PaperlayerView exact revision on arXiv

Source-linked AI summary

Insight into Insiders and IT: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

Ivan Homoliak, Flavio Toffalini, Juan Guarnizo, Yuval Elovici, Martín Ochoa

arXiv:1805.01612v2cs.CRcs.CY

TL;DR

Insider threats are challenging to address, and prior surveys have either focused on detection or lacked systematic categorization. This survey uses a grounded-theory review to organize the field and proposes a unified taxonomy, dataset overview, and research directions. It also highlights the continuing shortage of real and validated insider-threat data.

  • Problem

    Earlier insider-threat surveys were sometimes limited to detection approaches or lacked systematic categorization, despite the field’s substantial body of research.

    Source: §1 · p. 2

  • Method

    The survey applies grounded theory to organize insider-threat research by workflow and proposes a structural taxonomy based on existing taxonomies and 5W1H questions.

    Source: §3.5 · p. 12, §9 · p. 31

  • Results

    The survey provides a unified taxonomy for classifying incidents and defense coverage, aggregates public datasets, and identifies open questions and research directions.

    Source: §1.2 · p. 3

  • Takeaways & Limitations

    The taxonomy can classify incidents and defense-solution coverage, while the dataset overview supports testing and comparison with prior work.

    Source: §1.2 · p. 3

    Real insider-threat data remain scarce, and the few synthetic datasets containing malicious attacks are not validated as correctly modeling real environments.

    Source: §9 · pp. 31–32

Abstract

from arXiv · show

Insider threats are one of today's most challenging cybersecurity issues that are not well addressed by commonly employed security solutions. Despite several scientific works published in this domain, we argue that the field can benefit from the proposed structural taxonomy and novel categorization of research that contribute to the organization and disambiguation of insider threat incidents and the defense solutions used against them. The objective of our categorization is to systematize knowledge in insider threat research, while leveraging existing grounded theory method for rigorous literature review. The proposed categorization depicts the workflow among particular categories that include: 1) Incidents and datasets, 2) Analysis of attackers, 3) Simulations, and 4) Defense solutions. Special attention is paid to the definitions and taxonomies of the insider threat; we present a structural taxonomy of insider threat incidents, which is based on existing taxonomies and the 5W1H questions of the information gathering problem. Our survey will enhance researchers' efforts in the domain of insider threat, because it provides: a) a novel structural taxonomy that contributes to orthogonal classification of incidents and defining the scope of defense solutions employed against them, b) an updated overview on publicly available datasets that can be used to test new detection solutions against other works, c) references of existing case studies and frameworks modeling insiders' behaviors for the purpose of reviewing defense solutions or extending their coverage, and d) a discussion of existing trends and further research directions that can be used for reasoning in the insider threat domain.

1 INTRODUCTION

The introduction frames insider threats as difficult to address because insiders have legitimate access and may know system vulnerabilities, while earlier surveys leave gaps in breadth or systematic categorization. It presents a grounded-theory review, a workflow-based organization of research, and a unified taxonomy intended to help classify incidents and defense coverage.

1 INTRODUCTION

  • One survey attributed 27% of cyber crime incidents to suspected insiders, while insiders’ legitimate access and system knowledge can make malicious attacks harder to detect.Source: §1 · pp. 1–2
  • Earlier surveys either focused on detection approaches or lacked systematic literature categorization, motivating a more comprehensive, up-to-date review.Source: §1 · p. 2

1.1 Survey Approach

  • The review began with 322 works, checked highly ranked and highly cited papers, applied inclusion criteria, and used grounded theory to build a workflow-based categorization.The authors state that the survey was not intended to cover all literature.Source: §1.1 · pp. 2–3

1.2 Contributions

  • The survey proposes a unified taxonomy for classifying incidents and defense coverage, aggregates public datasets, and identifies open questions and research directions.Source: §1.2 · p. 3

2 EXISTING SURVEYS

Prior surveys classify insider-threat research using varied taxonomies and often focus on a narrower detection domain. This survey distinguishes itself by organizing broad, heterogeneous research first by workflow and then within each category.

