{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,31]],"date-time":"2026-10-31T05:17:26Z","timestamp":1793423846072,"version":"4.5.0"},"reference-count":68,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/tifs.2024.3396390","type":"journal-article","created":{"date-parts":[[2024,5,2]],"date-time":"2024-05-02T17:20:00Z","timestamp":1714670400000},"page":"5257-5271","source":"Crossref","is-referenced-by-count":43,"title":["MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning"],"prefix":"10.1109","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7626-8124","authenticated-orcid":false,"given":"Ahmed","family":"Aly","sequence":"first","affiliation":[{"name":"Department of Computer Science and Software Engineering, Concordia University, Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7819-5715","authenticated-orcid":false,"given":"Shahrear","family":"Iqbal","sequence":"additional","affiliation":[{"name":"National Research Council Canada, Fredericton, NB, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4284-8646","authenticated-orcid":false,"given":"Amr","family":"Youssef","sequence":"additional","affiliation":[{"name":"Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Essam","family":"Mansour","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Software Engineering, Concordia University, Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Threat hunting, definition and framework","author":"Liliengren","year":"2018"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2891891"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2011.67"},{"key":"ref4","first-page":"1","article-title":"ATLAS: A sequence-based learning approach for attack investigation","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Security)","author":"Alsaheel"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3539605"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/sp46215.2023.10179405"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref8","first-page":"487","article-title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data","volume-title":"Proc. 26th USENIX Secur. Symp. (USENIX Secur.)","author":"Hossain"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-90019-9_1"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427255"},{"key":"ref13","article-title":"RDF 1.1 concepts and abstract syntax","author":"Richard Cyganiak","year":"2014"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2013.50"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93417-4_38"},{"key":"ref16","volume-title":"Transparent Computing Engagement 3 Data Release","year":"2024"},{"key":"ref17","volume-title":"Operationally Transparent Cyber (OpTC) Data Release","year":"2024"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3559768"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE51399.2021.00024"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3523261"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-16-6054-2_13"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3289600.3290967"},{"key":"ref26","first-page":"1","article-title":"Dos and don\u2019ts of machine learning in computer security","volume-title":"Proc. USENIX Secur. Symp.","author":"Arp"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.2200\/S01125ED1V01Y202109DSK022"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0144578"},{"issue":"1","key":"ref29","doi-asserted-by":"crossref","first-page":"1008","DOI":"10.14778\/1453856.1453965","article-title":"Hexastore: Sextuple indexing for semantic web data management","volume":"1","author":"Weiss","year":"2008","journal-title":"Proc. VLDB Endowment"},{"issue":"7","key":"ref30","doi-asserted-by":"crossref","first-page":"517","DOI":"10.14778\/2536349.2536352","article-title":"TripleBit: A fast and compact system for large scale RDF data","volume":"6","author":"Yuan","year":"2013","journal-title":"Proc. VLDB Endowment"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/s00778-021-00711-3"},{"key":"ref32","volume-title":"Openlink Virtuoso","year":"2024"},{"key":"ref33","volume-title":"Stardog Union","year":"2024"},{"key":"ref34","volume-title":"Ontotext Graphdb","year":"2024"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-98192-5_54"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.2200\/S01045ED1V01Y202009AIM046"},{"key":"ref37","first-page":"18","article-title":"RDF 1.1 turtle","volume-title":"World Wide Web Consortium","author":"Beckett","year":"2014"},{"key":"ref38","volume-title":"DARPA Transparent Computing, TA5.1 Ground Truth Report Engagement 3","year":"2018"},{"key":"ref39","author":"Aric Hagberg","year":"2024","journal-title":"NetworkX: Network Analysis in Python"},{"key":"ref40","first-page":"1","article-title":"Reasoning with neural tensor networks for knowledge base completion","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"26","author":"Socher"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2018.05.002"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463573"},{"key":"ref43","volume-title":"Optc Red Team Ground Truth","year":"2020"},{"key":"ref44","article-title":"Deep graph library: A graph-centric, highly-performant package for graph neural networks","author":"Wang","year":"2019","journal-title":"arXiv:1909.01315"},{"key":"ref45","first-page":"1","article-title":"PyTorch: An imperative style, high-performance deep learning library","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Paszke"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-35314-7_2"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/IC3INA48034.2019.8949568"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-86514-6_1"},{"key":"ref49","first-page":"1","article-title":"DropEdge: Towards deep graph convolutional networks on node classification","volume-title":"Proc. 8th Int. Conf. Learn. Represent. (ICLR)","author":"Rong"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.07.061"},{"issue":"1","key":"ref51","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref52","volume-title":"The Next Decade of Cyber Threats","year":"2020"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00046"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_29"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24107"},{"key":"ref56","first-page":"2987","article-title":"SEAL: Storage-efficient causality analysis on enterprise logs with query-friendly compression","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Fei"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA52953.2021.00273"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3477314.3507097"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3229472"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom56396.2022.00106"},{"key":"ref63","first-page":"2461","article-title":"Back-propagating system dependency impact for attack investigation","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Fang"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833671"},{"key":"ref66","first-page":"905","article-title":"ATTACK2VEC: Leveraging temporal word embeddings to understand the evolution of cyberattacks","volume-title":"Proc. 28th USENIX Secur. Symp. (USENIX Secur.)","author":"Shen"},{"key":"ref67","volume-title":"Open IOC","year":"2024"},{"key":"ref68","volume-title":"Structured Threat Information Expression","year":"2024"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/10319981\/10517754.pdf?arnumber=10517754","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,14]],"date-time":"2024-05-14T04:52:47Z","timestamp":1715662367000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10517754\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":68,"URL":"https:\/\/doi.org\/10.1109\/tifs.2024.3396390","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}