{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T18:55:45Z","timestamp":1757616945581,"version":"3.44.0"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783031703706"},{"type":"electronic","value":"9783031703713"}],"license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024]]},"DOI":"10.1007\/978-3-031-70371-3_2","type":"book-chapter","created":{"date-parts":[[2024,8,31]],"date-time":"2024-08-31T23:31:13Z","timestamp":1725147073000},"page":"19-35","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Achieving Counterfactual Explanation for\u00a0Sequence Anomaly Detection"],"prefix":"10.1007","author":[{"given":"He","family":"Cheng","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Depeng","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shuhan","family":"Yuan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xintao","family":"Wu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,8,22]]},"reference":[{"key":"2_CR1","unstructured":"Alahmadi, B.A., Axon, L., Martinovic, I.: 99% False Positives: A Qualitative Study of $$\\{$$SOC$$\\}$$ Analysts\u2019 Perspectives on Security Alarms, pp. 2783\u20132800 (2022)"},{"key":"2_CR2","doi-asserted-by":"crossref","unstructured":"Antwarg, L., Miller, R.M., Shapira, B., Rokach, L.: Explaining anomalies detected by autoencoders using SHAP (2020). arXiv:1903.02407 [cs, stat]","DOI":"10.1016\/j.eswa.2021.115736"},{"key":"2_CR3","doi-asserted-by":"crossref","unstructured":"Bhusal, D., et al.: Sok: modeling explainability in security analytics for interpretability, trustworthiness, and usability. In: Proceedings of the 18th International Conference on Availability, Reliability and Security, pp. 1\u201312 (2023)","DOI":"10.1145\/3600160.3600193"},{"key":"2_CR4","doi-asserted-by":"crossref","unstructured":"Brown, A., Tuor, A., Hutchinson, B., Nichols, N.: Recurrent neural network attention mechanisms for interpretable system log anomaly detection. In: Proceedings of the First Workshop on MLCS. MLCS\u201918 (2018)","DOI":"10.1145\/3217871.3217872"},{"key":"2_CR5","unstructured":"Chen, C., Li, O., Tao, C., Barnett, A.J., Su, J., Rudin, C.: This looks like that: deep learning for interpretable image recognition. In: NeurIPS (2019)"},{"key":"2_CR6","doi-asserted-by":"publisher","unstructured":"Cheng, H., Xu, D., Yuan, S.: Sequential anomaly detection with local and global explanations. In: 2022 IEEE International Conference on Big Data (Big Data), pp. 1212\u20131217 (2022). https:\/\/doi.org\/10.1109\/BigData55660.2022.10020990","DOI":"10.1109\/BigData55660.2022.10020990"},{"key":"2_CR7","doi-asserted-by":"publisher","unstructured":"Cheng, H., Xu, D., Yuan, S.: Explainable sequential anomaly detection via prototypes. In: 2023 International Joint Conference on Neural Networks (IJCNN), pp.\u00a01\u20138 (2023). https:\/\/doi.org\/10.1109\/IJCNN54540.2023.10191703","DOI":"10.1109\/IJCNN54540.2023.10191703"},{"key":"2_CR8","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., Srikumar, V.: DeepLog: anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017)","DOI":"10.1145\/3133956.3134015"},{"issue":"3","key":"2_CR9","doi-asserted-by":"publisher","first-page":"229","DOI":"10.1016\/j.icte.2020.06.003","volume":"6","author":"A Farzad","year":"2020","unstructured":"Farzad, A., Gulliver, T.A.: Unsupervised log message anomaly detection. ICT Express 6(3), 229\u2013237 (2020)","journal-title":"ICT Express"},{"key":"2_CR10","doi-asserted-by":"crossref","unstructured":"Glasser, J., Lindauer, B.: Bridging the gap: a pragmatic approach to generating insider threat data. In: 2013 IEEE Security and Privacy Workshops (2013)","DOI":"10.1109\/SPW.2013.37"},{"key":"2_CR11","doi-asserted-by":"crossref","unstructured":"Han, D., et al.: DeepAID: interpreting and improving deep learning-based anomaly detection in security applications. In: CCS (2021)","DOI":"10.1145\/3460120.3484589"},{"key":"2_CR12","doi-asserted-by":"publisher","unstructured":"Han, X., Cheng, H., Xu, D., Yuan, S.: Interpretablesad: interpretable anomaly detection in sequential log data. In: 2021 IEEE International Conference on Big Data (Big Data), pp. 1183\u20131192 (2021). https:\/\/doi.org\/10.1109\/BigData52589.2021.9671642","DOI":"10.1109\/BigData52589.2021.9671642"},{"key":"2_CR13","doi-asserted-by":"publisher","unstructured":"He, P., Zhu, J., Zheng, Z., Lyu, M.R.: Drain: an online log parsing approach with fixed depth tree. In: 2017 IEEE International Conference on Web Services (ICWS), pp. 33\u201340 (2017). https:\/\/doi.org\/10.1109\/ICWS.2017.13","DOI":"10.1109\/ICWS.2017.13"},{"key":"2_CR14","unstructured":"Liznerski, P., Ruff, L., Vandermeulen, R.A., Franks, B.J., Kloft, M., M\u00fcller, K.R.: Explainable deep one-class classification. In: ICLR (2021)"},{"key":"2_CR15","doi-asserted-by":"crossref","unstructured":"Molnar, C.: Interpretable Machine Learning (2019)","DOI":"10.21105\/joss.00786"},{"key":"2_CR16","doi-asserted-by":"crossref","unstructured":"Nguyen, Q.P., Lim, K.W., Divakaran, D.M., Low, K.H., Chan, M.C.: GEE: a gradient-based explainable variational autoencoder for network anomaly detection. In: 2019 IEEE Conference on CNS, pp. 91\u201399 (2019)","DOI":"10.1109\/CNS.2019.8802833"},{"key":"2_CR17","doi-asserted-by":"crossref","unstructured":"Oliner, A., Stearley, J.: What supercomputers say: a study of five system logs. In: 37th Annual IEEE\/IFIP International Conference on DSN. IEEE (2007)","DOI":"10.1109\/DSN.2007.103"},{"key":"2_CR18","unstructured":"Ruff, L., et al.: Deep one-class classification. In: ICML (2018)"},{"key":"2_CR19","unstructured":"Ruff, L., et al.: Deep semi-supervised anomaly detection. In: ICLR (2020)"},{"key":"2_CR20","doi-asserted-by":"crossref","unstructured":"Yuan, S., Zheng, P., Wu, X., Tong, H.: Few-shot insider threat detection. In: CIKM (2020)","DOI":"10.1145\/3340531.3412161"},{"key":"2_CR21","unstructured":"Sundararajan, M., Najmi, A.: The many Shapley values for model explanation. In: ICML, pp. 9269\u20139278. PMLR (2020)"},{"key":"2_CR22","unstructured":"Sutton, R.S., Barto, A.G.: Reinforcement Learning: An Introduction. MIT Press, Cambridge (2018)"},{"key":"2_CR23","doi-asserted-by":"crossref","unstructured":"Wang, Z., Chen, Z., Ni, J., Liu, H., Chen, H., Tang, J.: Multi-scale one-class recurrent neural networks for discrete event sequence anomaly detection. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 3726\u20133734 (2021)","DOI":"10.1145\/3447548.3467125"},{"key":"2_CR24","unstructured":"Xu, K., et al.: Show, attend and tell: neural image caption generation with visual attention. In: ICML, pp. 2048\u20132057. PMLR (2015)"},{"key":"2_CR25","doi-asserted-by":"crossref","unstructured":"Yu, M., Chang, S., Zhang, Y., Jaakkola, T.S.: Rethinking cooperative rationalization: introspective extraction and complement control. In: EMNLP (2019)","DOI":"10.18653\/v1\/D19-1420"},{"key":"2_CR26","doi-asserted-by":"crossref","unstructured":"Zhou, R., et al.: LogAnomaly: unsupervised detection of sequential and quantitative anomalies in unstructured logs. In: IJCAI, pp. 4739\u20134745 (2019)","DOI":"10.24963\/ijcai.2019\/658"}],"container-title":["Lecture Notes in Computer Science","Machine Learning and Knowledge Discovery in Databases. Research Track and Demo Track"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-70371-3_2","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T21:12:35Z","timestamp":1757106755000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-70371-3_2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"ISBN":["9783031703706","9783031703713"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-70371-3_2","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2024]]},"assertion":[{"value":"22 August 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ECML PKDD","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Joint European Conference on Machine Learning and Knowledge Discovery in Databases","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Vilnius","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Lithuania","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"8 September 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12 September 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ecml2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/2024.ecmlpkdd.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}