Cited by 324Network Security and Intrusion DetectionInformation and Cyber SecuritySoftware System Performance and Reliability

The DOI matches its Crossref record; 23 of the 23 references it cites were found in a registry or an index.

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

Liu, Fucheng, Wen, Yu, Zhang, Dongxue, Jiang, Xihe, Xing, Xinyu, Meng, Dan·2019·Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

DOI 10.1145/3319535.3363224

Open this paper in CoChat — free account

Abstract

Conventional attacks of insider employees and emerging APT are both major threats for the organizational information system. Existing detections mainly concentrate on users' behavior and usually analyze logs recording their operations in an information system. In general, most of these methods consider sequential relationship among log entries and model users' sequential behavior. However, they ignore other relationships, inevitably leading to an unsatisfactory performance on various attack scenarios. We propose log2vec, a heterogeneous graph embedding based modularized method. First, it involves a heuristic approach that converts log entries into a heterogeneous graph in the light of diverse relationships among them. Next, it utilizes an improved graph embedding appropriate to the above heterogeneous graph, which can automatically represent each log entry into a low-dimension vector. The third component of log2vec is a practical detection algorithm capable of separating malicious and benign log entries into different clusters and identifying malicious ones. We implement a prototype of log2vec. Our evaluation demonstrates that log2vec remarkably outperforms state-of-the-art approaches, such as deep learning and hidden markov model (HMM). Besides, log2vec shows its capability to detect malicious events in various attack scenarios.

Integrity signals

Registry

Crossref · 10.1145/3319535.3363224

Cites

23 of 23 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

node2vec: Scalable Feature Learning for Networks
Grover, A., & Leskovec, J. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939754 · Cited by 10,926
Untitled work
(2007) · doi:10.5555/1283383.1283494 · Cited by 7,364
LINE: Large-scale Information Network Embedding
Tang, J., Qu, M., Wang, M., Zhang, M., Yan, J., & Mei, Q. (2015) · Proceedings of the 24th International Conference on World Wide Web · doi:10.1145/2736277.2741093 · Cited by 5,416
metapath2vec
Dong, Y., Chawla, N. V., & Swami, A. (2017) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3097983.3098036 · Cited by 2,283
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Deep Graph Kernels
Yanardag, P., & Vishwanathan, S. V. N. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783417 · Cited by 1,168
Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection
Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., & Song, D. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134018 · Cited by 704
Discriminative Embeddings of Latent Variable Models for Structured DataPreprint
Dai, H., Dai, B., & Song, L. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1603.05629 · Cited by 534
Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint
Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 347
The Robustness of the "Binormal" Assumptions Used in Fitting ROC Curves
Hanley, J. A. (1988) · Medical Decision Making · doi:10.1177/0272989x8800800308 · Cited by 308

