{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,16]],"date-time":"2026-10-16T02:53:20Z","timestamp":1792119200399,"version":"4.4.0"},"reference-count":85,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2023,6,27]],"date-time":"2023-06-27T00:00:00Z","timestamp":1687824000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000185","name":"DARPA","doi-asserted-by":"crossref","award":["N66001-18-C-4033"],"award-info":[{"award-number":["N66001-18-C-4033"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"crossref"}]},{"name":"National Science Foundation","award":["1618706, 1717774, 2127207"],"award-info":[{"award-number":["1618706, 1717774, 2127207"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2023,8,30]]},"abstract":"<jats:p>\n                    Lateral movement is a key stage of system compromise used by advanced persistent threats. Detecting it is no simple task. When network host logs are abstracted into discrete temporal graphs, the problem can be reframed as anomalous edge detection in an evolving network. Research in modern deep graph learning techniques has produced many creative and complicated models for this task. However, as is the case in many machine learning fields, the generality of models is of paramount importance for accuracy and scalability during training and inference. In this article, we propose a formalized approach to this problem with a framework we call\n                    <jats:sc>Euler<\/jats:sc>\n                    . It consists of a model-agnostic graph neural network stacked upon a model-agnostic sequence encoding layer such as a recurrent neural network. Models built according to the\n                    <jats:sc>Euler<\/jats:sc>\n                    framework can easily distribute their graph convolutional layers across multiple machines for large performance improvements. Additionally, we demonstrate that\n                    <jats:sc>Euler<\/jats:sc>\n                    -based models are as good, or better, than every state-of-the-art approach to anomalous link detection and prediction that we tested. As anomaly-based intrusion detection systems, our models efficiently identified anomalous connections between entities with high precision and outperformed all other unsupervised techniques for anomalous lateral movement detection. Additionally, we show that as a piece of a larger anomaly detection pipeline,\n                    <jats:sc>Euler<\/jats:sc>\n                    models perform well enough for use in real-world systems. With more advanced, yet still lightweight, alerting mechanisms ingesting the embeddings produced by\n                    <jats:sc>Euler<\/jats:sc>\n                    models, precision is boosted from 0.243, to 0.986 on real-world network traffic.\n                  <\/jats:p>","DOI":"10.1145\/3588771","type":"journal-article","created":{"date-parts":[[2023,3,24]],"date-time":"2023-03-24T08:15:51Z","timestamp":1679645751000},"page":"1-36","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":56,"title":["<scp>Euler<\/scp>\n                    : Detecting Network Lateral Movement via Scalable Temporal Link Prediction"],"prefix":"10.1145","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2866-4135","authenticated-orcid":false,"given":"Isaiah J.","family":"King","sequence":"first","affiliation":[{"name":"The George Washington University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8588-7680","authenticated-orcid":false,"given":"H. Howie","family":"Huang","sequence":"additional","affiliation":[{"name":"The George Washington University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,6,27]]},"reference":[{"key":"e_1_3_3_2_2","unstructured":"2023. About zeek \u2013 Book of zeek (v5.1.0). Zeek Documentation (2023). https:\/\/docs.zeek.org\/en\/current\/about.html."},{"key":"e_1_3_3_3_2","unstructured":"2019. Distributed RPC framework. PyTorch Master Documentation (2019). https:\/\/pytorch.org\/docs\/master\/rpc.html."},{"key":"e_1_3_3_4_2","unstructured":"2022. Pytorch\/tensorpipe: A tensor-aware point-to-point communication primitive for machine learning. Pytorch\/tensorpipe (2022). Retrieved from https:\/\/github.com\/pytorch\/tensorpipe."},{"issue":"2","key":"e_1_3_3_5_2","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1145\/380995.381030","article-title":"The UCI KDD archive of large data sets for data mining research and experimentation","volume":"2","author":"Bay Stephen D.","year":"2000","unstructured":"Stephen D. Bay, Dennis Kibler, Michael J. Pazzani, and Padhraic Smyth. 