{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,31]],"date-time":"2026-01-31T18:41:19Z","timestamp":1769884879315,"version":"3.49.0"},"reference-count":93,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/raid67961.2025.00050","type":"proceedings-article","created":{"date-parts":[[2026,1,30]],"date-time":"2026-01-30T21:00:02Z","timestamp":1769806802000},"page":"174-189","source":"Crossref","is-referenced-by-count":0,"title":["Carbon Filter: Scalable, Efficient, and Secure Alert Triage for Endpoint Detection & Response"],"prefix":"10.1109","author":[{"given":"Muhammad Adil","family":"Inam","sequence":"first","affiliation":[{"name":"University of Illinois at Urbana-Champaign,Siebel School of Computing and Data Science"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jonathan","family":"Oliver","sequence":"additional","affiliation":[{"name":"Carbon Black, Broadcom Inc"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Raghav","family":"Batta","sequence":"additional","affiliation":[{"name":"Carbon Black, Broadcom Inc"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Adam","family":"Bates","sequence":"additional","affiliation":[{"name":"University of Illinois at Urbana-Champaign,Siebel School of Computing and Data Science"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Endpoint detection and response (EDR)"},{"key":"ref2","article-title":"Endpoint Detection And Response Market Size, Share & Trends Report","year":"2023"},{"key":"ref3","article-title":"Mitre attack framework","year":"2022","journal-title":"Mitre"},{"key":"ref4","article-title":"Automated Incident Response: Respond to Every Alert","year":"2019"},{"key":"ref5","article-title":"New Research from Advanced Threat Analytics","year":"2019"},{"key":"ref6","article-title":"How Many Alerts is Too Many to Handle?","year":"2019"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecurity49315.2020.9138872"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2018.8709231"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3471621.3471858"},{"key":"ref10","article-title":"Cloud infrastructure is not immune from the solarwinds orion breach"},{"key":"ref11","first-page":"3891","article-title":"How does endpoint detection use the MITRE ATT&CK framework?","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Virkud"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2019.00026"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243776"},{"key":"ref16","article-title":"Sigmahq rule example"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref18","article-title":"Boot or logon initialization scripts: Rc scripts","year":"2020","journal-title":"Mitre"},{"key":"ref19","article-title":"Kairos:: Practical intrusion detection and investigation using wholesystem provenance","author":"Cheng","year":"2023","journal-title":"arXiv preprint arXiv:2308.05034"},{"key":"ref20","article-title":"Havoc C2 with AV\/EDR Bypass Methods in 2024","author":"Rothlisberger","year":"2024"},{"key":"ref21","first-page":"2389","article-title":"Faster yet safer: Logging system via Fixed-Key blockcipher","volume-title":"31st USENIX Security Symposium, ser. Security\u201922.","author":"Hoang"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833745"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24065"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417862"},{"key":"ref25","article-title":"The future of machine learning in cybersecurity"},{"key":"ref26","article-title":"Reaching the tipping point of web application and api security","year":"2021","journal-title":"published"},{"key":"ref27","article-title":"Amazon s3"},{"key":"ref28","first-page":"7","article-title":"TLSH - a locality sensitive hash","volume-title":"2013 Fourth Cybercrime and Trustworthy Computing Workshop","author":"Oliver"},{"key":"ref29","first-page":"1","article-title":"HAC-T and fast search for similarity in security","volume-title":"2020 International Conference on Omni-layer Intelligent Systems (COINS).","author":"Oliver"},{"key":"ref30","article-title":"Apache flink"},{"key":"ref31","article-title":"Amazon kinesis"},{"key":"ref32","article-title":"Protocol buffers"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.06.015"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15506-2_15"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2017.12.004"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098196"},{"key":"ref37","article-title":"Fishdbc: Flexible, incremental, scalable, hierarchical density-based clustering for arbitrary data and distance","author":"Dell\u2019Amico","year":"2019","journal-title":"arXiv preprint arXiv:1910.07283"},{"key":"ref38","article-title":"Tlsh software","journal-title":"Github"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/2833157.2833162"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/MCSE.2010.118"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3068335"},{"key":"ref42","article-title":"ANNOY library"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2889473"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/1963405.1963487"},{"key":"ref45","article-title":"Benchmarking for fast searching of nearest neighbors"},{"key":"ref46","article-title":"Neighborhood graph and tree (NGT) for indexing high-dimensional data"},{"key":"ref47","article-title":"Python implementation of approximate nearest neighbors (nn-descent)"},{"key":"ref48","article-title":"Incident