Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

node2vec: Scalable Feature Learning for Networks

Grover, A., & Leskovec, J. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939754 · Cited by 10,926

Untitled work

(2007) · doi:10.5555/1283383.1283494 · Cited by 7,364

LINE: Large-scale Information Network Embedding

Tang, J., Qu, M., Wang, M., Zhang, M., Yan, J., & Mei, Q. (2015) · Proceedings of the 24th International Conference on World Wide Web · doi:10.1145/2736277.2741093 · Cited by 5,416

metapath2vec

Dong, Y., Chawla, N. V., & Swami, A. (2017) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3097983.3098036 · Cited by 2,295

DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning

Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835

Deep Graph Kernels

Yanardag, P., & Vishwanathan, S. V. N. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783417 · Cited by 1,168

Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection

Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., & Song, D. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134018 · Cited by 704

Discriminative Embeddings of Latent Variable Models for Structured DataPreprint

Dai, H., Dai, B., & Song, L. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1603.05629 · Cited by 534

Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint

Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 347

The Robustness of the "Binormal" Assumptions Used in Fitting ROC Curves

Hanley, J. A. (1988) · Medical Decision Making · doi:10.1177/0272989x8800800308 · Cited by 308

Gs-Ocsvm: an APT attack detection method based on provenance graph

Liu, H., Liu, X., Zhao, C., & Ding, J. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-07902-7 · Cited by 1

Enterprise Threat Detection with Explainable AI for Cloud-Network Convergence

Wang, X., Wu, F., Huang, X., Wuri, Q., Gu, D., Zhang, R., & Gao, S. (2025) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp65844.2025.11192393 · Cited by 1

Predictable and Secure System Auditing for Real-Time Systems

Jiang, P., Hu, F., Huang, R., Xue, S., Deng, Z., Ren, Y., Jia, N., Guo, Y., Chen, X., Li, D., et al. (2025) · IEEE Real-Time Systems Symposium (RTSS) · doi:10.1109/rtss66672.2025.00028 · Cited by 1

DualAD: Dual adversarial network for image anomaly detection⋆

Wan, Y., & Feng, A. (2024) · IET Computer Vision · doi:10.1049/cvi2.12297 · Cited by 1

An Insider Threat Investigation Method by Graph Analysis with Log Texts

Fei, K., & Zhou, J. (2024) · International Conference on Networks, Communications and Information Technology (CNCIT) · doi:10.1145/3672121.3672126 · Cited by 1

Adaptive dynamic graphs for anomaly detection via inter- and intra-diffusion

Yuan, Z., Zhou, H., & Sun, Q. (2025) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-025-02638-5 · Cited by 1

A Bi-hierarchical Graph Based Approach for Insider Threat Detection

Hou, R., & Deng, X. (2025) · Lecture notes in electrical engineering · doi:10.1007/978-981-96-5318-8_31 · Cited by 1

TraceCluster: A Lightweight and Adaptive Clustering-Based Subgraph Attention Network for APT Detection in Provenance Graphs

Xu, L., Zhao, Z., Zhao, D., Wang, Z., & Ge, C. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3653175 · Cited by 1

Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition

Kong, K., Liu, D., Jin, X., Li, Z., & Geng, G. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00340 · Cited by 1

PrivGITD: A High Accuracy and Privacy-Preserving Graph Convolutional Network for Insider Threat Detection

Li, X., Geng, H., Li, L., Liu, F., & Li, C. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3672783 · Cited by 1

Wavelet-Aware Anomaly Detection in Multi-Channel User Logs via Deviation Modulation and Resolution-Adaptive Attention

Kaichuan, K., Liu, D., Jin, X., Xu, S., & Geng, G. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11461865 · Cited by 1

GNNFormer: capturing local interactions and long-term global dependencies for APT detection in provenance graphs

Yang, N., Wang, N., Dong, H., Liu, J., & Zhao, X. (2026) · Science China Information Sciences · doi:10.1007/s11432-025-4776-x · Cited by 1

Malicious Domain Detection on Out-of-Distribution Gray Data through Graph Contrastive Learning with Structure Aggregation

Gu, H.-J., He, D.-J., & Zhou, X. (2026) · Knowledge Discovery and Data Mining · doi:10.1145/3770854.3780237 · Cited by 1

MALICIOUS LOGIN DETECTION USING LONG SHORT-TERM MEMORY WITH AN ATTENTION MECHANISM

Wu, Y., Liu, F., & Yu, W. (2021) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-88381-2_8 · Cited by 1