2000. The UCI KDD archive of large data sets for data mining research and experimentation. ACM SIGKDD Explorations Newsletter 2, 2 (2000), 81\u201385.","journal-title":"ACM SIGKDD Explorations Newsletter"},{"key":"e_1_3_3_6_2","unstructured":"2014. Intel xeon processor E5-2683 v3 (35M Cache 2.00 GHz) product specifications. Intel Product Specifications: Processors (2014). Retrieved from https:\/\/ark.intel.com\/content\/www\/us\/en\/ark\/products\/81055\/intel-xeon-processor-e5-2683-v3-35m-cache-2-00-ghz.html."},{"key":"e_1_3_3_7_2","unstructured":"Ed Williams SpiderLab Trustwave and Edward Millington. 2020. OS credential dumping: LSASS memory sub-technique T1003.001. Mitre Att&ck (2020). https:\/\/attack.mitre.org\/techniques\/T1003\/001\/."},{"key":"e_1_3_3_8_2","unstructured":"Ryan Becwar and Vincent Le Toux. 2020. Use alternate authentication material: Pass the ticket Sub-technique T1550.003. Mitre Att&ck (2020). Retrieved from https:\/\/attack.mitre.org\/techniques\/1156T1550\/003\/."},{"key":"e_1_3_3_9_2","unstructured":"Jon Sternstein Mark Wee Praetorian Netskope Prasad Somasamduram Sekhar Sarukkai Syed Ummar Farooqh and Yossi Weizman. 2017. Valid accounts. MITRE ATT&CK (2017). Retrieved from https:\/\/attack.mitre.org\/techniques\/T1078\/."},{"key":"e_1_3_3_10_2","unstructured":"2018. Lateral movement tactic TA0008. MITRE ATT&CK (2018). https:\/\/attack.mitre.org\/tactics\/TA0008\/."},{"key":"e_1_3_3_11_2","first-page":"296","volume-title":"Proceedings of the International Symposium on Communications and Information Technologies (ISCIT)","author":"Alazab Ammar","year":"2012","unstructured":"Ammar Alazab, Michael Hobbs, Jemal Abawajy, and Moutaz Alazab. 2012. Using feature selection for intrusion detection system. In Proceedings of the International Symposium on Communications and Information Technologies (ISCIT). IEEE, 296\u2013301."},{"key":"e_1_3_3_12_2","first-page":"483","volume-title":"Proceedings of the Spring Joint Computer Conference","author":"Amdahl Gene M.","year":"1967","unstructured":"Gene M. Amdahl. 1967. Validity of the single processor approach to achieving large scale computing capabilities. In Proceedings of the Spring Joint Computer Conference. 483\u2013485."},{"key":"e_1_3_3_13_2","doi-asserted-by":"crossref","first-page":"27","DOI":"10.1145\/3450569.3463573","volume-title":"Proceedings of the 26th ACM Symposium on Access Control Models and Technologies","author":"Anjum Md Monowar","year":"2021","unstructured":"Md Monowar Anjum, Shahrear Iqbal, and Benoit Hamelin. 2021. Analyzing the usefulness of the DARPA OpTC dataset in cyber threat detection research. In Proceedings of the 26th ACM Symposium on Access Control Models and Technologies. 27\u201332."},{"key":"e_1_3_3_14_2","first-page":"242","volume-title":"Proceedings of the IEEE 44th Conference on Local Computer Networks (LCN)","author":"Bai Tim","year":"2019","unstructured":"Tim Bai, Haibo Bian, Abbas Abou Daya, Mohammad A. Salahuddin, Noura Limam, and Raouf Boutaba. 2019. A machine learning approach for RDP-based lateral movement detection. In Proceedings of the IEEE 44th Conference on Local Computer Networks (LCN). IEEE, 242\u2013245."},{"key":"e_1_3_3_15_2","first-page":"3242","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence","volume":"34","author":"Bhatia Siddharth","year":"2020","unstructured":"Siddharth Bhatia, Bryan Hooi, Minji Yoon, Kijung Shin, and Christos Faloutsos. 2020. MIDAS: Microcluster-based detector of anomalies in edge streams. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 34. 3242\u20133249."},{"issue":"1","key":"e_1_3_3_16_2","doi-asserted-by":"crossref","first-page":"1049","DOI":"10.1109\/TNSM.2021.3054356","article-title":"Uncovering lateral movement using authentication logs","volume":"18","author":"Bian Haibo","year":"2021","unstructured":"Haibo Bian, Tim Bai, Mohammad A. Salahuddin, Noura Limam, Abbas Abou Daya, and Raouf Boutaba. 2021. Uncovering lateral movement using authentication logs. IEEE Trans. Netw. Serv. Manag. 18, 1 (2021), 1049\u20131063.","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"e_1_3_3_17_2","first-page":"257","volume-title":"Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID\u201920)","author":"Bowman Benjamin","year":"2020","unstructured":"Benjamin Bowman, Craig Laprade, Yuede Ji, and H. Howie Huang. 2020. Detecting lateral movement in enterprise computer networks with unsupervised graph AI. In Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID\u201920). 257\u2013268."