The DOI matches its Crossref record; 23 of the 23 references it cites were found in a registry or an index.
Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise
Abstract
Conventional attacks of insider employees and emerging APT are both major threats for the organizational information system. Existing detections mainly concentrate on users' behavior and usually analyze logs recording their operations in an information system. In general, most of these methods consider sequential relationship among log entries and model users' sequential behavior. However, they ignore other relationships, inevitably leading to an unsatisfactory performance on various attack scenarios. We propose log2vec, a heterogeneous graph embedding based modularized method. First, it involves a heuristic approach that converts log entries into a heterogeneous graph in the light of diverse relationships among them. Next, it utilizes an improved graph embedding appropriate to the above heterogeneous graph, which can automatically represent each log entry into a low-dimension vector. The third component of log2vec is a practical detection algorithm capable of separating malicious and benign log entries into different clusters and identifying malicious ones. We implement a prototype of log2vec. Our evaluation demonstrates that log2vec remarkably outperforms state-of-the-art approaches, such as deep learning and hidden markov model (HMM). Besides, log2vec shows its capability to detect malicious events in various attack scenarios.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“However, these methods mainly focus on relative time information of user activity and do not establish a direct connection with the specific timing of user activities.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Liu et al. (2019)
Citations
Cites
node2vec: Scalable Feature Learning for Networks
Grover, A., & Leskovec, J. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939754 · Cited by 10,926
(2007) · doi:10.5555/1283383.1283494 · Cited by 7,364
LINE: Large-scale Information Network Embedding
Tang, J., Qu, M., Wang, M., Zhang, M., Yan, J., & Mei, Q. (2015) · Proceedings of the 24th International Conference on World Wide Web · doi:10.1145/2736277.2741093 · Cited by 5,416
Dong, Y., Chawla, N. V., & Swami, A. (2017) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3097983.3098036 · Cited by 2,295
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Yanardag, P., & Vishwanathan, S. V. N. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783417 · Cited by 1,168
Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection
Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., & Song, D. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134018 · Cited by 704
Discriminative Embeddings of Latent Variable Models for Structured DataPreprint
Dai, H., Dai, B., & Song, L. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1603.05629 · Cited by 534
Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint
Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 347
The Robustness of the "Binormal" Assumptions Used in Fitting ROC Curves
Hanley, J. A. (1988) · Medical Decision Making · doi:10.1177/0272989x8800800308 · Cited by 308
Cited by
Sorted by citations
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534113 · Cited by 454
A Survey on Automated Log Analysis for Reliability Engineering
He, S., He, P., Chen, Z., Yang, T., Su, Y., & Lyu, M. R. (2022) · ACM Computing Surveys · doi:10.1145/3460345 · Cited by 334
Deep learning for insider threat detection: Review, challenges and opportunities
Yuan, S., & Wu, X. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102221 · Cited by 271
Graph Neural Networks for Intrusion Detection: A Survey
Bilot, T., Madhoun, N. E., Agha, K. A., & Zouaoui, A. (2023) · IEEE Access · doi:10.1109/access.2023.3275789 · Cited by 294
Log-based anomaly detection with deep learning: how far are we?
Le, V.-H., & Zhang, H. (2022) · Proceedings of the 44th International Conference on Software Engineering · doi:10.1145/3510003.3510155 · Cited by 257
THREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning
Wang, S., Wang, Z., Zhou, T., Sun, H., Yin, X., Han, D., Zhang, H., Shi, X., & Yang, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3208815 · Cited by 263
Provenance-based Intrusion Detection Systems: A Survey
Zipperle, M., Gottwalt, F., Chang, E. J., & Dillon, T. S. (2022) · ACM Computing Surveys · doi:10.1145/3539605 · Cited by 160
Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance
Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., & Han, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00005 · Cited by 190
Anomaly Detection for Insider Threats Using Unsupervised Ensembles
Le, D. C., & Zincir-Heywood, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3071928 · Cited by 147
{ATLAS}: A Sequence-based Learning Approach for Attack Investigation
Alsaheel, A., Nan, Y., Ma, S., Yu, L., Walkup, G., Celik, Z. B., Zhang, X., & Xu, D. (2021) · USENIX Security Symposium · Cited by 134
WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics
Zeng, J., Chua, Z. L., Chen, Y., Ji, K., Liang, Z., & Mao, J. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24549 · Cited by 126
Threat detection and investigation with system-level provenance graphs: A survey
Li, Z., Chen, Q. A., Yang, R., Chen, Y., & Ruan, W. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102282 · Cited by 125
Ashizawa, N., Yanai, N., Cruz, J. P., & Okamura, S. (2021) · ACM International Symposium on Blockchain and Secure Critical Infrastructure (BSCI) · doi:10.1145/3457337.3457841 · Cited by 115
LogFiT: Log Anomaly Detection Using Fine-Tuned Language Models
Almodovar, C., Sabrina, F., Karimi, S., & Azad, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3358730 · Cited by 111
DEEPCASE: Semi-Supervised Contextual Analysis of Security Events
van Ede, T., Aghakhani, H., Spahn, N., Bortolameotti, R., Cova, M., Continella, A., van Steen, M. R., Peter, A., Kruegel, C., & Vigna, G. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833671 · Cited by 104
DEPCOMM: Graph Summarization on System Audit Logs for Attack Investigation
Xu, Z., Fang, P., Liu, C., Xiao, X., Wen, Y. T., & Meng, D. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833632 · Cited by 89
Self-citationDeepAG: Attack Graph Construction and Threats Prediction With Bi-Directional Deep Learning
Li, T., Jiang, Y. L., Lin, C., Obaidat, M. S., Shen, Y., & Ma, J. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3143551 · Cited by 88
Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security
Wang, C., & Zhu, H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3191493 · Cited by 80
E-GRACL: an IoT intrusion detection system based on graph neural networks
Lin, L., Zhong, Q., Qiu, J., & Liang, Z. (2024) · The Journal of Supercomputing · doi:10.1007/s11227-024-06471-5 · Cited by 73
Goyal, A., Han, X., Wang, G., & Bates, A. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24207 · Cited by 70
Levshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 67
Li, X., Li, X., Jia, J., Li, L., Yuan, J., Gao, Y., & Yu, S. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3245413 · Cited by 60
A graph empowered insider threat detection framework based on daily activities
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., Liu, M., & Man, C. (2023) · ISA Transactions · doi:10.1016/j.isatra.2023.06.030 · Cited by 60
SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection
Apruzzese, G., Laskov, P., & Schneider, J. (2023) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp57164.2023.00042 · Cited by 73
Logging to the Danger Zone: Race Condition Attacks and Defenses on System Audit Frameworks
Paccagnella, R., Liao, K., Tian, D. J., & Bates, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417862 · Cited by 56
Wang, Z. Q., & El Saddik, A. (2023) · IEEE Access · doi:10.1109/access.2023.3324371 · Cited by 49
Robust Anomaly-Based Insider Threat Detection Using Graph Neural Network
Xiao, J., Yang, L., Zhong, F., Wang, X., Chen, H., & Li, D. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3222635 · Cited by 48
Learning Approximate Execution Semantics From Traces for Binary Function Similarity
Pei, K., Xuan, Z., Yang, J., Jana, S., & Ray, B. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2022.3231621 · Cited by 53
ALchemist: Fusing Application and Audit Logs for Precise Attack Provenance without Instrumentation
Yu, L., Ma, S., Zhang, Z., Tao, G., Zhang, X., Xu, D., Urias, V. E., Han, L., Ciocarlie, G. F., Yegneswaran, V., et al. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24445 · Cited by 47
BRITD: behavior rhythm insider threat detection with time awareness and user adaptation
Song, S., Gao, N., Zhang, Y., & Ma, C. (2024) · Cybersecurity · doi:10.1186/s42400-023-00190-9 · Cited by 45
“Similarly, Soh et al. (2019) (Liu et al. 2019).”
