{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T16:48:40Z","timestamp":1783529320065,"version":"3.55.0"},"publisher-location":"Cham","reference-count":49,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032105530","type":"print"},{"value":"9783032105547","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-10554-7_7","type":"book-chapter","created":{"date-parts":[[2026,1,2]],"date-time":"2026-01-02T02:00:08Z","timestamp":1767319208000},"page":"121-144","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Resilience Against APTs: A Provenance-Based IIoT Dataset for\u00a0Cybersecurity Research"],"prefix":"10.1007","author":[{"given":"Erfan","family":"Ghiasvand","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Suprio","family":"Ray","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shahrear","family":"Iqbal","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sajjad","family":"Dadkhah","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ali A.","family":"Ghorbani","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,1,2]]},"reference":[{"issue":"7","key":"7_CR1","doi-asserted-by":"publisher","first-page":"5558","DOI":"10.1109\/JIOT.2020.3032093","volume":"8","author":"M Al-Hawawreh","year":"2020","unstructured":"Al-Hawawreh, M., Sitnikova, E.: Developing a security testbed for industrial internet of things. IEEE Internet Things J. 8(7), 5558\u20135573 (2020)","journal-title":"IEEE Internet Things J."},{"issue":"5","key":"7_CR2","doi-asserted-by":"publisher","first-page":"3962","DOI":"10.1109\/JIOT.2021.3102056","volume":"9","author":"M Al-Hawawreh","year":"2021","unstructured":"Al-Hawawreh, M., Sitnikova, E., Aboutorab, N.: X-iiotid: a connectivity-agnostic and device-agnostic intrusion data set for industrial internet of things. IEEE Internet Things J. 9(5), 3962\u20133977 (2021)","journal-title":"IEEE Internet Things J."},{"key":"7_CR3","doi-asserted-by":"publisher","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","volume":"8","author":"A Alsaedi","year":"2020","unstructured":"Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A., Anwar, A.: Ton_iot telemetry dataset: a new generation dataset of iot and iiot for data-driven intrusion detection systems. IEEE Access 8, 165130\u2013165150 (2020)","journal-title":"IEEE Access"},{"issue":"2","key":"7_CR4","doi-asserted-by":"publisher","first-page":"1851","DOI":"10.1109\/COMST.2019.2891891","volume":"21","author":"A Alshamrani","year":"2019","unstructured":"Alshamrani, A., Myneni, S., Chowdhary, A., Huang, D.: A survey on advanced persistent threats: techniques, solutions, challenges, and research opportunities. IEEE Commun. Surv. Tutor. 21(2), 1851\u20131877 (2019)","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"6","key":"7_CR5","doi-asserted-by":"publisher","first-page":"10441","DOI":"10.1109\/JIOT.2019.2939286","volume":"6","author":"MN Aman","year":"2019","unstructured":"Aman, M.N., Basheer, M.H., Sikdar, B.: Data provenance for IoT with light weight authentication and privacy preservation. IEEE Internet Things J. 6(6), 10441\u201310457 (2019)","journal-title":"IEEE Internet Things J."},{"key":"7_CR6","doi-asserted-by":"crossref","unstructured":"Aman, M.N., Chua, K.C., Sikdar, B.: Secure data provenance for the internet of things. In: Proceedings of the 3rd ACM International Workshop on IoT Privacy, Trust, and Security, pp. 11\u201314 (2017)","DOI":"10.1145\/3055245.3055255"},{"key":"7_CR7","doi-asserted-by":"crossref","unstructured":"Anjum, M.M., Iqbal, S., Hamelin, B.: Anubis: a provenance graph-based framework for advanced persistent threat detection. In: Proceedings of the 37th ACM\/SIGAPP Symposium on Applied Computing, pp. 1684\u20131693 (2022)","DOI":"10.1145\/3477314.3507097"},{"key":"7_CR8","unstructured":"Barre, M., Gehani, A., Yegneswaran, V.: Mining data provenance to detect advanced persistent threats. In: 11th International Workshop on Theory and Practice of Provenance (TaPP 2019) (2019)"},{"key":"7_CR9","unstructured":"Bates, A., Tian, D.J., Butler, K.R., Moyer, T.: Trustworthy $$\\{$$Whole-System$$\\}$$ provenance for the linux kernel. In: 24th USENIX Security Symposium (USENIX Security 15), pp. 319\u2013334 (2015)"},{"key":"7_CR10","unstructured":"Berrada, G., Cheney, J.: Aggregating unsupervised provenance anomaly detectors. In: 11th International Workshop on Theory and Practice of Provenance (TaPP 