The DOI matches its Crossref record; 59 of the 59 references it cites were found in a registry or an index.
GRAIN: Graph neural network and reinforcement learning aided causality discovery for multi-step attack scenario reconstruction
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
GRAIN, building upon graph neural networks, introduces Reinforcement Learning to filter attack paths with the maximum effect via a reward function.
“GRAIN[36], building upon graph neural networks, introduces Reinforcement Learning (RL) to filter attack paths with the maximum effect via a reward function.”
From From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps (2026) · cites this paper as [36]
Citations
Cites
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805 · Cited by 73,173
(2003) · Journal of Machine Learning Research · doi:10.5555/944919.944937 · Cited by 32,337
Semi-supervised classification with graph convolutional networks
Kipf, T. N., & Welling, M. (2016) · arXiv · doi:10.48550/arxiv.1609.02907 · Cited by 24,853
Distributed Representations of Words and Phrases and their Compositionality
Mikolov, T., Sutskever, I., Chen, K., Corrado, G., & Dean, J. (2013) · arXiv · doi:10.48550/arxiv.1310.4546 · Cited by 24,533
Graph Attention NetworksPreprint
Veličković, P., Casanova, A., Liò, P., Cucurull, G., Romero, A., & Bengio, Y. (2017) · arXiv (Cornell University) · doi:10.17863/cam.48429 · Cited by 19,745
Advances in Neural Information Processing Systems 29
Teymur, O., Zygalakis, K., & Calderhead, B. (2016) · Cited by 13,881
(1999) · Cited by 12,854
Advances in Neural Information Processing Systems 25
Zhang, Y., Sutton, C. A., Storkey, A., & Zoubin Ghahramani, A. (2012) · Cited by 12,653
Inductive Representation Learning on Large Graphs
Hamilton, W. L., Ying, R., & Leskovec, J. (2017) · arXiv · doi:10.48550/arxiv.1706.02216 · Cited by 10,639
Enriching Word Vectors with Subword Information
Bojanowski, P., Grave, E., Joulin, A., & Mikolov, T. (2017) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl_a_00051 · Cited by 9,645
Distributed Representations of Sentences and DocumentsPreprint
Le, Q. V., & Mikolov, T. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1405.4053 · Cited by 7,905
Uncovering the overlapping community structure of complex networks in nature and society
Palla, G., Derényi, I., Farkas, I., & Vicsek, T. (2005) · Nature · doi:10.1038/nature03607 · Cited by 5,373
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018) · Proceedings of the 4th International Conference on Information Systems Security and Privacy · doi:10.5220/0006639801080116 · Cited by 5,318
(1999) · Cited by 5,147
Jeh, G., & Widom, J. (2002) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/775047.775126 · Cited by 1,954
Causal Inference in Statistics
Pearl, J., Glymour, M., & Jewell, N. P. (2016) · Cited by 1,436
Strategies for Pre-training Graph Neural NetworksPreprint
Hu, W., Liu, B., Gomes, J., Žitnik, M., Liang, P., Pande, V. S., & Leskovec, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.12265 · Cited by 1,361
Toward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
An Algorithm for Fast Recovery of Sparse Causal Graphs
Spirtes, P., & Glymour, C. (1991) · Social Science Computer Review · doi:10.1177/089443939100900106 · Cited by 956
Constructing attack scenarios through correlation of intrusion alerts
Ning, P., Cui, Y., & Reeves, D. S. (2002) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/586110.586144 · Cited by 506
STATL: An attack language for state-based intrusion detection
Eckmann, S. T., Vigna, G., & Kemmerer, R. A. (2002) · Journal of Computer Security · doi:10.3233/jcs-2002-101-204 · Cited by 366
Weisfeiler and Leman Go Neural: Higher-Order Graph Neural Networks
Morris, C., Ritzert, M., Fey, M., Hamilton, W. L., Lenssen, J. E., Rattan, G., & Grohe, M. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33014602 · Cited by 209
Adversarial Attacks and Defenses for Deep-Learning-Based Unmanned Aerial Vehicles
Tian, J., Wang, B., Guo, R., Wang, Z., Cao, K., & Wang, X. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3111024 · Cited by 202
Causal Inference in the Presence of Latent Variables and Selection BiasPreprint
Spirtes, P., Meek, C., & Richardson, T. S. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1302.4983 · Cited by 199
Optimal security hardening using multi-objective optimization on attack tree models of networks
Dewri, R., Poolsappasit, N., Ray, I., & Whitley, D. (2007) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1315245.1315272 · Cited by 190
A systematic survey on multi-step attack detection
Navarro, J., Deruyver, A., & Parrend, P. (2018) · Computers & Security · doi:10.1016/j.cose.2018.03.001 · Cited by 159
The SEPSES Knowledge Graph: An Integrated Resource for Cybersecurity
