining and machine learning methods for cyber security intrusion detection[J]. IEEE Communications Surveys & Tutorials, 2016, 18(2):1153-1176.
 Bell A J C, Rogers M B, Pearce J M. The insider threat: behavioral indicators and factors influencing likelihood of intervention[J]. International Journal of Critical Infrastructure Protection, 2019, 24: 166-176.
 Ramirez A G, Lara C, Betev L, et al. Arhuaco: deep learning and isolation based security for distributed high-throughput computing[J]. arXiv:1801.04179, 2018.
 Gavai G, Sricharan K, Gunning D, et al. Supervised and unsupervised methods to detect insider threat from enterprise social and online activity data[J]. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applica-tions, 2015, 6(4): 47-63.
 Aberger C R, Tu S S, Olukotun K, et al. EmptyHeaded: a relational engine for graph processing[C]//Proceedings of the 2016 International Conference on Management of Data, San Francisco, Jun 26-Jul 1, 2016. New York: ACM, 2016:431-446.
 Zhang X L, Furtlehner C, Germain-Renaud C, et al. Data stream clustering with affinity propagation[J]. IEEE Transactions on Knowledge and Data Engineering, 2014, 26(7): 1644-1656.
 Sun Y, Tang K, Minku L L, et al. Online ensemble learning of data streams with gradually evolved classes[J]. IEEE Trans-actions on Knowledge and Data Engineering, 2016, 28(6): 1532-1545.
 Webb G I, Hyde R, Cao H, et al. Characterizing concept drift[J]. Data Mining and Knowledge Discovery, 2016, 30(4): 964-994.
 Brzezinski D, Stefanowski J. Combining block-based and online methods in learning ensembles from concept drifting data streams[J]. Information Sciences, 2014, 265: 50-67.
 Lv K, Chen Y, Hu C Z. Dynamic defense strategy against advanced persistent threat under heterogeneous networks[J]. Information Fusion, 2019, 49: 216-226.
 Chen L, Mei Q L. Mining frequent items in data stream using time fading model[J]. Information Sciences, 2014, 257: 54-69.
 Koutra D, Kang U, Vreeken J, et al. Summarizing and under-standing large graphs[J]. Statistical Analysis and Data Mining, 2015, 8(3): 183-202.
 Velampalli S, Jonnalagedda M V. Graph based knowledge dis-covery using MapReduce and SUBDUE algorithm[J]. Data & Knowledge Engineering, 2017, 111: 103-113.
 Padmanabhan S, Chakravarthy S. HDB-Subdue: a scalable approach to graph mining[C]//LNCS 5691: Proceedings of the 11th International Conference on Data Warehousing and Knowledge Discovery, Linz, Aug 31-Sep 2, 2009. Berlin,Heidelberg: Springer, 2009: 325-338.
 Legg P A, Buckley O, Goldsmith M, et al. Automated insider threat detection system using user and role-based profile assessment[J]. IEEE Systems Journal, 2015, 11(2): 503-512.
 Chowdhury S, Khanzadeh M, Akula R, et al. Botnet detection using graph-based feature clustering[J]. Journal of Big Data, 2017, 4: 14.
 Kim J, Park M, Kim H, et al. Insider threat detection based on user behavior modeling and anomaly detection algorithms[J]. Applied Sciences, 2019, 9(19): 4018.
 Haidar D, Gaber M M, Kovalchuk Y. AnyThreat: an oppor-tunistic knowledge discovery approach to insider threat detec-tion[J]. arXiv:1812.00257, 2018.
 Hubballi N, Santini J. Detecting TCP ACK storm attack: a state transition modelling approach[J]. IET Networks, 2018, 7(6): 429-434.
 Lazier C L, Argenti M. Techniques and systems for detecting anomalous operational data: U.S. Patent 9785495[P]. 2017-10-10.
 Jiang D D, Yao C, Xu Z Z, et al. Multi-scale anomaly detection for high-speed network traffic[J]. Transactions on Emerging Telecommunications Technologies, 2015, 26(3): 308-317.
 Hubballi N, Suryanarayanan V. False alarm minimization tech-niques in signature-based intrusion detection systems: a survey[J]. Computer Communications, 2014, 49: 1-17.
 Siddique K, Akhtar Z, Khan F A, et al. KDD Cup 99 data sets: a perspective on the role of data sets in network intrusion detection research[J]. IEEE Computer, 2019, 52(2): 41-51.
 Ring M, Wunderlich S, Scheuring D, et al. A survey of network-based intrusion detection data sets[J]. arXiv:1903. 02460v1, 2019.
 Cam-Winget N, Paul S, Anderson B, et al. Intrusion detection model for an internet-of-things operations environment: U.S. Patent Application 16/135756[P]. 2019-08-01.
 Liu J, Strohschein D, Samsi S, et al. Large scale organization and inference of an imagery dataset for public safety[J]. arXiv:1908.09006, 2019.
 Jiang M, Cui P, Beutel A, et al. Catching synchronized beha-viors in large networks: a graph mining approach[J]. ACM Transactions on Knowledge Discovery from Data, 2016, 10(4): 35.