Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise
Abstract
Conventional attacks of insider employees and emerging APT are both major threats for the organizational information system. Existing detections mainly concentrate on users' behavior and usually analyze logs recording their operations in an information system. In general, most of these methods consider sequential relationship among log entries and model users' sequential behavior. However, they ignore other relationships, inevitably leading to an unsatisfactory performance on various attack scenarios. We propose log2vec, a heterogeneous graph embedding based modularized method. First, it involves a heuristic approach that converts log entries into a heterogeneous graph in the light of diverse relationships among them. Next, it utilizes an improved graph embedding appropriate to the above heterogeneous graph, which can automatically represent each log entry into a low-dimension vector. The third component of log2vec is a practical detection algorithm capable of separating malicious and benign log entries into different clusters and identifying malicious ones. We implement a prototype of log2vec. Our evaluation demonstrates that log2vec remarkably outperforms state-of-the-art approaches, such as deep learning and hidden markov model (HMM). Besides, log2vec shows its capability to detect malicious events in various attack scenarios.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Sequence models such as LSTM, Transformer, etc., or heterogeneous graphs mainly focus on relative time information of user activity and do not establish a direct connection with the specific timing of user activities.
“However, these methods mainly focus on relative time information of user activity and do not establish a direct connection with the specific timing of user activities.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Liu et al. (2019)
Cites
node2vec: Scalable Feature Learning for Networks
Grover, A., & Leskovec, J. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939754 · Cited by 10,926 · see citing works
(2007) · doi:10.5555/1283383.1283494 · Cited by 7,364 · see citing works
LINE: Large-scale Information Network Embedding
Tang, J., Qu, M., Wang, M., Zhang, M., Yan, J., & Mei, Q. (2015) · Proceedings of the 24th International Conference on World Wide Web · doi:10.1145/2736277.2741093 · Cited by 5,416 · see citing works
Dong, Y., Chawla, N. V., & Swami, A. (2017) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3097983.3098036 · Cited by 2,224 · see citing works
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835 · see citing works
Yanardag, P., & Vishwanathan, S. V. N. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783417 · Cited by 1,108 · see citing works
Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection
Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., & Song, D. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134018 · Cited by 682 · see citing works
Discriminative Embeddings of Latent Variable Models for Structured DataPreprint
Dai, H., Dai, B., & Song, L. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1603.05629 · Cited by 534 · see citing works
The Robustness of the "Binormal" Assumptions Used in Fitting ROC Curves
Hanley, J. A. (1988) · Medical Decision Making · doi:10.1177/0272989x8800800308 · Cited by 308 · see citing works
Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint
Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 286 · see citing works
Yen, T.-F., Oprea, A., Onarlıoğlu, K., Leetham, T., Robertson, W., Juels, A., & Kirda, E. (2013) · Annual Computer Security Applications Conference · doi:10.1145/2523649.2523670 · Cited by 270 · see citing works
Sun, Y., Norick, B., Han, J., Yan, X., Yu, P. S., & Yu, X. (2012) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2339530.2339738 · Cited by 199 · see citing works
Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data
Azaria, A., Richardson, A., Kraus, S., & Subrahmanian, V. S. (2014) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2014.2377811 · Cited by 133 · see citing works