2 EXISTING SURVEYS

  • Salem et al. [2008] divided malicious insiders into traitors and masqueraders, while Hunker and Probst [2011] emphasized combining psychosocial and technical approaches.Source: §2 · p. 3
  • Azaria et al. [2014] grouped work into six categories drawn from different dimensions, so a new approach might not fit any one category.Source: §2 · pp. 3–4

2.1 Comparison with Our Survey

  • Earlier surveys covered either heterogeneous studies or narrower detection topics, whereas this survey applies coarse workflow categories followed by finer categories within each.Source: §2.1 · p. 4

3 DEFINITIONS AND TAXONOMIES

The section reviews definitions of insiders and insider threats, organizes existing taxonomies by intent, and presents a structural taxonomy of incidents based on 5W1H questions. The taxonomy aims to make incident descriptions systematic, clear, and extensible.

3 DEFINITIONS AND TAXONOMIES

  • The survey groups taxonomies as malicious, unintentional, or combined, then proposes a structural incident taxonomy organized around information-gathering questions.The scope of “insider” can be ambiguous when outsiders operate inside a network or former employees attack from outside; whistle-blowers are placed under malicious threats for classification purposes, without taking a position on their ethics.Source: §3 · p. 5

3.1 Definitions

  • Definitions distinguish insiders as people described by access, knowledge, trust, or policy from insider threats as their harmful or policy-violating actions.Most cited threat definitions assume malicious intent, others allow either intent, and Collins et al. [2016] explicitly define unintentional insider threat.Source: §3.1 · p. 5

3.2 Unintentional Insider Threat Taxonomies

  • Unintentional-threat taxonomies classify data-spillage risks and human errors, including CERT’s four incident types and Reason’s distinction between slips and mistakes.Wall [2013] also distinguishes well-meaning from negligent insiders and describes four employee risk types: underminers, over-ambitious, socially engineered, and data-leakers.Source: §3.2 · p. 7

3.3 Malicious Insider Threat Taxonomies

  • Malicious-threat taxonomies classify perpetrators by behavior, knowledge, and incident type, including Anderson’s masqueraders, misfeasors, and clandestine users [1980].Salem et al. [2008] distinguish traitors from masqueraders by system knowledge and credential use, while CERT profiles IT sabotage, intellectual-property theft, and fraud [2012].Source: §3.3 · pp. 7–10

3.4 Combined Taxonomies of Insider Threat

  • Combined taxonomies cover both intentions through policy violations, human-centered dimensions, and system monitoring levels.Bishop and Gates [2008] distinguish misuse of legitimate access from obtaining unauthorized access; Magklaras and Furnell [2002] classify role, reason, and system consequences, while Phyo and Furnell [2004] identify network, operating-system, application, and data monitoring levels.Source: §3.4 · pp. 10–11
  • Probst and Hunker [2010] distinguish insider threats that do not violate trust, including accidents and policy disobedience, from trust-violating simple and high-profile threats.The latter categories are similar to the low-end and high-end insiders in.Source: §3.4 · p. 12

3.5 Structural Taxonomy of Insider Incidents by 5W1H

  • The structural taxonomy uses 5W1H to unify existing taxonomies, selecting mostly orthogonal ones and adding subcategories to describe insider incidents systematically.It separates malicious from unintentional incidents and adds malicious-incident categories for duration and timing relative to job termination; the latter assumes insiders leave or are fired.Source: §3.5 · p. 12, Figure 1 · p. 13
  • The proposed taxonomy organizes incident information in a clear, maintainable format that can be extended or modified to integrate future case studies.It represents policy violations involving legitimate access to obtain unauthorized access with a red dashed arrow; two examples appear in Appendix B.Source: §3.5 · p. 12

4 PROPOSED CATEGORIZATION

The survey organizes insider-threat research into four connected categories: incidents and datasets, analysis of incidents, simulations, and defense solutions. Its categorization uses grounded theory and presents a workflow linking these contributions.

