{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,10]],"date-time":"2025-06-10T22:40:04Z","timestamp":1749595204563,"version":"3.41.0"},"publisher-location":"Cham","reference-count":23,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030779634"},{"type":"electronic","value":"9783030779641"}],"license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"DOI":"10.1007\/978-3-030-77964-1_15","type":"book-chapter","created":{"date-parts":[[2021,6,11]],"date-time":"2021-06-11T08:03:43Z","timestamp":1623398623000},"page":"181-194","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Grasp the Key: Towards Fast and Accurate Host-Based Intrusion Detection in Data Centers"],"prefix":"10.1007","author":[{"given":"Mengtian","family":"Gu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Biyu","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fengyang","family":"Du","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuehai","family":"Tang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wang","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Liangjun","family":"Zang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jizhong","family":"Han","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Songlin","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2021,6,9]]},"reference":[{"key":"15_CR1","doi-asserted-by":"publisher","first-page":"2986","DOI":"10.1109\/TC.2016.2519914","volume":"65","author":"M Ambusaidi","year":"2016","unstructured":"Ambusaidi, M., He, X., Nanda, P., Tan, Z.: Building an intrusion detection system using a filter-based feature selection algorithm. IEEE Trans. Comput. 65, 2986\u20132998 (2016)","journal-title":"IEEE Trans. Comput."},{"issue":"1","key":"15_CR2","first-page":"71","volume":"9","author":"N Assem","year":"2014","unstructured":"Assem, N., Rachidi, T., Graini, M.T.E.: Intrusion detection using Bayesian classifier for arbitrarily long system call sequences. IADIS Int. J. Comput. Sci. Inf. Syst. 9(1), 71\u201381 (2014)","journal-title":"IADIS Int. J. Comput. Sci. Inf. Syst."},{"key":"15_CR3","doi-asserted-by":"publisher","first-page":"e0130140","DOI":"10.1371\/journal.pone.0130140","volume":"10","author":"S Bach","year":"2015","unstructured":"Bach, S., Binder, A., Montavon, G., Klauschen, F., M\u00fcller, K.R., Samek, W.: On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. Plos One 10, e0130140 (2015)","journal-title":"Plos One"},{"doi-asserted-by":"crossref","unstructured":"Creech, G., Hu, J.: Generation of a new ids test dataset: time to retire the KDD collection. In: 2013 IEEE Wireless Communications and Networking Conference (WCNC) (2013)","key":"15_CR4","DOI":"10.1109\/WCNC.2013.6555301"},{"key":"15_CR5","doi-asserted-by":"publisher","first-page":"514","DOI":"10.1016\/j.cose.2011.05.007","volume":"30","author":"D Yuxin","year":"2011","unstructured":"Yuxin, D., Xuebing, Y., Di, Z., Li, D.: Feature representation and selection in malicious code detection methods based on static system calls. Comput. Secur. 30, 514\u2013524 (2011)","journal-title":"Comput. Secur."},{"unstructured":"Forrest, S., Hofmeyr, S.A., Somayaji, A., Longstaff, T.A.: A sense of self for unix processes. In: SP (1996)","key":"15_CR6"},{"unstructured":"Ghosh, A.K., Schwartzbard, A., Schatz, M.: Learning program behavior profiles for intrusion detection. In: Workshop on Intrusion Detection and Network Monitoring, vol.51462, pp. 1\u201313 (1999)","key":"15_CR7"},{"unstructured":"Godsell, M.: Why should we trust you? Marketing (2007)","key":"15_CR8"},{"issue":"MAR.","key":"15_CR9","first-page":"415","volume":"137","author":"W Khreich","year":"2017","unstructured":"Khreich, W., Murtaza, S.S., Hamou-Lhadj, A., Talhi, C.: Combining heterogeneous anomaly detectors for improved software security. J. Syst. Softw. 137(MAR.), 415\u2013429 (2017)","journal-title":"J. Syst. Softw."},{"unstructured":"Kim, B., et al.: Interpretability beyond feature attribution: quantitative testing with concept activation vectors (TCAV) (2017)","key":"15_CR10"},{"doi-asserted-by":"crossref","unstructured":"Kim, Y.: Convolutional neural networks for sentence classification. arXiv preprint arXiv:1408.5882 (2014)","key":"15_CR11","DOI":"10.3115\/v1\/D14-1181"},{"unstructured":"Liao, Y., Vemuri, V.R.: Using text categorization techniques for intrusion detection. USENIX Security Symposium, vol. 12, pp. 51\u201359 (2002)","key":"15_CR12"},{"doi-asserted-by":"crossref","unstructured":"Liu, M., Xue, Z., Xu, X., Zhong, C., Chen, J.: Host-based intrusion detection system with system calls: review and future trends. ACM Comput. Surv. 51(5), 98.1\u201398.36 (2019)","key":"15_CR13","DOI":"10.1145\/3214304"},{"doi-asserted-by":"crossref","unstructured":"Liu, X., Wang, X., Matwin, S.: Improving the interpretability of deep neural networks with knowledge distillation. In: 2018 IEEE International Conference on Data Mining Workshops (ICDMW) (2018)","key":"15_CR14","DOI":"10.1109\/ICDMW.2018.00132"},{"unstructured":"Lundberg, S., Lee, S.I.: A unified approach to interpreting model predictions (2017)","key":"15_CR15"},{"issue":"4","key":"15_CR16","doi-asserted-by":"publisher","first-page":"994","DOI":"10.1109\/TIFS.2018.2868614","volume":"14","author":"PF Marteau","year":"2018","unstructured":"Marteau, P.F.: Sequence covering for efficient host-based intrusion detection. IEEE Trans. Inf. Forensics Secur. 