},{"issue":"2","key":"e_1_3_3_18_2","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A survey of data mining and machine learning methods for cyber security intrusion detection","volume":"18","author":"Buczak Anna L.","year":"2015","unstructured":"Anna L. Buczak and Erhan Guven. 2015. A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun. Surv. Tutor. 18, 2 (2015), 1153\u20131176.","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"e_1_3_3_19_2","volume-title":"Snort 2.1 Intrusion Detection","author":"Caswell Brian","year":"2004","unstructured":"Brian Caswell and Jay Beale. 2004. Snort 2.1 Intrusion Detection. Elsevier."},{"key":"e_1_3_3_20_2","article-title":"GC-LSTM: Graph convolution embedded LSTM for dynamic link prediction","author":"Chen Jinyin","year":"2018","unstructured":"Jinyin Chen, Xuanheng Xu, Yangyang Wu, and Haibin Zheng. 2018. GC-LSTM: Graph convolution embedded LSTM for dynamic link prediction. arXiv preprint arXiv:1812.04206 (2018).","journal-title":"arXiv preprint arXiv:1812.04206"},{"key":"e_1_3_3_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-18214-4_5"},{"key":"e_1_3_3_22_2","article-title":"On the properties of neural machine translation: Encoder-decoder approaches","author":"Cho Kyunghyun","year":"2014","unstructured":"Kyunghyun Cho, Bart Van Merri\u00ebnboer, Dzmitry Bahdanau, and Yoshua Bengio. 2014. On the properties of neural machine translation: Encoder-decoder approaches. arXiv preprint arXiv:1409.1259 (2014).","journal-title":"arXiv preprint arXiv:1409.1259"},{"key":"e_1_3_3_23_2","article-title":"Empirical evaluation of gated recurrent neural networks on sequence modeling","author":"Chung Junyoung","year":"2014","unstructured":"Junyoung Chung, Caglar Gulcehre, KyungHyun Cho, and Yoshua Bengio. 2014. Empirical evaluation of gated recurrent neural networks on sequence modeling. arXiv preprint arXiv:1412.3555 (2014).","journal-title":"arXiv preprint arXiv:1412.3555"},{"key":"e_1_3_3_24_2","volume-title":"The Internet Engineering Task Force (IETF)","author":"Claise Benoit","year":"2004","unstructured":"Benoit Claise. 2004. Cisco systems netflow services export version 9. The Internet Engineering Task Force (IETF), Network Working Group, Technical Report. Retrieved from https:\/\/www.ietf.org\/rfc\/rfc3954.txt."},{"issue":"6","key":"e_1_3_3_25_2","first-page":"446","article-title":"A study on NSL-KDD dataset for intrusion detection system based on classification algorithms","volume":"4","author":"Dhanabal L.","year":"2015","unstructured":"L. Dhanabal and S. P. Shantharajah. 2015. A study on NSL-KDD dataset for intrusion detection system based on classification algorithms. Int. J. Adv. Res. Comput. Commun. Eng. 4, 6 (2015), 446\u2013452.","journal-title":"Int. J. Adv. Res. Comput. Commun. Eng."},{"key":"e_1_3_3_26_2","doi-asserted-by":"crossref","first-page":"213","DOI":"10.1007\/s00354-019-00065-z","article-title":"Temporal link prediction: A survey","volume":"38","author":"Divakaran Aswathy","year":"2019","unstructured":"Aswathy Divakaran and Anuraj Mohan. 2019. Temporal link prediction: A survey. New Gener. Comput. 38 (2019), 213\u2013258.","journal-title":"New Gener. Comput."},{"key":"e_1_3_3_27_2","first-page":"1","volume-title":"Proceedings of the 15th International Conference on Computer Engineering and Systems (ICCES)","author":"El-Hadidi Mohamed Gamal","year":"2020","unstructured":"Mohamed Gamal El-Hadidi and Marianne A. Azer. 2020. Detecting Mimikatz in lateral movements using Mutex. In Proceedings of the 15th International Conference on Computer Engineering and Systems (ICCES). IEEE, 1\u20136."},{"key":"e_1_3_3_28_2","doi-asserted-by":"crossref","first-page":"38","DOI":"10.1515\/9781400841356.38","volume-title":"The Structure and Dynamics of Networks","author":"Erd\u00f6s Paul","year":"2011","unstructured":"Paul Erd\u00f6s and Alfr\u00e9d R\u00e9nyi. 2011. On the evolution of random graphs. In The Structure and Dynamics of Networks. Princeton University Press, 38\u201382."},{"key":"e_1_3_3_29_2","first-page":"178","volume-title":"Proceedings of the 20th International Conference on Advanced Communication Technology (ICACT)","author":"Farahnakian Fahimeh","year":"2018","unstructured":"Fahimeh Farahnakian and Jukka Heikkonen. 2018. A deep auto-encoder based approach for intrusion detection system. In Proceedings of the 20th International Conference on Advanced Communication Technology (ICACT). IEEE, 178\u2013183."},{"key":"e_1_3_3_30_2","first-page":"3431","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Fu Chuanpu","year":"2021","unstructured":"Chuanpu Fu, Qi Li, Meng Shen, and Ke Xu. 2021. Realtime robust malicious traffic detection via frequency domain analysis. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 3431\u20133446."},{"key":"e_1_3_3_31_2","first-page":"1263","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Gilmer Justin","year":"2017","unstructured":"Justin Gilmer, Samuel S. Schoenholz, Patrick F. Riley, Oriol Vinyals, and George E. Dahl. 2017. Neural message passing for quantum chemistry. In Proceedings of the International Conference on Machine Learning. PMLR, 1263\u20131272."},{"key":"e_1_3_3_32_2","first-page":"98","volume-title":"Proceedings of the IEEE Security and Privacy Workshops","author":"Glasser Joshua","year":"2013","unstructured":"Joshua Glasser and Brian Lindauer. 2013. Bridging the gap: A pragmatic approach to generating insider threat data. In Proceedings of the IEEE Security and Privacy Workshops. IEEE, 98\u2013104."},{"key":"e_1_3_3_33_2","doi-asserted-by":"crossref","first-page":"104816","DOI":"10.1016\/j.knosys.2019.06.024","article-title":"dyngraph2vec: Capturing network dynamics using dynamic graph representation learning","volume":"187","author":"Goyal Palash","year":"2020","unstructured":"Palash Goyal, Sujit Rokka Chhetri, and Arquimedes Canedo. 2020. dyngraph2vec: Capturing network dynamics using dynamic graph representation learning. Knowl.-based Syst. 187 (2020), 104816.","journal-title":"Knowl.-based Syst."},{"key":"e_1_3_3_34_2","article-title":"DynGEM: Deep embedding method for dynamic graphs","author":"Goyal Palash","year":"2018","unstructured":"Palash Goyal, Nitin Kamra, Xinran He, and Yan Liu. 2018. DynGEM: Deep embedding method for dynamic graphs. arXiv preprint arXiv:1805.11273 (2018).","journal-title":"arXiv preprint arXiv:1805.11273"},{"key":"e_1_3_3_35_2","doi-asserted-by":"crossref","first-page":"855","DOI":"10.1145\/2939672.2939754","volume-title":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","author":"Grover Aditya","year":"2016","unstructured":"Aditya Grover and Jure Leskovec. 2016. node2vec: Scalable feature learning for networks. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 855\u2013864."},{"key":"e_1_3_3_36_2","first-page":"10701","volume-title":"Advances in Neural Information Processing Systems","author":"Hajiramezanali Ehsan","year":"2019","unstructured":"Ehsan Hajiramezanali, Arman Hasanzadeh, Krishna Narayanan, Nick Duffield, Mingyuan Zhou, and Xiaoning Qian. 2019. Variational graph recurrent neural networks. In Advances in Neural Information Processing Systems, Vol. 32. Curran Associates, Inc., 10701\u201310711. Retrieved from https:\/\/proceedings.neurips.cc\/paper\/2019\/file\/a6b8deb7798e7532ade2a8934477d3ce-Paper.pdf."},{"key":"e_1_3_3_37_2","article-title":"Inductive representation learning on large graphs","author":"Hamilton William L.","year":"2017","unstructured":"William L. Hamilton, Rex Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. arXiv preprint arXiv:1706.02216 (2017).","journal-title":"arXiv preprint arXiv:1706.02216"},{"key":"e_1_3_3_38_2","first-page":"220","volume-title":"Proceedings of the IEEE Conference on Intelligence and Security Informatics (ISI)","author":"Heard Nick","year":"2016","unstructured":"Nick Heard and Patrick Rubin-Delanchy. 2016. Network-wide anomaly detection via the Dirichlet process. In Proceedings of the IEEE Conference on Intelligence and Security Informatics (ISI). IEEE, 220\u2013224."},{"key":"e_1_3_3_39_2","first-page":"3093","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)","author":"Ho Grant","year":"2021","unstructured":"Grant Ho, Mayank Dhiman, Devdatta Akhawe, Vern Paxson, Stefan Savage, Geoffrey M. Voelker, and David Wagner. 2021. Hopper: Modeling and detecting lateral movement. In Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921). 3093\u20133110."},{"issue":"8","key":"e_1_3_3_40_2","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter Sepp","year":"1997","unstructured":"Sepp Hochreiter and J\u00fcrgen Schmidhuber. 1997. Long short-term memory. Neural Computat. 9, 8 (1997), 1735\u20131780.","journal-title":"Neural Computat."},{"key":"e_1_3_3_41_2","doi-asserted-by":"crossref","first-page":"4363","DOI":"10.1109\/TIFS.2021.3098977","article-title":"TRACE: Enterprise-wide provenance tracking for real-time apt detection","volume":"16","author":"Irshad Hassaan","year":"2021","unstructured":"Hassaan Irshad, Gabriela Ciocarlie, Ashish Gehani, Vinod Yegneswaran, Kyu Hyung Lee, Jignesh Patel, Somesh Jha, Yonghwi Kwon, Dongyan Xu, and Xiangyu Zhang. 