TapTree: Process-Tree Based Host Behavior Modeling and Threat Detection Framework via Sequential Pattern Mining

Mamun, M., & Buffett, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-15777-6_30 · Cited by 3

Inferring Attack Paths in Networks with Periodic Topology Changes

Hao, F., Wang, Z., Shi, M., Peng, T., Fang, L., & Li, F. (2022) · IEEE Smart World Congress (SWC) · doi:10.1109/smartworld-uic-atc-scalcom-digitaltwin-pricomp-metaverse56740.2022.00113 · Cited by 1

Anomaly-Based Insider Threat Detection via Hierarchical Information Fusion

Wang, E., Li, Q., Zhao, S., & Han, X. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-44213-1_2 · Cited by 1

Comparative Analysis of Deep Learning Models and Preprocessing Techniques for Anomaly Detection in Syslog

Macková, K., Benk, D., & Šrotýř, M. (2023) · International Conference on Information and Communication Systems (ICICS) · doi:10.1109/icics60529.2023.10330520 · Cited by 1

From Data Packets to Secure Networks with Advanced Analytical Frameworks for a Comprehensive Understanding of Threat Landscapes

H, S. K., Kumar, A., & Singh, V. (2023) · International Conference on Recent Advances in Science and Engineering Technology (ICRASET) · doi:10.1109/icraset59632.2023.10420255 · Cited by 1

Design and Implementation of Cyber Space Threat Detection System Based on User Behavioral Logs

Wang, W., Li, H., & Nie, P. (2023) · International Conference on Electronic Information Engineering and Computer Communication (EIECC) · doi:10.1109/eiecc60864.2023.10456685 · Cited by 1

A Distributed Storage System for System Logs Based on Hybrid Compression Scheme

Chang, B., Zhou, F., Wang, Z., Wen, Y., & Zhang, B. (2023) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa-bdcloud-socialcom-sustaincom59178.2023.00127 · Cited by 1

FORTRESS: Shortest Feature Weighted Path System for Attack Investigation

Xiao, Q., Chen, R., Hu, M., Xing, J., Tang, F., Zhang, L., & Qiu, J. (2023) · Asian Conference on Artificial Intelligence Technology (ACAIT) · doi:10.1109/acait60137.2023.10528541 · Cited by 1

PG-AID: An Anomaly-based Intrusion Detection Method Using Provenance Graph

Meng, L., Xi, R., Li, Z., & Zhu, H. (2024) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd61410.2024.10580067 · Cited by 1

TurboLog: A Turbocharged Lossless Compression Method for System Logs via Transformer

Chang, B., Wang, Z., Li, S., Zhou, F., Yu, W., & Zhang, B. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10649957 · Cited by 1

Research on APT Attack Detection Methods for Power Information Systems

Zhu, M., Xu, T., He, Q., Qiu, R., Zhu, J., Wang, W., & Li, J. (2024) · IEEE Information Technology, Networking, Electronic and Automation Control Conference (ITNEC) · doi:10.1109/itnec60942.2024.10733125 · Cited by 1

LLM4ITD: Insider Threat Detection with Fine-Tuned Large Language Models

Zhang, M., Liang, X., Tian, F., Yang, Y., Yu, H., & Li, B. (2024) · International Conference on Interactive Intelligent Systems and Techniques (IIST) · doi:10.1109/iist62526.2024.00017 · Cited by 3

Interpersonal Communication in the Character Building of Students in Islamic Boarding Schools

Dafrizal, D., Rohanis, R., Alfriani, R. D., Faizah, T., & Yanderi, I. (2023) · Suluah Pasaman · doi:10.70588/suluahpasaman.v1i2.141 · Cited by 1

PGAE: A Perturbed Graph Autoencoder Integrating Explicit and Implicit Features for APT Detection

Liu, C., Xiang, C., Han, M., Meng, X., & Song, W. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-9872-1_25 · Cited by 1

Multi-modal Swarm Intelligence for Secure UAV Missions

Xiao, Y., Sadia, M., & Chen, A. (2025) · Springer eBooks · doi:10.1007/978-981-95-1050-4_6 · Cited by 1

Detecting User-Perceived Failure in Mobile Applications via Mining User Traces

Tian, D. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion52605.2021.00054 · Cited by 1