4.1 Workflow of Research Contributions

  • Grounded theory structures the review through inclusion criteria, searching, selection, coding, and presentation of findings.The analysis uses open, axial, and selective coding to identify and refine categories.Source: §4.1 · p. 14
  • Incidents and datasets supply evaluation data and case studies, while analysis of incidents models behaviors, indicators, and insider-threat lifecycles.These analyses include definitions and taxonomies, behavioral frameworks, security pathways, and psychological or social studies.Source: §4.1 · pp. 14–15
  • Simulations model insider environments to study simulation settings or generate synthetic datasets, using system dynamics, discrete-event simulation, or game theory.Source: §4.1 · p. 15
  • Defense solutions cover detection, assessment, prevention, and mitigation, including decoy-based and procedural approaches as well as practical tools.The category surveys defense options and trends in their development.Source: §4.1 · p. 15
  • The workflow runs from incidents toward solutions, but can also run back as simulations generate datasets and detection contributes case studies or testbeds.Incident analysis can inform simulation and defense design, and simulation experiments can inform detection settings.Source: §4.1 · p. 15

5 INCIDENTS AND DATASETS

This section organizes documented insider incidents and the datasets used to study them. It proposes dataset categories that distinguish malicious intent and access patterns from benign-intent identification or authentication data.

5 INCIDENTS AND DATASETS

  • The section surveys incident case studies and datasets gathered from laboratory experiments or real-world sources as resources for designing and evaluating research approaches.Examples include the synthetic CERT datasets, which contain logon, browsing, file-access, email, device-use, psychometric, and LDAP data.Source: §5 · p. 15, §5.2.3 · pp. 18–19

5.1 Case Studies of Incidents

  • Randazzo et al. [2005] examined 23 finance-sector cases, while Kowalski et al. [2008] described 36 government-sector cases; fraud was the largest incident category in both samples.The finance sample included 15 fraud cases; the government sample included 21.Source: §5.1 · p. 16
  • Incident studies include clusters organized by attack type and by setting, including sabotage, fraud, IP theft, government, and corporate cases.Cappelli et al. [2012] grouped 51 cases by incident profile; Cole and Ring [2005] grouped cases by government and corporate settings.Source: §5.1 · pp. 16–17

5.2 Datasets

  • Five dataset classes distinguish malicious intent and access routes from benign-intent label schemes; separating benign datasets enables reproducible settings, while authentication datasets permit variable sample mixtures.Only one real-world dataset was known to the authors, so the real-world/laboratory distinction is used tangentially.Source: §5.2 · p. 17
  • Substituted masquerader datasets use legitimate data from previously unseen users as malicious samples, but are less suitable for testing masquerader detection than masquerader-based datasets.The Schonlau dataset approximates masqueraders by blending in data from unknown users, which does not contain malicious intent.Source: §5.2.4 · p. 19

6 ANALYSIS OF INCIDENTS

This section surveys models of insider incidents across the attacker lifecycle, including behavioral frameworks and psychological and social accounts. It describes how organizations may intervene at different stages and reviews frameworks that characterize attacker, organizational, and situational factors.

6.1 Behavioral Frameworks

  • The security action cycle models abuse over time, from pre-kinetic events and deterrence through misuse, prevention, successful attack, and possible detection.Organizations aim to maximize desired states and minimize undesired states through actions and countermeasures at different stages.Source: §6.1 · pp. 20–21
  • Behavioral frameworks represent incidents through attacker attributes, critical pathways, risk factors, or connected catalyst, actor, attack, and organization characteristics.Nurse et al. [2014] built their framework using grounded theory on 80 case studies; Claycomb et al. [2012] identified six consecutive events in sabotage cases.Source: §6.1 · p. 21
  • Intentional analysis models an employee’s insider-threat likelihood with a Bayesian network; after intent to attack, behavioral analysis models attack-success probability with Markov decision processes, considering an acKlaim-calculus environment.Kammüller et al. [2016] formally modeled malicious and inadvertent insider threats in the IoT using attack trees and Isabelle.Source: Figure 6 · p. 22

6.2 Psychological and Social Theory

  • Psychological and social studies examine personality, emotional states, risk perception, workplace justice, trust, and indicators associated with insider incidents.The cited work reports correlations between incidents and several personal or situational factors, rather than a single defining profile.Source: §6.2 · pp. 22–23

7 SIMULATION RESEARCH

The section surveys programmed-model simulations used in insider-threat research, grouping them into discrete-event, system-dynamics, and game-theory approaches. The examples cover performance evaluation, policy analysis, and strategic interactions between defenders and insiders.