Flagged first, then by citations

Show all 23 references

Sorted by citations

Items 101–200 of 324

Detect Insider Threat with Associated Session Graph
Ding, J., Qian, P., Ma, J., Wang, Z., Lu, Y., & Xie, X. (2024) · Electronics · doi:10.3390/electronics13244885 · Cited by 10
A graph-based approach to detect unexplained sequences in a log
Cinque, M., Corte, R. D., Moscato, V., & Sperlí, G. (2021) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.114556 · Cited by 11
Foreseer: Efficiently Forecasting Malware Event Series with Long Short-Term Memory
Gogineni, K., Derasari, P., & Venkataramani, G. (2022) · International Symposium on Secure and Private Execution Environment Design (SEED) · doi:10.1109/seed55351.2022.00016 · Cited by 10
RShield: A Refined Shield for Complex Multi-step Attack Detection Based on Temporal Graph Network
Yang, W., Gao, P., Huang, H., Wei, X., Liu, W., Zhu, S., & Luo, W. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-00129-1_40 · Cited by 10
A novel malware detection method based on audit logs and graph neural network
Zhen, Y., Tian, D., Fu, X., & Hu, C. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.110524 · Cited by 13
Efficient intrusion detection via heterogeneous graph attention networks and parallel provenance analysis
Wu, L., Xie, Y., Zhao, S.-X., Zhou, P., Feng, D., Wildani, A., & Wu, Y.-F. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111552 · Cited by 9
KnowGraph: Knowledge-Enabled Anomaly Detection via Logical Reasoning on Graph Data
Zhou, A., Xu, X., Raghunathan, R., Lal, A., Guan, X., Yu, B., & Li, B. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690354 · Cited by 18
Detecting Unknown Threat Based on Continuous‐Time Dynamic Heterogeneous Graph Network
Gao, P., Yang, W., Zhang, H., Wei, X., Huang, H., Luo, W., Guo, Z., & Hao, Y. (2022) · Wireless Communications and Mobile Computing · doi:10.1155/2022/7502294 · Cited by 9
End-To-End Anomaly Detection for Identifying Malicious Cyber Behavior through NLP-Based Log EmbeddingsPreprint
Golczynski, A., & Emanuello, J. A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.12276 · Cited by 9
Apt Detection of Ransomware - An Approach to Detect Advanced Persistent Threats Using System Call Information
Baksi, R. P., Nalka, V., & Upadhyaya, S. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00221 · Cited by 9
Plenty of Phish in the Sea: Analyzing Potential Pre-attack Surfaces
Urban, T., Große-Kampmann, M., Tatang, D., Holz, T., & Pohlmann, N. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-59013-0_14 · Cited by 8
SIRAJ: A Unified Framework for Aggregation of Malicious Entity Detectors
Thirumuruganathan, S., Nabeel, M., Choo, E., Khalil, I. M., & Yu, T. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833725 · Cited by 8
Insider Threat Detection Using Generative Adversarial Graph Attention Networks
Li, C., Li, F., Yu, M., Guo, Y., Wen, Y., & Li, Z. (2022) · Globecom · doi:10.1109/globecom48099.2022.10001207 · Cited by 8
Self-citation
Multi-source data fusion for insider threat detection using residual networks
Ge, D., Zhong, S., & Chen, K. (2022) · doi:10.1109/cecit58139.2022.00069 · Cited by 8
Insider Threat Detection Based On Heterogeneous Graph Neural Network
Tian, T., Gong, Y., Jiang, B., Liu, J., Feng, H., & Lu, Z. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00096 · Cited by 8
DrSec: Flexible Distributed Representations for Efficient Endpoint Security
Sharif, M., Datta, P., Riddle, A., Westfall, K., Bates, A., Ganti, V., Lentzk, M., & Ott, D. E. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00145 · Cited by 10
BEDIM: Lateral Movement Detection In Enterprise Network Through Behavior Deviation Measurement
Dong, C., Chen, Y., Zhang, Y., Liu, Y., Lü, Z., Dong, P., & Liu, B. (2021) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys53884.2021.00076 · Cited by 8
Anomaly detection on software log based on Temporal Memory