Chen, Y., POSKITT, C. M., & Sun, J. (2018) · Singapore Management University Institutional Knowledge (InK) (Singapore Management University) · Cited by 129 · see citing works
Michael Backes, A., Humbert, M., Pang, J., & Zhang, Y. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3133972 · Cited by 125 · see citing works
Chen, Y., POSKITT, C. M., & Sun, J. (2018) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2018.00016 · Cited by 118 · see citing works
Learning Dynamic Context Graphs for Predicting Social Events
Deng, S., Rangwala, H., & Ning, Y. (2019) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3292500.3330919 · Cited by 103 · see citing works
Tang, Y., Li, D., Li, Z., Zhang, M., Jee, K., Xiao, X., Wu, Z., Rhee, J., Xu, F., & Li, Q. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243763 · Cited by 90 · see citing works
An Unsupervised Multi-Detector Approach for Identifying Malicious Lateral Movement
Bohara, A., Noureddine, M. A., Fawaz, A., & Sanders, W. H. (2017) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds.2017.31 · Cited by 70 · see citing works
Detecting Insider Threat from Enterprise Social and Online Activity Data
Gavai, G., Sricharan, K., Gunning, D., Rolleston, R., Hanley, J., & Singhal, M. (2015) · Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats · doi:10.1145/2808783.2808784 · Cited by 69 · see citing works
Alarm Reduction and Correlation in Intrusion Detection Systems
Burbeck, K. R., Burschka, S., Chyssler, T., Lingvall, T., & Semling, M. (2004) · Technische Universität Dortmund Eldorado (Technische Universität Dortmund) · doi:10.17877/de290r-2012 · Cited by 37 · see citing works
The Target and Other Financial Data Breaches: Frequently Asked Questions
Weiss, N. E., & Miller, R. S. (2015) · University of North Texas Digital Library (University of North Texas) · Cited by 29 · see citing works
Common Sense Guide to Mitigating Insider Threats, Fifth Edition
Collins, M. L., Theis, M., Trzeciak, R., Strozer, J., Clark, J., Costa, D., Cassidy, T., Albrethsen, M., & Moore, A. (2016) · Figshare · doi:10.1184/r1/12890918 · Cited by 19 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534113 · Cited by 454 · see citing works
A Survey on Automated Log Analysis for Reliability Engineering
He, S., He, P., Chen, Z., Yang, T., Su, Y., & Lyu, M. R. (2022) · ACM Computing Surveys · doi:10.1145/3460345 · Cited by 334 · see citing works
Deep learning for insider threat detection: Review, challenges and opportunities
Yuan, S., & Wu, X. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102221 · Cited by 271 · see citing works
Graph Neural Networks for Intrusion Detection: A Survey
Bilot, T., Madhoun, N. E., Agha, K. A., & Zouaoui, A. (2023) · IEEE Access · doi:10.1109/access.2023.3275789 · Cited by 267 · see citing works
Log-based anomaly detection with deep learning: how far are we?
Le, V.-H., & Zhang, H. (2022) · Proceedings of the 44th International Conference on Software Engineering · doi:10.1145/3510003.3510155 · Cited by 257 · see citing works
THREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning
Wang, S., Wang, Z., Zhou, T., Sun, H., Yin, X., Han, D., Zhang, H., Shi, X., & Yang, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3208815 · Cited by 248 · see citing works
Provenance-based Intrusion Detection Systems: A Survey
Zipperle, M., Gottwalt, F., Chang, E. J., & Dillon, T. S. (2022) · ACM Computing Surveys · doi:10.1145/3539605 · Cited by 160 · see citing works
Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance
Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., & Han, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00005 · Cited by 157 · see citing works
Anomaly Detection for Insider Threats Using Unsupervised Ensembles
Le, D. C., & Zincir-Heywood, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3071928 · Cited by 147 · see citing works
{ATLAS}: A Sequence-based Learning Approach for Attack Investigation
Alsaheel, A., Nan, Y., Ma, S., Yu, L., Walkup, G., Celik, Z. B., Zhang, X., & Xu, D. (2021) · USENIX Security Symposium · Cited by 134 · see citing works
WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics
Zeng, J., Chua, Z. L., Chen, Y., Ji, K., Liang, Z., & Mao, J. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24549 · Cited by 118 · see citing works
Threat detection and investigation with system-level provenance graphs: A survey
Li, Z., Chen, Q. A., Yang, R., Chen, Y., & Ruan, W. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102282 · Cited by 117 · see citing works
Ashizawa, N., Yanai, N., Cruz, J. P., & Okamura, S. (2021) · ACM International Symposium on Blockchain and Secure Critical Infrastructure (BSCI) · doi:10.1145/3457337.3457841 · Cited by 115 · see citing works
LogFiT: Log Anomaly Detection Using Fine-Tuned Language Models
Almodovar, C., Sabrina, F., Karimi, S., & Azad, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3358730 · Cited by 111 · see citing works
DEEPCASE: Semi-Supervised Contextual Analysis of Security Events
van Ede, T., Aghakhani, H., Spahn, N., Bortolameotti, R., Cova, M., Continella, A., van Steen, M. R., Peter, A., Kruegel, C., & Vigna, G. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833671 · Cited by 97 · see citing works
DEPCOMM: Graph Summarization on System Audit Logs for Attack Investigation
Xu, Z., Fang, P., Liu, C., Xiao, X., Wen, Y. T., & Meng, D. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833632 · Cited by 89 · see citing works
Self-citationDeepAG: Attack Graph Construction and Threats Prediction With Bi-Directional Deep Learning
Li, T., Jiang, Y. L., Lin, C., Obaidat, M. S., Shen, Y., & Ma, J. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3143551 · Cited by 88 · see citing works
Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security
Wang, C., & Zhu, H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3191493 · Cited by 74 · see citing works
E-GRACL: an IoT intrusion detection system based on graph neural networks
Lin, L., Zhong, Q., Qiu, J., & Liang, Z. (2024) · The Journal of Supercomputing · doi:10.1007/s11227-024-06471-5 · Cited by 73 · see citing works
Goyal, A., Han, X., Wang, G., & Bates, A. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24207 · Cited by 67 · see citing works
Levshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 62 · see citing works
Li, X., Li, X., Jia, J., Li, L., Yuan, J., Gao, Y., & Yu, S. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3245413 · Cited by 60 · see citing works
A graph empowered insider threat detection framework based on daily activities
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., Liu, M., & Man, C. (2023) · ISA Transactions · doi:10.1016/j.isatra.2023.06.030 · Cited by 60 · see citing works
SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection
Apruzzese, G., Laskov, P., & Schneider, J. (2023) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp57164.2023.00042 · Cited by 58 · see citing works
Logging to the Danger Zone: Race Condition Attacks and Defenses on System Audit Frameworks
Paccagnella, R., Liao, K., Tian, D. J., & Bates, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417862 · Cited by 51 · see citing works
Wang, Z. Q., & El Saddik, A. (2023) · IEEE Access · doi:10.1109/access.2023.3324371 · Cited by 49 · see citing works
Robust Anomaly-Based Insider Threat Detection Using Graph Neural Network
Xiao, J., Yang, L., Zhong, F., Wang, X., Chen, H., & Li, D. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3222635 · Cited by 48 · see citing works
Learning Approximate Execution Semantics From Traces for Binary Function Similarity
Pei, K., Xuan, Z., Yang, J., Jana, S., & Ray, B. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2022.3231621 · Cited by 48 · see citing works
ALchemist: Fusing Application and Audit Logs for Precise Attack Provenance without Instrumentation
Yu, L., Ma, S., Zhang, Z., Tao, G., Zhang, X., Xu, D., Urias, V. E., Han, L., Ciocarlie, G. F., Yegneswaran, V., et al. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24445 · Cited by 47 · see citing works
BRITD: behavior rhythm insider threat detection with time awareness and user adaptation
Song, S., Gao, N., Zhang, Y., & Ma, C. (2024) · Cybersecurity · doi:10.1186/s42400-023-00190-9 · Cited by 45 · see citing works
“Similarly, Soh et al. (2019) (Liu et al. 2019).”