BackgroundMethodLayerLog: Log sequence anomaly detection based on hierarchical semantics
Zhang, C., Wang, X., Zhang, H., Zhang, J., Zhang, H., Liu, C., & Han, P. (2022) · Applied Soft Computing · doi:10.1016/j.asoc.2022.109860 · Cited by 52
Fu, C., Li, Q. L., Xu, K., & Wu, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3616631 · Cited by 45
ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search
Altınışık, E., Deniz, F., & Sencar, H. T. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623187 · Cited by 52
Advanced Persistent Threat Attack Detection Systems: A Review of Approaches, Challenges, and Trends
Buchta, R., Gkoktsis, G., Heine, F., & Kleiner, C. (2024) · Digital Threats Research and Practice · doi:10.1145/3696014 · Cited by 51
Temporal Logical Attention Network for Log-Based Anomaly Detection in Distributed Systems
Liu, Y., Ren, S., Wang, X., & Zhou, M. (2024) · Sensors · doi:10.3390/s24247949 · Cited by 53
ITDBERT: Temporal-semantic Representation for Insider Threat Detection
Huang, W., Zhu, H., Li, C., Lv, Q., Wang, Y., & Yang, H. (2021) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc53001.2021.9631538 · Cited by 41
R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection
Goyal, A., Wang, G., & Bates, A. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00253 · Cited by 47
LogKG: Log Failure Diagnosis Through Knowledge Graph
Sui, Y., Zhang, Y., Sun, J., Xu, T., Zhang, S., Li, Z., Sun, Y., Guo, F., Shen, J., Zhang, Y., et al. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3293890 · Cited by 48
LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection
Cai, X., Wang, Y., Xu, S., Li, H., Zhang, Y., Liu, Z., & Yuan, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3488527 · Cited by 46
An empirical study of the impact of log parsers on the performance of log-based anomaly detection
Fu, Y., Yan, M. L., Xu, Z., Xia, X., Zhang, X., & Yang, D. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10214-6 · Cited by 38
Ashizawa, N., Yanai, N., Cruz, J. P., & Okamura, S. (2022) · Blockchain Research and Applications · doi:10.1016/j.bcra.2022.100101 · Cited by 38
Cyber threat prediction using dynamic heterogeneous graph learning
Zhao, J., Shao, M., Wang, H., Yu, X., Li, B. H., & Liu, X. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.108086 · Cited by 39
Graph Intelligence Enhanced Bi-Channel Insider Threat Detection
Hong, W., Yin, J., You, M., Wang, H., Cao, J., Li, J., & Liu, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-23020-2_5 · Cited by 34
T-Trace: Constructing the APTs Provenance Graphs Through Multiple Syslogs Correlation
Li, T., Liu, X., Qiao, W., Zhu, X., Shen, Y., & Ma, J. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3273918 · Cited by 34
Investigating and improving log parsing in practice
Fu, Y., Yan, M. L., Xu, J., Li, J., Liu, Z., Zhang, X., & Yang, D. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3558947 · Cited by 34
Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
Wang, J., Sun, Q., & Zhou, C. (2023) · Applied Sciences · doi:10.3390/app132413021 · Cited by 32
GraphCH: A Deep Framework for Assessing Cyber-Human Aspects in Insider Threat Detection
Roy, K. C., & Chen, Q. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3353929 · Cited by 32
Detection of compromised functions in a serverless cloud environment
Ben-Shimol, L., Lavi, D., Klevansky, E., Brodt, O., Mimran, D., Elovici, Y., & Shabtai, A. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104261 · Cited by 33
DeepTaskAPT: Insider APT detection using Task-tree based Deep Learning
Mamun, M., & Shi, K. (2021) · 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00102 · Cited by 29
Pikachu: Temporal Walk Based Dynamic Graph Embedding for Network Anomaly Detection
Paudel, R., & Huang, H. H. (2022) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms54207.2022.9789921 · Cited by 32
Sec2graph: Network Attack Detection Based on Novelty Detection on Graph Structured Data
Leichtnam, L., Totel, É., Prigent, N., & Mé, L. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-52683-2_12 · Cited by 29
Wang, Z. Q., Wang, H., & Saddik, A. E. (2024) · IEEE Access · doi:10.1109/access.2024.3482988 · Cited by 28
Domain adaptation for Windows advanced persistent threat detection
Coulter, R., Zhang, J., Pan, L., & Xiang, Y. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102496 · Cited by 28
Zhang, B., Gao, Y., Kuang, B., Yu, C., Fu, A., & Susilo, W. (2024) · ACM Computing Surveys · doi:10.1145/3700749 · Cited by 30
LogEval: A comprehensive benchmark suite for LLMs in log analysis
Cui, T., Ma, S., Chen, Z., Xiao, T., Zhao, C., Tao, S., Liu, Y., Zhang, S., Lin, D., Liu, C., et al. (2025) · Empirical Software Engineering · doi:10.1007/s10664-025-10701-6 · Cited by 36