14(4), 994\u20131006 (2018)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"unstructured":"Shrikumar, A., Greenside, P., Shcherbina, A., Kundaje, A.: Not just a black box: learning important features through propagating activation differences (2016)","key":"15_CR17"},{"unstructured":"Simonyan, K., Vedaldi, A., Zisserman, A.: Deep inside convolutional networks: visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034 (2013)","key":"15_CR18"},{"issue":"1","key":"15_CR19","first-page":"136","volume":"56","author":"RC Staudemeyer","year":"2015","unstructured":"Staudemeyer, R.C.: Applying long short-term memory recurrent neural networks to intrusion detection. South Afr. Comput. J. 56(1), 136\u2013154 (2015)","journal-title":"South Afr. Comput. J."},{"issue":"6","key":"15_CR20","doi-asserted-by":"publisher","first-page":"1057","DOI":"10.1109\/72.728352","volume":"9","author":"AB Tickle","year":"1998","unstructured":"Tickle, A.B., Andrews, R., Golea, M., Diederich, J.: The truth will come to light: directions and challenges in extracting the knowledge embedded within trained artificial neural networks. IEEE Trans. Neural Netw. 9(6), 1057\u20131068 (1998)","journal-title":"IEEE Trans. Neural Netw."},{"key":"15_CR21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"226","DOI":"10.1007\/11856214_12","volume-title":"Recent Advances in Intrusion Detection","author":"K Wang","year":"2006","unstructured":"Wang, K., Parekh, J.J., Stolfo, S.J.: Anagram: a content anomaly detector resistant to mimicry attack. In: Zamboni, D., Kruegel, C. (eds.) RAID 2006. LNCS, vol. 4219, pp. 226\u2013248. Springer, Heidelberg (2006). https:\/\/doi.org\/10.1007\/11856214_12"},{"doi-asserted-by":"crossref","unstructured":"Xie, W., Xu, S., Zou, S., Xi, J.: A system-call behavior language system for malware detection using a sensitivity-based LSTM model. In: Proceedings of the 2020 3rd International Conference on Computer Science and Software Engineering, pp. 112\u2013118 (2020)","key":"15_CR22","DOI":"10.1145\/3403746.3403914"},{"doi-asserted-by":"crossref","unstructured":"Zhou, P., Shi, W., Tian, J., Qi, Z., Xu, B.: Attention-based bidirectional long short-term memory networks for relation classification. In: Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers) (2016)","key":"15_CR23","DOI":"10.18653\/v1\/P16-2034"}],"container-title":["Lecture Notes in Computer Science","Computational Science \u2013 ICCS 2021"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-77964-1_15","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,10]],"date-time":"2025-06-10T22:03:46Z","timestamp":1749593026000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-77964-1_15"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"ISBN":["9783030779634","9783030779641"],"references-count":23,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-77964-1_15","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2021]]},"assertion":[{"value":"9 June 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICCS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Computational Science","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Krakow","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Poland","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2021","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 June 2021","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 June 2021","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"iccs-computsci2021","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.iccs-meeting.org\/iccs2021\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"156","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"48","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"14","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"31% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"2.8","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3.9","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"212 full and 43 short papers were selected from 479 submissions to the workshops\/ thematic tracks. The conference was held virtually.","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}