BackgroundMethodLayerLog: Log sequence anomaly detection based on hierarchical semantics
Zhang, C., Wang, X., Zhang, H., Zhang, J., Zhang, H., Liu, C., & Han, P. (2022) · Applied Soft Computing · doi:10.1016/j.asoc.2022.109860 · Cited by 45 · see citing works
Fu, C., Li, Q. L., Xu, K., & Wu, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3616631 · Cited by 45 · see citing works
ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search
Altınışık, E., Deniz, F., & Sencar, H. T. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623187 · Cited by 44 · see citing works
Advanced Persistent Threat Attack Detection Systems: A Review of Approaches, Challenges, and Trends
Buchta, R., Gkoktsis, G., Heine, F., & Kleiner, C. (2024) · Digital Threats Research and Practice · doi:10.1145/3696014 · Cited by 43 · see citing works
Temporal Logical Attention Network for Log-Based Anomaly Detection in Distributed Systems
Liu, Y., Ren, S., Wang, X., & Zhou, M. (2024) · Sensors · doi:10.3390/s24247949 · Cited by 43 · see citing works
ITDBERT: Temporal-semantic Representation for Insider Threat Detection
Huang, W., Zhu, H., Li, C., Lv, Q., Wang, Y., & Yang, H. (2021) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc53001.2021.9631538 · Cited by 41 · see citing works
R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection
Goyal, A., Wang, G., & Bates, A. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00253 · Cited by 41 · see citing works
LogKG: Log Failure Diagnosis Through Knowledge Graph
Sui, Y., Zhang, Y., Sun, J., Xu, T., Zhang, S., Li, Z., Sun, Y., Guo, F., Shen, J., Zhang, Y., et al. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3293890 · Cited by 40 · see citing works
LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection
Cai, X., Wang, Y., Xu, S., Li, H., Zhang, Y., Liu, Z., & Yuan, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3488527 · Cited by 40 · see citing works
An empirical study of the impact of log parsers on the performance of log-based anomaly detection
Fu, Y., Yan, M. L., Xu, Z., Xia, X., Zhang, X., & Yang, D. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10214-6 · Cited by 38 · see citing works
Ashizawa, N., Yanai, N., Cruz, J. P., & Okamura, S. (2022) · Blockchain Research and Applications · doi:10.1016/j.bcra.2022.100101 · Cited by 38 · see citing works
Cyber threat prediction using dynamic heterogeneous graph learning
Zhao, J., Shao, M., Wang, H., Yu, X., Li, B. H., & Liu, X. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.108086 · Cited by 36 · see citing works
Graph Intelligence Enhanced Bi-Channel Insider Threat Detection
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., & Liu, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-23020-2_5 · Cited by 34 · see citing works
T-Trace: Constructing the APTs Provenance Graphs Through Multiple Syslogs Correlation
Li, T., Liu, X., Qiao, W., Zhu, X., Shen, Y., & Ma, J. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3273918 · Cited by 34 · see citing works
Investigating and improving log parsing in practice
Fu, Y., Yan, M. L., Xu, J., Li, J., Liu, Z., Zhang, X., & Yang, D. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3558947 · Cited by 34 · see citing works
Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
Wang, J., Sun, Q., & Zhou, C. (2023) · Applied Sciences · doi:10.3390/app132413021 · Cited by 32 · see citing works
GraphCH: A Deep Framework for Assessing Cyber-Human Aspects in Insider Threat Detection
Roy, K. C., & Chen, Q. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3353929 · Cited by 32 · see citing works
Detection of compromised functions in a serverless cloud environment
Ben-Shimol, L., Lavi, D., Klevansky, E., Brodt, O., Mimran, D., Elovici, Y., & Shabtai, A. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104261 · Cited by 30 · see citing works
DeepTaskAPT: Insider APT detection using Task-tree based Deep Learning
