{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T03:50:37Z","timestamp":1784260237801,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":47,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,12,5]],"date-time":"2022-12-05T00:00:00Z","timestamp":1670198400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,12,5]]},"DOI":"10.1145\/3564625.3567972","type":"proceedings-article","created":{"date-parts":[[2022,12,3]],"date-time":"2022-12-03T01:01:29Z","timestamp":1670029289000},"page":"769-784","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["MADDC: Multi-Scale Anomaly Detection, Diagnosis and Correction for Discrete Event Logs"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5342-4275","authenticated-orcid":false,"given":"Xiaolei","family":"Wang","sequence":"first","affiliation":[{"name":"College of Computer, National University of Defense Technology, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8845-7539","authenticated-orcid":false,"given":"Lin","family":"Yang","sequence":"additional","affiliation":[{"name":"Systems Engineering Institute, Academy of Military Science, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0818-2526","authenticated-orcid":false,"given":"Dongyang","family":"Li","sequence":"additional","affiliation":[{"name":"Systems Engineering Institute, Academy of Military Science, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4530-5401","authenticated-orcid":false,"given":"Linru","family":"Ma","sequence":"additional","affiliation":[{"name":"Systems Engineering Institute, Academy of Military Science, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0045-4128","authenticated-orcid":false,"given":"Yongzhong","family":"He","sequence":"additional","affiliation":[{"name":"School of Computer and Information Technology, Beijing Jiaotong University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8450-2483","authenticated-orcid":false,"given":"Junchao","family":"Xiao","sequence":"additional","affiliation":[{"name":"School of Systems Science and Engineering, Sun Yat-Sen University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5702-4941","authenticated-orcid":false,"given":"Jiyuan","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Computer, National University of Defense Technology, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8495-7795","authenticated-orcid":false,"given":"Yuexiang","family":"Yang","sequence":"additional","affiliation":[{"name":"College of Computer, National University of Defense Technology, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,5]]},"reference":[{"key":"e_1_3_2_1_1_1","first-page":"1","article-title":"A Tour in Process Mining: From Practice to Algorithmic","volume":"14","author":"Aalst W.","year":"2019","unstructured":"W. Aalst , J. Carmona , T. Chatain , and B.\u00a0 V. Dongen . 2019 . A Tour in Process Mining: From Practice to Algorithmic Challenges. Trans. Petri Nets Other Model. Concurr. 14 (2019), 1 \u2013 35 . W. Aalst, J. Carmona, T. Chatain, and B.\u00a0V. Dongen. 2019. A Tour in Process Mining: From Practice to Algorithmic Challenges. Trans. Petri Nets Other Model. Concurr. 14 (2019), 1\u201335.","journal-title":"Challenges. Trans. Petri Nets Other Model. Concurr."},{"key":"e_1_3_2_1_2_1","volume-title":"Finding Structure in Unstructured Processes: The Case for Process Mining. Seventh International Conference on Application of Concurrency to System Design (ACSD 2007)","author":"Aalst W.","year":"2007","unstructured":"W. Aalst and C. G\u00fcnther . 2007 . Finding Structure in Unstructured Processes: The Case for Process Mining. Seventh International Conference on Application of Concurrency to System Design (ACSD 2007) ( 2007 ), 3\u201312. W. Aalst and C. G\u00fcnther. 2007. Finding Structure in Unstructured Processes: The Case for Process Mining. Seventh International Conference on Application of Concurrency to System Design (ACSD 2007)(2007), 3\u201312."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2004.47"},{"key":"e_1_3_2_1_4_1","volume-title":"ATLAS: A Sequence-based Learning Approach for Attack Investigation. In USENIX Security Symposium.","author":"Alsaheel A.","year":"2021","unstructured":"Abdulellah\u00a0 A. Alsaheel , Yuhong Nan , Shiqing Ma , Le Yu , Gregory Walkup , Z.