2021. TRACE: Enterprise-wide provenance tracking for real-time apt detection. IEEE Trans. Inf. Forens. Secur. 16 (2021), 4363\u20134376.","journal-title":"IEEE Trans. Inf. Forens. Secur."},{"key":"e_1_3_3_42_2","volume-title":"Comprehensive, Multi-source Cyber-security Events Data Set","author":"Kent Alexander D.","year":"2015","unstructured":"Alexander D. Kent. 2015. Comprehensive, Multi-source Cyber-security Events Data Set. Technical Report. Los Alamos National Lab. (LANL), Los Alamos, NM."},{"key":"e_1_3_3_43_2","doi-asserted-by":"crossref","first-page":"150","DOI":"10.1016\/j.cose.2014.09.001","article-title":"Authentication graphs: Analyzing user behavior within an enterprise network","volume":"48","author":"Kent Alexander D.","year":"2015","unstructured":"Alexander D. Kent, Lorie M. Liebrock, and Joshua C. Neil. 2015. Authentication graphs: Analyzing user behavior within an enterprise network. Comput. Secur. 48 (2015), 150\u2013166.","journal-title":"Comput. Secur."},{"key":"e_1_3_3_44_2","first-page":"1","volume-title":"Proceedings of the 3rd International Cyber Resilience Conference (CRC)","author":"Khalid Adam","year":"2021","unstructured":"Adam Khalid, Anazida Zainal, Mohd Aizaini Maarof, and Fuad A. Ghaleb. 2021. Advanced persistent threat detection: A survey. In Proceedings of the 3rd International Cyber Resilience Conference (CRC). IEEE, 1\u20136."},{"key":"e_1_3_3_45_2","volume-title":"Proceedings of the Network and Distributed System Security Symposium","author":"King Isaiah J.","year":"2022","unstructured":"Isaiah J. King and H. Howie Huang. 2022. Euler: Detecting network lateral movement via scalable temporal graph link prediction. In Proceedings of the Network and Distributed System Security Symposium. Internet Society. DOI:10.14722\/ndss.2022.24107"},{"key":"e_1_3_3_46_2","doi-asserted-by":"crossref","first-page":"223","DOI":"10.1145\/945445.945467","volume-title":"Proceedings of the 19th ACM Symposium on Operating Systems Principles","author":"King Samuel T.","year":"2003","unstructured":"Samuel T. King and Peter M. Chen. 2003. Backtracking intrusions. In Proceedings of the 19th ACM Symposium on Operating Systems Principles. 223\u2013236."},{"key":"e_1_3_3_47_2","article-title":"Adam: A method for stochastic optimization","author":"Kingma Diederik P.","year":"2014","unstructured":"Diederik P. Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014).","journal-title":"arXiv preprint arXiv:1412.6980"},{"key":"e_1_3_3_48_2","article-title":"Semi-supervised classification with graph convolutional networks","author":"Kipf Thomas N.","year":"2016","unstructured":"Thomas N. Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016).","journal-title":"arXiv preprint arXiv:1609.02907"},{"key":"e_1_3_3_49_2","article-title":"Variational graph auto-encoders","author":"Kipf Thomas N.","year":"2016","unstructured":"Thomas N. Kipf and Max Welling. 2016. Variational graph auto-encoders. arXiv preprint arXiv:1611.07308 (2016).","journal-title":"arXiv preprint arXiv:1611.07308"},{"key":"e_1_3_3_50_2","volume-title":"Algorithm Design","author":"Kleinberg Jon","year":"2006","unstructured":"Jon Kleinberg and \u00c9va Tardos. 2006. Interval scheduling: The greedy algorithm stays ahead. In Algorithm Design. Addison Wesley."},{"key":"e_1_3_3_51_2","first-page":"583","volume-title":"Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI\u201914)","author":"Li Mu","year":"2014","unstructured":"Mu Li, David G. Andersen, Jun Woo Park, Alexander J. Smola, Amr Ahmed, Vanja Josifovski, James Long, Eugene J. Shekita, and Bor-Yiing Su. 2014. Scaling distributed machine learning with the parameter server. In Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI\u201914). 583\u2013598."},{"key":"e_1_3_3_52_2","first-page":"1","volume-title":"Proceedings of the IEEE\/ACIS 15th International Conference on Computer and Information Science (ICIS)","author":"Li Meicong","year":"2016","unstructured":"Meicong Li, Wei Huang, Yongbin Wang, Wenqing Fan, and Jianfang Li. 2016. The study of APT attack stage model. In Proceedings of the IEEE\/ACIS 15th International Conference on Computer and Information Science (ICIS). IEEE, 1\u20135."