{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T02:06:39Z","timestamp":1789178799941,"version":"build-2803163510"},"publisher-location":"New York, NY, USA","reference-count":45,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF (National Science Foundation)","doi-asserted-by":"publisher","award":["2148177"],"award-info":[{"award-number":["2148177"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,7]]},"DOI":"10.1145\/3634737.3645012","type":"proceedings-article","created":{"date-parts":[[2024,6,28]],"date-time":"2024-06-28T11:51:38Z","timestamp":1719575498000},"page":"96-111","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Decoding the MITRE Engenuity ATT&CK Enterprise Evaluation: An Analysis of EDR Performance in Real-World Environments"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-8301-7961","authenticated-orcid":false,"given":"Xiangmin","family":"Shen","sequence":"first","affiliation":[{"name":"Northwestern University, Evanston, IL, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7712-0292","authenticated-orcid":false,"given":"Zhenyuan","family":"Li","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-4036-5342","authenticated-orcid":false,"given":"Graham","family":"Burleigh","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-3901-2131","authenticated-orcid":false,"given":"Lingzhi","family":"Wang","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4103-1498","authenticated-orcid":false,"given":"Yan","family":"Chen","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,7]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[n. d.]. Endpoint Detection and Response Market Report. https:\/\/www.mordorintelligence.com\/industry-reports\/endpoint-detection-and-response-market"},{"key":"e_1_3_2_1_2_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Alahmadi Bushra A.","year":"2022","unstructured":"Bushra A. Alahmadi, Louise Axon, and Ivan Martinovic. 2022. 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 2783--2800. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/alahmadi"},{"key":"e_1_3_2_1_3_1","volume-title":"BenchIoT: A Security Benchmark for the Internet of Things. In 49th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN).","author":"Almakhdhub Naif Saleh","year":"2019","unstructured":"Naif Saleh Almakhdhub, Abraham A. Clements, Mathias Payer, and Saurabh Bagchi. 2019. BenchIoT: A Security Benchmark for the Internet of Things. In 49th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN)."},{"key":"e_1_3_2_1_4_1","volume-title":"USENIX Security Symposium. 3005--3022","author":"Alsaheel Abdulellah","year":"2021","unstructured":"Abdulellah Alsaheel, Yuhong Nan, Shiqing Ma, Le Yu, Gregory Walkup, Z Berkay Celik, Xiangyu Zhang, and Dongyan Xu. 2021. ATLAS: A Sequence-based Learning Approach for Attack Investigation.. In USENIX Security Symposium. 3005--3022."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2891891"},{"key":"e_1_3_2_1_6_1","unstructured":"AV-Comparatives. 2023. AV-Comparatives. https:\/\/www.av-comparatives.org\/."},{"key":"e_1_3_2_1_7_1","unstructured":"Brian Barrett. 2020. How 4 Chinese Hackers Allegedly Took Down Equifax. https:\/\/www.wired.com\/story\/equifax-hack-china\/."},{"key":"e_1_3_2_1_8_1","volume-title":"Trustworthy Whole-System Provenance for the Linux Kernel. In 24th USENIX Security Symposium (USENIX Security 15)","author":"Bates Adam","year":"2015","unstructured":"Adam Bates, Dave (Jing) Tian, Kevin R.B. Butler, and Thomas Moyer. 2015. Trustworthy Whole-System Provenance for the Linux Kernel. In 24th USENIX Security Symposium (USENIX Security 15). USENIX Association, Washington, D.C., 319--334. https:\/\/www.usenix.org\/conference\/usenixsecurity15\/technical-sessions\/presentation\/bates"},{"key":"e_1_3_2_1_9_1","volume-title":"Sanger","author":"Broad William J.","year":"2011","unstructured":"William J. Broad, John Markoff, and David E. Sanger. 2011. Israeli Test on Worm Called Crucial in Iran Nuclear Delay. https:\/\/www.nytimes.com\/2011\/01\/16\/world\/middleeast\/16stuxnet.html."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3474718.3474722"},{"key":"e_1_3_2_1_11_1","unstructured":"CNNMoney. 2013. Target: 40 million credit cards compromised. https:\/\/money.cnn.com\/2013\/12\/18\/news\/companies\/target-credit-card\/index.html."},{"key":"e_1_3_2_1_12_1","volume-title":"IT Security - Largest Companies by Market Cap. https:\/\/companiesmarketcap.com\/it-security\/largest-companies-by-market-cap\/. [Online","year":"2023","unstructured":"CompaniesMarketCap. 2021. IT Security - Largest Companies by Market Cap. https:\/\/companiesmarketcap.com\/it-security\/largest-companies-by-market-cap\/. [Online; accessed 6-March-2023]."