2019) (2019)"},{"key":"7_CR11","doi-asserted-by":"crossref","unstructured":"Breitenbacher, D., Homoliak, I., Aung, Y.L., Tippenhauer, N.O., Elovici, Y.: Hades-iot: a practical host-based anomaly detection system for iot devices. In: Proceedings of the 2019 ACM Asia conference on computer and communications security. pp. 479\u2013484 (2019)","DOI":"10.1145\/3321705.3329847"},{"issue":"5","key":"7_CR12","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3530812","volume":"55","author":"Z Chen","year":"2022","unstructured":"Chen, Z., et al.: Machine learning-enabled iot security: open issues and challenges under advanced persistent threats. ACM Comput. Surv. 55(5), 1\u201337 (2022)","journal-title":"ACM Comput. Surv."},{"key":"7_CR13","unstructured":"Corporation, M.: Apt29 (2023). https:\/\/attack.mitre.org\/groups\/G0016\/. Accessed Oct 2023"},{"issue":"4","key":"7_CR14","doi-asserted-by":"publisher","first-page":"2233","DOI":"10.1109\/TII.2014.2300753","volume":"10","author":"L Da Xu","year":"2014","unstructured":"Da Xu, L., He, W., Li, S.: Internet of things in industries: a survey. IEEE Trans. Ind. Inf. 10(4), 2233\u20132243 (2014)","journal-title":"IEEE Trans. Ind. Inf."},{"key":"7_CR15","first-page":"1","volume":"2018","author":"A Di Pinto","year":"2018","unstructured":"Di Pinto, A., Dragoni, Y., Carcano, A.: Triton: the first ics cyber attack on safety instrument systems. Proc. Black Hat USA 2018, 1\u201326 (2018)","journal-title":"Proc. Black Hat USA"},{"key":"7_CR16","doi-asserted-by":"publisher","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","volume":"10","author":"MA Ferrag","year":"2022","unstructured":"Ferrag, M.A., Friha, O., Hamouda, D., Maglaras, L., Janicke, H.: Edge-iiotset: a new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning. IEEE Access 10, 40281\u201340306 (2022)","journal-title":"IEEE Access"},{"key":"7_CR17","unstructured":"Five Directions: Operationally transparent cyber (optc) dataset. https:\/\/github.com\/FiveDirections\/OpTC-data. Accessed 22 Feb 2024"},{"key":"7_CR18","doi-asserted-by":"crossref","unstructured":"Garcia-Teodoro, P., Diaz-Verdejo, J., Maci\u00e1-Fern\u00e1ndez, G., V\u00e1zquez, E.: Anomaly-based network intrusion detection: techniques, systems and challenges. Comput. Secur. 28(1-2), 18\u201328 (2009)","DOI":"10.1016\/j.cose.2008.08.003"},{"key":"7_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1007\/978-3-642-35170-9_6","volume-title":"Middleware 2012","author":"A Gehani","year":"2012","unstructured":"Gehani, A., Tariq, D.: SPADE: support for provenance auditing in distributed environments. In: Narasimhan, P., Triantafillou, P. (eds.) Middleware 2012. LNCS, vol. 7662, pp. 101\u2013120. Springer, Heidelberg (2012). https:\/\/doi.org\/10.1007\/978-3-642-35170-9_6"},{"key":"7_CR20","doi-asserted-by":"crossref","unstructured":"Grover, A., Leskovec, J.: node2vec: scalable feature learning for networks. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 855\u2013864 (2016)","DOI":"10.1145\/2939672.2939754"},{"key":"7_CR21","unstructured":"Hamilton, W., Ying, Z., Leskovec, J.: Inductive representation learning on large graphs. Adv. Neural Inf. Process. Syst. 30 (2017)"},{"key":"7_CR22","doi-asserted-by":"crossref","unstructured":"Han, X., Pasquier, T., Bates, A., Mickens, J., Seltzer, M.: Unicorn: runtime provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525 (2020)","DOI":"10.14722\/ndss.2020.24046"},{"key":"7_CR23","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., Bates, A., Marino, D.: Tactical provenance analysis for endpoint detection and response systems. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 1172\u20131189. IEEE (2020)","DOI":"10.1109\/SP40000.2020.00096"},{"key":"7_CR24","doi-asserted-by":"publisher","first-page":"881","DOI":"10.1007\/s00778-017-0486-1","volume":"26","author":"M Herschel","year":"2017","unstructured":"Herschel, M., Diestelk\u00e4mper, R., Ben Lahmar, H.: A survey on provenance: what for? what form? what from? VLDB J. 26, 881\u2013906 (2017)","journal-title":"VLDB J."