{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T18:41:03Z","timestamp":1769539263169,"version":"3.49.0"},"reference-count":56,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T00:00:00Z","timestamp":1769904000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T00:00:00Z","timestamp":1769904000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T00:00:00Z","timestamp":1769904000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Shenzhen Science and Technology Program","award":["KJZD20231023094701003"],"award-info":[{"award-number":["KJZD20231023094701003"]}]},{"name":"Major Key Project of Peng Cheng Laboratory","award":["PCL2024A05"],"award-info":[{"award-number":["PCL2024A05"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372137"],"award-info":[{"award-number":["62372137"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"Opening Project of Science and Technology on Communication Networks Laboratory","doi-asserted-by":"publisher","award":["FFX22641X005"],"award-info":[{"award-number":["FFX22641X005"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Internet Things J."],"published-print":{"date-parts":[[2026,2,1]]},"DOI":"10.1109\/jiot.2025.3633319","type":"journal-article","created":{"date-parts":[[2025,11,17]],"date-time":"2025-11-17T18:42:32Z","timestamp":1763404952000},"page":"4434-4448","source":"Crossref","is-referenced-by-count":0,"title":["ContrastMatcher: Adaptive Contrastive Provenance Graph Matching for Host-Based Attack Detection"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-2449-1759","authenticated-orcid":false,"given":"Hao","family":"Yan","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"}]},{"given":"Wenhao","family":"Liao","sequence":"additional","affiliation":[{"name":"Shenzhen Institute for Advanced Study, University of Electronic Science and Technology of China, Shenzhen, China"}]},{"given":"Jia","family":"Sun","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"}]},{"given":"Lei","family":"Du","sequence":"additional","affiliation":[{"name":"Department of New Networks, Peng Cheng Laboratory, Shenzhen, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1627-5811","authenticated-orcid":false,"given":"Liyi","family":"Zeng","sequence":"additional","affiliation":[{"name":"Department of New Networks, Peng Cheng Laboratory, Shenzhen, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7546-852X","authenticated-orcid":false,"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0305-2132","authenticated-orcid":false,"given":"Binxing","family":"Fang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2891891"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-019-0038-7"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102282"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref5","first-page":"5197","article-title":"MAGIC: Detecting advanced persistent threats via masked graph representation learning","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Jia"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623187"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-90019-9_1"},{"key":"ref9","first-page":"2987","article-title":"SEAL: Storage-efficient causality analysis on enterprise logs with query-friendly compression","volume-title":"30th USENIX Secur. Symp.","author":"Fei"},{"key":"ref10","first-page":"1723","article-title":"Dependence-preserving data compaction for scalable forensic analysis","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Hossain"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427255"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2025.114169"},{"key":"ref14","year":"2025","journal-title":"Overview \/ About the CVE Program"},{"key":"ref15","volume-title":"Mitre Att&ck: Design and Philosophy","author":"Strom","year":"2020"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/321921.321925"},{"key":"ref17","first-page":"5812","article-title":"Graph contrastive learning with augmentations","volume-title":"Proc. NIPS","volume":"33","author":"You"},{"key":"ref18","article-title":"Neural subgraph matching","year":"2020","journal-title":"arXiv:2007.03092"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.5555\/3524938.3525087"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00975"},{"key":"ref21","first-page":"12121","article-title":"Graph contrastive learning automated","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"You"},{"key":"ref22","article-title":"Darpa Transparent Computing Program Engagement 3 Data Release","year":"2022"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-96-0850-8_21"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/0378-8733(83)90028-X"},{"key":"ref25","first-page":"1","article-title":"Trusses: Cohesive subgraphs for social network analysis","volume":"16","author":"Cohen","year":"2008","journal-title":"Nat. Secur. Agency Tech. Rep."},{"key":"ref26","article-title":"Fast graph representation learning with PyTorch geometric","author":"Fey","year":"2019","journal-title":"arXiv:1903.02428"},{"key":"ref27","first-page":"8026","article-title":"PyTorch: An imperative style, high-performance deep learning library","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Paszke"},{"key":"ref28","article-title":"Fast graph representation learning with PyTorch geometric","author":"Fey","year":"2019","journal-title":"arXiv:1903.02428"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.25080\/tcwv9851"},{"key":"ref31","article-title":"An empirical study of graph contrastive learning","author":"Zhu","year":"2021","journal-title":"arXiv:2109.01116"},{"issue":"20","key":"ref32","first-page":"48550","article-title":"Graph attention networks","volume":"1050","author":"Velickovic","year":"2018","journal-title":"stat"},{"key":"ref33","first-page":"3835","article-title":"Graph matching networks for learning the similarity of graph structured objects","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3289600.3290967"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006525"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/1281192.1281271"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/9961342"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref44","first-page":"3005","article-title":"ATLAS: A sequence-based learning approach for attack investigation","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Alsahee"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00046"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.14778\/2856318.2856320"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516731"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23350"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243763"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978378"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3076288"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3608666"},{"key":"ref53","article-title":"Deep graph infomax","author":"Veli\u010dkovi\u0107","year":"2018","journal-title":"arXiv:1809.10341"},{"key":"ref54","first-page":"4116","article-title":"Contrastive multi-view representation learning on graphs","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Hassani"},{"key":"ref55","article-title":"Deep graph contrastive representation learning","author":"Zhu","year":"2020","journal-title":"arXiv:2006.04131"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3449802"}],"container-title":["IEEE Internet of Things Journal"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6488907\/11363065\/11250629.pdf?arnumber=11250629","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T06:02:58Z","timestamp":1769493778000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11250629\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,1]]},"references-count":56,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/jiot.2025.3633319","relation":{},"ISSN":["2327-4662","2372-2541"],"issn-type":[{"value":"2327-4662","type":"electronic"},{"value":"2372-2541","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,1]]}}}