},{"key":"e_1_3_3_53_2","article-title":"PyTorch distributed: Experiences on accelerating data parallel training","author":"Li Shen","year":"2020","unstructured":"Shen Li, Yanli Zhao, Rohan Varma, Omkar Salpekar, Pieter Noordhuis, Teng Li, Adam Paszke, Jeff Smith, Brian Vaughan, Pritam Damania, et\u00a0al. 2020. PyTorch distributed: Experiences on accelerating data parallel training. arXiv preprint arXiv:2006.15704 (2020).","journal-title":"arXiv preprint arXiv:2006.15704"},{"key":"e_1_3_3_54_2","doi-asserted-by":"crossref","first-page":"29219","DOI":"10.1109\/ACCESS.2018.2839770","article-title":"Deep dynamic network embedding for link prediction","volume":"6","author":"Li Taisong","year":"2018","unstructured":"Taisong Li, Jiawei Zhang, S. Yu Philip, Yan Zhang, and Yonghong Yan. 2018. Deep dynamic network embedding for link prediction. IEEE Access 6 (2018), 29219\u201329230.","journal-title":"IEEE Access"},{"key":"e_1_3_3_55_2","first-page":"1","volume-title":"Proceedings of the IEEE Military Communications Conference (MILCOM)","author":"Liu Qingyun","year":"2018","unstructured":"Qingyun Liu, Jack W. Stokes, Rob Mead, Tim Burrell, Ian Hellen, John Lambert, Andrey Marochko, and Weidong Cui. 2018. Latte: Large-scale lateral movement detection. In Proceedings of the IEEE Military Communications Conference (MILCOM). IEEE, 1\u20136."},{"key":"e_1_3_3_56_2","doi-asserted-by":"crossref","first-page":"89","DOI":"10.1007\/978-981-33-6173-7_7","volume-title":"Applied Soft Computing and Communication Networks","author":"Lohiya Ritika","year":"2021","unstructured":"Ritika Lohiya and Ankit Thakkar. 2021. Intrusion detection using deep neural network with antirectifier layer. In Applied Soft Computing and Communication Networks. Springer, 89\u2013105."},{"key":"e_1_3_3_57_2","first-page":"1795","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Milajerdi Sadegh M.","year":"2019","unstructured":"Sadegh M. Milajerdi, Birhanu Eshete, Rigel Gjomemo, and V. N. Venkatakrishnan. 2019. Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 1795\u20131812."},{"key":"e_1_3_3_58_2","first-page":"1137","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP)","author":"Milajerdi Sadegh M.","year":"2019","unstructured":"Sadegh M. Milajerdi, Rigel Gjomemo, Birhanu Eshete, Ramachandran Sekar, and V. N. Venkatakrishnan. 2019. Holmes: Real-time apt detection through correlation of suspicious information flows. In Proceedings of the IEEE Symposium on Security and Privacy (SP). IEEE, 1137\u20131152."},{"key":"e_1_3_3_59_2","first-page":"2","article-title":"Kitsune: An ensemble of autoencoders for online network intrusion detection","volume":"5","author":"Mirsky Yisroel","year":"2018","unstructured":"Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. 2018. Kitsune: An ensemble of autoencoders for online network intrusion detection. Mach. Learn. 5 (2018), 2.","journal-title":"Mach. Learn."},{"key":"e_1_3_3_60_2","article-title":"Data Model | MITRE Cyber Analytics Repository","year":"2022","unstructured":"MITRE. 2022. Data Model | MITRE Cyber Analytics Repository. Retrieved from https:\/\/car.mitre.org\/data_model\/.","journal-title":"Retrieved from https:\/\/car.mitre.org\/data_model\/"},{"key":"e_1_3_3_61_2","unstructured":"Ghulam Mohi-ud din. 2018. NSL-KDD. DOI:10.21227\/425a-3e55"},{"key":"e_1_3_3_62_2","first-page":"969","volume-title":"Proceedings of the Web Conference","author":"Nguyen Giang Hoang","year":"2018","unstructured":"Giang Hoang Nguyen, John Boaz Lee, Ryan A. Rossi, Nesreen K. Ahmed, Eunyee Koh, and Sungchul Kim. 2018. Continuous-time dynamic network embeddings. In Proceedings of the Web Conference. 969\u2013976."},{"key":"e_1_3_3_63_2","first-page":"1","volume-title":"Proceedings of the International Joint Conference on Neural Networks (IJCNN)","author":"Ouyang Linshu","year":"2020","unstructured":"Linshu Ouyang, Yongzheng Zhang, and Yipeng Wang. 2020. Unified graph embedding-based anomalous edge detection. In Proceedings of the International Joint Conference on Neural Networks (IJCNN). IEEE, 1\u20138."},{"key":"e_1_3_3_64_2","first-page":"5363","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence","volume":"34","author":"Pareja Aldo","year":"2020","unstructured":"Aldo Pareja, Giacomo Domeniconi, Jie Chen, Tengfei Ma, Toyotaro Suzumura, Hiroki Kanezashi, Tim Kaler, Tao Schardl, and Charles Leiserson. 2020. EvolveGCN: Evolving graph convolutional networks for dynamic graphs. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 34. 5363\u20135370."},{"key":"e_1_3_3_65_2","doi-asserted-by":"crossref","first-page":"701","DOI":"10.1145\/2623330.2623732","volume-title":"Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","author":"Perozzi Bryan","year":"2014","unstructured":"Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. 2014. DeepWalk: Online learning of social representations. In Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 701\u2013710."