Investigation","year":"2019","journal-title":"Fireeye"},{"key":"ref49","article-title":"Atlas v2: An open-source dataset for intrusion detection research","author":"Riddle"},{"key":"ref50","first-page":"3005","article-title":"{ATLAS}: A sequence-based learning approach for attack investigation","volume-title":"30th USENIX security symposium (USENIX security 21)","author":"Alsaheel"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1002\/j.1538-7305.1948.tb01338.x"},{"key":"ref52","article-title":"Normalization: A preprocessing stage","volume":"abs\/1503.06462","author":"Patro","year":"2015","journal-title":"CoRR"},{"key":"ref53","article-title":"Atlasv2: Atlas attack engagements, version 2","author":"Riddle","year":"2023"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427255"},{"key":"ref55","article-title":"Implementing risk-based alerting","author":"Bull","year":"2024"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3627673.3680057"},{"key":"ref57","first-page":"2443","article-title":"ALASTOR: Reconstructing the provenance of serverless intrusions","volume-title":"31st USENIX Security Symposium (USENIX Security 22).","author":"Datta"},{"key":"ref58","first-page":"2461","article-title":"Back-Propagating system dependency impact for attack investigation","volume-title":"31st USENIX Security Symposium (USENIX Security 22).","author":"Fang"},{"key":"ref59","first-page":"3005","article-title":"ATLAS: A sequence-based learning approach for attack investigation","volume-title":"30th USENIX Security Symposium (USENIX Security 21). USENIX Association","author":"Alsaheel"},{"key":"ref60","article-title":"Causal analysis for software-defined networking attacks","volume-title":"30th USENIX Security Symposium (USENIX Security 21). USENIX Association","author":"Ujcich"},{"key":"ref61","first-page":"3989","article-title":"CLARION: Sound and clear provenance tracking for microservice deployments","volume-title":"30th USENIX Security Symposium (USENIX Security 21).","author":"Chen"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23141"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-78813-5_42"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23306"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05171-6_6"},{"key":"ref68","first-page":"639","article-title":"SAQL: A stream-based query system for real-time abnormal system behavior detection","volume-title":"27th USENIX Security Symposium (USENIX Security 18).","author":"Gao"},{"key":"ref69","article-title":"MPI: Multiple Perspective Attack Investigation with Semantic Aware Execution Partitioning","author":"Ma"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134045"},{"key":"ref71","first-page":"487","article-title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data","volume-title":"26th USENIX Security Symposium","author":"Hossain"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991122"},{"key":"ref73","article-title":"Trustworthy WholeSystem Provenance for the Linux Kernel","volume-title":"Proceedings of 24th USENIX Security Symposium","author":"Bates"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3564625.3567997"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/3564625.3567990"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23057"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00139"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00005"},{"key":"ref79","first-page":"2345","article-title":"SIGL: Securing software installations through deep graph learning","volume-title":"30th USENIX Security Symposium (USENIX Security 21). USENIX Association","author":"Han"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2960353"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2867595"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3368860.3368862"},{"key":"ref85","article-title":"Frappuccino: Fault-detection through runtime analysis of provenance","volume-title":"9th USENIX Workshop on Hot Topics in Cloud Computing","author":"Han"},{"key":"ref86","article-title":"StreamSpot: Detecting network anomalies in edge streams (Source Code and Data)","author":"Manzoor","year":"2016"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00253"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00112"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179405"},{"key":"ref90","article-title":"Enriching intrusion alerts through multi-host causality","volume-title":"Proceedings of the 12th ISOC Network and Distributed System Security Symposium, ser. NDSS\u201905","author":"King"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1007\/11760146_24"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427255"}],"event":{"name":"2025 28th International Symposium on Research in Attacks, Intrusions and Defenses (RAID)","location":"Gold Coast, Australia","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,22]]}},"container-title":["2025 28th International Symposium on Research in Attacks, Intrusions and Defenses (RAID)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11352430\/11352388\/11352477.pdf?arnumber=11352477","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,31]],"date-time":"2026-01-31T06:10:21Z","timestamp":1769839821000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11352477\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":93,"URL":"https:\/\/doi.org\/10.1109\/raid67961.2025.00050","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}