{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T20:54:06Z","timestamp":1782161646957,"version":"3.54.5"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032299208","type":"print"},{"value":"9783032299215","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-29921-5_13","type":"book-chapter","created":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T20:19:39Z","timestamp":1782159579000},"page":"187-201","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Host Behavioral Consistency Modeling for\u00a0Causal and\u00a0Interpretable Intrusion Detection"],"prefix":"10.1007","author":[{"given":"Boyuan","family":"Xu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yun","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yiru","family":"Gong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Linxu","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chen","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tian","family":"Tian","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bo","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhigang","family":"Lu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,6,23]]},"reference":[{"key":"13_CR1","doi-asserted-by":"crossref","unstructured":"Cheng, Z., et al.: Kairos: practical intrusion detection and investigation using whole-system provenance. In: Proceedings of the IEEE Symposium on Security and Privacy (SP), pp. 3533\u20133551 (2024)","DOI":"10.1109\/SP54263.2024.00005"},{"key":"13_CR2","doi-asserted-by":"crossref","unstructured":"Goyal, A., Wang, G., Bates, A.: R-caid: embedding root cause analysis within provenance-based intrusion detection. In: Proceedings of the 45th IEEE Symposium on Security and Privacy (S&P), pp. 3515\u20133532 (2024)","DOI":"10.1109\/SP54263.2024.00253"},{"key":"13_CR3","doi-asserted-by":"crossref","unstructured":"Han, X., Pasquier, T., Bates, A., Mickens, J., Seltzer, M.: Unicorn: runtime provenance-based detector for advanced persistent threats. In: Proceedings of the Network and Distributed System Security Symposium (NDSS) (2020)","DOI":"10.14722\/ndss.2020.24046"},{"key":"13_CR4","unstructured":"Han, X., et al.: SIGL: securing software installations through deep graph learning. In: Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), pp. 2345\u20132362 (2021)"},{"key":"13_CR5","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., Bates, A., Marino, D.: Tactical provenance analysis for endpoint detection and response systems. In: Proceedings of the IEEE Symposium on Security and Privacy (SP), pp. 1172\u20131189 (2020)","DOI":"10.1109\/SP40000.2020.00096"},{"key":"13_CR6","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., et al.: NoDoze: combatting threat alert fatigue with automated provenance triage. In: Proceedings of the Network and Distributed System Security Symposium (NDSS) (2019)","DOI":"10.14722\/ndss.2019.23349"},{"key":"13_CR7","unstructured":"Hossain, M.N., et al.: SLEUTH: real-time attack scenario reconstruction from cots audit data. In: Proceedings of the 26th USENIX Security Symposium (USENIX Security), pp. 487\u2013504 (2017)"},{"key":"13_CR8","doi-asserted-by":"crossref","unstructured":"Hossain, M.N., Sheikhi, S., Sekar, R.: Combating dependence explosion in forensic analysis using alternative tag propagation semantics. In: Proceedings of the IEEE Symposium on Security and Privacy (SP) (2020)","DOI":"10.1109\/SP40000.2020.00064"},{"key":"13_CR9","unstructured":"Jia, Z., et al.: MAGIC: Detecting advanced persistent threats via masked graph representation learning. In: Proceedings of the 33rd USENIX Security Symposium (USENIX Security), pp. 5197\u20135214 (2024)"},{"key":"13_CR10","unstructured":"Jiang, B., et al.: ORTHRUS: achieving high quality of attribution in provenance-based intrusion detection systems. In: Proceedings of the 34th USENIX Security Symposium (USENIX Security), pp. 7173\u20137192 (2025)"},{"key":"13_CR11","unstructured":"Keromytis, A.D.: Transparent computing engagement 3 data release (2018). https:\/\/github.com\/darpa-i2o\/Transparent-Computing\/blob\/master\/README-E3.md. DARPA\/I2O. Accessed 09 Feb 2026"},{"key":"13_CR12","doi-asserted-by":"crossref","unstructured":"Kwon, Y., et al.: MCI: modeling-based causality inference in audit logging for attack investigation. In: Proceedings of the Network and Distributed System Security Symposium (NDSS) (2018)","DOI":"10.14722\/ndss.2018.23306"},{"key":"13_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104588","volume":"157","author":"H Li","year":"2025","unstructured":"Li, H., et al.: MIRDETECTOR: applying malicious intent representation for enhanced apt anomaly detection. Comput. Secur. 157, 104588 (2025)","journal-title":"Comput. Secur."