NeVe: A Log-based Fast Incremental Network Feature Embedding Approach

Tian, R., Diao, Z., Jiang, H., & Xie, G. (2021) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc53001.2021.9631421 · Cited by 1

Cyber Threat Indicators Association Prediction Based on Weighted Fusion of Semantic and Topological Information

Wang, Y., Lang, B., Xiao, N., & Chen, Y. (2022) · International Conference on Algorithms, Computing and Artificial Intelligence (ACAI) · doi:10.1145/3579654.3579690 · Cited by 1

Hopper: Modeling and Detecting Lateral Movement (Extended Report)Preprint

Ho, G., Dhiman, M., Akhawe, D., Paxson, V., Savage, S., Voelker, G. M., & Wagner, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.13442 · Cited by 1

Deep Learning Models and Social Engineering Dynamics in Insider Threat Detection: A Systematic ReviewPreprint

Galadima, I. B., Ithnin, N., Wahab, N. H. A., Osman, M. Z., & Gabi, D. (2025) · Research Square · doi:10.21203/rs.3.rs-7396895/v1 · Cited by 1

Network-wide intrusion detection through statistical analysis of event logs : an interaction-centric approach

Larroche, C. (2021) · theses.fr (ABES) · doi:10.70675/82be75ebz77e8z4ce8zb891z46d74f27254f · Cited by 1

Thwarting Sophisticated Enterprise Attacks: Data-Driven Methods and Insights

Ho, G. (2020) · eScholarship (California Digital Library)

Constructing and Generating a Time-varying State- Space Vector against Cloud Service Event Interactions

Jiang, Y., Li, X., Xia, C., Hu, H., Zhang, Z., & Wang, H. (2021) · IEEE International Conference on Big Data and Artificial Intelligence (BDAI) · doi:10.1109/bdai52447.2021.9515231

Secure Namespaced Kernel Audit for ContainersPreprint

Lim, S. Y., Stelea, B., Han, X., & Pasquier, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.02481 · Cited by 1

A Vectorization Method to Cloud Service Instance Data for Service Compliance

Li, X., Zhang, C., Yang, H., & Huang, C. (2021) · International Conference on Computational Intelligence and Applications (ICCIA) · doi:10.1109/iccia52886.2021.00033

GenGLAD: A Generated Graph Based Log Anomaly Detection Framework

Wang, H., Chen, Y., Zhang, C., Li, J., Gan, C., Zhang, Y., & Chen, X. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-28124-2_2

Detecting Anomalous Behaviours Based on System Logs: A Dynamic Graph Perspective

Wang, M., Wang, Y., Wu, T., Chen, C., & Qian, K. (2023) · International Conference on Intelligent Computing and Signal Processing (ICSP) · doi:10.1109/icsp58490.2023.10248606

An Attack Entity Deducing Model for Attack Forensics

Jiang, T., He, J., Li, T., Fang, W., Li, W., & Tang, C. (2023) · Communications in computer and information science · doi:10.1007/978-981-99-8184-7_26

Unsupervised Representation Learning for Fault Diagnosis in IT Infrastructure

Xin, H. (2023) · International Conference on Machine Learning, Cloud Computing and Intelligent Mining (MLCCIM) · doi:10.1109/mlccim60412.2023.00050

LogCSS: Log anomaly detection based on BERT-CNN with context-semantics-statistics features

Li, Z., Tu, X., Gao, H. Z., Huang, S., & Ma, Z. (2024) · Journal of Intelligent & Fuzzy Systems · doi:10.3233/jifs-235801

Network Scanning Detection Based on Spatiotemporal Behavior

Zhang, P., & Cui, B. (2024) · Lecture notes on data engineering and communications technologies · doi:10.1007/978-3-031-53555-0_11

Automatic Anomaly Detection Using Unlabelled Log Data

Zhu, Y., Min, G., Wu, Y., & Wang, H. (2023) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys60770.2023.00075

Deep Dive into Insider Threats: Malicious Activity Detection within Enterprise

Xiao, H., Du, D., Liu, J., Liu, S., Zhu, Y., Liu, Y., & Lü, Z. (2024) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd61410.2024.10580430

ColBetect: A Contrastive Learning Framework Featuring Dual Negative Samples for Anomaly Behavior Detection

Yuan, Z., Zhou, H., Sun, Q., & Li, J. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-7241-4_29

