{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T21:47:14Z","timestamp":1770846434538,"version":"3.50.1"},"reference-count":38,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,5]],"date-time":"2025-10-05T00:00:00Z","timestamp":1759622400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,5]],"date-time":"2025-10-05T00:00:00Z","timestamp":1759622400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,5]]},"DOI":"10.1109\/smc58881.2025.11343010","type":"proceedings-article","created":{"date-parts":[[2026,1,28]],"date-time":"2026-01-28T20:54:44Z","timestamp":1769633684000},"page":"2372-2379","source":"Crossref","is-referenced-by-count":0,"title":["NAHID: Node-Level Host Intrusion Detection Based on Provenance Graph"],"prefix":"10.1109","author":[{"given":"Wentao","family":"Li","sequence":"first","affiliation":[{"name":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"}]},{"given":"Xingyuan","family":"Wei","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"}]},{"given":"Qiujian","family":"Lv","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"}]},{"given":"Yan","family":"Wang","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"}]},{"given":"Ning","family":"Li","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"}]},{"given":"Ziyang","family":"Yu","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Mining data provenance to detect advanced persistent threats[C]","volume-title":"11th International Workshop on Theory and Practiceof Provenance (TaPP 2019)","author":"Barre"},{"key":"ref2","article-title":"Aggregating unsupervised provenance anomaly detectors[C]","volume-title":"11th International Workshop on Theory and Practice of Provenance (TaPP 2019)","author":"Berrada"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24207"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3160879"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00005"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330895"},{"key":"ref11","article-title":"Temporal graph networks for deep learning on dynamic graphs[J]","author":"Rossi","year":"2020"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/214"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS54207.2022.9789878"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102675"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3275789"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5474"},{"key":"ref20","article-title":"Transparent Computing Engagement 3 Data Release","author":"Keromytis","year":"2018"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00949"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1515\/jisys-2023-0248"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.3390\/electronics9030460"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.25046\/aj080206"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101681"},{"key":"ref26","first-page":"319","article-title":"Trustworthy Whole-System provenance for the linux kernel[C]","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Bates"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref28","first-page":"4355","article-title":"PROGRAPHER: An anomaly detection system based on provenance graph embedding[C]","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Yang"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref30","first-page":"2345","article-title":"SIGL: Securing software installations through deep graph learning[C]","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Han"},{"key":"ref31","article-title":"One Hot Encoding"},{"key":"ref32","article-title":"Bag of Words"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363224"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.7717\/peerj-cs.858"},{"key":"ref36","article-title":"Rethinking The Memory Staleness Problem In Dynamics GNN[J]","author":"Ventura","year":"2022"},{"issue":"7","key":"ref37","first-page":"2529","article-title":"A Survey of Network Attack Investigation Based on Provenance Graph[J]","volume-title":"Acta Electronica Sinica","volume":"52","author":"Jing","year":"2024"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102282"}],"event":{"name":"2025 IEEE International Conference on Systems, Man, and Cybernetics (SMC)","location":"Vienna, Austria","start":{"date-parts":[[2025,10,5]]},"end":{"date-parts":[[2025,10,8]]}},"container-title":["2025 IEEE International Conference on Systems, Man, and Cybernetics (SMC)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11342430\/11342431\/11343010.pdf?arnumber=11343010","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T20:53:26Z","timestamp":1770843206000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11343010\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,5]]},"references-count":38,"URL":"https:\/\/doi.org\/10.1109\/smc58881.2025.11343010","relation":{},"subject":[],"published":{"date-parts":[[2025,10,5]]}}}