SATARK’s open-source rebuild is grounded in peer-reviewed and conference research on insider threat prediction, behavioral analysis, malware techniques, and web security. Publication details below are taken from confirmed BibTeX records.
Early architecture and incident-response work established detection of insider cyber threats as a primary research direction (2012 onward), later formalized in behavioral prediction studies and doctoral research.
See also Research origins in the documentation.
Behavioral analysis for predicting and detecting insider threats — including deep learning approaches and Windows forensic analysis — forms the core of the SATARK research lineage.
Transparent risk scoring with contributing factors, evidence, confidence, reasoning, and knowledge references — not unexplained numeric scores.
Detections should answer “why was this classified as malicious?” AI may assist with summaries, but detections must remain reproducible without an LLM.
Confirmed from BibTeX. Machine-readable source:
references.bib.
An Architecture for Detection and Incident Response of Insider Cyber Threats
An insider cyber threat prediction mechanism based on behavioral analysis
Predicting Insider Threats by Behavioural Analysis using Deep Learning
Prediction of Insider Cyber Threats Using Behavioral Analysis
Detection of Insider Threat Based on Forensic Analysis of Windows
Mobile web analytics
Frontline techniques to prevent web application vulnerability
Techniques for malware analysis
Techniques for Malicious JavaScript Detection
Requirements to build a system that uses machine learning based approach for analysis of forensic data
Computer-based systems configured for malware detection and methods of use thereof
Public sample telemetry for demos lives under
examples/data/ in the repository. Broader research datasets will be linked
here when licensing and provenance are confirmed.
examples/legacy/lstm_usb_anomaly.py