{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T17:33:56Z","timestamp":1778348036244,"version":"3.51.4"},"reference-count":67,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61972449"],"award-info":[{"award-number":["61972449"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61972448"],"award-info":[{"award-number":["61972448"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U1705261"],"award-info":[{"award-number":["U1705261"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61821003"],"award-info":[{"award-number":["61821003"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["CCF-NSFOCUS"],"award-info":[{"award-number":["CCF-NSFOCUS"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2019kfyXKJC021"],"award-info":[{"award-number":["2019kfyXKJC021"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Fundamental Research Funds for the Central Universities HUST","award":["2021JYCXJJ049"],"award-info":[{"award-number":["2021JYCXJJ049"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2023,3,1]]},"DOI":"10.1109\/tdsc.2022.3160879","type":"journal-article","created":{"date-parts":[[2022,3,22]],"date-time":"2022-03-22T19:43:11Z","timestamp":1647978191000},"page":"1624-1640","source":"Crossref","is-referenced-by-count":26,"title":["Paradise: Real-Time, Generalized, and Distributed Provenance-Based Intrusion Detection"],"prefix":"10.1109","volume":"20","author":[{"given":"Yafeng","family":"Wu","sequence":"first","affiliation":[{"name":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Wuhan National Laboratory for Optoelectronics, Key Laboratory of Information Storage, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5757-4396","authenticated-orcid":false,"given":"Yulai","family":"Xie","sequence":"additional","affiliation":[{"name":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Wuhan National Laboratory for Optoelectronics, Key Laboratory of Information Storage, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuelong","family":"Liao","sequence":"additional","affiliation":[{"name":"School of Science and Technology, Wuhan National Laboratory for Optoelectronics, Key Laboratory of Information Storage, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8629-4622","authenticated-orcid":false,"given":"Pan","family":"Zhou","sequence":"additional","affiliation":[{"name":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4674-6006","authenticated-orcid":false,"given":"Dan","family":"Feng","sequence":"additional","affiliation":[{"name":"School of Science and Technology, Wuhan National Laboratory for Optoelectronics, Key Laboratory of Information Storage, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lin","family":"Wu","sequence":"additional","affiliation":[{"name":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Wuhan National Laboratory for Optoelectronics, Key Laboratory of Information Storage, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuan","family":"Li","sequence":"additional","affiliation":[{"name":"NSFOCUS Inc., Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Avani","family":"Wildani","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Emory University, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0822-0740","authenticated-orcid":false,"given":"Darrell","family":"Long","sequence":"additional","affiliation":[{"name":"Jack Baskin School of Engineering, University of California, Santa Cruz, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101739"},{"key":"ref3","first-page":"1","article-title":"High accuracy attack provenance via binary-based execution partition","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Lee"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/2881025.2881031"},{"key":"ref5","article-title":"FRAPpuccino: Fault-detection through runtime analysis of provenance","volume-title":"Proc. 9th USENIX Workshop Hot Top. Cloud Comput.","author":"Han"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2016.02.005"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2867595"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2960353"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2004.07.005"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35170-9_6"},{"key":"ref11","first-page":"43","article-title":"Provenance-aware storage systems","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Muniswamy-Reddy"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420989"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"ref14","article-title":"Provenance-based intrusion detection: Opportunities and challenges","volume-title":"Proc. 10th USENIX Workshop Theory Pract. Provenance","author":"Han"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2010.07.005"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2010.10.001"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3076288"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23141"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3214304"},{"key":"ref23","first-page":"1","article-title":"Application of named graphs towards custom provenance views","volume-title":"Proc. Workshop Theory Pract. Provenance","author":"Gibson"},{"key":"ref24","first-page":"171","article-title":"Using provenance to aid in personal file search","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Shah"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2011.26"},{"key":"ref26","first-page":"25","article-title":"Transparent result caching","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Vahdat"},{"key":"ref27","first-page":"525","article-title":"Eidetic systems","volume-title":"Proc. 11th USENIX Symp. Oper. Syst. Des. Implementation","author":"Devecsery"},{"key":"ref28","first-page":"1366","article-title":"Zoom* userviews: Querying relevant provenance in workflow systems","volume-title":"Proc. 33rd Int. Conf. Very Large Data Bases","author":"Biton"},{"key":"ref29","article-title":"Layering in provenance systems","volume-title":"Proc. Conf. USENIX Annu. Tech. Conf.","author":"Muniswamy-Reddy"},{"key":"ref30","first-page":"15","article-title":"Provenance for the cloud","volume-title":"Proc. Conf. File Storage Technol.","author":"Muniswamy-Reddy"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/2484028.2484070"},{"key":"ref32","first-page":"3005","article-title":"ATLAS: A sequence-based learning approach for attack investigation","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Alsaheel"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.physa.2013.06.056"},{"key":"ref34","article-title":"Mining data provenance to detect advanced persistent threats","volume-title":"Proc. 11th Int. Workshop Theory Pract. Provenance","author":"Barre"},{"key":"ref35","article-title":"ZooKeeper: Wait-free coordination for internet-scale systems","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Hunt"},{"key":"ref36","first-page":"1","article-title":"Kafka: A distributed messaging system for log processing","volume-title":"Proc. NetDB","author":"Kreps"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-18638-7_6"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463573"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.3844\/jcssp.2018.1155.1173"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3391800.3398175"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1996.502675"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-980109"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2006.871569"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(02)00514-X"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_13"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2013.13"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2821095"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2503271"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2017.2772792"},{"key":"ref54","first-page":"1","article-title":"Anomaly-based intrusion detection of IoT device sensor data using provenance graphs","volume-title":"Proc. 1st Int. Workshop Secur. Privacy Internet-of-Things","author":"Nwafor"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/2043556.2043584"},{"key":"ref56","first-page":"319","article-title":"Trustworthy whole-system provenance for the Linux kernel","volume-title":"Proc. USENIX Secur. Symp.","author":"Bates"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052640"},{"key":"ref58","article-title":"Applying provenance in APT monitoring and analysis: Practical challenges for scalable, efficient and trustworthy distributed provenance","volume-title":"Proc. 9th USENIX Workshop Theory Pract. Provenance","author":"Jenkinson"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243776"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243808"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23306"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243763"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046741"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382232"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-015-1615-5"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/MSST.2010.5496972"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/MCC.2014.53"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/1851476.1851593"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/2716260"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2014.7004343"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/s41060-016-0027-9"},{"issue":"3","key":"ref72","doi-asserted-by":"crossref","first-page":"173","DOI":"10.1504\/IJHPCN.2013.056525","article-title":"Security event correlation approach for cloud computing","volume":"7","author":"Ficco","year":"2013","journal-title":"Int. J. High Perform. Comput. Netw."},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/10068314\/09739913.pdf?arnumber=9739913","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,18]],"date-time":"2024-01-18T00:04:56Z","timestamp":1705536296000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9739913\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3,1]]},"references-count":67,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2022.3160879","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,3,1]]}}}