},{"key":"e_1_3_3_66_2","article-title":"Dylink2vec: Effective feature representation for link prediction in dynamic networks","author":"Rahman Mahmudur","year":"2018","unstructured":"Mahmudur Rahman, Tanay Kumar Saha, Mohammad Al Hasan, Kevin S. Xu, and Chandan K. Reddy. 2018. Dylink2vec: Effective feature representation for link prediction in dynamic networks. arXiv preprint arXiv:1804.05755 (2018).","journal-title":"arXiv preprint arXiv:1804.05755"},{"key":"e_1_3_3_67_2","article-title":"Dynamic graph representation learning via self-attention networks","author":"Sankar Aravind","year":"2018","unstructured":"Aravind Sankar, Yanhong Wu, Liang Gou, Wei Zhang, and Hao Yang. 2018. Dynamic graph representation learning via self-attention networks. arXiv preprint arXiv:1812.09430 (2018).","journal-title":"arXiv preprint arXiv:1812.09430"},{"key":"e_1_3_3_68_2","doi-asserted-by":"crossref","first-page":"100393","DOI":"10.1016\/j.iot.2021.100393","article-title":"CyberLearning: Effectiveness analysis of machine learning security modeling to detect cyber-anomalies and multi-attacks","volume":"14","author":"Sarker Iqbal H.","year":"2021","unstructured":"Iqbal H. Sarker. 2021. CyberLearning: Effectiveness analysis of machine learning security modeling to detect cyber-anomalies and multi-attacks. Internet Things 14 (2021), 100393.","journal-title":"Internet Things"},{"key":"e_1_3_3_69_2","first-page":"362","volume-title":"Proceedings of the International Conference on Neural Information Processing","author":"Seo Youngjoo","year":"2018","unstructured":"Youngjoo Seo, Micha\u00ebl Defferrard, Pierre Vandergheynst, and Xavier Bresson. 2018. Structured sequence modeling with graph convolutional recurrent networks. In Proceedings of the International Conference on Neural Information Processing. Springer, 362\u2013373."},{"key":"e_1_3_3_70_2","article-title":"Pitfalls of graph neural network evaluation","author":"Shchur Oleksandr","year":"2018","unstructured":"Oleksandr Shchur, Maximilian Mumme, Aleksandar Bojchevski, and Stephan G\u00fcnnemann. 2018. Pitfalls of graph neural network evaluation. arXiv preprint arXiv:1811.05868 (2018).","journal-title":"arXiv preprint arXiv:1811.05868"},{"issue":"5","key":"e_1_3_3_71_2","doi-asserted-by":"crossref","first-page":"056115","DOI":"10.1103\/PhysRevE.85.056115","article-title":"Random walks on temporal networks","volume":"85","author":"Starnini Michele","year":"2012","unstructured":"Michele Starnini, Andrea Baronchelli, Alain Barrat, and Romualdo Pastor-Satorras. 2012. Random walks on temporal networks. Phys. Rev. E 85, 5 (2012), 056115.","journal-title":"Phys. Rev. E"},{"key":"e_1_3_3_72_2","doi-asserted-by":"crossref","first-page":"101734","DOI":"10.1016\/j.cose.2020.101734","article-title":"APT datasets and attack modeling for automated detection methods: A review","volume":"92","author":"Stojanovi\u0107 Branka","year":"2020","unstructured":"Branka Stojanovi\u0107, Katharina Hofer-Schmitz, and Ulrike Kleb. 2020. APT datasets and attack modeling for automated detection methods: A review. Comput. Secur. 92 (2020), 101734.","journal-title":"Comput. Secur."},{"key":"e_1_3_3_73_2","unstructured":"Blake E. Strom Andy Applebaum Doug P. Miller Kathryn C. Nickels Adam G. Pennington and Cody B. Thomas. 2018. Mitre attack: Design and philosophy. The MITRE Corporation Technical Report."},{"key":"e_1_3_3_74_2","first-page":"301","volume-title":"Proceedings of the World Wide Web Conference","author":"Taheri Aynaz","year":"2019","unstructured":"Aynaz Taheri, Kevin Gimpel, and Tanya Berger-Wolf. 2019. Learning to represent the evolution of dynamic graphs with recurrent models. In Proceedings of the World Wide Web Conference. 301\u2013307."},{"key":"e_1_3_3_75_2","doi-asserted-by":"crossref","first-page":"1067","DOI":"10.1145\/2736277.2741093","volume-title":"Proceedings of the 24th International Conference on World Wide Web","author":"Tang Jian","year":"2015","unstructured":"Jian Tang, Meng Qu, Mingzhe Wang, Ming Zhang, Jun Yan, and Qiaozhu Mei. 2015. Line: Large-scale information network embedding. In Proceedings of the 24th International Conference on World Wide Web. 1067\u20131077."},{"key":"e_1_3_3_76_2","unstructured":"Jacob Torrey. 2020. GitHub - darpa-i2o\/Transparent-Computing: Material from the DARPA Transparent Computing Program. Retrieved from https:\/\/github.com\/darpa-i2o\/Transparent-Computing."