Hirakawa, R., Uchida, H., Nakano, A., Tominaga, K., & Nakatoh, Y. (2021) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2021.107433 · Cited by 8
Brewing Vodka: Distilling Pure Knowledge for Lightweight Threat Detection in Audit Logs
Wu, W.-Y., Qiao, W., Yan, W., Jiang, B., Liu, Y., Liu, B., Lu, Z., & Liu, J. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3696410.3714563 · Cited by 7
Log2Graph: A graph convolution neural network based method for insider threat detection
Fei, K., Zhou, J., Su, L., Wang, W., & Chen, Y. (2024) · Journal of Computer Security · doi:10.3233/jcs-230092 · Cited by 7
FedHE-Graph: Federated Learning with Hybrid Encryption on Graph Neural Networks for Advanced Persistent Threat Detection
Bahar, A. A. M., Ferrahi, K. S., Messai, M., Seba, H., & Amrouche, K. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3670466 · Cited by 7
A Comprehensive Review of Anomaly Detection in Web Logs
Majd, M., Najafi, P., Alhosseini, S. A., Cheng, F., & Meinel, C. (2022) · IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT) · doi:10.1109/bdcat56447.2022.00027 · Cited by 7
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · arXiv · doi:10.48550/arxiv.2103.04475 · Cited by 7
Using Dirichlet Marked Hawkes Processes for Insider Threat Detection
Zheng, P., Yuan, S., & Wu, X. (2022) · Digital Threats: Research and Practice · doi:10.1145/3457908 · Cited by 6
BiCAM: A Bidirectional Contextualized Attentive Model for Analyzing the Correlation of Heterogeneous Security Events
Luo, X., Wang, J. J., Yin, L., Zhao, K., Qian, K., Zhang, D., & Chen, K. (2024) · IEEE Transactions on Reliability · doi:10.1109/tr.2024.3491894 · Cited by 6
Self-citation
Warping the Defence Timeline: Non-Disruptive Proactive Attack Mitigation for Kubernetes Clusters
Bagheri, S., Kermabon-Bobinnec, H., Majumdar, S., Jarraya, Y., Wang, L., & Pourzandi, M. (2023) · International Conference on Communications · doi:10.1109/icc45041.2023.10278632 · Cited by 7
End-to-end log statement generation at block-level
Fu, Y., Yan, M. L., He, P., Liu, C., Zhang, X., & Yang, D. (2024) · Journal of Systems and Software · doi:10.1016/j.jss.2024.112146 · Cited by 6
Insider Threat Detection Based on User and Entity Behavior Analysis with a Hybrid Model
Song, Y., & Yuan, J. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-75764-8_17 · Cited by 6
HeteroSample: Meta-Path Guided Sampling for Heterogeneous Graph Representation Learning
Liu, A., Chen, J., Du, R., Wu, C., Feng, Y., Li, T., & Ma, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3484996 · Cited by 6
Context-Aware Intrusion Detection in Industrial Control Systems
Ahmed, M. R., & Zhang, M. (2023) · doi:10.1145/3689930.3695212 · Cited by 6
DPI-ITD: A Dual-Perspective Information-Driven Framework for Insider Threat Detection in IoT Systems
Kong, K., Jin, X., Liu, D., Xu, S., Liu, Z., & Geng, G. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3589636 · Cited by 6
An Insider Threat Detection Method Based on Heterogeneous Graph Embedding
Zheng, C., Hu, W., Li, T., Liu, X., Zhang, J., & Wang, L. (2022) · IEEE International Conference on Big Data Security on Cloud, IEEE International Conference on High Performance and Smart Computing, and IEEE International Conference on Intelligent Data and Security (BigDataSecurity/HPSC/IDS) · doi:10.1109/bigdatasecurityhpscids54978.2022.00013 · Cited by 6
DeepEAD: Explainable Anomaly Detection from System Logs
Wang, X., Kim, K. J., Wang, Y., Koike–Akino, T., & Parsons, K. (2023) · International Conference on Communications · doi:10.1109/icc45041.2023.10279563 · Cited by 6
Insider Threat Detection: A Review
Manoharan, P., Yin, J., Wang, H., Zhang, Y., & Ye, W. (2024) · International Conference on Networking and Network Applications (NaNA) · doi:10.1109/nana63151.2024.00031 · Cited by 6
Memory-Augmented Insider Threat Detection with Temporal-Spatial Fusion