},{"key":"7_CR25","unstructured":"Hossain, M.N., et al.: $$\\{$$SLEUTH$$\\}$$: real-time attack scenario reconstruction from $$\\{$$COTS$$\\}$$ audit data. In: 26th USENIX Security Symposium (USENIX Security 17), pp. 487\u2013504 (2017)"},{"key":"7_CR26","doi-asserted-by":"publisher","first-page":"1441","DOI":"10.1007\/s11280-019-00746-1","volume":"23","author":"R Hu","year":"2020","unstructured":"Hu, R., Yan, Z., Ding, W., Yang, L.T.: A survey on data provenance in iot. World Wide Web 23, 1441\u20131463 (2020)","journal-title":"World Wide Web"},{"issue":"3","key":"7_CR27","doi-asserted-by":"publisher","first-page":"66","DOI":"10.3390\/fi11030066","volume":"11","author":"S Jaloudi","year":"2019","unstructured":"Jaloudi, S.: Communication protocols of an industrial internet of things environment: a comparative study. Future Internet 11(3), 66 (2019)","journal-title":"Future Internet"},{"issue":"6","key":"7_CR28","doi-asserted-by":"publisher","first-page":"881","DOI":"10.1007\/s00778-017-0486-1","volume":"26","author":"M Herschel","year":"2017","unstructured":"Herschel, M., Diestelkamper, R., Ben Lahmar, H.: A survey on provenance: what for? What form? What from? VLDB J. 26(6), 881\u2013906 (2017)","journal-title":"VLDB J."},{"issue":"3","key":"7_CR29","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1109\/MSP.2011.67","volume":"9","author":"R Langner","year":"2011","unstructured":"Langner, R.: Stuxnet: dissecting a cyberwarfare weapon. IEEE Secur. Priv. 9(3), 49\u201351 (2011)","journal-title":"IEEE Secur. Priv."},{"key":"7_CR30","doi-asserted-by":"crossref","unstructured":"Malik, P.K., et al.: Industrial internet of things and its applications in industry 4.0: state of the art. Comput. Commun. 166, 125\u2013139 (2021)","DOI":"10.1016\/j.comcom.2020.11.016"},{"key":"7_CR31","first-page":"36","volume":"55","author":"Z Michael","year":"2022","unstructured":"Michael, Z., Florian, G., Elizabeth, C., Tharam, D.: Provenance-based intrusion detection systems: a survey. ACM Comput. Surv. 55, 36 (2022)","journal-title":"ACM Comput. Surv."},{"key":"7_CR32","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.: Holmes: real-time apt detection through correlation of suspicious information flows. In: 2019 IEEE Symposium on Security and Privacy (SP), pp. 1137\u20131152. IEEE (2019)","DOI":"10.1109\/SP.2019.00026"},{"key":"7_CR33","unstructured":"MITRE: Group g0016 - APT29. https:\/\/attack.mitre.org\/groups\/G0016\/. Accessed Apr 2024"},{"key":"7_CR34","series-title":"Communications in Computer and Information Science","doi-asserted-by":"publisher","first-page":"138","DOI":"10.1007\/978-3-030-59621-7_8","volume-title":"Deployable Machine Learning for Security Defense","author":"S Myneni","year":"2020","unstructured":"Myneni, S., et al.: DAPT 2020 - constructing a benchmark dataset for advanced persistent threats. In: Wang, G., Ciptadi, A., Ahmadzadeh, A. (eds.) MLHat 2020. CCIS, vol. 1271, pp. 138\u2013163. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-59621-7_8"},{"key":"7_CR35","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109688","volume":"227","author":"S Myneni","year":"2023","unstructured":"Myneni, S., Jha, K., Sabur, A., Agrawal, G., Deng, Y., Chowdhary, A., Huang, D.: Unraveled\u2013a semi-synthetic dataset for advanced persistent threats. Comput. Netw. 227, 109688 (2023)","journal-title":"Comput. Netw."},{"issue":"13","key":"7_CR36","doi-asserted-by":"publisher","first-page":"5941","DOI":"10.3390\/s23135941","volume":"23","author":"ECP Neto","year":"2023","unstructured":"Neto, E.C.P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., Ghorbani, A.A.: Ciciot 2023: a real-time dataset and benchmark for large-scale attacks in iot environment. Sensors 23(13), 5941 (2023)","journal-title":"Sensors"},{"key":"7_CR37","unstructured":"NS-3: Ns-3 consortium. https:\/\/www.nsnam.org\/. Accessed 11 Mar 2024"},{"key":"7_CR38","doi-asserted-by":"crossref","unstructured":"Nwafor, E., Campbell, A., Hill, D., Bloom, G.: Towards a provenance collection framework for internet of things devices. In: 2017 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computed, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld\/SCALCOM\/UIC\/ATC\/CBDCom\/IOP\/SCI), pp.\u00a01\u20136. IEEE (2017)","DOI":"10.1109\/UIC-ATC.2017.8397531"},{"key":"7_CR39","doi-asserted-by":"crossref","unstructured":"Pan, B., Stakhanova, N., Ray, S.: Data provenance in security and privacy. ACM Comput. Surv. (2023)","DOI":"10.1145\/3593294"},{"key":"7_CR40","doi-asserted-by":"crossref","unstructured":"Pasquier, T., et al.: Practical whole-system provenance capture. In: Proceedings of the 2017 Symposium on Cloud Computing, pp. 405\u2013418 (2017)","DOI":"10.1145\/3127479.3129249"},{"key":"7_CR41","unstructured":"Ren, Y., Liu, B., Huang, C., Dai, P., Bo, L., Zhang, J.: Heterogeneous deep graph infomax. arXiv preprint arXiv:1911.08538 (2019)"},{"key":"7_CR42","volume":"43","author":"L Sadineni","year":"2022","unstructured":"Sadineni, L., Pilli, E.S., Battula, R.B.: Provnet-iot: provenance based network layer forensics in internet of things. Forensic Sci. Int. Digit. Investigat. 