{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,26]],"date-time":"2025-03-26T11:22:06Z","timestamp":1742988126585,"version":"3.40.3"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783031714634"},{"type":"electronic","value":"9783031714641"}],"license":[{"start":{"date-parts":[[2024,11,13]],"date-time":"2024-11-13T00:00:00Z","timestamp":1731456000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,11,13]],"date-time":"2024-11-13T00:00:00Z","timestamp":1731456000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-71464-1_28","type":"book-chapter","created":{"date-parts":[[2024,11,12]],"date-time":"2024-11-12T17:50:43Z","timestamp":1731433843000},"page":"333-346","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["BehaMiner: System Behavior Mining for\u00a0Audit Log Based on\u00a0Graph Learning"],"prefix":"10.1007","author":[{"given":"Xiu","family":"Ma","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoze","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ce","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ziyang","family":"Yu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qi","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiujian","family":"Lv","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yan","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jianguo","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,11,13]]},"reference":[{"key":"28_CR1","unstructured":"Endpoint monitoring and forensics. https:\/\/logrhythm.com\/products\/endpoint-monitoring"},{"key":"28_CR2","doi-asserted-by":"crossref","unstructured":"Altinisik, E., Deniz, F., Sencar, H.T.: Provg-searcher: a graph representation learning approach for efficient provenance graph search. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 2247\u20132261 (2023)","DOI":"10.1145\/3576915.3623187"},{"key":"28_CR3","unstructured":"Bordes, A., Usunier, N., Garcia-Duran, A., Weston, J., Yakhnenko, O.: Translating embeddings for modeling multi-relational data. In: Advances in Neural Information Processing Systems, vol. 26 (2013)"},{"key":"28_CR4","doi-asserted-by":"crossref","unstructured":"Cheng, Z., et al.: Kairos:: practical intrusion detection and investigation using whole-system provenance. arXiv preprint arXiv:2308.05034 (2023)","DOI":"10.1109\/SP54263.2024.00005"},{"key":"28_CR5","unstructured":"Corporation, M.: Event tracing for windows (ETW). http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa363668(v=vs.85).aspx"},{"key":"28_CR6","doi-asserted-by":"crossref","unstructured":"Elhadi, A.A.E., Maarof, M.A., Barry, B.I., Hamza, H.: Enhancing the detection of metamorphic malware using call graphs. Comput. Secur. 46, 62\u201378 (2014). https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0167404814001060","DOI":"10.1016\/j.cose.2014.07.004"},{"key":"28_CR7","unstructured":"Hamilton, W., Ying, Z., Leskovec, J.: Inductive representation learning on large graphs. In: Advances in Neural Information Processing Systems, vol. 30 (2017)"},{"key":"28_CR8","doi-asserted-by":"crossref","unstructured":"Han, D., et al.: Deepaid: interpreting and improving deep learning-based anomaly detection in security applications. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 3197\u20133217 (2021)","DOI":"10.1145\/3460120.3484589"},{"key":"28_CR9","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., et al.: Nodoze: combatting threat alert fatigue with automated provenance triage. In: Network and Distributed Systems Security Symposium (2019)","DOI":"10.14722\/ndss.2019.23349"},{"key":"28_CR10","doi-asserted-by":"crossref","unstructured":"Hossain, M.N., Sheikhi, S., Sekar, R.: Combating dependence explosion in forensic analysis using alternative tag propagation semantics. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 1139\u20131155. IEEE (2020)","DOI":"10.1109\/SP40000.2020.00064"},{"key":"28_CR11","unstructured":"Kipf, T.N., Welling, M.: Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2017)"},{"key":"28_CR12","doi-asserted-by":"crossref","unstructured":"Kwon, Y., et\u00a0al.: MCI: modeling-based causality inference in audit logging for attack investigation. In: Network and Distributed Systems Security (NDSS) Symposium (2018)","DOI":"10.14722\/ndss.2018.23306"},{"key":"28_CR13","doi-asserted-by":"crossref","unstructured":"Li, J., Zhang, R., Liu, J., Liu, G., et\u00a0al.: Logkernel: a threat hunting approach based on behaviour provenance graph and graph kernel clustering. Secur. Commun. Netw. 2022 (2022)","DOI":"10.1155\/2022\/4577141"},{"key":"28_CR14","doi-asserted-by":"crossref","unstructured":"Monti, F., Boscaini, D., Masci, J., Rodola, E., Svoboda, J., Bronstein, M.M.: Geometric deep learning on graphs and manifolds using mixture model CNNs. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 5115\u20135124 (2017)","DOI":"10.1109\/CVPR.2017.576"},{"key":"28_CR15","unstructured":"Nikolentzos, G., Vazirgiannis, M.: Message passing graph kernels. arXiv preprint arXiv:1808.02510 (2018)"},{"issue":"5","key":"28_CR16","doi-asserted-by":"publisher","first-page":"503","DOI":"10.1108\/00220410410560582","volume":"60","author":"S Robertson","year":"2004","unstructured":"Robertson, S.: Understanding inverse document frequency: on theoretical arguments for IDF. J. Doc. 60(5), 503\u2013520 (2004)","journal-title":"J. Doc."},{"key":"28_CR17","unstructured":"Velickovic, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., Bengio, Y.: Graph attention networks. arXiv preprint arXiv:1710.10903 (2018)"},{"key":"28_CR18","doi-asserted-by":"crossref","unstructured":"Wang, Q., et\u00a0al.: You are what you do: hunting stealthy malware via data provenance analysis. In: NDSS (2020)","DOI":"10.14722\/ndss.2020.24167"},{"key":"28_CR19","doi-asserted-by":"publisher","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","volume":"17","author":"S Wang","year":"2022","unstructured":"Wang, S., et al.: Threatrace: detecting and tracing host-based threats in node level through provenance graph learning. IEEE Trans. Inf. Forensics Secur. 17, 3972\u20133987 (2022)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"28_CR20","unstructured":"Xu, K., Hu, W., Leskovec, J., Jegelka, S.: How powerful are graph neural networks? arXiv preprint arXiv:1810.00826 (2018)"},{"key":"28_CR21","unstructured":"Xu, K., Hu, W., Leskovec, J., Jegelka, S.: How powerful are graph neural networks? In: International Conference on Learning Representations (2019)"},{"key":"28_CR22","doi-asserted-by":"crossref","unstructured":"Xu, Z., Fang, P., Liu, C., Xiao, X., Wen, Y., Meng, D.: Depcomm: graph summarization on system audit logs for attack investigation. In: 2022 IEEE Symposium on Security and Privacy (SP), pp. 540\u2013557. IEEE (2022)","DOI":"10.1109\/SP46214.2022.9833632"},{"key":"28_CR23","doi-asserted-by":"publisher","unstructured":"Zeng, J., Chua, Z.L., Chen, Y., Ji, K., Liang, Z., Mao, J.: WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics, February 2021. https:\/\/doi.org\/10.14722\/ndss.2021.24549","DOI":"10.14722\/ndss.2021.24549"},{"key":"28_CR24","doi-asserted-by":"crossref","unstructured":"Zengy, J., et al.: Shadewatcher: recommendation-guided cyber threat analysis using system audit records. In: 2022 IEEE Symposium on Security and Privacy (SP), pp. 489\u2013506. IEEE (2022)","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"28_CR25","doi-asserted-by":"crossref","unstructured":"Zhang, H., Cai, L., Zhao, L., Yu, A., Ma, J., Meng, D.: Logminer: a system audit log reduction strategy based on behavior pattern mining. In: MILCOM 2022-2022 IEEE Military Communications Conference (MILCOM), pp. 292\u2013297. IEEE (2022)","DOI":"10.1109\/MILCOM55135.2022.10017626"},{"key":"28_CR26","doi-asserted-by":"crossref","unstructured":"Zong, B., et al.: Behavior query discovery in system-generated temporal graphs. arXiv preprint arXiv:1511.05911 (2015)","DOI":"10.14778\/2856318.2856320"}],"container-title":["Lecture Notes in Computer Science","Wireless Artificial Intelligent Computing Systems and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-71464-1_28","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,12]],"date-time":"2024-11-12T18:05:52Z","timestamp":1731434752000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-71464-1_28"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11,13]]},"ISBN":["9783031714634","9783031714641"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-71464-1_28","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2024,11,13]]},"assertion":[{"value":"13 November 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"WASA","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Wireless Artificial Intelligent Computing Systems and Applications","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Qingdao","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21 June 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 June 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"wasa2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/wasa-conference.org\/WASA2024\/index.html","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}