{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,29]],"date-time":"2026-01-29T08:53:36Z","timestamp":1769676816857,"version":"3.49.0"},"reference-count":41,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2023YFB3107300"],"award-info":[{"award-number":["2023YFB3107300"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172244"],"award-info":[{"award-number":["62172244"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62572285"],"award-info":[{"award-number":["62572285"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["ZR2024MF050"],"award-info":[{"award-number":["ZR2024MF050"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Taishan Scholars Program","award":["tsqn202211210"],"award-info":[{"award-number":["tsqn202211210"]}]},{"name":"Key Research and Development Program of Shandong","award":["2025CXPT082"],"award-info":[{"award-number":["2025CXPT082"]}]},{"name":"\u201c20 New Universities\u201d Project of Jinan City","award":["202333023"],"award-info":[{"award-number":["202333023"]}]},{"name":"\u201c20 New Universities\u201d Project of Jinan City","award":["202333045"],"award-info":[{"award-number":["202333045"]}]},{"name":"Pairing Plan Project of the School of Computer Science and Technology","award":["202333023"],"award-info":[{"award-number":["202333023"]}]},{"name":"Pairing Plan Project of the School of Computer Science and Technology","award":["202333045"],"award-info":[{"award-number":["202333045"]}]},{"name":"Pairing Plan Project of the School of Computer Science and Technology","award":["2024JDJH12"],"award-info":[{"award-number":["2024JDJH12"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3653175","type":"journal-article","created":{"date-parts":[[2026,1,12]],"date-time":"2026-01-12T21:59:20Z","timestamp":1768255160000},"page":"1065-1080","source":"Crossref","is-referenced-by-count":0,"title":["TraceCluster: A Lightweight and Adaptive Clustering-Based Subgraph Attention Network for APT Detection in Provenance Graphs"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3386-4756","authenticated-orcid":false,"given":"Lijuan","family":"Xu","sequence":"first","affiliation":[{"name":"Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0538-8217","authenticated-orcid":false,"given":"Zicheng","family":"Zhao","sequence":"additional","affiliation":[{"name":"Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1812-1316","authenticated-orcid":false,"given":"Dawei","family":"Zhao","sequence":"additional","affiliation":[{"name":"Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8182-2852","authenticated-orcid":false,"given":"Zhen","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence, Optics and Electronics (iOPEN) and the School of Mechanical Engineering, Northwestern Polytechnical University, Xi’an, Shaanxi, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9274-7325","authenticated-orcid":false,"given":"Chunpeng","family":"Ge","sequence":"additional","affiliation":[{"name":"Joint SDU-NTU Centre for Artificial Intelligence Research (C-FAIR) and the School of Software, Shandong University, Jinan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICPC.2010.49"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2855563"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.120059"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3397269"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3037903"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363224"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338931"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00005"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3396390"},{"key":"ref16","first-page":"7173","article-title":"Orthrus: Achieving high quality of attribution in provenance-based intrusion detection systems","volume-title":"Proc. Secur. Symp. (USENIX Secur.)","author":"Jiang"},{"key":"ref17","first-page":"1","article-title":"Semi-supervised classification with graph convolutional networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kipf"},{"key":"ref18","first-page":"1025","article-title":"Inductive representation learning on large graphs","volume-title":"Proc. 31st Int. Conf. Neural Inf. Process. Syst.","author":"Hamilton"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2008.2005605"},{"key":"ref20","first-page":"1","article-title":"FastGCN: Fast learning with graph convolutional networks via importance sampling","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chen"},{"key":"ref21","first-page":"1","article-title":"Stochastic training of graph convolutional networks with variance reduction","volume-title":"Proc. 32nd Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"Chen"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330925"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243811"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1162\/neco_a_01199"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-34637-9_5"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3273918"},{"key":"ref28","first-page":"6439","article-title":"Wasserstein Weisfeiler\u2013Lehman graph kernels","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Togninalli"},{"issue":"5","key":"ref29","first-page":"887","article-title":"Provg-searcher: A graph representation learning approach for efficient provenance graph search","volume":"32","author":"Zhou","year":"2020","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref30","first-page":"6575","article-title":"DISTDET: A cost-effective distributed cyber threat detection system","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Dong"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23204"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SC.1998.10018"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1002\/j.1538-7305.1970.tb01770.x"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD.1995.480017"},{"key":"ref37","article-title":"Systemtap: Instrumenting the Linux kernel for analyzing performance and functional problems","author":"Jacob","year":"2025"},{"key":"ref38","volume-title":"Transparent Computing Engagement 3 Data Release","author":"Keromytis","year":"2018"},{"key":"ref39","first-page":"1137","article-title":"A neural probabilistic language model","volume":"3","author":"Bengio","year":"2003","journal-title":"J. Mach. Learn. Res."},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1613\/jair.953"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2858826"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11346813.pdf?arnumber=11346813","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,28]],"date-time":"2026-01-28T20:58:40Z","timestamp":1769633920000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11346813\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":41,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3653175","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}