},{"key":"e_1_3_3_77_2","article-title":"Graph attention networks","author":"Veli\u010dkovi\u0107 Petar","year":"2017","unstructured":"Petar Veli\u010dkovi\u0107, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2017. Graph attention networks. arXiv preprint arXiv:1710.10903 (2017).","journal-title":"arXiv preprint arXiv:1710.10903"},{"issue":"2","key":"e_1_3_3_78_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3377454","article-title":"A survey on distributed machine learning","volume":"53","author":"Verbraeken Joost","year":"2020","unstructured":"Joost Verbraeken, Matthijs Wolting, Jonathan Katzy, Jeroen Kloppenburg, Tim Verbelen, and Jan S. Rellermeyer. 2020. A survey on distributed machine learning. ACM Comput. Surv. 53, 2 (2020), 1\u201333.","journal-title":"ACM Comput. Surv."},{"issue":"12","key":"e_1_3_3_79_2","doi-asserted-by":"crossref","first-page":"4954","DOI":"10.1021\/acs.chemmater.0c01907","article-title":"Machine learning for materials scientists: An introductory guide toward best practices","volume":"32","author":"Wang Anthony Yu-Tung","year":"2020","unstructured":"Anthony Yu-Tung Wang, Ryan J. Murdock, Steven K. Kauwe, Anton O. Oliynyk, Aleksander Gurlo, Jakoah Brgoch, Kristin A. Persson, and Taylor D. Sparks. 2020. Machine learning for materials scientists: An introductory guide toward best practices. Chem. Mater. 32, 12 (2020), 4954\u20134965.","journal-title":"Chem. Mater."},{"key":"e_1_3_3_80_2","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006464"},{"key":"e_1_3_3_81_2","article-title":"DeepHunter: A graph neural network based approach for robust cyber threat hunting","author":"Wei Renzheng","year":"2021","unstructured":"Renzheng Wei, Lijun Cai, Aimin Yu, and Dan Meng. 2021. DeepHunter: A graph neural network based approach for robust cyber threat hunting. arXiv preprint arXiv:2104.09806 (2021).","journal-title":"arXiv preprint arXiv:2104.09806"},{"key":"e_1_3_3_82_2","first-page":"248","volume-title":"Proceedings of the IEEE Conference on Intelligence and Security Informatics (ISI)","author":"Whitehouse Mark","year":"2016","unstructured":"Mark Whitehouse, Marina Evangelou, and Niall M. Adams. 2016. Activity-based temporal anomaly detection in enterprise-cyber security. In Proceedings of the IEEE Conference on Intelligence and Security Informatics (ISI). IEEE, 248\u2013250."},{"issue":"2","key":"e_1_3_3_83_2","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1016\/J.ENG.2016.02.008","article-title":"Strategies and principles of distributed machine learning on big data","volume":"2","author":"Xing Eric P.","year":"2016","unstructured":"Eric P. Xing, Qirong Ho, Pengtao Xie, and Dai Wei. 2016. Strategies and principles of distributed machine learning on big data. Engineering 2, 2 (2016), 179\u2013195.","journal-title":"Engineering"},{"key":"e_1_3_3_84_2","article-title":"How powerful are graph neural networks?","author":"Xu Keyulu","year":"2018","unstructured":"Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks? arXiv preprint arXiv:1810.00826 (2018).","journal-title":"arXiv preprint arXiv:1810.00826"},{"issue":"9","key":"e_1_3_3_85_2","doi-asserted-by":"crossref","first-page":"3848","DOI":"10.1109\/TITS.2019.2935152","article-title":"T-GCN: A temporal graph convolutional network for traffic prediction","volume":"21","author":"Zhao Ling","year":"2019","unstructured":"Ling Zhao, Yujiao Song, Chao Zhang, Yu Liu, Pu Wang, Tao Lin, Min Deng, and Haifeng Li. 2019. T-GCN: A temporal graph convolutional network for traffic prediction. IEEE Trans. Intell. Transport. Syst. 21, 9 (2019), 3848\u20133858.","journal-title":"IEEE Trans. Intell. Transport. Syst."},{"key":"e_1_3_3_86_2","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence","volume":"32","author":"Zhou Lekui","year":"2018","unstructured":"Lekui Zhou, Yang Yang, Xiang Ren, Fei Wu, and Yueting Zhuang. 2018. Dynamic network embedding by modeling triadic closure process. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 32."}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3588771","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3588771","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T12:47:36Z","timestamp":1750164456000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3588771"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,6,27]]},"references-count":85,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2023,8,30]]}},"alternative-id":["10.1145\/3588771"],"URL":"https:\/\/doi.org\/10.1145\/3588771","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,6,27]]},"assertion":[{"value":"2022-08-19","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-03-13","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-06-27","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}