Li, D., Yang, L., Zhang, H., Wang, X., & Ma, L. (2022) · Security and Communication Networks · doi:10.1155/2022/6418420 · Cited by 6
FusionITD: enhanced cross-modal insider threat perception framework via behavior-semantic fusion
Yuan, L., Chang, D., Hu, H., Jiang, Y., Chang, H., Fang, L., & Liu, Y. (2026) · Cybersecurity · doi:10.1186/s42400-026-00555-w · Cited by 5
Nip in the Bud: Forecasting and Interpreting Post- Exploitation Attacks in Real-Time Through Cyber Threat Intelligence Reports
Zhu, T., Ying, J., Chen, T., Xiong, C., Cheng, W., Yuan, Q., Zheng, A., Lv, M., & Chen, Y. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3444781 · Cited by 7
Automatic Generation of Malware Threat Intelligence from Unstructured Malware Traces
Wei, Y., & Zou, F. (2021) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-90019-9_3 · Cited by 5
Log Anomaly Detection Based on Hierarchical Graph Neural Network and Label Contrastive Coding
Fang, Y., Zhao, Z., Xu, Y., & Liu, Z. (2022) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.033124 · Cited by 6
Crook-sourced intrusion detection as a service
Araujo, F., Ayoade, G., Al-Naami, K., Gao, Y., Hamlen, K. W., & Khan, L. R. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.102880 · Cited by 5
Leveraging Token-Based Representation to Detect Lateral Movement
Liu, J., & Shi, J. (2023) · Asia-Pacific Conference on Image Processing, Electronics and Computers (IPEC) · doi:10.1109/ipec57296.2023.00074 · Cited by 5
A GMM-Based Anomaly IP Detection Model from Security Logs
Zhou, F., & Qu, H. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-74717-6_11 · Cited by 5
Attention-embedding mesh saliency
Liu, C., Luan, W., Fu, R., Pang, H., & Li, Y. (2022) · The Visual Computer · doi:10.1007/s00371-022-02444-y · Cited by 5
SauronEyes: Disentangling Voluminous Logs to Unveil Camouflaged Attack Intentions
Qiao, W., Wu, W.-Y., Liu, S., Feng, Y., Wang, Z., Liu, J., Li, T., Jiang, B., Lu, Z., & Liu, B. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3618381 · Cited by 4
HiSec: Towards Cyber Threat Correlation and Discovery Based on Hierarchical Graph Neural Networks
Xu, L., Lin, X., Li, J., Bai, M., & Wang, L. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00067 · Cited by 4
PDCleaner: A multi-view collaborative data compression method for provenance graph-based APT detection systems
Jin, J., Zhu, T., Yuan, Q., Chen, T., Lv, M., Zheng, C., Mei, J.-P., & Pan, X. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104359 · Cited by 6
LogSHIELD: A Graph-Based Real-Time Anomaly Detection Framework Using Frequency Analysis
Roy, K. C., & Chen, Q. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-2417-1_4 · Cited by 6
Towards Automated and Explainable Threat Hunting with Generative AI
Purba, M. D., Chu, B., & French, W. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00067 · Cited by 5
HASGDetector: An Effective Host-Based Intrusion Anomaly Detection Framework With Large-Scale Attribute Heterogeneous Graphs
Xie, G., Xu, X., Gao, H., & Iqbal, M. (2025) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2025.3592903 · Cited by 5
Dinspector: Dual factor graph attention mechanism for Advanced Persistent Threat detection
Wang, H., Wen, C., Li, L., Pu, H., & Zhang, Y. (2026) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2026.113861 · Cited by 4
Insider Threat Defense Strategies: Survey and Knowledge Integration
Song, C., Zhang, J., Ma, L., Hu, X., Zheng, J., & Yang, L. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-5489-2_10 · Cited by 4
TGCN-DA: A Temporal Graph Convolutional Network with Data Augmentation for High Accuracy Insider Threat Detection
Li, X., Li, L., Li, X., Cai, B., & Li, B. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00170 · Cited by 4
DAEMON: Dynamic Auto-encoders for Contextualised Anomaly Detection Applied to Security MONitoring
Dey, A., Totel, É., & Costé, B. (2022) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-06975-8_4 · Cited by 4