Kiesling, E., Ekelhart, A., Kurniawan, K., & Ekaputra, F. J. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30796-7_13 · Cited by 107
(2021) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00002 · Cited by 101
Maintainable Log Datasets for Evaluation of Intrusion Detection Systems
Landauer, M., Skopik, F., Frank, M., Hotwagner, W., Wurzenberger, M., & Rauber, A. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3201582 · Cited by 77
Reinforced Causal Explainer for Graph Neural Networks
Wang, X., Wu, Y., Zhang, A., Feng, F., He, X., & Chua, T. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3170302 · Cited by 67
Improving SIEM alert metadata aggregation with a novel kill-chain based classification model
Bryant, B. D., & Saiedian, H. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101817 · Cited by 52
Alert-driven Attack Graph Generation using S-PDFA
Nadeem, A., Verwer, S., Moskal, S., & Yang, S. J. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3117348 · Cited by 51
Poirot: Causal Correlation Aided Semantic Analysis for Advanced Persistent Threat Detection
Yang, J., Zhang, Q., Jiang, X., Chen, S., & Yang, F. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3101649 · Cited by 49
Self-citationDiscovering Attack Scenarios via Intrusion Alert Correlation Using Graph Convolutional Networks
Cheng, Q., Wu, C., & Zhou, S. (2021) · IEEE Communications Letters · doi:10.1109/lcomm.2020.3048995 · Cited by 46
Process mining and hierarchical clustering to help intrusion alert visualization
de Alvarenga, S. C., Barbon, S., Miani, R. S., Cukier, M., & Zarpel�ão, B. B. (2017) · Computers & Security · doi:10.1016/j.cose.2017.11.021 · Cited by 46
Wang, X., Yang, X., Liang, X., Zhang, X., Zhang, W., & Gong, X. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103583 · Cited by 45
Mao, B., Liu, J., Lai, Y., & Sun, M. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108340 · Cited by 43
ONTIDS: A Highly Flexible Context-Aware and Ontology-Based Alert Correlation Framework
Sadighian, A., Fernandez, J. M., Lemay, A., & Zargar, S. T. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-05302-8_10 · Cited by 42
Haas, S., & Fischer, M. (2018) · ACM Symposium on Applied Computing · doi:10.1145/3167132.3167239 · Cited by 42
Characterizing Attacker Behavior in a Cybersecurity Penetration Testing Competition
Munaiah, N., Rahman, A., Pelletier, J., Williams, L. A., & Meneely, A. (2019) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1109/esem.2019.8870147 · Cited by 41
Attack scenario reconstruction approach using attack graph and alert data mining
Hu, H., Liu, J., Zhang, Y., Liu, Y., Xu, X., & Tan, J. (2020) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102522 · Cited by 40
Attack scenario reconstruction using intrusion semantics
Barzegar, M., & Shajari, M. (2018) · Expert Systems with Applications · doi:10.1016/j.eswa.2018.04.030 · Cited by 35
MAAC: Novel Alert Correlation Method To Detect Multi-step Attack
Wang, X., Gong, X., Yu, L., & Liu, J. (2021) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00106 · Cited by 32
Multi-step attack detection in industrial control systems using causal analysis
Jadidi, Z., Hagemann, J., & Quevedo, D. E. (2022) · Computers in Industry · doi:10.1016/j.compind.2022.103741 · Cited by 29
Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack
Wang, W., Yi, P., Jiang, J., Zhang, P., & Chen, X. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103533 · Cited by 29
Proceedings of the 10th International Conference on Information Systems Security and Privacy
Lanza, C., Lahmadi, A., & Osmond, F. (2024) · doi:10.5220/0000184400003648 · Cited by 28
Attack scenario reconstruction via fusing heterogeneous threat intelligence
Zang, X., Gong, J., Zhang, X., & Li, G. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103420 · Cited by 24
Discovering Novel Multistage Attack Patterns in Alert Streams
Ai-fang, Z., Li, Z., Li, D., & Wang, L. (2007) · IEEE International Conference on Networking, Architecture and Storage (NAS) · doi:10.1109/nas.2007.20 · Cited by 18
Cyberattack Action-Intent-Framework for Mapping Intrusion ObservablesPreprint
Moskal, S., & Yang, S. J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.07838 · Cited by 18
Trace2Vec: Detecting complex multi-step attacks with explainable graph neural network
Liu, W., Gao, P., Zhang, H., Li, K., Yang, W., Wei, X., & Shu, J. (2025) · Pattern Recognition · doi:10.1016/j.patcog.2025.111363 · Cited by 16
Crowdstrike: Global Threat Report 2020
Crowdstrike (2020) · Florida International University Digital Commons (Florida International University) · Cited by 16
A Causal Graph-Based Approach for APT Predictive Analytics
Liu, H., & Jiang, R. (2023) · Electronics · doi:10.3390/electronics12081849 · Cited by 14
An ATT&CK-KG for Linking Cybersecurity Attacks to Adversary Tactics and Techniques.