Mamun, M., & Shi, K. (2021) · 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00102 · Cited by 29 · see citing works
Pikachu: Temporal Walk Based Dynamic Graph Embedding for Network Anomaly Detection
Paudel, R., & Huang, H. H. (2022) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms54207.2022.9789921 · Cited by 29 · see citing works
Sec2graph: Network Attack Detection Based on Novelty Detection on Graph Structured Data
Leichtnam, L., Totel, É., Prigent, N., & Mé, L. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-52683-2_12 · Cited by 29 · see citing works
Wang, Z. Q., Wang, H., & Saddik, A. E. (2024) · IEEE Access · doi:10.1109/access.2024.3482988 · Cited by 28 · see citing works
Domain adaptation for Windows advanced persistent threat detection
Coulter, R., Zhang, J., Pan, L., & Xiang, Y. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102496 · Cited by 28 · see citing works
Zhang, B., Gao, Y., Kuang, B., Yu, C., Fu, A., & Susilo, W. (2024) · ACM Computing Surveys · doi:10.1145/3700749 · Cited by 26 · see citing works
LogEval: A comprehensive benchmark suite for LLMs in log analysis
Cui, T., Ma, S., Chen, Z., Xiao, T., Zhao, C., Tao, S., Liu, Y., Zhang, S., Lin, D., Liu, C., et al. (2025) · Empirical Software Engineering · doi:10.1007/s10664-025-10701-6 · Cited by 26 · see citing works
LogM : Log Analysis for Multiple Components of Hadoop Platform
Xie, Y., Yang, K., & Luo, P. (2021) · IEEE Access · doi:10.1109/access.2021.3076897 · Cited by 25 · see citing works
Secure Namespaced Kernel Audit for Containers
Lim, S. Y., Stelea, B., Han, X., & Pasquier, T. (2021) · ACM Symposium on Cloud Computing (SoCC) · doi:10.1145/3472883.3486976 · Cited by 25 · see citing works
MP-GCN: A Phishing Nodes Detection Approach via Graph Convolution Network for Ethereum
Yu, T., Chen, X., Xu, Z., & Xu, J. (2022) · Applied Sciences · doi:10.3390/app12147294 · Cited by 24 · see citing works
Towards Next-Generation Cybersecurity with Graph AI
Bowman, B., & Huang, H. H. (2021) · ACM SIGOPS Operating Systems Review · doi:10.1145/3469379.3469386 · Cited by 23 · see citing works
TeLL: log level suggestions via modeling multi-level code block information
Liu, J., Zeng, J., Wang, X., Ji, K., & Liang, Z. (2022) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3533767.3534379 · Cited by 23 · see citing works
A Survey of Deep Anomaly Detection for System Logs
Zhao, X., Jiang, Z., & Ma, J. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892726 · Cited by 23 · see citing works
LaAeb: A comprehensive log-text analysis based approach for insider threat detection
Fei, K., Zhou, J., Zhou, Y., Gu, X., Fan, H., Li, B., Wang, W., & Chen, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104126 · Cited by 22 · see citing works
Bhattarai, B. D., & Huang, H. H. (2022) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3488932.3523261 · Cited by 22 · see citing works
Li, L., & Chen, W. (2024) · Electronics · doi:10.3390/electronics13050945 · Cited by 22 · see citing works
Anomaly Detection on Interleaved Log Data With Semantic Association Mining on Log-Entity Graph
Chu, G., Wang, J., Qi, Q., Sun, H., Zhuang, Z., He, B., Jing, Y., Zhang, L., & Liao, J. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3527856 · Cited by 22 · see citing works
Cybersecurity Threat Intelligence Augmentation and Embedding Improvement - A Healthcare Usecase
Sills, M., Ranade, P., & Mittal, S. (2020) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi49825.2020.9280482 · Cited by 21 · see citing works
Automatic Parsing and Utilization of System Log Features in Log Analysis: A Survey
Ma, J., Liu, Y., Wan, H., & Sun, G. (2023) · Applied Sciences · doi:10.3390/app13084930 · Cited by 20 · see citing works
EdgeTorrent: Real-time Temporal Graph Representations for Intrusion Detection