ProDE: Interpretable APT Detection Method Based on Encoder-decoder Architecture
Zhou, F., Chang, B., Wen, Y., & Meng, D. (2023) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads60453.2023.00059 · Cited by 4
Self-citation
Microwave Link Failures Prediction via LSTM-based Feature Fusion Network
Ruan, Z., Yang, S., Pan, L., Ma, X., Luo, W., & Grobler, M. M. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9533814 · Cited by 4
Backdoor Investigation and Incident Response: From Zero to Profit
Lai, A. C. T., Wong, K. W. K., Wong, J. T. W., Lau, A. T. W., Ho, A., Wang, S., & Muppala, J. K. (2022) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-06365-7_14 · Cited by 4
LONGAN: Detecting Lateral Movement based on Heterogeneous Graph Neural Networks with Temporal Features
Zong, Y., Shi, Z., & Huang, W. (2024) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc61673.2024.10733661 · Cited by 3
KDCFI AI-based knowledge discovery framework for cloud forensic investigation
Saluja, P., & Bhavsar, M. D. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-07952-x · Cited by 3
Detecting advanced persistent threats via heterogeneous graph learning from homophily and heterogeneity views
Liu, Y., Ye, A., Lu, W., & Yang, L. (2026) · Cybersecurity · doi:10.1186/s42400-025-00425-x · Cited by 3
UDAD: An Accurate Unsupervised Database Anomaly Detection Method
Zhong, H., Zhang, F., Zhao, Y., Zhang, W., Xiao, W., Tang, X., & Zang, L. (2023) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc59175.2023.10253824 · Cited by 3
Continuous-Time Temporal Graph Learning on Provenance Graphs
Reha, J., Lovisotto, G., Russo, M., Gravina, A., & Grohnfeldt, C. (2023) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw60847.2023.00148 · Cited by 4
APM: An Attack Path-based Method for APT Attack Detection on Few-Shot Learning
Li, J., Li, T., Zhang, R., Wu, D., Yue, H., & Yang, Z. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00025 · Cited by 3
Social-Hunter: A social heuristics-based approach to early unveiling unknown malicious logins using valid accounts
Tang, M., & Ge, B. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104269 · Cited by 3
DPUaudit: DPU-assisted Pull-based Architecture for Near-Zero Cost System Auditing
Jiang, P., Jiang, H., Huang, R., Lei, H., Zhong, Z., Zhang, S., Ren, Y., Jia, N., Hu, X., Guo, Y., et al. (2025) · IEEE International Symposium on High-Performance Computer Architecture (HPCA) · doi:10.1109/hpca61900.2025.00014 · Cited by 3
Embedding More Knowledge: Strategic Graph Masking Based Advanced Persistent Threats Detection
Jia, J., Yang, L., Zhou, L., Sang, A., Yang, H., & Wang, A. (2025) · International Workshop on Quality of Service · doi:10.1109/iwqos65803.2025.11143256 · Cited by 3
AttackMiner: A Graph Neural Network Based Approach for Attack Detection from Audit Logs
Pan, Y., Cai, L., Leng, T., Zhao, L., Ma, J., Yu, A., & Meng, D. (2023) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-25538-0_27 · Cited by 3
Self-citation
An Unsupervised Approach For Detecting Lateral Movement Logins Based On Knowledge Graph
Ma, X., Li, C., & Tu, B. (2022) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa-bdcloud-socialcom-sustaincom57177.2022.00095 · Cited by 3
Representation-enhanced APT Detection Using Contrastive Learning
Zhou, F., Chang, B., Yu, W., & Meng, D. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00024 · Cited by 3
Self-citation
GC-UNet: Enhance UNet with GCN for Periodontitis Segmentation
Xu, W., Guo, Y., Li, W., Jiang, L., & Li, S. (2024) · IEEE International Conference on Bioinformatics and Biomedicine (BIBM) · doi:10.1109/bibm62325.2024.10821919 · Cited by 3
Attributing Stealth Cyberattacks via Temporal Probabilistic Graph Neural Networks
Liu, W., Gao, P., Zhang, H., Li, K., Yang, W., Wei, X., & Shu, J. (2025) · Journal of Computer Information Systems · doi:10.1080/08874417.2024.2446955 · Cited by 3
