| A survey of insider attack detection research MB Salem, S Hershkop, SJ Stolfo Insider Attack and Cyber Security: Beyond the Hacker, 69-90, 2008 | 480 | 2008 |
| Methods, systems, and media for baiting inside attackers SJ Stolfo, AD Keromytis, BM Bowen, S Hershkop, VP Kemerlis, ... US Patent 9,009,829, 2015 | 457 | 2015 |
| Real time data mining-based intrusion detection W Lee, SJ Stolfo, PK Chan, E Eskin, W Fan, M Miller, S Hershkop, ... Proceedings DARPA Information Survivability Conference and Exposition II …, 2001 | 451 | 2001 |
| System and methods for detecting intrusions in a computer system by monitoring operating system registry accesses F Apap, A Honig, H Shlomo, E Eskin, SJ Stolfo US Patent 7,448,084, 2008 | 408 | 2008 |
| Methods, systems, and media for masquerade attack detection by monitoring computer user behavior SJ Stolfo, MB Salem, S Hershkop US Patent 8,769,684, 2014 | 357 | 2014 |
| System and methods for detecting intrusions in a computer system by monitoring operating system registry accesses F Apap, A Honig, H Shlomo, E Eskin, SJ Stolfo US Patent 7,913,306, 2011 | 349 | 2011 |
| Baiting inside attackers using decoy documents BM Bowen, S Hershkop, AD Keromytis, SJ Stolfo Security and Privacy in Communication Networks: 5th International ICST …, 2009 | 291 | 2009 |
| Detecting malicious software by monitoring anomalous windows registry accesses F Apap, A Honig, S Hershkop, E Eskin, S Stolfo Recent Advances in Intrusion Detection: 5th International Symposium, RAID …, 2002 | 189 | 2002 |
| Automated social hierarchy detection through email network analysis R Rowe, G Creamer, S Hershkop, SJ Stolfo Proceedings of the 9th WebKDD and 1st SNA-KDD 2007 workshop on Web mining …, 2007 | 179 | 2007 |
| Behavior-based modeling and its application to email analysis SJ Stolfo, S Hershkop, CW Hu, WJ Li, O Nimeskern, K Wang ACM Transactions on Internet Technology (TOIT) 6 (2), 187-221, 2006 | 131 | 2006 |
| Insider attack and cyber security: beyond the hacker SJ Stolfo, SM Bellovin, S Hershkop, AD Keromytis, S Sinclair, SW Smith Springer Science & Business Media, 2008 | 125 | 2008 |
| Designing host and network sensors to mitigate the insider threat B Bowen, MB Salem, S Hershkop, A Keromytis, S Stolfo IEEE security & privacy 7 (6), 22-29, 2009 | 117 | 2009 |
| Met: An experimental system for malicious email tracking M Bhattacharyya, S Hershkop, E Eskin Proceedings of the 2002 workshop on New security paradigms, 3-10, 2002 | 114 | 2002 |
| Detecting spam email using multiple spam classifiers V Rajan, M Wegman, R Segal, J Crawford, J Kephart, S Hershkop US Patent App. 11/029,069, 2006 | 108 | 2006 |
| A comparative evaluation of two algorithms for windows registry anomaly detection SJ Stolfo, F Apap, E Eskin, K Heller, S Hershkop, A Honig, K Svore Journal of Computer Security 13 (4), 659-693, 2005 | 97 | 2005 |
| Combining email models for false positive reduction S Hershkop, SJ Stolfo Proceedings of the eleventh ACM SIGKDD international conference on Knowledge …, 2005 | 85 | 2005 |
| Behavior profiling of email SJ Stolfo, S Hershkop, K Wang, O Nimeskern, CW Hu Intelligence and Security Informatics: First NSF/NIJ Symposium, ISI 2003 …, 2003 | 83 | 2003 |
| A behavior-based approach to securing email systems SJ Stolfo, S Hershkop, K Wang, O Nimeskern, CW Hu Computer Network Security: Second International Workshop on Mathematical …, 2003 | 80 | 2003 |
| Anomaly detection in computer security and an application to file system accesses SJ Stolfo, S Hershkop, LH Bui, R Ferster, K Wang Foundations of Intelligent Systems: 15th International Symposium, ISMIS 2005 …, 2005 | 79 | 2005 |
| Behavior-based email analysis with application to spam detection S Hershkop Columbia University, 2006 | 73 | 2006 |