EFSNet: A Threat Detection Method Based on System Event Feature Sequence

Yang, Q., Wang, J., Fei, J., Yang, Q., & Ding, L. (2024) · International Conference on Next Generation Data-driven Networks (NGDN) · doi:10.1109/ngdn61651.2024.10744054

A Network Security Event Detection for Power Monitoring System Based on Matrix Factorization

Ye, L., Lv, X., Wang, J., & Zhao, H. S. (2024) · International Conference on Intelligent Computing and Signal Processing (ICSP) · doi:10.1109/icsp62122.2024.10743961

Detecting Behavioral Anomalies for Cybersecurity

Wang, C., & Zhu, H. (2024) · Springer eBooks · doi:10.1007/978-981-97-9014-2_5

System for Detecting Anomalies in Information Security Logs

Vulfin, A., Ложников, П. С., Sulavko, A. Е., АТАРСКАЯ, Е. А., & Kirillova, A. D. (2024) · Lecture notes in networks and systems · doi:10.1007/978-3-031-77411-9_4

Behavior-Based Insider Threat Detection Using a Deep Neural Network

Besnaci, S., Hafidi, M., & Lamia, M. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-82156-1_15

A Study on Efficient Provenance-Based Intrusion Detection System Using Few-Shot Graph Representation Learning

Dat, P. T. T., Duy, P. T., & Pham, V.-H. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-4285-4_35

Zypkro: A Node-Level Anomaly Detector for Provenance Graphs Based on Nonlinear Interaction and Adaptive Domain Techniques

Zong, Y., Chen, R., Ni, X., Hu, M., Xiao, Q., Chen, X., Cai, Y., & Qiu, J. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-4503-9_23

A Novel Approach for Advanced Persistent Threats Detection via Graph Transformer

Luo, Z., Yang, J., & Ouyang, D. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-4503-9_19

Система обнаружения аномалий в журналах регистрации событий средств защиты информации

технологий, У. У. Н. И., АТАРСКАЯ, Е. А., ВУЛЬФИН, А. М., технологий, У. У. Н. И., Кириллова, А. Д., & технологий, У. У. Н. И. (2025) · Systems Engineering and Information Technologies · doi:10.54708/2658-5014-siit-2025-no1-p3

Sky-Eye: Detect Multi-stage Cyber Attacks at the Bigger Picture

Bi, P., Wang, Q., Lv, Z., Yun, X., & Zang, T. (2025) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-89363-6_14

ATKHunter: Towards Automated Attack Detection by Behavior Pattern Learning

Pan, Y., Zhao, L., Li, C., Leng, T., Yu, A., Cai, L., & Meng, D. (2025) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-89363-6_15

CryptMove: Moving Stealthily through Legitimate and Encrypted Communication Channels

Alam, M. R., Wei, J., & Wang, Q. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726496

SiamEHGT: An Evolving Heterogeneous Graph Transformer for Insider Threat Detection based on Siamese Architecture

Qi, Y., An, N., Wang, Z., Yuan, Y., Zhang, C., Zhu, Y. H., & Lü, Z. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033609

AISSGR: Attack Investigation Based on Self-supervised Graph Representation Learning

Hu, L., Liu, J., & Zhang, R. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-7005-5_25

InstPro: Provenance-Based Transient Execution Attack Detection and Investigation on Instruction Execution Traces

Zheng, Y., Wen, Y., Wang, R., Wu, Y., Zhang, B., & Meng, D. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3583792

Reviewing Graph Construction Rules in Graph-Based Insider Threat Detection Models

Chung, J. Z. A., Yong, K. S. C., Han, J., & Then, P. (2025) · IEEE Symposium on Computer Applications & Industrial Electronics (ISCAIE) · doi:10.1109/iscaie64985.2025.11081151

APT Attacks Based on Graph Markup Learning

Liu, Y., Zhang, R., & Han, H. (2025) · Lecture notes in networks and systems · doi:10.1007/978-3-031-94898-5_47

AI-AUGMENTED CYBERSECURITY: GRAPH NEURAL NETWORKS FOR PREDICTING NATION-STATE CYBERATTACKS

Matta, S. S., & Bolli, M. (2024) · doi:10.63125/z3dy9737

An Automated Approach to Constructing STRIDE Threat Rule Model and Updating Rule Base

Fu, C., Zhang, H., & Guan, X. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3772283 · Cited by 2