Kurniawan, K., Ekelhart, A., & Kiesling, E. (2021) · Cited by 11
RShield: A Refined Shield for Complex Multi-step Attack Detection Based on Temporal Graph Network
Yang, W., Gao, P., Huang, H., Wei, X., Liu, W., Zhu, S., & Luo, W. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-00129-1_40 · Cited by 10
Wang, Y., Guo, Y., & Chen, F. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2022.103373 · Cited by 10
Diakhame, M. L., Diallo, C., & Mejri, M. (2023) · Cyber Security in Networking Conference (CSNet) · doi:10.1109/csnet59123.2023.10339751 · Cited by 6
Danger, J., Debbabi, M., Marion, J.-Y., Marion, J.-Y., & Zincir-Heywood, N. (2014) · HAL · doi:10.1007/978-3-319-05302-8 · Cited by 3
Flagged first, then by citations
Cited by
Sorted by citations
Exploring Causal Learning Through Graph Neural Networks: An In‐Depth Review
Job, S., Tao, X., Cai, T., Xie, H., Li, L., Li, Q., & Yong, J. (2025) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.70024 · Cited by 29
Kesavan, T., Sankaralingam, A., Albert, J. R., & Rengasamy, K. (2025) · AIP Advances · doi:10.1063/5.0300303 · Cited by 7
APT Attribution Using Heterogeneous Graph Neural Networks with Contextual Threat Intelligence
Mead, A. J., & Arabo, A. (2025) · Electronics · doi:10.3390/electronics14234597 · Cited by 4
Xie, J., Li, S., Yun, X., Yin, T., Xu, H., & Sun, P. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3601396 · Cited by 4
ML4SOC: A Comprehensive Review on Machine Learning for Security Operations Centres
Waschke, F., Vaarandi, R., & Guerra-Manzanares, A. (2026) · ACM Computing Surveys · doi:10.1145/3820494 · Cited by 2
Differentially private adaptive noise for graph neural network in online social networks
Yang, C., Zhu, T., Liu, Y., Ding, Y., & Liu, Z. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111757 · Cited by 1
Xu, P., Zhou, C., Naqvi, S. S. A., Wang, M., & 梁旭清 (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3734734 · Cited by 1
From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps
Zhu, Y., Li, X., Suo, J., Yin, Y., & Huang, C. (2026) · 2026 International Conference on AI in Education Technology and Applications (AIETA) · doi:10.1109/aieta69357.2026.11508946
Garcia, R., Lahmadi, A., Gimenez, P.-F., & Sala, C. (2025) · doi:10.1145/3733826.3762680
$$\textrm{A}^{3}\text {LLM}$$: A Novel Large Language Model-Based Method For Attack Alert Analysis
Zhao, C., Li, Y., Cheng, J., Du, D., Li, Y., Li, S., Han, D., & Liu, Y. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-21168-2_9
Mutalib, N. H. A., Sabri, A. Q. M., Wahab, A. W. A., Abdullah, E. R. M. F., & AlDahoul, N. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.6828213
Ferdous, J., Islam, R., & Islam, M. Z. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2607.06860
Trident: Structural-Temporal-Semantic Fusion via GAT-Transformer for Multi-Stage Attack Detection
Chen, S., Dai, Y., Li, F., Yang, H., Zhang, Y., & Zhang, Y. (2026) · International Conference on Communications · doi:10.1109/icc59461.2026.11588290
Self-citationSEMAD: Semantic-Enhanced Malicious Package Detection Using LLMs and Prompt EngineeringPreprint
Anh, T. D.-T., Nguyen, H.-L., Truong-Le, T. M., & Vu, D. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7323943
Adaptive Deep Reinforcement Learning for Autonomous Cyber Threat Mitigation in Smart Networks
Mithra, C., Yerasuri, S. S., Priyadharshini, V., Bhuvaneswari, P., Aarthy, C. C. J., & Verma, S. (2026) · IEEE International Conference on Instrumentation (INSTCon) · doi:10.1109/instcon69741.2026.11691728
Attack-step identifiability on the network-observable data plane: a pre-registered measurement studyPreprint
Guo, T., Wang, W., Wang, J., & Zhu, S. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7615247
Kraust, S., & Mottok, J. (2026) · International Conference on Cybersecurity and AI-Based Systems (Cyber-AI) · doi:10.1109/cyber-ai70573.2026.11755150
El-Attar, I. A., Ali, A., & El-Hajj, M. I. (2026) · Array · doi:10.1016/j.array.2026.101367
Metadata
- Authors
- Xiao, F., Chen, S., Yang, J., He, H., Jiang, X., Tan, X., & Jin, D.
- Affiliations
- University of Science and Technology of China (CN)
- Corresponding author
- Chen, Shuangwu
- Venue
- Computers & Security
- Publisher
- Elsevier BV
- Published
- 2025-01
- Volume
- 148
- Pages
- 104180
- ISSN
- 0167-4048 (ISSN-L)
- OpenAlex
- W4403936474
- Cited by
- 17
- References
- 59
- Citations by year
- 2026: 11 · 2025: 6
- FWCI
- 2.50
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- Computers & Security (publishedVersion)
- Funders
- National Natural Science Foundation of China
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- attack scenario reconstruction, security alerts, alert correlation, alarm fatigue, causal effect estimation, graph neural networks, reinforcement learning, cyberattack detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