7 SIMULATION RESEARCH

  • Discrete-event simulations model system activities as state changes between events and have been used for risk-assessment evaluation, insider inference, data generation, and anomaly detection.Examples include multi-entity Bayesian networks and colored Petri nets for simulated insider activity in SCADA systems.Source: §7 · pp. 23–24
  • System-dynamics simulations represent dependencies, feedback, and interactions over time, and have compared security-control levels and training or policy strategies in fraud and sabotage scenarios.The approaches include perfect information, consistency training, and alignment training compared with a base run.Source: §7 · p. 24
  • Game-theory studies model interdependent defender and insider decisions; one comparison found quantal response equilibrium can represent bounded rationality unlike Nash equilibrium.Other examples include stochastic games and dynamic Bayesian networks paired with quantal response equilibrium.Source: §7 · p. 24

8 DEFENSE SOLUTIONS

The survey groups insider-threat defenses into mitigation and prevention, detection and threat assessment, and complementary practical approaches. It organizes detection by approach type and, for evaluated work, also by dataset setting and feature domain.

8 DEFENSE SOLUTIONS

  • The survey covers mitigation and prevention, detection and threat assessment, and complementary best practices, guidelines, decoys, and practical solutions.It notes that some defenses overlap with broader IT-security topics and limits coverage to works with significant intersection with insider threats.Source: §8 · p. 25

8.1 Mitigation and Prevention

  • Prevention approaches span deterrence, data-leakage controls, process analysis, risk budgets, decoys, database protections, access control, and reconnaissance limits.Examples include access restrictions based on need-to-know, trust or risk, and simulated network topologies that delay reconnaissance.Source: §8.1 · p. 25, §8.1.1 · p. 25, §8.1.2 · p. 26

8.2 Detection and Threat Assessment Approaches

  • Conceptual detection approaches are grouped as anomaly-based, misuse-based, hybrid, or general, distinguishing baseline behavior, modeled misuse, combined modeling, and general reasoning.Anomaly and misuse methods model one behavior type; hybrid techniques model legitimate and malicious behavior together.Source: §8.2 · p. 27
  • Operational detection works add classification-based and unsupervised outlier categories; unsupervised outlier detection does not require labeled training data.The survey distinguishes hybrid approaches, which independently merge anomaly- and misuse-based methods, from classification-based approaches, which combine them simultaneously.Source: §8.2 · p. 29
  • Operational studies use varied observables and datasets, including command histories, file interactions, system calls, transactions, GUI behavior, psychosocial indicators, and user interactions.The survey also proposes organizing operational work by evaluation dataset setting and feature domain.Source: §8.2 · pp. 29–31

9 CONCLUSION

The survey systematizes insider-threat research through a workflow-based categorization and a 5W1H structural taxonomy. It identifies evidence gaps and recommends broader datasets, feature coverage, and layered defenses.

9 CONCLUSION

  • The survey organizes research into incidents and datasets, incident analysis, simulations, and defense solutions, and proposes a 5W1H structural taxonomy for orthogonal incident classification.The taxonomy is based on existing taxonomies and is intended to help define the scope of defenses used against incidents.Source: §9 · p. 31
  • Real data for assessing defenses remain scarce, and only a few synthetic datasets contain malicious-insider samples.The survey notes that the synthetic datasets are not validated as correctly modeling real environments and calls for creating and sharing datasets.Source: §9 · pp. 31–32
  • Assuming insiders are moving targets, the authors warn that methods built on existing datasets may not work in practice and recommend adversarial classification.They propose adversarial classification both to improve detection and to enrich datasets.Source: §9 · p. 32
  • The authors recommend including collusion attacks and concept-drift variations in datasets to support more realistic and challenging detection tests.They also identify a challenge in giving multiplayer-game participants ethical dilemmas about self-benefit versus team interests.Source: §9 · p. 32
  • Detection approaches tend to use opportunity-based features while omitting motive and capability features; the authors recommend specifying MOC feature domains and detection scope.Privacy concerns or unsuitable dataset contents may contribute to the absence of motive-based features.Source: §9 · p. 32
  • The authors recommend layered defense: procedural and preventive measures first, misuse-based detection second, and anomaly-based and unsupervised outlier detection third.Alerts from the latter two detection layers should be correlated in a dedicated view.Source: §9 · p. 32

A INSIDER THREAT FROM DIFFERENT PERSPECTIVES

The section compares four perspectives on threats to show how insider threat crosses disciplinary definitions. Their shared intersection concerns malicious insiders threatening information-system security.