},{"key":"13_CR14","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Eshete, B., Gjomemo, R., Venkatakrishnan, V.N.: POIROT: aligning attack behavior with kernel audit records for cyber threat hunting. In: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 1795\u20131812 (2019)","DOI":"10.1145\/3319535.3363217"},{"key":"13_CR15","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.N.: HOLMES: real-time APT detection through correlation of suspicious information flows. In: Proceedings of the IEEE Symposium on Security and Privacy (SP), pp. 1137\u20131152 (2019)","DOI":"10.1109\/SP.2019.00026"},{"issue":"11","key":"13_CR16","doi-asserted-by":"publisher","first-page":"11744","DOI":"10.1109\/TIFS.2025.3618381","volume":"20","author":"W Qiao","year":"2025","unstructured":"Qiao, W., et al.: SAURONEYES: disentangling voluminous logs to unveil camouflaged attack intentions. IEEE Trans. Inf. Forensics Secur. 20(11), 11744\u201311758 (2025)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"13_CR17","doi-asserted-by":"crossref","unstructured":"Sharma, A., Gupta, B.B., Singh, A.K., Saraswat, V.K.: Advanced persistent threats (APT): evolution, anatomy, attribution and countermeasures. J. Ambient Intell. Humanized Comput. 14(7), 9355\u20139381 (2023)","DOI":"10.1007\/s12652-023-04603-y"},{"issue":"10","key":"13_CR18","doi-asserted-by":"publisher","first-page":"2506","DOI":"10.1109\/TIFS.2018.2821095","volume":"13","author":"X Sun","year":"2018","unstructured":"Sun, X., Dai, J., Singhal, A., Liu, P., Yen, J.: Using Bayesian networks for probabilistic identification of zero-day attack paths. IEEE Trans. Inf. Forensics Secur. 13(10), 2506\u20132521 (2018)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"13_CR19","doi-asserted-by":"crossref","unstructured":"Rehman, M.U., Ahmadi, H., Hassan, W.U.: FLASH: a comprehensive approach to intrusion detection via provenance graph representation learning. In: Proceedings of the IEEE Symposium on Security and Privacy (SP), pp. 3552\u20133570 (2024)","DOI":"10.1109\/SP54263.2024.00139"},{"key":"13_CR20","doi-asserted-by":"crossref","unstructured":"Wang, Q., et al.: You are what you do: hunting stealthy malware via data provenance analysis. In: Proceedings of the Network and Distributed System Security Symposium (NDSS) (2020)","DOI":"10.14722\/ndss.2020.24167"},{"key":"13_CR21","doi-asserted-by":"publisher","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","volume":"17","author":"S Wang","year":"2022","unstructured":"Wang, S., et al.: THREATRACE: detecting and tracing host-based threats in node level through provenance graph learning. IEEE Trans. Inf. Forensics Secur. 17, 3972\u20133987 (2022)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"13_CR22","doi-asserted-by":"crossref","unstructured":"Wu, W., et al.: Brewing Vodka: distilling pure knowledge for lightweight threat detection in audit logs. In: Proceedings of the ACM Web Conference 2025 (WWW \u201925) (2025)","DOI":"10.1145\/3696410.3714563"},{"key":"13_CR23","unstructured":"Xie, Y., Wu, Y., Feng, D., Long, D.D.E.: P-Gaussian: provenance-based gaussian distribution for detecting intrusion behavior variants using high efficient and real time memory databases. IEEE Trans. Dependable Secure Comput. 18(6), 2660\u20132674 (2021)"},{"key":"13_CR24","unstructured":"Yang, F., Xu, J., Xiong, C., Li, Z., Zhang, K.: PROGRAPHER: an anomaly detection system based on provenance graph embedding. In: Proceedings of the 32nd USENIX Security Symposium (USENIX Security 2023) (2023)"},{"key":"13_CR25","doi-asserted-by":"crossref","unstructured":"Zeng, J., et al.: ShadeWatcher: recommendation-guided cyber threat analysis using system audit records. In: Proceedings of the IEEE Symposium on Security and Privacy (SP), pp. 489\u2013506 (2022)","DOI":"10.1109\/SP46214.2022.9833669"},{"issue":"7","key":"13_CR26","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3539605","volume":"55","author":"M Zipperle","year":"2022","unstructured":"Zipperle, M., Gottwalt, F., Chang, E., Dillon, T.: Provenance-based intrusion detection systems: a survey. ACM Comput. Surv. 55(7), 1\u201336 (2022)","journal-title":"ACM Comput. Surv."}],"container-title":["Lecture Notes in Computer Science","Computational Science \u2013 ICCS 2026"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-29921-5_13","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T20:19:47Z","timestamp":1782159587000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-29921-5_13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032299208","9783032299215"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-29921-5_13","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"23 June 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICCS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Computational Science","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Hamburg","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Germany","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29 June 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"1 July 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"iccs-computsci2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.iccs-meeting.org\/iccs2026\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}