LogM : Log Analysis for Multiple Components of Hadoop Platform
Xie, Y., Yang, K., & Luo, P. (2021) · IEEE Access · doi:10.1109/access.2021.3076897 · Cited by 25
Secure Namespaced Kernel Audit for Containers
Lim, S. Y., Stelea, B., Han, X., & Pasquier, T. (2021) · ACM Symposium on Cloud Computing (SoCC) · doi:10.1145/3472883.3486976 · Cited by 25
MP-GCN: A Phishing Nodes Detection Approach via Graph Convolution Network for Ethereum
Yu, T., Chen, X., Xu, Z., & Xu, J. (2022) · Applied Sciences · doi:10.3390/app12147294 · Cited by 24
Towards Next-Generation Cybersecurity with Graph AI
Bowman, B., & Huang, H. H. (2021) · ACM SIGOPS Operating Systems Review · doi:10.1145/3469379.3469386 · Cited by 23
TeLL: log level suggestions via modeling multi-level code block information
Liu, J., Zeng, J., Wang, X., Ji, K., & Liang, Z. (2022) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3533767.3534379 · Cited by 23
A Survey of Deep Anomaly Detection for System Logs
Zhao, X., Jiang, Z., & Ma, J. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892726 · Cited by 23
LaAeb: A comprehensive log-text analysis based approach for insider threat detection
Fei, K., Zhou, J., Zhou, Y., Gu, X., Fan, H., Li, B., Wang, W., & Chen, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104126 · Cited by 24
Bhattarai, B. D., & Huang, H. H. (2022) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3488932.3523261 · Cited by 25
Li, L., & Chen, W. (2024) · Electronics · doi:10.3390/electronics13050945 · Cited by 23
Anomaly Detection on Interleaved Log Data With Semantic Association Mining on Log-Entity Graph
Chu, G., Wang, J., Qi, Q., Sun, H., Zhuang, Z., He, B., Jing, Y., Zhang, L., & Liao, J. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3527856 · Cited by 25
Cybersecurity Threat Intelligence Augmentation and Embedding Improvement - A Healthcare Usecase
Sills, M., Ranade, P., & Mittal, S. (2020) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi49825.2020.9280482 · Cited by 21
Automatic Parsing and Utilization of System Log Features in Log Analysis: A Survey
Ma, J., Liu, Y., Wan, H., & Sun, G. (2023) · Applied Sciences · doi:10.3390/app13084930 · Cited by 23
EdgeTorrent: Real-time Temporal Graph Representations for Intrusion Detection
King, I. J., Shu, X., Jang, J., Eykholt, K., Lee, T., & Huang, H. H. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607201 · Cited by 22
Training regime influences to semi-supervised learning for insider threat detection
Le, D. C., Zincir-Heywood, N., & Heywood, M. I. (2021) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw53761.2021.00010 · Cited by 19
A Graph Convolution Neural Network Based Method for Insider Threat Detection
Fei, K., Zhou, J., Su, L., Wang, W., Chen, Y., & Zhang, F. (2022) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa-bdcloud-socialcom-sustaincom57177.2022.00016 · Cited by 19
MLTracer: Malicious Logins Detection System via Graph Neural Network
Liu, F., Wen, Y., Wu, Y., Liang, S., Jiang, X., & Meng, D. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00099 · Cited by 18
Self-citationUnsupervised Contextual Anomaly Detection for Database Systems
Li, S., Yin, Q., Li, G., Li, Q. L., Liu, Z., & Zhu, J. (2022) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/3514221.3517861 · Cited by 19
ProcSAGE: an efficient host threat detection method based on graph representation learning
Xu, B., Gong, Y., Geng, X., Li, Y., Dong, C., Liu, S., Liu, Y., Jiang, B., & Lü, Z. (2024) · Cybersecurity · doi:10.1186/s42400-024-00240-w · Cited by 18
SparkAC: Fine-Grained Access Control in Spark for Secure Data Sharing and Analytics
Xue, T., Wen, Y., Luo, B., Li, G., Li, Y., Zhang, B., Zheng, Y., Hu, Y., & Meng, D. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3149544 · Cited by 16
Self-citationDeep Temporal Graph Infomax for Imbalanced Insider Threat Detection
Gao, P., Zhang, H., Wang, M., Yang, W., Wei, X., Lv, Z., & Ma, Z. (2023) · Journal of Computer Information Systems · doi:10.1080/08874417.2023.2267510 · Cited by 16
Kumar, A., Noliya, A., & Makani, R. (2023) · International Journal of Adaptive Control and Signal Processing · doi:10.1002/acs.3717 · Cited by 16
Yuan, L.-P., Liu, P., & Zhu, S. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453098 · Cited by 16
Insider Intrusion Detection Techniques: A State-of-the-Art Review
Nisha, T. N., & Pramod, D. (2023) · Journal of Computer Information Systems · doi:10.1080/08874417.2023.2175337 · Cited by 16
InterpretableSAD: Interpretable Anomaly Detection in Sequential Log Data
Han, X., Cheng, H., Xu, D., & Yuan, S. (2021) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata52589.2021.9671642 · Cited by 15
AJSAGE: A intrusion detection scheme based on Jump-Knowledge Connection To GraphSAGE
