The DOI matches its Crossref record; 23 of the 23 references it cites were found in a registry or an index.
Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise
Abstract
Conventional attacks of insider employees and emerging APT are both major threats for the organizational information system. Existing detections mainly concentrate on users' behavior and usually analyze logs recording their operations in an information system. In general, most of these methods consider sequential relationship among log entries and model users' sequential behavior. However, they ignore other relationships, inevitably leading to an unsatisfactory performance on various attack scenarios. We propose log2vec, a heterogeneous graph embedding based modularized method. First, it involves a heuristic approach that converts log entries into a heterogeneous graph in the light of diverse relationships among them. Next, it utilizes an improved graph embedding appropriate to the above heterogeneous graph, which can automatically represent each log entry into a low-dimension vector. The third component of log2vec is a practical detection algorithm capable of separating malicious and benign log entries into different clusters and identifying malicious ones. We implement a prototype of log2vec. Our evaluation demonstrates that log2vec remarkably outperforms state-of-the-art approaches, such as deep learning and hidden markov model (HMM). Besides, log2vec shows its capability to detect malicious events in various attack scenarios.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“However, these methods mainly focus on relative time information of user activity and do not establish a direct connection with the specific timing of user activities.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Liu et al. (2019)
Citations
Cites
node2vec: Scalable Feature Learning for Networks
Grover, A., & Leskovec, J. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939754 · Cited by 10,926
(2007) · doi:10.5555/1283383.1283494 · Cited by 7,364
LINE: Large-scale Information Network Embedding
Tang, J., Qu, M., Wang, M., Zhang, M., Yan, J., & Mei, Q. (2015) · Proceedings of the 24th International Conference on World Wide Web · doi:10.1145/2736277.2741093 · Cited by 5,416
Dong, Y., Chawla, N. V., & Swami, A. (2017) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3097983.3098036 · Cited by 2,295
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Yanardag, P., & Vishwanathan, S. V. N. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783417 · Cited by 1,168
Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection
Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., & Song, D. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134018 · Cited by 704
Discriminative Embeddings of Latent Variable Models for Structured DataPreprint
Dai, H., Dai, B., & Song, L. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1603.05629 · Cited by 534
Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data StreamsPreprint
Tuor, A. R., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S. M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.00811 · Cited by 347
The Robustness of the "Binormal" Assumptions Used in Fitting ROC Curves
Hanley, J. A. (1988) · Medical Decision Making · doi:10.1177/0272989x8800800308 · Cited by 308
Cited by
Sorted by citations
Items 301–324 of 324
APIECHO: Training-Less Anomaly Detection via Intra-API Behavioral Comparison for Web Applications
Peng, Y., Wu, Y., Wu, D., Ji, S., Wan, H., & Zhao, X. (2026) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp63933.2026.00016
Ppin: Anomaly-Based Intrusion Detection on Provenance Graph via Behavior Pattern Mining
Liu, D., Li, Z. L., Zhang, Z. D., Wang, Z., & Yan, J. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3710034
DGTLMD: Unsupervised Lateral Movement Detection via Dynamic Graph Transformer
Du, Y., Feng, J., Li, Y., Liu, Z., Zhang, L., & Wen, Y. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582646
Self-citationXu, L., Shan, B., Yu, F., Han, X., & Zhao, D. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581484
Kaichuan, K., Liu, D., Jin, X., & Geng, G. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581710
Cui, W., Hu, Y., Liu, Z., Feng, J., Zhang, S., & Wen, Y. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-22545-0_7