\u00a0 Berkay Celik , X. Zhang , and Dongyan Xu . 2021 . ATLAS: A Sequence-based Learning Approach for Attack Investigation. In USENIX Security Symposium. Abdulellah\u00a0A. Alsaheel, Yuhong Nan, Shiqing Ma, Le Yu, Gregory Walkup, Z.\u00a0Berkay Celik, X. Zhang, and Dongyan Xu. 2021. ATLAS: A Sequence-based Learning Approach for Attack Investigation. In USENIX Security Symposium."},{"key":"e_1_3_2_1_5_1","unstructured":"Jinwon An and S. Cho. 2015. Variational Autoencoder based Anomaly Detection using Reconstruction Probability.  Jinwon An and S. Cho. 2015. Variational Autoencoder based Anomaly Detection using Reconstruction Probability."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3477314.3507097"},{"key":"e_1_3_2_1_7_1","unstructured":"A. Berti S.\u00a0V. Zelst and W. Aalst. 2019. Process Mining for Python (PM4Py): Bridging the Gap Between Process- and Data Science. ArXiv abs\/1905.06169(2019).  A. Berti S.\u00a0V. Zelst and W. Aalst. 2019. Process Mining for Python (PM4Py): Bridging the Gap Between Process- and Data Science. ArXiv abs\/1905.06169(2019)."},{"key":"e_1_3_2_1_8_1","volume-title":"Process Mining: Opportunities for Process Diagnostics. In BPM.","author":"Bose R.","year":"2010","unstructured":"R. Bose and W. Aalst . 2010 . Trace Alignment in Process Mining: Opportunities for Process Diagnostics. In BPM. R. Bose and W. Aalst. 2010. Trace Alignment in Process Mining: Opportunities for Process Diagnostics. In BPM."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2010.235"},{"key":"e_1_3_2_1_10_1","volume-title":"Spell: Streaming Parsing of System Event Logs. 2016 IEEE 16th International Conference on Data Mining (ICDM)","author":"Du Min","year":"2016","unstructured":"Min Du and Feifei Li . 2016 . Spell: Streaming Parsing of System Event Logs. 2016 IEEE 16th International Conference on Data Mining (ICDM) (2016), 859\u2013864. Min Du and Feifei Li. 2016. Spell: Streaming Parsing of System Event Logs. 2016 IEEE 16th International Conference on Data Mining (ICDM) (2016), 859\u2013864."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"crossref","unstructured":"Sebastian Dunzer M. Stierle M. Matzner and Stephan Baier. 2019. Conformance checking: a state-of-the-art literature review. In S-BPM ONE \u201919.  Sebastian Dunzer M. Stierle M. Matzner and Stephan Baier. 2019. Conformance checking: a state-of-the-art literature review. In S-BPM ONE \u201919.","DOI":"10.1145\/3329007.3329014"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2009.60"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2999572.2999600"},{"key":"e_1_3_2_1_15_1","volume-title":"Visual Anomaly Detection in Event Sequence Data. 2019 IEEE International Conference on Big Data (Big Data)","author":"Guo Shunan","year":"2019","unstructured":"Shunan Guo , Zhuochen Jin , Q. Chen , D. Gotz , H. Zha , and N. Cao . 2019 . Visual Anomaly Detection in Event Sequence Data. 2019 IEEE International Conference on Big Data (Big Data) ( 2019 ), 1125\u20131130. Shunan Guo, Zhuochen Jin, Q. Chen, D. Gotz, H. Zha, and N. Cao. 2019. Visual Anomaly Detection in Event Sequence Data. 2019 IEEE International Conference on Big Data (Big Data) (2019), 1125\u20131130."},{"key":"e_1_3_2_1_16_1","unstructured":"Y. Guo Yujin Wen Congwei Jiang Yixin Lian and Yi Wan. 2021. Detecting Log Anomalies with Multi-Head Attention (LAMA). ArXiv abs\/2101.02392(2021).  Y. Guo Yujin Wen Congwei Jiang Yixin Lian and Yi Wan. 2021. Detecting Log Anomalies with Multi-Head Attention (LAMA). ArXiv abs\/2101.02392(2021)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2013.184"},{"key":"e_1_3_2_1_18_1","volume-title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats. ArXiv abs\/2001.01525(2020).","author":"Han Xueyuan","year":"2020","unstructured":"Xueyuan Han , Thomas Pasquier , Adam Bates , James\u00a0 W. Mickens , and Margo\u00a0 I. Seltzer . 2020 . UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats. ArXiv abs\/2001.01525(2020). Xueyuan Han, Thomas Pasquier, Adam Bates, James\u00a0W. Mickens, and Margo\u00a0I. Seltzer. 2020. UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats. ArXiv abs\/2001.01525(2020)."