},{"key":"e_1_3_2_1_13_1","unstructured":"Crowdstrike. 2021. CrowdStrike Achieves 100% Detection Coverage. https:\/\/www.crowdstrike.com\/blog\/crowdstrike-falcon-mitre-attack-evaluation-results-third-iteration\/."},{"key":"e_1_3_2_1_14_1","unstructured":"CrowdStrike. 2023. Kerberoasting - Cybersecurity 101. https:\/\/www.crowdstrike.com\/cybersecurity-101\/kerberoasting\/"},{"key":"e_1_3_2_1_15_1","unstructured":"DARPA. 1998. DARPA Intrusion Detection Evaluation. https:\/\/archive.ll.mit.edu\/ideval\/index.html"},{"key":"e_1_3_2_1_16_1","unstructured":"DARPA. 2023. DARPA Transparent Computing. https:\/\/www.darpa.mil\/program\/transparent-computing"},{"key":"e_1_3_2_1_17_1","volume-title":"Benchmarking datasets for Anomaly-based Network Intrusion Detection: KDD CUP 99 alternatives","author":"Divekar Abhishek","unstructured":"Abhishek Divekar, Meet Parekh, Vaibhav Savla, Rudra Mishra, and Mahesh Shirole. 2018. Benchmarking datasets for Anomaly-based Network Intrusion Detection: KDD CUP 99 alternatives. In IEEE 3rd International Conference on Computing, Communication and Security (ICCCS)."},{"key":"e_1_3_2_1_18_1","volume-title":"2023","author":"Center for Threat-Informed Defense. Accessed","unstructured":"Center for Threat-Informed Defense. Accessed: 2023. Adversary Emulation Library. https:\/\/github.com\/center-for-threat-informed-defense\/adversary_emulation_library."},{"key":"e_1_3_2_1_19_1","unstructured":"Gartner. 2021. Magic Quadrant for Endpoint Protection Platforms. https:\/\/www.gartner.com\/en\/documents\/4001307\/magic-quadrant-for-endpoint-protection-platforms."},{"key":"e_1_3_2_1_20_1","volume-title":"Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services.","author":"Grace Michael","year":"2012","unstructured":"Michael Grace, Yajin Zhou, Qiang Zhang, Shihong Zou, and Xuxian Jiang. 2012. RiskRanker: Scalable and Accurate Zero-Day Android Malware Detection. In Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services."},{"key":"e_1_3_2_1_21_1","volume-title":"Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats. Network and Distributed System Security Symposium","author":"Han Xueyuan","year":"2020","unstructured":"Xueyuan Han, Thomas Pasquier, Adam Bates, James Mickens, and Margo Seltzer. 2020. Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats. Network and Distributed System Security Symposium (2020)."},{"key":"e_1_3_2_1_22_1","volume-title":"Constructing Benchmarks for Supporting Explainable Evaluations of Static Application Security Testing Tools. In International Symposium on Theoretical Aspects of Software Engineering (TASE).","author":"Hao Gaojian","year":"2019","unstructured":"Gaojian Hao, Feng Li, Wei Huo, Qing Sun, Wei Wang, Xinhua Li, and Wei Zou. 2019. Constructing Benchmarks for Supporting Explainable Evaluations of Static Application Security Testing Tools. In International Symposium on Theoretical Aspects of Software Engineering (TASE)."},{"key":"e_1_3_2_1_23_1","volume-title":"NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. In Network and Distributed System Security Symposium.","author":"Hassan Wajih Ul","year":"2019","unstructured":"Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. 2019. NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_24_1","volume-title":"USENIX Security Symposium.","author":"Hossain Md Nahid","unstructured":"Md Nahid Hossain, Sadegh M. Milajerdi, Junao Wang, Birhanu Eshete, Rigel Gjomemo, R. Sekar, Scott Stoller, and V.N. Venkatakrishnan. 2017. SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data. In USENIX Security Symposium."},{"key":"e_1_3_2_1_25_1","volume-title":"Combating Dependence Explosion in Forensic Analysis Using Alternative Tag Propagation Semantics. In IEEE Symposium on Security and Privacy (SP).","author":"Hossain Md Nahid","unstructured":"Md Nahid Hossain, Sanaz Sheikhi, and R. Sekar. 2020. Combating Dependence Explosion in Forensic Analysis Using Alternative Tag Propagation Semantics. In IEEE Symposium on Security and Privacy (SP)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945467"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102282"},{"key":"e_1_3_2_1_28_1","volume-title":"Network and Distributed System Security Symposium.","author":"Ma Shiqing","year":"2016","unstructured":"Shiqing Ma, Xiangyu Zhang, and Dongyan Xu. 2016. ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_29_1","volume-title":"International Conference on Computing, Networking and Communications (ICNC).","author":"Marnerides Angelos K.","unstructured":"Angelos K. Marnerides, Petros Spachos, Periklis Chatzimisios, and Andreas U. Mauthe. 