43, 301441 (2022)","journal-title":"Forensic Sci. Int. Digit. Investigat."},{"issue":"11","key":"7_CR43","doi-asserted-by":"publisher","first-page":"4724","DOI":"10.1109\/TII.2018.2852491","volume":"14","author":"E Sisinni","year":"2018","unstructured":"Sisinni, E., Saifullah, A., Han, S., Jennehag, U., Gidlund, M.: Industrial internet of things: challenges, opportunities, and directions. IEEE Trans. Ind. Inf. 14(11), 4724\u20134734 (2018)","journal-title":"IEEE Trans. Ind. Inf."},{"key":"7_CR44","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101734","volume":"92","author":"B Stojanovi\u0107","year":"2020","unstructured":"Stojanovi\u0107, B., Hofer-Schmitz, K., Kleb, U.: Apt datasets and attack modeling for automated detection methods: A review. Comput. Secur. 92, 101734 (2020)","journal-title":"Comput. Secur."},{"key":"7_CR45","doi-asserted-by":"crossref","unstructured":"Whitehead, D.E., Owens, K., Gammel, D., Smith, J.: Ukraine cyber-induced power outage: analysis and practical mitigation strategies. In: 2017 70th Annual Conference for Protective Relay Engineers (CPRE), pp.\u00a01\u20138. IEEE (2017)","DOI":"10.1109\/CPRE.2017.8090056"},{"key":"7_CR46","doi-asserted-by":"crossref","unstructured":"Wurm, J., Hoang, K., Arias, O., Sadeghi, A.R., Jin, Y.: Security analysis on consumer and industrial iot devices. In: 2016 21st Asia and South Pacific Design Automation Conference (ASP-DAC), pp. 519\u2013524. IEEE (2016)","DOI":"10.1109\/ASPDAC.2016.7428064"},{"key":"7_CR47","doi-asserted-by":"crossref","unstructured":"Xu, K., Tian, K., Yao, D., Ryder, B.G.: A sharper sense of self: probabilistic reasoning of program behaviors for anomaly detection with context sensitivity. In: 2016 46th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 467\u2013478. IEEE (2016)","DOI":"10.1109\/DSN.2016.49"},{"key":"7_CR48","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102675","volume":"116","author":"Z Yang","year":"2022","unstructured":"Yang, Z., et al.: A systematic literature review of methods and datasets for anomaly-based network intrusion detection. Comput. Secur. 116, 102675 (2022)","journal-title":"Comput. Secur."},{"issue":"7","key":"7_CR49","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3539605","volume":"55","author":"M Zipperle","year":"2022","unstructured":"Zipperle, M., Gottwalt, F., Chang, E., Dillon, T.: Provenance-based intrusion detection systems: a survey. ACM Comput. Surv. 55(7), 1\u201336 (2022)","journal-title":"ACM Comput. Surv."}],"container-title":["Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering","Mobile and Ubiquitous Systems: Computing, Networking and Services"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-10554-7_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,2]],"date-time":"2026-01-02T02:00:11Z","timestamp":1767319211000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-10554-7_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032105530","9783032105547"],"references-count":49,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-10554-7_7","relation":{},"ISSN":["1867-8211","1867-822X"],"issn-type":[{"value":"1867-8211","type":"print"},{"value":"1867-822X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"2 January 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors declare no conflict of interest.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"MobiQuitous","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Mobile and Ubiquitous Systems: Computing, Networking, and Services","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Oslo","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Norway","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12 November 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 November 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"mobiquitous2024a","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/mobiquitous.eai-conferences.org\/2024\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}