Xu, L., Zhao, Z., Zhao, D., Li, X., Lu, X., & Yan, D. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104263 · Cited by 16
SENTINEL: Insider Threat Detection Based on Multi-Timescale User Behavior Interaction Graph Learning
Xiao, F., Chen, S., Chen, S. J., Ma, Y., He, H., & Yang, J. (2024) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2024.3519155 · Cited by 15
Trace2Vec: Detecting complex multi-step attacks with explainable graph neural network
Liu, W., Gao, P., Zhang, H., Li, K., Yang, W., Wei, X., & Shu, J. (2025) · Pattern Recognition · doi:10.1016/j.patcog.2025.111363 · Cited by 16
Building Machine Learning-based Threat Hunting System from Scratch
Chen, C.-K., Lin, S.-C., Huang, S.-C., Chu, Y.-T., Lei, C., & Huang, C. (2021) · Digital Threats Research and Practice · doi:10.1145/3491260 · Cited by 18
Wei, X., Wang, J., Sun, C., Towey, D., Shoufeng, Z., Zuo, W., Yu, Y., Ruan, R., & Song, G. (2024) · Journal of Software Evolution and Process · doi:10.1002/smr.2650 · Cited by 14
A novel intelligent cognitive computing-based APT malware detection for Endpoint systems
Xuan, C. D., Huong, D., & Nguyen, T.-V. (2022) · Journal of Intelligent & Fuzzy Systems · doi:10.3233/jifs-220233 · Cited by 14
Few-Shot Log Anomaly Detection Based on Matching Networks
Han, C., Guan, B., Li, T., Kang, D., Qin, J., & Wu, Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3363626 · Cited by 13
GMFITD: Graph Meta-Learning for Effective Few-Shot Insider Threat Detection
Li, X., Li, L., Li, X., Cai, B., Jia, J., Gao, Y., & Yu, S. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3430106 · Cited by 13
Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosis
Huang, J., Jiang, Z., Liu, J., Huo, Y., Gu, J., Chen, Z., Feng, C., Dong, H., Yang, Z., & Lyu, M. R.-T. (2024) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre62328.2024.00055 · Cited by 13
Yuan, Z., Sun, Q., Zhou, H., Shao, M., & Fu, X. (2025) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-024-02516-6 · Cited by 14
An Approach for Poisoning Attacks Against RNN-Based Cyber Anomaly Detection
Xu, J., Wen, Y., Yang, C. H., & Meng, D. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00231 · Cited by 13
Self-citationTime-Window Based Group-Behavior Supported Method for Accurate Detection of Anomalous Users
Yuan, L.-P., Choo, E., Yu, T., Khalil, I. M., & Zhu, S. (2021) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48987.2021.00038 · Cited by 13
GRU and Multi-autoencoder based Insider Threat Detection for Cyber Security
Meng, F., Lu, P., Li, J., Hu, T., Yin, M., & Lou, F. (2021) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc53577.2021.00035 · Cited by 13
An APT Malware Classification Method Based on Adaboost Feature Selection and LightGBM
Xu, N., Li, S., Wu, X., Han, W., & Luo, X. (2021) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc53577.2021.00101 · Cited by 13
A Causal Graph-Based Approach for APT Predictive Analytics
Liu, H., & Jiang, R. (2023) · Electronics · doi:10.3390/electronics12081849 · Cited by 14
Zhu, X., Dong, J., Qi, J., Zhou, Z., Dong, Z., Sun, Y., & Moyu, W. (2024) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2024.3393491 · Cited by 12
Soylu, M., & Daş, R. (2025) · IEEE Access · doi:10.1109/access.2025.3603403 · Cited by 12
Prov2vec: Learning Provenance Graph Representation for Anomaly Detection in Computer Systems
Bhattarai, B. D., & Huang, H. H. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3664494 · Cited by 13
Qiu, K., Zhang, Y., Feng, Y., & Chen, F. (2025) · Journal of Network and Systems Management · doi:10.1007/s10922-025-09912-5 · Cited by 12
Yang, W., Gao, P., Huang, H., Wei, X., Zhang, H., & Qu, Z. (2022) · Globecom · doi:10.1109/globecom48099.2022.10001486 · Cited by 12
Xu, J., Shu, X., & Li, Z. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00012 · Cited by 10
Metadata
- Authors
- Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D.
- Affiliations
- Institute of Information Engineering (CN)
- Chinese Academy of Sciences (CN)
- Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
- Pennsylvania State University (US)
- Venue
- Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2019-11-06
- Pages
- 1777-1794
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2986944522
- Cited by
- 319
- References
- 23
- Citations by year
- 2026: 46 · 2025: 61 · 2024: 64 · 2023: 47 · 2022: 47 · 2021: 45 · 2020: 9
- FWCI
- 21.82
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Chinese Academy of Sciences (No.XDC02010300)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Keywords
- heterogeneous graph embedding, insider attacks, advanced persistent threats, information systems security, user behavior analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