},{"key":"e_1_3_2_1_19_1","volume-title":"Drain: An Online Log Parsing Approach with Fixed Depth Tree. 2017 IEEE International Conference on Web Services (ICWS)","author":"He Pinjia","year":"2017","unstructured":"Pinjia He , Jieming Zhu , Zibin Zheng , and Michael\u00a0 R. Lyu . 2017 . Drain: An Online Log Parsing Approach with Fixed Depth Tree. 2017 IEEE International Conference on Web Services (ICWS) (2017), 33\u201340. Pinjia He, Jieming Zhu, Zibin Zheng, and Michael\u00a0R. Lyu. 2017. Drain: An Online Log Parsing Approach with Fixed Depth Tree. 2017 IEEE International Conference on Web Services (ICWS) (2017), 33\u201340."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"e_1_3_2_1_21_1","unstructured":"Diederik\u00a0P. Kingma and M. Welling. 2014. Auto-Encoding Variational Bayes. CoRR abs\/1312.6114(2014).  Diederik\u00a0P. Kingma and M. Welling. 2014. Auto-Encoding Variational Bayes. CoRR abs\/1312.6114(2014)."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS47738.2020.9110301"},{"key":"e_1_3_2_1_23_1","volume-title":"Log Clustering Based Problem Identification for Online Service Systems. 2016 IEEE\/ACM 38th International Conference on Software Engineering Companion (ICSE-C)","author":"Lin Qingwei","year":"2016","unstructured":"Qingwei Lin , Hongyu Zhang , Jian-Guang Lou , Y. Zhang , and Xuewei Chen . 2016 . Log Clustering Based Problem Identification for Online Service Systems. 2016 IEEE\/ACM 38th International Conference on Software Engineering Companion (ICSE-C) (2016), 102\u2013111. Qingwei Lin, Hongyu Zhang, Jian-Guang Lou, Y. Zhang, and Xuewei Chen. 2016. Log Clustering Based Problem Identification for Online Service Systems. 2016 IEEE\/ACM 38th International Conference on Software Engineering Companion (ICSE-C) (2016), 102\u2013111."},{"key":"e_1_3_2_1_24_1","volume-title":"Isolation Forest. 2008 Eighth IEEE International Conference on Data Mining","author":"Liu F.","year":"2008","unstructured":"F. Liu , K. Ting , and Z. Zhou . 2008 . Isolation Forest. 2008 Eighth IEEE International Conference on Data Mining ( 2008 ), 413\u2013422. F. Liu, K. Ting, and Z. Zhou. 2008. Isolation Forest. 2008 Eighth IEEE International Conference on Data Mining (2008), 413\u2013422."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/s12555-016-0168-6"},{"key":"e_1_3_2_1_26_1","volume-title":"Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining(2010)","author":"Lou Jian-Guang","unstructured":"Jian-Guang Lou , Qiang Fu , Shengqi Yang , Jiang Li , and B. Wu . 2010. Mining program workflow from interleaved traces . Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining(2010) . Jian-Guang Lou, Qiang Fu, Shengqi Yang, Jiang Li, and B. Wu. 2010. Mining program workflow from interleaved traces. Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining(2010)."},{"key":"e_1_3_2_1_27_1","volume-title":"USENIX Annual Technical Conference.","author":"Lou Jian-Guang","year":"2010","unstructured":"Jian-Guang Lou , Qiang Fu , Shengqi Yang , Ye Xu , and Jiang Li . 2010 . Mining Invariants from Console Logs for System Problem Detection . In USENIX Annual Technical Conference. Jian-Guang Lou, Qiang Fu, Shengqi Yang, Ye Xu, and Jiang Li. 2010. Mining Invariants from Console Logs for System Problem Detection. In USENIX Annual Technical Conference."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2017.7995934"},{"key":"e_1_3_2_1_29_1","volume-title":"Accelerated Hierarchical Density Based Clustering. 2017 IEEE International Conference on Data Mining Workshops (ICDMW)","author":"McInnes L.","year":"2017","unstructured":"L. McInnes and John Healy . 2017 . Accelerated Hierarchical Density Based Clustering. 2017 IEEE International Conference on Data Mining Workshops (ICDMW) (2017), 33\u201342. L. McInnes and John Healy. 2017. Accelerated Hierarchical Density Based Clustering. 2017 IEEE International Conference on Data Mining Workshops (ICDMW) (2017), 33\u201342."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2014.01.012"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338501.3357374"},{"key":"e_1_3_2_1_33_1","volume-title":"Trace Clustering in Process Mining. In Business Process Management Workshops.","author":"Song Minseok","unstructured":"Minseok Song , C. G\u00fcnther , and W. Aalst . 