{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:01:25Z","timestamp":1782975685633,"version":"3.54.5"},"reference-count":74,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00242","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"3739-3758","source":"Crossref","is-referenced-by-count":0,"title":["Beyond Nodes vs. Edges: A Multi-View Fusion Framework for Provenance-Based Intrusion Detection"],"prefix":"10.1109","author":[{"given":"Fan","family":"Yang","sequence":"first","affiliation":[{"name":"The Chinese University of Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Binyan","family":"Xu","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Di","family":"Tang","sequence":"additional","affiliation":[{"name":"Sun Yat-Sen University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kehuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179405"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991122"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2891891"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23141"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607201"},{"key":"ref13","article-title":"How powerful are graph neural networks?","author":"Xu","year":"2018","journal-title":"arXiv preprint"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623187"},{"key":"ref15","first-page":"4355","article-title":"PROGRAPHER: an anomaly detection system based on provenance graph embedding","volume-title":"32nd USENIX Security Symposium, USENIX Security 2023","author":"Yang","year":"2023"},{"key":"ref16","first-page":"3","article-title":"Provenance-based intrusion detection: opportunities and challenges","volume-title":"Proceedings of the 10th USENIX Conference on Theory and Practice of Provenance, ser. TaPP\u201918","author":"Han"},{"key":"ref17","author":"Jia","year":"2023","journal-title":"Magic: Detecting advanced persistent threats via masked graph representation learning"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-014-0365-y"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2021.3118815"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00253"},{"key":"ref22","article-title":"SIGL: Securing software installations through deep graph learning","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Han"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23204"},{"key":"ref24","article-title":"Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems","volume-title":"Security Symposium (USENIX Sec\u201925). USENIX","author":"Bilot"},{"key":"ref25","article-title":"ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems","volume-title":"Security Symposium (USENIX Sec\u201925). USENIX","author":"Jiang"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00005"},{"key":"ref27","volume-title":"Transparent computing engagement 3 data release accessed 29th january 2025"},{"key":"ref28","volume-title":"Transparent computing engagement 5","year":"2019"},{"key":"ref29","volume-title":"Operationally transparent cyber (optc) data","year":"2019"},{"key":"ref30","author":"Kipf","year":"2017","journal-title":"Semi-supervised classification with graph convolutional networks"},{"key":"ref31","author":"Veli\u010dkovi\u0107","year":"2018","journal-title":"Graph attention networks"},{"key":"ref32","volume-title":"Winodws event tracing","author":"Marshall","year":"2021"},{"key":"ref33","volume-title":"Linux audit","author":"Grubb","year":"2021"},{"key":"ref34","volume-title":"Dtrace","author":"Neville-Neil","year":"2018"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24065"},{"key":"ref36","first-page":"319","article-title":"Trustworthy WholeSystem provenance for the linux kernel","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Bates"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417862"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5474"},{"key":"ref40","article-title":"Efficient estimation of word representations in vector space","author":"Mikolov","year":"2013","journal-title":"arXiv preprint"},{"key":"ref41","author":"Leimeister","year":"2019","journal-title":"Skip-gram word embeddings in hyperbolic space"},{"key":"ref42","article-title":"Neural message passing for quantum chemistry","volume":"abs\/1704.01212","author":"Gilmer","year":"2017","journal-title":"CoRR"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-39964-3_62"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/tbdata.2025.3618474"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2019.2921572"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539321"},{"key":"ref47","article-title":"How attentive are graph attention networks?","author":"Brody","year":"2021","journal-title":"arXiv preprint"},{"issue":"7","key":"ref48","first-page":"579","article-title":"Multilayer perceptron and neural networks","volume":"8","author":"Popescu","year":"2009","journal-title":"WSEAS Trans. Cir. and Sys."},{"key":"ref49","author":"Arp","year":"2021","journal-title":"Dos and don\u2019ts of machine learning in computer security"},{"key":"ref50","volume-title":"Learning from data: concepts, theory, and methods","year":"2007"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"ref52","article-title":"ATLAS: A sequence-based learning approach for attack investigation","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Alsaheel"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"},{"key":"ref54","volume-title":"The freebsd project","year":"2025"},{"key":"ref55","volume-title":"The linux kernel archives","year":"2025"},{"key":"ref56","volume-title":"Android open source project","year":"2025"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3744788"},{"key":"ref58","article-title":"Ocr-apt: Reconstructing apt stories from audit logs using subgraph anomaly detection and 11 ms","author":"Aly","journal-title":"ser. CCS \u201925"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230822"},{"key":"ref60","first-page":"519","article-title":"Auc: a statistically consistent and more discriminating measure than accuracy","volume-title":"Proceedings of the 18th International Joint Conference on Artificial Intelligence, ser. IJCAI\u201903","author":"Ling","year":"2003"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3084050"},{"key":"ref62","volume-title":"Ground truth file","author":"Computing","year":"2018"},{"key":"ref63","volume-title":"REAPr label set","year":"2024"},{"key":"ref64","volume-title":"Data mining: Concepts and techniques","author":"Han","year":"2011"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-75823-2_18"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v24i1.7659"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/s11222-016-9706-6"},{"key":"ref68","first-page":"582","volume-title":"Support vector method for novelty detection,\u201d ser. NIPS\u201999","author":"Sch\u00f6lkopf","year":"1999"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2008.17"},{"key":"ref70","volume-title":"Deep learning for anomaly detection: A survey","author":"Chalapathy","year":"2019"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24207"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00049"},{"key":"ref74","article-title":"Temporal graph networks for deep learning on dynamic graphs","volume":"abs\/2006.10637","author":"Rossi","year":"2020","journal-title":"CoRR"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573614.pdf?arnumber=11573614","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:31:11Z","timestamp":1782970271000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573614\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":74,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00242","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}