A INSIDER THREAT FROM DIFFERENT PERSPECTIVES

  • Counterproductive workplace behavior includes intentional conduct contrary to organizational interests, including some IT misuse, but is limited to internal employees.Examples include personal use of IT resources, misuse of work time or sick leave, and P2P sharing.Source: Counterproductive Workplace Behavior · p. 42
  • Anderson’s intrusion-attempt definition covers intentional unauthorized access, modification, or denial of use; internal threats include masqueraders, misfeasors, and clandestine users.This perspective treats insider threats as a subset of intrusion threats.Source: Intrusion Attempts · p. 42
  • Loch et al.’s security-threat taxonomy combines internal/external, human/non-human, accidental/intentional, and CIA-impact dimensions, yielding 16 subcategories.Cappelli et al.’s malicious-insider definition includes current or former employees, contractors, or business partners who misuse authorized access and harm confidentiality, integrity, or availability.Source: Threats to IS Security · p. 42, Malicious Insiders Involving Third… · p. 43
  • Across the four perspectives, the shared intersection is malicious insider threat to information systems; unintentional insider threat can also intersect with the broader definitions.Figure 9 depicts the intersection abstractly.Source: Figure 9 · p. 42, Malicious Insiders Involving Third… · p. 43

B THE APPLICATION OF PROPOSED STRUCTURAL TAXONOMY OF INSIDER INCIDENTS: EXAMPLES

The examples apply the proposed 5W1H taxonomy to malicious and unintentional insider incidents. They classify incident outcomes, actors, access, motivations, detection locations, and timing.

B THE APPLICATION OF PROPOSED STRUCTURAL TAXONOMY OF INSIDER INCIDENTS: EXAMPLES

  • The malicious example uses all six 5W1H questions to characterize incident outcome, means, motive, actor, detection location, and timing.The section states that the proposed taxonomy is demonstrated with one malicious and one unintentional case study.Source: B THE APPLICATION OF PROPOSED… · pp. 43–44
  • A contractor working as a hospital security guard used physical access to attack an HVAC computer, install a botnet, and cause a one-hour system outage.The case also involved access to a nurses-station computer connected to organizational computers and containing medical and billing information.Source: B THE APPLICATION OF PROPOSED… · p. 43
  • The malicious case is classified as involving a planted inside associate with no system role; its possible financial or personal motives are explicitly uncertain.The two-day activity could be detected at operating-system, network, and physical levels; the authors classify it as short-term.Source: B THE APPLICATION OF PROPOSED… · pp. 43–44
  • In the unintentional case, employees deceived by an HR-benefits phishing email enabled malicious-code installation and data leakage, prompting the organization to disconnect Internet access.The taxonomy characterizes the phishing as an outsider-originated attack that induced an unintentional policy violation through legitimate access.Source: B THE APPLICATION OF PROPOSED… · p. 44

C TAXONOMY OF DETECTION FEATURES

The survey organizes detection features around motive, opportunity, and capability, then reviews procedural guidance, decoy-based defenses, and practical detection, SIEM, and audit tools.

C TAXONOMY OF DETECTION FEATURES

D BEST PRACTICES AND GUIDELINES

  • Best-practice work ranges from general guidance and sector-specific controls to management frameworks, incident monitoring, and security standards.ISO 27002 controls identify insiders, detect unexpected behavior, and influence organizational security culture.Source: D BEST PRACTICES AND GUIDELINES · pp. 45–46

E DECOY-BASED SOLUTIONS

  • Decoy defenses use honeypots, honeytokens, and deceptive documents or network artifacts to expose suspicious insider activity.Some approaches embed beacons in trap documents or use decoys during attack preparation and exfiltration.Source: E DECOY-BASED SOLUTIONS · pp. 46–47

F OTHER PRACTICAL SOLUTIONS

  • Practical products are grouped as detection, SIEM, and audit tools, with detection spanning rule matching, behavioral recording, and machine learning.SIEM systems aggregate events and alerts, while audit tools log activity for forensic and audit purposes.Source: F OTHER PRACTICAL SOLUTIONS · pp. 47–48

G DETECTION AND THREAT ASSESSMENT APPROACHES: ADDITIONAL WORKS

This section briefly presents the remaining works in the input literature database that fit the subcategory, using the survey’s main-text categorization structure.