2008 . Trace Clustering in Process Mining. In Business Process Management Workshops. Minseok Song, C. G\u00fcnther, and W. Aalst. 2008. Trace Clustering in Process Mining. In Business Process Management Workshops."},{"key":"e_1_3_2_1_34_1","volume-title":"Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic. In NDSS.","author":"Song Yingbo","year":"2009","unstructured":"Yingbo Song , A. Keromytis , and S. Stolfo . 2009 . Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic. In NDSS. Yingbo Song, A. Keromytis, and S. Stolfo. 2009. Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic. In NDSS."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.amc.2008.05.028"},{"key":"e_1_3_2_1_36_1","unstructured":"Aaron Tuor Samuel Kaplan Brian Hutchinson Nicole Nichols and Sean Robinson. 2017. Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams. ArXiv abs\/1710.00811(2017).  Aaron Tuor Samuel Kaplan Brian Hutchinson Nicole Nichols and Sean Robinson. 2017. Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams. ArXiv abs\/1710.00811(2017)."},{"key":"e_1_3_2_1_37_1","unstructured":"Z. Wang Zhengzhang Chen Jingchao Ni Hui Liu H. Chen and Jiliang Tang. 2020. Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection. ArXiv abs\/2008.13361(2020).  Z. Wang Zhengzhang Chen Jingchao Ni Hui Liu H. Chen and Jiliang Tang. 2020. Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection. ArXiv abs\/2008.13361(2020)."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"crossref","unstructured":"W. Xu Ling Huang A. Fox D. Patterson and Michael\u00a0I. Jordan. 2009. Detecting large-scale system problems by mining console logs. SOSP \u201909.  W. Xu Ling Huang A. Fox D. Patterson and Michael\u00a0I. Jordan. 2009. Detecting large-scale system problems by mining console logs. SOSP \u201909.","DOI":"10.1145\/1629575.1629587"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"crossref","unstructured":"W. Xu Ling Huang A. Fox D. Patterson and Michael\u00a0I. Jordan. 2009. Large-Scale System Problems Detection by Mining Console Logs.  W. Xu Ling Huang A. Fox D. Patterson and Michael\u00a0I. Jordan. 2009. Large-Scale System Problems Detection by Mining Console Logs.","DOI":"10.1109\/ICDM.2009.19"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2009.19"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"crossref","unstructured":"K. Yamanishi and Y. Maruyama. 2005. Dynamic syslog mining for network failure monitoring. In KDD \u201905.  K. Yamanishi and Y. Maruyama. 2005. Dynamic syslog mining for network failure monitoring. In KDD \u201905.","DOI":"10.1145\/1081870.1081927"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2953981"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/2872362.2872407"},{"key":"e_1_3_2_1_44_1","unstructured":"Lun-Pin Yuan Euijin Choo Ting Yu Issa\u00a0M. Khalil and Sencun Zhu. 2020. Time-Window Group-Correlation Support vs. Individual Features: A Detection of Abnormal Users. ArXiv abs\/2012.13971(2020).  Lun-Pin Yuan Euijin Choo Ting Yu Issa\u00a0M. Khalil and Sencun Zhu. 2020. Time-Window Group-Correlation Support vs. Individual Features: A Detection of Abnormal Users. ArXiv abs\/2012.13971(2020)."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453098"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338931"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.4018\/ijbdcn.2017070107"}],"event":{"name":"ACSAC: Annual Computer Security Applications Conference","location":"Austin TX USA","acronym":"ACSAC"},"container-title":["Proceedings of the 38th Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3564625.3567972","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3564625.3567972","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T18:09:12Z","timestamp":1750183752000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3564625.3567972"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,5]]},"references-count":47,"alternative-id":["10.1145\/3564625.3567972","10.1145\/3564625"],"URL":"https:\/\/doi.org\/10.1145\/3564625.3567972","relation":{},"subject":[],"published":{"date-parts":[[2022,12,5]]},"assertion":[{"value":"2022-12-05","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}