Machine Learning Methods of Intelligent System Event Analysis for Multistep Cyberattack Detection
Kotenko, I. V., & Levshun, D. (2024) · Scientific and Technical Information Processing · doi:10.3103/s0147688224700254 · Cited by 3
Heterogeneous Security Events Prioritization Using Auto-encoders
Dey, A., Totel, É., & Navers, S. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-68887-5_10 · Cited by 3
Faux Insider Hazard Investigation on Non-Public Cloud Computing by Using ADAM’s Technique
Wibowo, D. K., Luthfi, A., Prayudi, Y., Ramadhani, E., & Maulana, M. (2022) · Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi) · doi:10.29207/resti.v6i6.4714 · Cited by 3
rProfiler -- Assessing Insider Influence on Enterprise Assets
Shukla, M., & Lodha, S. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3420026 · Cited by 3
Dynamically Modelling Heterogeneous Higher-Order Interactions for Malicious Behavior Detection in Event LogsPreprint
Larroche, C., Mazel, J., & Clémençon, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.15708 · Cited by 3
Robustness of ML-Enhanced IDS to Stealthy AdversariesPreprint
Wong, V., & Emanuello, J. A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.10742 · Cited by 3
TWLog: Task Workflow-Based Log Anomaly Detection
Zhang, S., Fan, D., He, L., Liu, Y., & Chen, D. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-7244-5_1 · Cited by 2
FPGAA: A Multi-Feature Provenance Graph for the Accurate Alert System
Jiao, J., Min, S., Guo, D., Du, F., & Cheng, F. (2024) · IEEE Access · doi:10.1109/access.2024.3476680 · Cited by 2
Detecting Edge and Node Anomalies with Temporal GNNs
Cavallo, A., Gioacchini, L., Vassio, L., & Mellia, M. (2024) · doi:10.1145/3694811.3697818 · Cited by 2
Madeline: Continuous and Low-cost Monitoring with Graph-free Representations to Combat Cyber Threats
Song, W., Ding, H., Meng, N., Gao, P., & Yao, D. D. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00075 · Cited by 2
Resist Dependency Explosion in Attack Investigation With Splittable Tag Propagation and Aggregation
Sang, A., Wang, Y., Jia, J., Yang, L., Feng, P., Zhou, L., & Ma, J. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3599661 · Cited by 2
Chaos: Robust Spatio-Temporal Fusion for Generalizable APT Provenance Tracing
Li, T., Qiao, W., Feng, Y., Xu, J., Tasca, P., Lin, W., Dang, Z., Ma, Z., & Ma, J. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3182-0_32 · Cited by 2
A novel host-based intrusion detection approach leveraging audit logs
Jiang, J., Chu, H., & Tian, D. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.107995 · Cited by 2
Dynamic Adaptive Aggregation and Feature Pyramid Network Enhanced GraphSAGE for Advanced Persistent Threat Detection in Next-Generation Communication Networks
Kou, L., Pan, X., Dong, G., Wang, M., Miao, C., Zhang, J., & Duan, P. (2026) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2026.3660650 · Cited by 2
A survey of security in satellite Internet networks
Cao, J., Sun, Y., Zhang, Y., Ma, R., Zhang, T., Su, Z., Su, P., Li, H., & Feng, D. (2026) · Scientia Sinica Informationis · doi:10.1360/ssi-2025-0463 · Cited by 2
A Hash-based Multidimensional Graph Neural Network Approach for Zero Trust Oriented Access Control Security
Shi, F., Cao, S., & Zhang, X. (2023) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads60453.2023.00319 · Cited by 2
A Study on Historical Behaviour Enabled Insider Threat Prediction
Xiao, F., Hong, W., Yin, J., Wang, H., Cao, J., & Zhang, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-2387-4_31 · Cited by 2
CGP-Mamba: An Intrusion Detection Method Based on State Space Model
He, J., Wang, G., Liu, N., & Kong, L. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-4509-1_18 · Cited by 2
Data Embedding Scheme for Efficient Program Behavior Modeling With Neural Networks