G DETECTION AND THREAT ASSESSMENT APPROACHES: ADDITIONAL WORKS

  • The section covers remaining database papers in this subcategory and retains the categorization structure used in the survey’s main text.The passage provides no further descriptions of those works.Source: G DETECTION AND THREAT ASSESSMENT… · p. 48

G.1 Conceptual Works

The conceptual works address insider threat through user-risk assessment, behavior models, and assessments of organizational environments and attack paths.

G.1 Conceptual Works

  • Several conceptual approaches assess users through role-based actions, access to resources, behavioral indicators, or combined psychological and cyber observables.BANDIT compares MOC indicators with user baselines and group behavior, producing two Euclidean-distance scores [Berk et al. 2012].Source: §G.1 · p. 48
  • Risk-assessment concepts combine behavioral or psychosocial indicators with Bayesian networks, regression, neural networks, or user-stimulating events.Greitzer et al. [2012] use 12 indicators as inputs to three modeling approaches; Sasaki [2012] monitors users’ reactions to a stimulating event.Source: §G.1 · p. 48
  • Environment-focused approaches model attack cost, possible attack trails, and changing network assets and vulnerabilities.Examples include key challenge graphs and risk-assessment graphs [Chinchani et al. 2010; Ha et al. 2007; Naghmouchi et al. 2016].Source: §G.1 · p. 48

G.2 Operational Works

Operational studies cover misuse and anomaly detection, classification, and outlier detection, using varied user, system, file, network, and psychosocial data.

G.2 Operational Works

  • Misuse-based operational approaches include a Bayesian-network model for data exfiltration and graph matching for malicious interactions in web applications.The Bayesian network uses four binary detectors, including connected devices, after-hours work, file-sharing visits, and employee dismissal information [Roberts et al. 2016].Source: §G.2 · p. 48
  • Unix/Linux command-history studies predominantly model masqueraders, using sequence alignment, one-class learning, state machines, pattern mining, and command compression.Other operational work uses file-system logs, system calls, Windows features, and general cyber or psychosocial observables [Camiña et al. 2014; Nguyen et al. 2003; Greitzer et al. 2013].Source: §G.2 · pp. 48–50
  • Classification-based approaches apply Naïve Bayes, SVMs, self-consistency updates, and ensemble classifiers to commands, database transactions, and GUI interactions.Taylor et al. [2013] use logistic regression with LIWC categories and linguistic style matching to detect data exfiltration in email.Source: §G.2 · p. 50
  • Unsupervised outlier studies use ensembles, clustering, Markov chains, stream mining, and bioinformatics clustering across several activity domains.Chen et al. [2012] apply nearest-neighbor networks to healthcare collaboration logs and observe that normal users tend to form communities unlike illicit insiders.Source: §G.2 · p. 50

H ADDITIONAL CATEGORIZATIONS OF OPERATIONAL APPROACHES OF THE DETECTION AND THREAT ASSESSMENT SUBCATEGORY

The survey adds two ways to categorize operational detection and threat-assessment work: by dataset setting and by feature domain, alongside its main intrusion-detection and machine-learning categorization.

H ADDITIONAL CATEGORIZATIONS OF OPERATIONAL APPROACHES OF THE DETECTION AND THREAT ASSESSMENT SUBCATEGORY

  • The survey adds dataset-setting and feature-domain categorizations to its main categorization based on intrusion detection and machine learning.Source: H ADDITIONAL CATEGORIZATIONS OF… · p. 50
  • Six dataset settings distinguish masquerader, traitor, miscellaneous malicious, substituted masquerader, unintentional insider, and user-identification tasks.Source: H ADDITIONAL CATEGORIZATIONS OF… · p. 50
  • The feature-domain categorization builds on the MOC-based taxonomy and adds domains to represent all operational works in the literature database.Source: H ADDITIONAL CATEGORIZATIONS OF… · p. 51
  • Dataset type and evaluation setting need not match: masquerader datasets can support user identification, while identification datasets can support substituted-masquerader detection [Song et al. 2013; El Masri et al. 2014; Maxion 2003; Yu and Graham 2006].Source: H ADDITIONAL CATEGORIZATIONS OF… · p. 51
  • A data source does not by itself determine the feature domain: email-text analyses may use motive features, unlike approaches also analyzing senders and recipients [Brown et al. 2013; Greitzer et al. 2013; Legg et al. 2015].Source: H ADDITIONAL CATEGORIZATIONS OF… · p. 51
Loading 1805.01612v2…