Self-citationVGAE4PG: A semantically preserved unsupervised provenance graph reduction framework
Lv, A., Ouyang, G., & Huang, Y. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581538
Alluvion: Efficient APT Detection via Two-Tower Provenance Graph Encoding
Li, S., Zhou, J., Jiang, Z. H., Yang, P., W, C., Cui, M., & Zhang, K. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582115
LogMamba: Efficient Graph-Level Anomaly Detection for APTs via State Space Models
Li, W., Chen, Y., Zhu, K., Yan, W., Wang, X., Tian, T., Jiang, B., & Lu, Z. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582008
Measuring Attack Observability in Cloud Telemetry Logs: A Cross-Platform Analysis
Dhooghe, M. G. K., Park, M., Rhee, J., Choe, Y. R., & Kim, C. H. (2026) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn69566.2026.00036
Qian, R., Dong, H., Hou, J., Cui, Y., & Zhou, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-2856-0_17
Cheng, K., Li, D., Tang, W., Shu, Y., & Qiang, W. (2026) · Applied Sciences · doi:10.3390/app16147054
SNIFFER: Early Threat Detection via Chain-of-Thought of Sequence Generation and Context Alignment
Ye, M., Xu, Z., Zheng, Y., & Wen, Y. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-32767-3_12
Self-citationMulti‐Agent Real‐Time Detection of Insider Threats via Collaborative Reasoning
Cheng, K., Li, D., Tang, W., Tan, L., Xiang, K., Liu, T., & Qiang, W. (2026) · Security and Privacy · doi:10.1002/spy2.70243
Jia, Y., Fu, J., Lin, L., & Wang, H. (2026) · International Conference on Computer Communication and Artificial Intelligence (CCAI) · doi:10.1109/ccai69603.2026.11642009
Xu, G., Chang, Y., Tian, B., Liu, X., Chen, X., Chen, Y., & Li, Z. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112681
Zhang, S., & Wang, C. (2026) · International Conference on Computer Information Science and Application Technology (CISAT) · doi:10.1109/cisat71030.2026.11682625
Explainable Transformer Models for Insider Threat Detection in Enterprise Systems
Al-Dhaqm, A., Bamasoud, D. M., Brnawy, R., Bamaqa, A., Alharbi, A. A., & Aljubayri, I. (2026) · Engineering Technology & Applied Science Research · doi:10.48084/etasr.21281
Randive, K. D., Jain, K. P., & Ghosh, T. (2026) · International Conference on Emerging Techniques in Computational Intelligence (ICETCI) · doi:10.1109/icetci71772.2026.11710426
Beyond Isotropic Aggregation: Residual Graph Attention for Provenance-Based Threat Detection
Xu, X., Huang, Y., & Ouyang, G. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-6843-6_27
Enhancing APT detection via representation learning on provenance graphs with graph transformers
Liu, Z., Zhang, X., Zhang, L., Du, Y., Zheng, Y., & Wen, Y. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112887
Self-citationVIGIL: Detecting Advanced Persistent Threats Under the Enemy Within Scenario
Liu, Z., Luo, Z., Chen, H., Wang, Y., & Wei, Z. (2026) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc70364.2026.11740023
Narra, S. L. (2023) · The Eastasouth Journal of Information System and Computer Science · doi:10.58812/esiscs.v1i01.1289
Design of a hybrid behavioral profiling framework for intelligent cyber risk assessment
Huskova, V. H., Shkolnikov, V. I., Khalyhov, A., & Lysov, B. S. (2026) · Eastern-European Journal of Enterprise Technologies · doi:10.15587/1729-4061.2026.371521
Metadata
- Authors
- Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D.
- Affiliations
- Institute of Information Engineering (CN)
- Chinese Academy of Sciences (CN)
- Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
- Pennsylvania State University (US)
- Venue
- Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2019-11-06
- Pages
- 1777-1794
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2986944522
- Cited by
- 319
- References
- 23
- Citations by year
- 2026: 46 · 2025: 61 · 2024: 64 · 2023: 47 · 2022: 47 · 2021: 45 · 2020: 9
- FWCI
- 21.82
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Chinese Academy of Sciences (No.XDC02010300)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Keywords
- heterogeneous graph embedding, insider attacks, advanced persistent threats, information systems security, user behavior analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