King, I. J., Shu, X., Jang, J., Eykholt, K., Lee, T., & Huang, H. H. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607201 · Cited by 20 · see citing works
Training regime influences to semi-supervised learning for insider threat detection
Le, D. C., Zincir-Heywood, N., & Heywood, M. I. (2021) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw53761.2021.00010 · Cited by 19 · see citing works
A Graph Convolution Neural Network Based Method for Insider Threat Detection
Fei, K., Zhou, J., Su, L., Wang, W., Chen, Y., & Zhang, F. (2022) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa-bdcloud-socialcom-sustaincom57177.2022.00016 · Cited by 19 · see citing works
MLTracer: Malicious Logins Detection System via Graph Neural Network
Liu, F., Wen, Y., Wu, Y., Liang, S., Jiang, X., & Meng, D. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00099 · Cited by 18 · see citing works
Self-citationUnsupervised Contextual Anomaly Detection for Database Systems
Li, S., Yin, Q., Li, G., Li, Q. L., Liu, Z., & Zhu, J. (2022) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/3514221.3517861 · Cited by 17 · see citing works
ProcSAGE: an efficient host threat detection method based on graph representation learning
Xu, B., Gong, Y., Geng, X., Li, Y., Dong, C., Liu, S., Liu, Y., Jiang, B., & Lü, Z. (2024) · Cybersecurity · doi:10.1186/s42400-024-00240-w · Cited by 16 · see citing works
SparkAC: Fine-Grained Access Control in Spark for Secure Data Sharing and Analytics
Xue, T., Wen, Y., Luo, B., Li, G., Li, Y., Zhang, B., Zheng, Y., Hu, Y., & Meng, D. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3149544 · Cited by 16 · see citing works
Self-citationDeep Temporal Graph Infomax for Imbalanced Insider Threat Detection
Gao, P., Zhang, H., Wang, M., Yang, W., Wei, X., Lv, Z., & Ma, Z. (2023) · Journal of Computer Information Systems · doi:10.1080/08874417.2023.2267510 · Cited by 16 · see citing works
Kumar, A., Noliya, A., & Makani, R. (2023) · International Journal of Adaptive Control and Signal Processing · doi:10.1002/acs.3717 · Cited by 16 · see citing works
Yuan, L.-P., Liu, P., & Zhu, S. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453098 · Cited by 16 · see citing works
Insider Intrusion Detection Techniques: A State-of-the-Art Review
Nisha, T. N., & Pramod, D. (2023) · Journal of Computer Information Systems · doi:10.1080/08874417.2023.2175337 · Cited by 16 · see citing works
InterpretableSAD: Interpretable Anomaly Detection in Sequential Log Data
Han, X., Cheng, H., Xu, D., & Yuan, S. (2021) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata52589.2021.9671642 · Cited by 15 · see citing works
AJSAGE: A intrusion detection scheme based on Jump-Knowledge Connection To GraphSAGE
Xu, L., Zhao, Z., Zhao, D., Li, X., Lu, X., & Yan, D. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104263 · Cited by 15 · see citing works
SENTINEL: Insider Threat Detection Based on Multi-Timescale User Behavior Interaction Graph Learning
Xiao, F., Chen, S., Chen, S. J., Ma, Y., He, H., & Yang, J. (2024) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2024.3519155 · Cited by 15 · see citing works
Trace2Vec: Detecting complex multi-step attacks with explainable graph neural network
Liu, W., Gao, P., Zhang, H., Li, K., Yang, W., Wei, X., & Shu, J. (2025) · Pattern Recognition · doi:10.1016/j.patcog.2025.111363 · Cited by 15 · see citing works
Building Machine Learning-based Threat Hunting System from Scratch
Chen, C.-K., Lin, S.-C., Huang, S.-C., Chu, Y.-T., Lei, C., & Huang, C. (2021) · Digital Threats Research and Practice · doi:10.1145/3491260 · Cited by 15 · see citing works
Wei, X., Wang, J., Sun, C., Towey, D., Shoufeng, Z., Zuo, W., Yu, Y., Ruan, R., & Song, G. (2024) · Journal of Software Evolution and Process · doi:10.1002/smr.2650 · Cited by 14 · see citing works
A novel intelligent cognitive computing-based APT malware detection for Endpoint systems