2015. Malware detection in the cloud under Ensemble Empirical Mode Decomposition. In International Conference on Computing, Networking and Communications (ICNC)."},{"key":"e_1_3_2_1_30_1","volume-title":"Security Benchmarks for Web Serving Systems. In IEEE 25th International Symposium on Software Reliability Engineering.","author":"Mendes Naaliel","year":"2014","unstructured":"Naaliel Mendes, Henrique Madeira, and Joao Duraes. 2014. Security Benchmarks for Web Serving Systems. In IEEE 25th International Symposium on Software Reliability Engineering."},{"key":"e_1_3_2_1_31_1","volume-title":"POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting. ACM SIGSAC Conference on Computer and Communications Security","author":"Milajerdi Sadegh M.","year":"2019","unstructured":"Sadegh M. Milajerdi, Birhanu Eshete, Rigel Gjomemo, and Venkat Venkatakrishnan. 2019. POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting. ACM SIGSAC Conference on Computer and Communications Security (2019)."},{"key":"e_1_3_2_1_32_1","volume-title":"IEEE Symposium on Security and Privacy (SP).","author":"Milajerdi Sadegh M.","unstructured":"Sadegh M. Milajerdi, Rigel Gjomemo, Birhanu Eshete, R. Sekar, and V.N. Venkatakrishnan. 2019. HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows. In IEEE Symposium on Security and Privacy (SP)."},{"key":"e_1_3_2_1_33_1","unstructured":"MITRE. 2023. ATT&CK\u00ae EVALUATIONS. https:\/\/attackevals.mitre-engenuity.org\/."},{"key":"e_1_3_2_1_34_1","unstructured":"MITRE. 2023. Matrix - Enterprise | MITRE ATT&CK\u00ae. https:\/\/attack.mitre.org\/matrices\/enterprise\/."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3165624"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/IWSSIP.2009.5367701"},{"key":"e_1_3_2_1_37_1","volume-title":"SoK: Benchmarking Flaws in Systems Security. In IEEE European Symposium on Security and Privacy (EuroS P).","author":"van der Kouwe Erik","year":"2019","unstructured":"Erik van der Kouwe, Gernot Heiser, Dennis Andriesse, Herbert Bos, and Cristiano Giuffrida. 2019. SoK: Benchmarking Flaws in Systems Security. In IEEE European Symposium on Security and Privacy (EuroS P)."},{"key":"e_1_3_2_1_38_1","volume-title":"Network and Distributed System Security Symposium.","author":"Wang Q.","year":"2020","unstructured":"Q. Wang, Wajih Ul Hassan, Ding Li, Kangkook Jee, X. Yu, Kexuan Zou, J. Rhee, Zhengzhang Chen, Wei Cheng, Carl A. Gunter, and Haifeng Chen. 2020. You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2867595"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2960353"},{"key":"e_1_3_2_1_41_1","article-title":"CONAN: A Practical Real-time APT Detection System with High Accuracy and Efficiency","author":"Xiong Chunlin","year":"2020","unstructured":"Chunlin Xiong, Tiantian Zhu, Weihao Dong, Linqi Ruan, Runqing Yang, Yan Chen, Yueqiang Cheng, Shuai Cheng, and Xutong Chen. 2020. CONAN: A Practical Real-time APT Detection System with High Accuracy and Efficiency. IEEE Transactions on Dependable and Secure Computing (Feb. 2020).","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"e_1_3_2_1_42_1","volume-title":"Yinfang Chen, Kaihang Ji, Zhenkai Liang, and Jian Mao.","author":"Zeng Jun","year":"2021","unstructured":"Jun Zeng, Zheng Leong Chua, Yinfang Chen, Kaihang Ji, Zhenkai Liang, and Jian Mao. 2021. WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics.. In NDSS."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3539605"},{"key":"e_1_3_2_1_45_1","volume-title":"Florida Artificial Intelligence Research Society Conference.","author":"Zuech Richard","year":"2015","unstructured":"Richard Zuech, Taghi M. Khoshgoftaar, Naeem Seliya, Maryam Mousaarab Najafabadi, and Clifford Kemp. 2015. A New Intrusion Detection Benchmarking System. In Florida Artificial Intelligence Research Society Conference."}],"event":{"name":"ASIA CCS '24: 19th ACM Asia Conference on Computer and Communications Security","location":"Singapore Singapore","acronym":"ASIA CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 19th ACM Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3634737.3645012","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T23:44:06Z","timestamp":1750290246000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3634737.3645012"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7]]},"references-count":45,"alternative-id":["10.1145\/3634737.3645012","10.1145\/3634737"],"URL":"https:\/\/doi.org\/10.1145\/3634737.3645012","relation":{},"subject":[],"published":{"date-parts":[[2024,7]]},"assertion":[{"value":"2024-07-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}