Ahn, S., Yi, H., Bae, H., Yoon, S., & Paek, Y. (2022) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2022.3146425 · Cited by 2
ConLBS: An Attack Investigation Approach Using Contrastive Learning with Behavior Sequence
Li, J., Zhang, R., & Liu, J. (2023) · Sensors · doi:10.3390/s23249881 · Cited by 2
An Anomaly Detection Method Based on Meta-Path and Heterogeneous Graph Attention Network
Peng, Z., Shan, C., & Hu, C. (2024) · International Conference on Computer Engineering and Application (ICCEA) · doi:10.1109/iccea62105.2024.10604208 · Cited by 2
“One Model Fits All Nodes”: Neuron Activation Pattern Analysis-Based Attack Traffic Detection Framework for P2P Networks
Xu, S., Fu, C., Li, Q. L., & Xu, K. (2025) · IEEE Transactions on Networking · doi:10.1109/ton.2025.3546735 · Cited by 2
Investigation of Fake Insider Threats on Private Cloud Computing Services
Wibowo, D. K., Luthfi, A., & Widiyasono, N. (2022) · International Journal Of Science Technology & Management · doi:10.46729/ijstm.v3i5.613 · Cited by 2
HLMD: Detecting Lateral Movement Using Heterogeneous Graph Model
Gong, Y., Han, X., Du, D., Du, X., Jiang, B., Tian, T., & Lü, Z. (2023) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys60770.2023.00026 · Cited by 2
Improving the Realism of the Physical Layer of NS-3 by Considering the PAPR Problem of the IEEE 802.11p Transmitter
Chisaguano, D. J. R., León, J. P. A., Paredes, M. C. P., Lupera, P., & Urquiza-Aguiar, L. F. (2021) · ACM Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks (PE-WASUN) · doi:10.1145/3479240.3488509 · Cited by 2
A Survey of Host-Based Advanced Persistent Threat Detection Technology
徐, 志. (2022) · Computer Science and Application · doi:10.12677/csa.2022.121024 · Cited by 1
APT Attack Investigation via Fine-grained Sequence Construction and Learning
Wu, T., Lv, Z., Zhang, D., Qian, K., & Wang, M. (2023) · International Symposium on Computer Technology and Information Science (ISCTIS) · doi:10.1109/isctis58954.2023.10213187 · Cited by 1
Self-citation
Method for the Detection of Internal Threats in Academic Campus Networks
Vera, R. G. B., Barragán-González, B., Valencia, M. V. R., Cabrera, C. E. M., Barahona, B. E. V., & Silva-Cárdenas, C. (2024) · Lecture notes in networks and systems · doi:10.1007/978-3-031-70981-4_22 · Cited by 1
Pre-LogMGAE: Identification of Log Anomalies Using a Pre-Trained Masked Graph Autoencoder
Wu, A., & Kwon, Y. (2024) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds64841.2024.00036 · Cited by 1
DygLM: Detecting Lateral Movement Threat via Continuous-time Dynamic Graph Learning
Li, R., Zhou, Z., Jiang, G., Zhang, Z., & Liu, Q. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033299 · Cited by 1

Authors: Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D.
Affiliations: Institute of Information Engineering (CN)
Chinese Academy of Sciences (CN)
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
Pennsylvania State University (US)
ORCID: Liu, Fucheng
Wen, Yu
Xing, Xinyu
Meng, Dan
Venue: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
Publisher: ACM
Published: 2019-11-06
Pages: 1777-1794
ISSN: 1543-7221 (ISSN-L)
DOI: 10.1145/3319535.3363224
OpenAlex: W2986944522
Cited by: 319
References: 23
Citations by year: 2026: 46 · 2025: 61 · 2024: 64 · 2023: 47 · 2022: 47 · 2021: 45 · 2020: 9
FWCI: 21.82
Type: conference paper
Language: en
Open access: closed
Licence: www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations: ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
Funders: Chinese Academy of Sciences (No.XDC02010300)
Topics: Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
Keywords: heterogeneous graph embedding, insider attacks, advanced persistent threats, information systems security, user behavior analysis

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Claims other papers make about this one

Citations

Cites

Cited by

Related

Metadata

Record

About these checks