Behavior Molecule-Level Learning by Behavioral Interior Reconstruction

Wang, C. (2025) · Springer eBooks · doi:10.1007/978-981-95-1013-9_3

Log Anomaly Detection Based on Autonomous Attention Mechanism

Liu, J., & Fang, Z. (2025) · International Conference on Internet of Things, Artificial Intelligence and Mechanical Automation (IoTAIMA) · doi:10.1109/iotaima66468.2025.11212701

ALBGE: Audit Logs threat investigation based on Behavior Graph EmbeddingPreprint

Xu, X., Qin, T., Ouyang, G., & Huang, Y. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5749626

PORTIA: A Multi-Granularity APT Detection Model Based on Provenance Graphs

Ren, Y., Chen, H., Wang, H., Chen, Y., Zhou, Z., Si, C., & Liu, Q. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11228350

TRAIL: A Transformer-Enhanced Feature Embedding Approach for Unsupervised Anomaly Detection

Feng, J., Cui, W., Zhang, S., Wei, X., Du, Y., & Yu, W. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11228446

SlotITD: Insider Threat Detection Method Using Slot-Based Heterogeneous Graph Neural Network

Zhang, C., Qi, Y., Zhu, Y., Jiang, B., Lu, Z., & Guo, T. (2025) · Communications in computer and information science · doi:10.1007/978-981-95-4100-3_34

ApexSentinel: Detecting and Explaining Advanced Persistent Threats with Large Language Models

Zhang, J., Zou, F., Wu, C., & Zhang, H. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112437

Augmenting Security Logs with Artificial Intelligence: Are Deep Models the Missing Piece?

Safonov, Y., & Foltyn, O. (2025) · International Congress on Ultra Modern Telecommunications and Control Systems and Workshops (ICUMT) · doi:10.1109/icumt67815.2025.11268672

Overview of Computational Structural Behavior

Wang, C. (2025) · Springer eBooks · doi:10.1007/978-981-95-1013-9_1

MOLE: Provenance Graph Generation Framework Based on LLM Prompting

Ren, Y., Wang, H., Chen, Y., Zhou, Z., Si, C., & Liu, Q. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11229381

Encrypted Malicious Traffic Detection in Power Systems Based on Graph Convolutional Networks

Xu, X., Qu, G., & Wu, Y. (2025) · IEEE International Conference on Information Systems and Computer Aided Education (ICISCAE) · doi:10.1109/iciscae66104.2025.11307765

Design and Evaluation of Big Data Intrusion Detection Model Based on Multi-Source Data Fusion

Tang, K.-F. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-10400-7_25

Detecting and Characterizing APT Attacks in the Open World

Xi, H., Han, Y., Li, X., Song, J., Zhang, Z., Hai, W. A. N., & Zhao, X. (2025) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads67057.2025.11323077

NAHID: Node-Level Host Intrusion Detection Based on Provenance Graph

Li, W., Wei, X., Lv, Q., Wang, Y., Li, N., & Yu, Z. (2025) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc58881.2025.11343010

From Concealment to Exposure: Understanding the Lifecycle and Infrastructure of APT Domains

Avgetidis, A., Faulkenberry, A., Adjibi, B. V., Galloway, T., Kintis, P., Alrawi, O., Ma, Z., Monrose, F., Keromytis, A. D., Perdisci, R., et al. (2025) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1109/raid67961.2025.00041

FRLog: Log Anomaly Detection Based on Three-Stage Training with Reft Fine-Tuning for Large Language Model

Qiu, K., Xu, Z., Luo, T., Yan, M., Liu, R., Liu, P., & Chen, F. (2026) · Journal of Artificial Intelligence and Soft Computing Research · doi:10.2478/jaiscr-2026-0007

LLMBA: Efficient Behavior Analytics via Large Pretrained Models in Zero Trust Networks

Yan, S., Shi, L., Wang, W., Ren, J., Li, Y., & Sun, L. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3666459

TGID: Internal User Abnormal Behavior Detection Technology Based on Traceability Graph

郑保瑞, Ma, X., Lv, Q., Wang, Y., Yu, Z., & Lv, P. (2025) · IEEE International Conference on Network Infrastructure and Digital Content (IC-NIDC) · doi:10.1109/ic-nidc67200.2025.11390388

Trace-LogVector-Based Relational Retrieval for Conversational System Log Analysis