Xuan, C. D., Huong, D., & Nguyen, T.-V. (2022) · Journal of Intelligent & Fuzzy Systems · doi:10.3233/jifs-220233 · Cited by 14 · see citing works
Few-Shot Log Anomaly Detection Based on Matching Networks
Han, C., Guan, B., Li, T., Kang, D., Qin, J., & Wu, Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3363626 · Cited by 13 · see citing works
GMFITD: Graph Meta-Learning for Effective Few-Shot Insider Threat Detection
Li, X., Li, L., Li, X., Cai, B., Jia, J., Gao, Y., & Yu, S. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3430106 · Cited by 13 · see citing works
Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosis
Huang, J., Jiang, Z., Liu, J., Huo, Y., Gu, J., Chen, Z., Feng, C., Dong, H., Yang, Z., & Lyu, M. R.-T. (2024) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre62328.2024.00055 · Cited by 13 · see citing works
Yuan, Z., Sun, Q., Zhou, H., Shao, M., & Fu, X. (2025) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-024-02516-6 · Cited by 13 · see citing works
An Approach for Poisoning Attacks Against RNN-Based Cyber Anomaly Detection
Xu, J., Wen, Y., Yang, C. H., & Meng, D. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00231 · Cited by 13 · see citing works
Self-citationTime-Window Based Group-Behavior Supported Method for Accurate Detection of Anomalous Users
Yuan, L.-P., Choo, E., Yu, T., Khalil, I. M., & Zhu, S. (2021) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48987.2021.00038 · Cited by 13 · see citing works
GRU and Multi-autoencoder based Insider Threat Detection for Cyber Security
Meng, F., Lu, P., Li, J., Hu, T., Yin, M., & Lou, F. (2021) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc53577.2021.00035 · Cited by 13 · see citing works
An APT Malware Classification Method Based on Adaboost Feature Selection and LightGBM
Xu, N., Li, S., Wu, X., Han, W., & Luo, X. (2021) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc53577.2021.00101 · Cited by 13 · see citing works
A Causal Graph-Based Approach for APT Predictive Analytics
Liu, H., & Jiang, R. (2023) · Electronics · doi:10.3390/electronics12081849 · Cited by 12 · see citing works
Zhu, X., Dong, J., Qi, J., Zhou, Z., Dong, Z., Sun, Y., & Moyu, W. (2024) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2024.3393491 · Cited by 12 · see citing works
Soylu, M., & Daş, R. (2025) · IEEE Access · doi:10.1109/access.2025.3603403 · Cited by 12 · see citing works
Prov2vec: Learning Provenance Graph Representation for Anomaly Detection in Computer Systems
Bhattarai, B. D., & Huang, H. H. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3664494 · Cited by 11 · see citing works
Qiu, K., Zhang, Y., Feng, Y., & Chen, F. (2025) · Journal of Network and Systems Management · doi:10.1007/s10922-025-09912-5 · Cited by 10 · see citing works
Yang, W., Gao, P., Huang, H., Wei, X., Zhang, H., & Qu, Z. (2022) · Globecom · doi:10.1109/globecom48099.2022.10001486 · Cited by 10 · see citing works
Xu, J., Shu, X., & Li, Z. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00012 · Cited by 10 · see citing works
- Authors
- Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D.
- Affiliations
- Institute of Information Engineering (CN)
- Chinese Academy of Sciences (CN)
- Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
- Pennsylvania State University (US)
- Venue
- Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2019-11-06
- Pages
- 1777-1794
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2986944522
- Cited by
- 319
- References
- 23
- Citations by year
- 2026: 46 · 2025: 61 · 2024: 64 · 2023: 47 · 2022: 47 · 2021: 45 · 2020: 9
- FWCI
- 21.82
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Chinese Academy of Sciences (No.XDC02010300)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Keywords
- heterogeneous graph embedding, insider attacks, advanced persistent threats, information systems security, user behavior analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
