{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T09:10:02Z","timestamp":1784365802752,"version":"3.55.0"},"publisher-location":"Singapore","reference-count":16,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819234226","type":"print"},{"value":"9789819234233","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,7,19]],"date-time":"2026-07-19T00:00:00Z","timestamp":1784419200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,7,19]],"date-time":"2026-07-19T00:00:00Z","timestamp":1784419200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2027]]},"DOI":"10.1007\/978-981-92-3423-3_3","type":"book-chapter","created":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T08:49:16Z","timestamp":1784364556000},"page":"25-35","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["STORM: Scalable Real-Time Anomaly Detection on Large Heterogeneous System Graphs"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-8671-1093","authenticated-orcid":false,"given":"Yuyang","family":"Xie","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7393-3683","authenticated-orcid":false,"given":"Chaoqun","family":"Guo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8907-8423","authenticated-orcid":false,"given":"Jingxin","family":"Su","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,7,19]]},"reference":[{"key":"3_CR1","unstructured":"DARPA: DARPA Transparent Computing Program Engagement 3 data release. https:\/\/github.com\/darpa-i2o\/Transparent-Computing. Accessed 20 Sep 2022"},{"key":"3_CR2","first-page":"277","volume":"10","author":"A Fascista","year":"2024","unstructured":"Fascista, A., Coluccia, A., Ravazzi, C.: Graph signal reconstruction under heterogeneous noise via adaptive uncertainty-aware sampling and soft classification. IEEE Trans. Sig. Inf. Process. Netw. 10, 277\u2013293 (2024)","journal-title":"IEEE Trans. Sig. Inf. Process. Netw."},{"key":"3_CR3","doi-asserted-by":"crossref","unstructured":"Han, X., Pasquier, T.F.J.-M., Bates, A., Mickens, J., Seltzer, M.I.: Unicorn: Runtime provenance-based detector for advanced persistent threats. In: 27th Annual Network and Distributed System Security Symposium, NDSS 2020. The Internet Society, San Diego (2020)","DOI":"10.14722\/ndss.2020.24046"},{"key":"3_CR4","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., et al.: NoDoze: combatting threat alert fatigue with automated provenance triage. In: Network and Distributed System Security Symposium, NDSS 2019.The Internet Society, San Diego (2019)","DOI":"10.14722\/ndss.2019.23349"},{"key":"3_CR5","unstructured":"Hossain, M.N., et al.: SLEUTH: Real-time attack scenario reconstruction from COTS audit data. In: 26th USENIX Security Symposium, pp.\u00a0487\u2013504. USENIX Association, Vancouver, BC (2017)"},{"key":"3_CR6","doi-asserted-by":"crossref","unstructured":"Hou, Z., et al.: GraphMAE: self-supervised masked graph AutoEncoders. In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp.\u00a0594\u2013604. ACM, New York (2022)","DOI":"10.1145\/3534678.3539321"},{"key":"3_CR7","unstructured":"Jia, Z., Xiong, Y., Nan, Y., Zhang, Y., Zhao, J., Wen, M.: MAGIC: detecting advanced persistent threats via masked graph representation learning. In: 33rd USENIX Security Symposium, pp. 5197\u20135214. USENIX Association, Philadelphia, PA (2024)"},{"issue":"3","key":"3_CR8","doi-asserted-by":"publisher","first-page":"3036","DOI":"10.1109\/TPAMI.2025.3630673","volume":"48","author":"W Ju","year":"2026","unstructured":"Ju, W., et al.: A survey of graph neural networks in real world: imbalance, noise, privacy and OOD challenges. IEEE Trans. Pattern Anal. Mach. Intell. 48(3), 3036\u20133055 (2026)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"issue":"4","key":"3_CR9","doi-asserted-by":"publisher","first-page":"824","DOI":"10.1109\/TPAMI.2018.2889473","volume":"42","author":"YA Malkov","year":"2020","unstructured":"Malkov, Y.A., Yashunin, D.A.: Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs. IEEE Trans. Pattern Anal. Mach. Intell. 42(4), 824\u2013836 (2020)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"3_CR10","unstructured":"Manzoor, E.: StreamSpot dataset. https:\/\/github.com\/sbustreamspot\/sbustreamspot-data. Accessed 17 Sep 2022"},{"key":"3_CR11","doi-asserted-by":"crossref","unstructured":"Manzoor, E., Milajerdi, S.M., Akoglu, L.: Fast memory-efficient anomaly detection in streaming heterogeneous graphs. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp.\u00a01035\u20131044. ACM, New York (2016)","DOI":"10.1145\/2939672.2939783"},{"key":"3_CR12","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Eshete, B., Gjomemo, R., Venkatakrishnan, V.N.: POIROT: aligning attack behavior with kernel audit records for cyber threat hunting. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp.\u00a01795\u20131812. ACM, New York (2019)","DOI":"10.1145\/3319535.3363217"},{"key":"3_CR13","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.N.: HOLMES: Real-time APT detection through correlation of suspicious information flows. In: 2019 IEEE Symposium on Security and Privacy (SP), pp.\u00a01137\u20131152. IEEE, Los Alamitos (2019)","DOI":"10.1109\/SP.2019.00026"},{"key":"3_CR14","doi-asserted-by":"publisher","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","volume":"17","author":"S Wang","year":"2022","unstructured":"Wang, S., et al.: THREATRACE: detecting and tracing host-based threats in node level through provenance graph learning. IEEE Trans. Inf. Forensics Secur. 17, 3972\u20133987 (2022)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"3_CR15","doi-asserted-by":"crossref","unstructured":"Zengy, J., et al.: SHADEWATCHER: Recommendation-guided cyber threat analysis using system audit records. In: 2022 IEEE Symposium on Security and Privacy (SP), pp.\u00a0489\u2013506. IEEE, Los Alamitos (2022)","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"3_CR16","unstructured":"Zhu, Y., Xu, W., Zhang, J., Liu, Q., Wu, S., Wang, L.: Deep graph structure learning for robust representations: a survey. arXiv preprint: arXiv:2103.03036 (2021)"}],"container-title":["Lecture Notes in Computer Science","Advanced Intelligent Computing Technology and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-92-3423-3_3","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T08:49:29Z","timestamp":1784364569000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-92-3423-3_3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,19]]},"ISBN":["9789819234226","9789819234233"],"references-count":16,"URL":"https:\/\/doi.org\/10.1007\/978-981-92-3423-3_3","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,19]]},"assertion":[{"value":"19 July 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"ICIC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Intelligent Computing","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Toronto","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Canada","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22 July 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 July 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"icic2026a","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.ic-icc.cn\/2026\/index.htm","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}