{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,3]],"date-time":"2025-09-03T10:18:53Z","timestamp":1756894733170,"version":"3.41.2"},"reference-count":84,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U22B2028","62372410","62002324"],"award-info":[{"award-number":["U22B2028","62372410","62002324"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100022955","name":"Fundamental Research Funds for the Provincial Universities of Zhejiang","doi-asserted-by":"publisher","award":["RF-A2023009"],"award-info":[{"award-number":["RF-A2023009"]}],"id":[{"id":"10.13039\/100022955","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["LZ23F020011"],"award-info":[{"award-number":["LZ23F020011"]}]},{"DOI":"10.13039\/501100012166","name":"\u201cPioneer\u201d and \u201cLeading Goose\u201d Research and Development Program of Zhejiang","doi-asserted-by":"publisher","award":["2025C01082","2025C01013"],"award-info":[{"award-number":["2025C01082","2025C01013"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3592824","type":"journal-article","created":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T17:55:44Z","timestamp":1753466144000},"page":"7853-7866","source":"Crossref","is-referenced-by-count":1,"title":["Dehydrator: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-4293-5850","authenticated-orcid":false,"given":"Jie","family":"Ying","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8657-662X","authenticated-orcid":false,"given":"Tiantian","family":"Zhu","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}]},{"given":"Tieming","family":"Chen","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4810-7491","authenticated-orcid":false,"given":"Mingqi","family":"Lv","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-02333-0"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.21236\/ad0772806"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/2830903.2830905"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/11760146_24"},{"key":"ref5","first-page":"12","article-title":"BotHunter: Detecting malware infection through IDS-driven dialog correlation","volume-title":"Proc. USENIX Secur. Symp.","author":"Gu"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427255"},{"key":"ref7","first-page":"3989","article-title":"CLARION: Sound and clear provenance tracking for microservice deployments","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Chen"},{"key":"ref8","first-page":"2443","article-title":"ALASTOR: Reconstructing the provenance of serverless intrusions","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Datta"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102282"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179405"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3098977"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-17819-1_18"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484551"},{"key":"ref19","first-page":"241","article-title":"Kernel-supported cost-effective audit logging for causality tracking","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Ma"},{"key":"ref20","first-page":"319","article-title":"Trustworthy whole-system provenance for the Linux kernel","volume-title":"Proc. 24th USENIX Secur. Symp. (USENIX Secur.)","author":"Bates"},{"volume-title":"Trustwave Global Security Report","year":"2015","key":"ref21"},{"key":"ref22","first-page":"487","article-title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data","volume-title":"Proc. 26th USENIX Secur. Symp. (USENIX Secur.)","author":"Hossain"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00005"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945467"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3243667"},{"key":"ref26","first-page":"4355","article-title":"PROGRAPHER: An anomaly detection system based on provenance graph embedding","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Yang"},{"key":"ref27","first-page":"2987","article-title":"SEAL: Storage-efficient causality analysis on enterprise logs with query-friendly compression","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Fei"},{"key":"ref28","first-page":"3023","article-title":"ELISE: A storage efficient logging system powered by redundancy reduction and representation learning","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Ding"},{"key":"ref29","first-page":"3277","article-title":"The case for learned provenance graph storage systems","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Ding"},{"volume-title":"Darap3 Transparent Engagement 3","year":"2023","key":"ref30"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833632"},{"key":"ref32","first-page":"2461","article-title":"Back-propagating system dependency impact for attack investigation","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Fang"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.2971484"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00064"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/dcc.2019.00087"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3318464.3389734"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3226595.3226638"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.14778\/2367502.2367518"},{"volume-title":"Event Tracing","year":"2024","key":"ref39"},{"volume-title":"System Administration Utilities","year":"2024","key":"ref40"},{"volume-title":"Dtrace on Freebsd","year":"2024","key":"ref41"},{"volume-title":"The Linux Audit Framework","year":"2017","key":"ref42"},{"key":"ref43","first-page":"1137","article-title":"A neural probabilistic language model","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Bengio"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref45","article-title":"Efficient estimation of word representations in vector space","author":"Mikolov","year":"2013","journal-title":"arXiv:1301.3781"},{"key":"ref46","first-page":"1","article-title":"XLNet: Generalized autoregressive pretraining for language understanding","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Yang"},{"article-title":"Improving language understanding by generative pre-training","year":"2018","author":"Radford","key":"ref47"},{"key":"ref48","first-page":"129","article-title":"Parsing natural scenes and natural language with recursive neural networks","volume-title":"Proc. 28th Int. Conf. Mach. Learn. (ICML)","author":"Socher"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref50","article-title":"Empirical evaluation of gated recurrent neural networks on sequence modeling","author":"Chung","year":"2014","journal-title":"arXiv:1412.3555"},{"key":"ref51","article-title":"Not all parameters are born equal: Attention is mostly what you need","author":"Bogoychev","year":"2020","journal-title":"arXiv:2010.11859"},{"key":"ref52","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018","journal-title":"arXiv:1810.04805"},{"key":"ref53","article-title":"Long range arena: A benchmark for efficient transformers","author":"Tay","year":"2020","journal-title":"arXiv:2011.04006"},{"key":"ref54","article-title":"Fast transformer decoding: One write-head is all you need","author":"Shazeer","year":"2019","journal-title":"arXiv:1911.02150"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/W16-1603"},{"volume-title":"Postgresql: The World\u2019s Most Advanced Open Source Relational Database","year":"2024","key":"ref56"},{"volume-title":"Neo4j Graph Database","year":"2024","key":"ref57"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35170-9_6"},{"volume-title":"Sysdig","year":"2023","key":"ref59"},{"volume-title":"Postgresql Copy Command","year":"2024","key":"ref60"},{"volume-title":"Neo4j-admin Import","year":"2024","key":"ref61"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3406325.3465355"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1906.02762"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref65","first-page":"3005","article-title":"ATLAS: A sequence-based learning approach for attack investigation","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Alsaheel"},{"key":"ref66","first-page":"2390","article-title":"Fast decoding in sequence models using discrete latent variables","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Kaiser"},{"volume-title":"Accelerating Transformer Inference With Kv Caching","year":"2025","key":"ref67"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1903070116"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ab633c"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac3a74"},{"volume-title":"Mitre Att&ck","year":"2019","key":"ref71"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991122"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516731"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978378"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243763"},{"key":"ref81","first-page":"1723","article-title":"Dependence-preserving data compaction for scalable forensic analysis","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Secur.)","author":"Hossain"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1952"},{"volume-title":"Orientdb","year":"2024","key":"ref83"},{"volume-title":"Titan Graph Database","year":"2024","key":"ref84"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11096918.pdf?arnumber=11096918","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T18:14:01Z","timestamp":1754072041000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11096918\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":84,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3592824","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}