{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,25]],"date-time":"2026-01-25T02:11:35Z","timestamp":1769307095121,"version":"3.49.0"},"publisher-location":"Singapore","reference-count":25,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819608492","type":"print"},{"value":"9789819608508","type":"electronic"}],"license":[{"start":{"date-parts":[[2024,12,24]],"date-time":"2024-12-24T00:00:00Z","timestamp":1734998400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,12,24]],"date-time":"2024-12-24T00:00:00Z","timestamp":1734998400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-981-96-0850-8_21","type":"book-chapter","created":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T04:39:25Z","timestamp":1734928765000},"page":"318-333","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Semantic-Integrated Online Audit Log Reduction for\u00a0Efficient Forensic Analysis"],"prefix":"10.1007","author":[{"given":"Wenhao","family":"Liao","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jia","family":"Sun","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haiyan","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jianye","family":"Yang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,12,24]]},"reference":[{"key":"21_CR1","doi-asserted-by":"crossref","unstructured":"Altinisik, E., Deniz, F., Sencar, H.T.: ProvG-Searcher: A graph representation learning approach for efficient provenance graph search. In: CCS. pp. 2247\u20132261 (2023)","DOI":"10.1145\/3576915.3623187"},{"key":"21_CR2","doi-asserted-by":"crossref","unstructured":"Chang, B., Zhou, F., Wang, Z., Wen, Y., Zhang, B.: A distributed storage system for system logs based on hybrid compression scheme. In: ISPA\/BDCloud\/SocialCom\/SustainCom. pp. 724\u2013735 (2023)","DOI":"10.1109\/ISPA-BDCloud-SocialCom-SustainCom59178.2023.00127"},{"key":"21_CR3","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103485","volume":"135","author":"T Chen","year":"2023","unstructured":"Chen, T., et al.: System-level data management for endpoint advanced persistent threat detection: Issues, challenges and trends. Comput. Secur. 135, 103485 (2023)","journal-title":"Comput. Secur."},{"key":"21_CR4","doi-asserted-by":"crossref","unstructured":"Cheng, Z., et\u00a0al.: KAIROS: practical intrusion detection and investigation using whole-system provenance. In: SP (2024)","DOI":"10.1109\/SP54263.2024.00005"},{"key":"21_CR5","unstructured":"Ding, H., Yan, S., Zhai, J., Ma, S.: ELISE: a storage efficient logging system powered by redundancy reduction and representation learning. In: USENIX Security. pp. 3023\u20133040 (2021)"},{"key":"21_CR6","doi-asserted-by":"crossref","unstructured":"Dong, F., et\u00a0al.: Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools. In: CCS. pp. 2396\u20132410 (2023)","DOI":"10.1145\/3576915.3616580"},{"key":"21_CR7","unstructured":"Dong, F., et\u00a0al.: DISTDET: A cost-effective distributed cyber threat detection system. In: USENIX Security. pp. 6575\u20136592 (2023)"},{"key":"21_CR8","unstructured":"Fei, P., Li, Z., Wang, Z., Yu, X., Li, D., Jee, K.: SEAL: storage-efficient causality analysis on enterprise logs with query-friendly compression. In: USENIX Security. pp. 2987\u20133004 (2021)"},{"key":"21_CR9","doi-asserted-by":"crossref","unstructured":"Gehani, A., Tariq, D.: SPADE: support for provenance auditing in distributed environments. In: Middleware. pp. 101\u2013120 (2012)","DOI":"10.1007\/978-3-642-35170-9_6"},{"key":"21_CR10","unstructured":"Hossain, N., et\u00a0al.: Dependence-preserving data compaction for scalable forensic analysis. In: USENIX Security. pp. 1723\u20131740 (2018)"},{"key":"21_CR11","doi-asserted-by":"crossref","unstructured":"Inam, M.A., et\u00a0al.: FAuST: striking a bargain between forensic auditing\u2019s security and throughput. In: ACSAC. pp. 813\u2013826 (2022)","DOI":"10.1145\/3564625.3567990"},{"key":"21_CR12","doi-asserted-by":"crossref","unstructured":"Inam, M.A., et\u00a0al.: SoK: history is a vast early warning system: Auditing the provenance of system intrusions. In: SP. pp. 2620\u20132638 (2023)","DOI":"10.1109\/SP46215.2023.10179405"},{"key":"21_CR13","unstructured":"Jia, Z., Xiong, Y., Nan, Y., Zhang, Y., Zhao, J., Wen, M.: MAGIC: detecting advanced persistent threats via masked graph representation learning. In: USENIX Security (2024)"},{"key":"21_CR14","doi-asserted-by":"crossref","unstructured":"Jiang, B., Nain, P., Towsley, D.F.: On the convergence of the TTL approximation for an LRU cache under independent stationary request processes. TOMPECS 3, 20:1\u201320:31 (2018)","DOI":"10.1145\/3239164"},{"key":"21_CR15","unstructured":"Keromytis, A.D.: Transparent computing engagement 3 data release (2018)"},{"key":"21_CR16","unstructured":"Khoury, J., Upthegrove, T., Caro, A., Benyo, B., Kong, D.: An event-based data model for granular information flow tracking. In: TaPP (2020)"},{"key":"21_CR17","doi-asserted-by":"crossref","unstructured":"Lee, K.H., Zhang, X., Xu, D.: LogGC: garbage collecting audit log. In: CCS. pp. 1005\u20131016 (2013)","DOI":"10.1145\/2508859.2516731"},{"key":"21_CR18","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102282","volume":"106","author":"Z Li","year":"2020","unstructured":"Li, Z., Chen, Q.A., Yang, R., Chen, Y., Ruan, W.: Threat detection and investigation with system-level provenance graphs: A survey. Comput. Secur. 106, 102282 (2020)","journal-title":"Comput. Secur."},{"key":"21_CR19","doi-asserted-by":"crossref","unstructured":"Ma, S., Zhang, X., Xu, D.: ProTracer: Towards practical provenance tracing by alternating between logging and tainting. In: NDSS (2016)","DOI":"10.14722\/ndss.2016.23350"},{"key":"21_CR20","doi-asserted-by":"crossref","unstructured":"Michael, N., Mink, J., Liu, J., Gaur, S., Hassan, W.U., Bates, A.: On the forensic validity of approximated audit logs. In: ACSAC. pp. 189\u2013202 (2020)","DOI":"10.1145\/3427228.3427272"},{"key":"21_CR21","doi-asserted-by":"crossref","unstructured":"Tang, Y., et\u00a0al.: NodeMerge: Template based efficient data reduction for big-data causality analysis. In: CCS. pp. 1324\u20131337 (2018)","DOI":"10.1145\/3243734.3243763"},{"key":"21_CR22","unstructured":"Torrey, J.: Transparent computing engagement 5 data release (2020)"},{"key":"21_CR23","doi-asserted-by":"crossref","unstructured":"Xu, Z., et\u00a0al.: High fidelity data reduction for big data security dependency analyses. In: CCS. pp. 504\u2013516 (2016)","DOI":"10.1145\/2976749.2978378"},{"key":"21_CR24","doi-asserted-by":"publisher","first-page":"3312","DOI":"10.1109\/TIFS.2021.3076288","volume":"16","author":"T Zhu","year":"2021","unstructured":"Zhu, T., et al.: General, efficient, and real-time data compaction strategy for apt forensic analysis. IEEE Trans. Inf. Forensics Secur. 16, 3312\u20133325 (2021)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"21_CR25","doi-asserted-by":"crossref","unstructured":"Zipperle, M., Gottwalt, F., Chang, E., Dillon, T.S.: Provenance-based intrusion detection systems: A survey. ACM Comput. Surv. 55, 135:1\u2013135:36 (2022)","DOI":"10.1145\/3539605"}],"container-title":["Lecture Notes in Computer Science","Advanced Data Mining and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-96-0850-8_21","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T05:06:56Z","timestamp":1734930416000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-96-0850-8_21"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,24]]},"ISBN":["9789819608492","9789819608508"],"references-count":25,"URL":"https:\/\/doi.org\/10.1007\/978-981-96-0850-8_21","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,12,24]]},"assertion":[{"value":"24 December 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ADMA","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Advanced Data Mining and Applications","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Sydney, NSW","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Australia","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"3 December 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"5 December 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"adma2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/adma2024.github.io\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}