{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T19:55:24Z","timestamp":1790970924907,"version":"4.1.0"},"reference-count":45,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Open Project Program of the Shanghai Key Laboratory of Satellite Internet","award":["2025-O-04-SHHLWYJY-03-2937"],"award-info":[{"award-number":["2025-O-04-SHHLWYJY-03-2937"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3734719","type":"journal-article","created":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T13:58:53Z","timestamp":1790258333000},"page":"8750-8765","source":"Crossref","is-referenced-by-count":0,"title":["CrossHound: Multi-Source Provenance Correlation for Advanced Persistent Threat Detection and Investigation"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-4272-9604","authenticated-orcid":false,"given":"Jiaping","family":"Gui","sequence":"first","affiliation":[{"name":"Shanghai Jiao Tong University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-6299-4065","authenticated-orcid":false,"given":"Yixin","family":"Zhou","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xianggeng","family":"Zhu","sequence":"additional","affiliation":[{"name":"Shanghai Satellite Network Research Institute Company Ltd.,","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaohan","family":"Li","sequence":"additional","affiliation":[{"name":"Shanghai Satellite Network Research Institute Company Ltd.,","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-5760-731X","authenticated-orcid":false,"given":"Xiaofan","family":"Xu","sequence":"additional","affiliation":[{"name":"Shanghai Satellite Network Research Institute Company Ltd.,","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0243-805X","authenticated-orcid":false,"given":"Cunqing","family":"Hua","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ping","family":"Du","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-023-04603-y"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref3","first-page":"3005","article-title":"Atlas: A sequence-based learning approach for attack investigation","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Alsaheel"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103748"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00012"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23204"},{"key":"ref9","first-page":"5197","article-title":"MAGIC: Detecting advanced persistent threats via masked graph representation learning","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Jia"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00005"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3396390"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM55648.2025.11044565"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103420"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2024.104004"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.48175\/IJARSCT-1888"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3701716.3715209"},{"key":"ref17","volume-title":"Microsoft. Microsoft XDR.","year":"2025"},{"key":"ref18","volume-title":"Cortex XDR","year":"2025"},{"key":"ref19","volume-title":"Crowdstrike XDR.","year":"2025"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/s10489-020-02007-5"},{"key":"ref21","volume-title":"Operationally Transparent Cyber (OpTC) Data Release","year":"2025"},{"key":"ref22","volume-title":"Comprehensive, Multi-Source Cyber-Security Events","year":"2025"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3539605"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583379"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00051"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1312.6114"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/BF00288961"},{"key":"ref29","volume-title":"Grubbs\u2019s Test","year":"2025"},{"key":"ref30","volume-title":"The Zeek Network Security Monitor","year":"2025"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463573"},{"key":"ref32","volume-title":"NTLM User Authentication","year":"2025"},{"key":"ref33","first-page":"1","article-title":"On the bottleneck of graph neural networks and its practical implications","volume-title":"Proc. ICLR","author":"Alon"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/26.103043"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.17487\/rfc8158"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.14722\/prism.2026.23021"},{"key":"ref37","first-page":"1199","article-title":"Evading provenance-based ML detectors with adversarial system actions","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Mukherjee"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539321"},{"key":"ref41","first-page":"2461","article-title":"Back-propagating system dependency impact for attack investigation","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Fang"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833632"},{"key":"ref43","article-title":"A unified framework for data poisoning attack to graph-based semi-supervised learning","author":"Liu","year":"2019","journal-title":"arXiv:1910.14147"},{"key":"ref44","volume-title":"Hide Infrastructure","year":"2026"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417862"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11695229.pdf?arnumber=11695229","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T19:07:10Z","timestamp":1790968030000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11695229\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":45,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3734719","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}