{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,6]],"date-time":"2026-01-06T06:02:26Z","timestamp":1767679346813,"version":"3.48.0"},"reference-count":60,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U22B2028"],"award-info":[{"award-number":["U22B2028"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62002324"],"award-info":[{"award-number":["62002324"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372410"],"award-info":[{"award-number":["62372410"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Provincial Universities of Zhejiang","doi-asserted-by":"publisher","award":["RF-A2023009"],"award-info":[{"award-number":["RF-A2023009"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["LQ21F020016"],"award-info":[{"award-number":["LQ21F020016"]}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["LD22F020002"],"award-info":[{"award-number":["LD22F020002"]}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["LZ23F020011"],"award-info":[{"award-number":["LZ23F020011"]}]},{"name":"\u201cPioneer\u201d and \u201cLeading Goose\u201d R&D Program of Zhejiang","award":["2025C01082"],"award-info":[{"award-number":["2025C01082"]}]},{"name":"\u201cPioneer\u201d and \u201cLeading Goose\u201d R&D Program of Zhejiang","award":["2025C01013"],"award-info":[{"award-number":["2025C01013"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Serv. Manage."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tnsm.2025.3634590","type":"journal-article","created":{"date-parts":[[2025,11,24]],"date-time":"2025-11-24T19:00:00Z","timestamp":1764010800000},"page":"767-788","source":"Crossref","is-referenced-by-count":0,"title":["MADGuard: A High-Performance Microservice Anomaly Detection System With Multidimensional Data Fusion and Temporal Causal Analysis"],"prefix":"10.1109","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4790-9361","authenticated-orcid":false,"given":"Yanshang","family":"Yin","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8657-662X","authenticated-orcid":false,"given":"Tiantian","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4664-3311","authenticated-orcid":false,"given":"Tieming","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4810-7491","authenticated-orcid":false,"given":"Mingqi","family":"Lv","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2019.01.001"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2021.100415"},{"article-title":"Automatic policy generation for inter-service access control of microservices","volume-title":"Proc. USENIX Security Symp. USENIX Security Symp.","author":"Li","key":"ref3"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2020.106449"},{"key":"ref5","first-page":"655","article-title":"CRISP: Critical path analysis of large-scale microservice architectures","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Zhang"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2025.112390"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00268"},{"key":"ref8","first-page":"5971","article-title":"Cross container attacks: The bewildered eBPF on clouds","volume-title":"Proc. 32nd USENIX Security Symp. (USENIX Security)","author":"He"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103490"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510150"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103173"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102200"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2024.05.006"},{"volume-title":"Aquasec","year":"2023","key":"ref14"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICCIT52419.2022.9711600"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3058060.3058085"},{"volume-title":"Secure Flag","year":"2023","key":"ref17"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354227"},{"key":"ref19","first-page":"1423","article-title":"Security namespace: Making Linux security frameworks available to containers","volume-title":"Proc. 27th USENIX Security Symp. (USENIX Security)","author":"Sun"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427236"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24858-5_8"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3560810.3564266"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24286"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102282"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00005"},{"key":"ref28","first-page":"3989","article-title":"{CLARION}: Sound and clear provenance tracking for microservice deployments","volume-title":"Proc. 30th USENIX Security Symp. (USENIX Security)","author":"Chen"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"volume-title":"You\u2019re one misconfiguration away from a cloud-based data breach","year":"2020","author":"Kasinathan","key":"ref31"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1999.766910"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-010-0001-0"},{"volume-title":"Kubernetes","year":"2019","key":"ref34"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1002\/int.23035"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3297280.3297401"},{"key":"ref37","first-page":"263","article-title":"TeaStore: A micro-service reference application","volume-title":"Proc. IEEE 4th Int. Workshops Found. Appl. Self* Syst. (FAS* W)","author":"von Kistowski"},{"volume-title":"Sock shop: A microservice demo application","year":"2017","key":"ref38"},{"volume-title":"Tetragon\u2014eBPF-based security observability and runtime enforcement","year":"2023","key":"ref39"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2024.112142"},{"key":"ref41","first-page":"2327","article-title":"{CADE}: Detecting and explaining concept drift samples for security applications","volume-title":"Proc. 30th USENIX Security Symp. (USENIX Security)","author":"Yang"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2876857"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CSITSS64042.2024.10817058"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3608129"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3076288"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-023-10437-z"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2022.11.001"},{"article-title":"Dapper, a large-scale distributed systems tracing infrastructure","year":"2010","author":"Sigelman","key":"ref48"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TCCN.2020.2966615"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2022.3155447"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2023.03.028"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102728"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-1277-9_9"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS60048.2023.00076"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3276487"},{"volume-title":"Falco: Container native runtime security","year":"2022","key":"ref56"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58291.2024.00025"},{"volume-title":"Twisklock: The most complete container cybersecurity platform","year":"2018","key":"ref58"},{"volume-title":"Tracee: Linux runtime security and forensics using EBPF","year":"2023","key":"ref59"},{"volume-title":"DevGraph","year":"2022","key":"ref60"}],"container-title":["IEEE Transactions on Network and Service Management"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/4275028\/11319294\/11267039.pdf?arnumber=11267039","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,6]],"date-time":"2026-01-06T05:58:56Z","timestamp":1767679136000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11267039\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":60,"URL":"https:\/\/doi.org\/10.1109\/tnsm.2025.3634590","relation":{},"ISSN":["1932-4537","2373-7379"],"issn-type":[{"type":"electronic","value":"1932-4537"},{"type":"electronic","value":"2373-7379"}],"subject":[],"published":{"date-parts":[[2026]]}}}