Park, S.-C., & Kim, Y.-H. (2026) · Sensors · doi:10.3390/s26061806

A Graph Embedding-Based Method for Network Anomaly Detection

Zhao, X. L., & Yuan, J. (2025) · IEEE International Conference on Electrical, Automation and Computer Engineering (ICEACE) · doi:10.1109/iceace67491.2025.11439112

Boundary-Aware Contrastive Learning for Log Anomaly Detection

Ailabouni, F., Román‐Gallego, J., Pérez‐Delgado, M., & Grande-Pérez, L. (2026) · Applied Sciences · doi:10.3390/app16073208

Baseline Generation Method for HIDS Data Based on Manifold Learning

Jia, J., Wang, Y., Zhou, L., Song, Z., & Yi, L. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-8417-8_43

Datascience in support of cybersecurity operations : Adaptable, robust and explainable anomaly detection for security analysts

Dey, A. (2022) · theses.fr (ABES) · doi:10.70675/bbc1d3b6z9f35z4e71za7b8za73d0939f820

Change-Aware Temporal Alignment on Heterogeneous Graph Snapshots for Insider Threat Detection

Yang, M., Zhou, Y., Wu, D., Pang, G., & Zhu, C. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11461839

AEGIS: Enhancing Provenance-Based Intrusion Detection System with LLM-Powered Deep Semantic Representation

Liu, B., Zhang, F., Feng, Y., Chen, C., Wang, X., Cao, Y., & Liu, Q. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11461473

Fusion Is Not A Simple Ensemble! Towards The Evolving Views in Insider Threat Detection

Song, C., Yang, L., Zheng, J., Zhang, J., Kuang, H., Liao, J., & Zhao, M. (2026) · International World Wide Web Conference (WWW) · doi:10.1145/3774904.3792398

Decoding APTs: Multi-Stage Threat Detection via Contrastive Bias-Aware Graphormer

Huo, C., Wang, G., Liu, N., Wang, P., & Huo, Y. (2026) · International Conference on Computer, Artificial Intelligence and Control Engineering (CAICE) · doi:10.1145/3804601.3804615

A Grammar-Driven Approach to Model and Detect APT Attack Sequences

Rebstock, A., Busnel, Y., & Ludinard, R. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-20018-1_14

ANTEATER: A Filter-then-Scrutinize Architecture for End-to-End Attack Investigation

Ren, Y., Wang, H., Li, L., Chen, H., Si, C., Zhou, Z., & Liu, Q. (2026) · Proceedings of the ACM on Management of Data · doi:10.1145/3802012

An Unsupervised Anomaly Detection Method for Traceability Graphs Based on Masked Autoencoders

Xu, J., Xu, F., Zhu, Y., Sun, C., Zheng, J., & Zhou, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-20080-8_3

Unsupervised Graph Learning For Insider Threat Detection

Bertrand, S., Germain, P., & Tawbi, N. (2026) · IFIP advances in information and communication technology · doi:10.1007/978-3-032-27993-4_2

A Security Analysis Method for Access Control Graphs Based on DeepWalk Node Embedding

Radu, C., Constantin, E., & Dragomir, M. (2026) · Journal of Applied Automation Technologies · doi:10.64972/jaat.2026v4.136p20e:262-275

WiLDash: A Web Application for LLM-Based Wi-Fi Log Data Processing and Human Mobility Analysis

Yang, Q., Zhu, L., & Yuan, Y. (2026) · ASCE International Conference on Transportation and Development (ICTD) · doi:10.1061/9780784487013.033

Log2Graph: A graph convolution neural network based method for insider threat detection

Fei, K., Zhou, J., Su, L., Wang, W., & Chen, Y. (2024) · Journal of Computer Security · doi:10.3233/jcs-230092 · Cited by 7

Log2vec A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

Fu-cheng, L., Wen, Y., Dongxue, Z., Jiang, X., Xing, X., & Meng, D. (2019) · ACM Proceedings · Cited by 37

Doc2vec-Based Insider Threat Detection through Behaviour Analysis of Multi-source Security Logs

Liu, L., Chen, C., Zhang, J., De Vel, O., & Xiang, Y. (2020) · 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00050 · Cited by 9

Insider Threat Identification Using the Simultaneous Neural Learning of Multi-Source Logs

Liu, L., Chen, C., Zhang, J., De Vel, O., & Xiang, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2957055 · Cited by 31

MM-LogVec: System Log Anomaly Detection Method Based on Multimodal Representation Learning

Li, J., Zhang, R., & Liu, J. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10888643 · Cited by 2