{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T05:50:29Z","timestamp":1791352229492,"version":"4.3.1"},"publisher-location":"New York, NY, USA","reference-count":77,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,7,30]],"date-time":"2024-07-30T00:00:00Z","timestamp":1722297600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Scie","award":["212720"],"award-info":[{"award-number":["212720"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,7,30]]},"DOI":"10.1145\/3664476.3664494","type":"proceedings-article","created":{"date-parts":[[2024,7,25]],"date-time":"2024-07-25T12:35:50Z","timestamp":1721910950000},"page":"1-14","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":10,"title":["Prov2vec: Learning Provenance Graph Representation for Anomaly Detection in Computer Systems"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9959-7622","authenticated-orcid":false,"given":"Bibek","family":"Bhattarai","sequence":"first","affiliation":[{"name":"George Washington University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8588-7680","authenticated-orcid":false,"given":"H. Howie","family":"Huang","sequence":"additional","affiliation":[{"name":"George Washington University, Washington DC, USA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,7,30]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research. CoRR abs\/2103.03080","author":"Anjum Monowar","year":"2021","unstructured":"Md.\u00a0Monowar Anjum, Shahrear Iqbal, and Benoit Hamelin. 2021. Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research. CoRR abs\/2103.03080 (2021). arXiv:2103.03080https:\/\/arxiv.org\/abs\/2103.03080"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3477314.3507097"},{"key":"e_1_3_2_1_3_1","volume-title":"24th { USENIX} Security Symposium ({ USENIX} Security 15). 319\u2013334.","author":"Bates Adam","unstructured":"Adam Bates, Dave\u00a0Jing Tian, Kevin\u00a0RB Butler, and Thomas Moyer. 2015. Trustworthy whole-system provenance for the linux kernel. In 24th { USENIX} Security Symposium ({ USENIX} Security 15). 319\u2013334."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5724"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3523261"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2005.132"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2018.00105"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363226"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"e_1_3_2_1_10_1","volume-title":"SedanSpot: Detecting Anomalies in Edge Streams. 2018 IEEE International Conference on Data Mining (ICDM)","author":"Eswaran Dhivya","year":"2018","unstructured":"Dhivya Eswaran and Christos Faloutsos. 2018. SedanSpot: Detecting Anomalies in Edge Streams. 2018 IEEE International Conference on Data Mining (ICDM) (2018)."},{"key":"e_1_3_2_1_11_1","unstructured":"FreeBSD. 2018. DTrace on FreeBSD. https:\/\/wiki.freebsd.org\/DTrace."},{"key":"e_1_3_2_1_12_1","volume-title":"27th { USENIX} Security Symposium ({ USENIX} Security 18).","author":"Gao Peng","unstructured":"Peng Gao, Xusheng Xiao, Ding Li, Zhichun Li, Kangkook Jee, Zhenyu Wu, Chung\u00a0Hwan Kim, Sanjeev\u00a0R Kulkarni, and Prateek Mittal. 2018. { SAQL} : A Stream-based Query System for Real-Time Abnormal System Behavior Detection. In 27th { USENIX} Security Symposium ({ USENIX} Security 18)."},{"key":"e_1_3_2_1_13_1","unstructured":"Peng Gao Xusheng Xiao Zhichun Li Fengyuan Xu Sanjeev\u00a0R Kulkarni and Prateek Mittal. 2018. { AIQL} : Enabling Efficient Attack Investigation from System Monitoring Data. In 2018 { USENIX} Annual Technical Conference ({ USENIX}{ ATC} 18)."},{"key":"e_1_3_2_1_14_1","unstructured":"Github. 2022. Powershell Empire. https:\/\/github.com\/EmpireProject\/Empire."},{"key":"e_1_3_2_1_15_1","unstructured":"Steve Grubb. 2022. auditd - The Linux Audit daemon. https:\/\/linux.die.net\/man\/8\/auditd."},{"key":"e_1_3_2_1_16_1","volume-title":"Representation learning on graphs: Methods and applications. arXiv preprint arXiv:1709.05584","author":"Hamilton L","year":"2017","unstructured":"William\u00a0L Hamilton, Rex Ying, and Jure Leskovec. 2017. Representation learning on graphs: Methods and applications. arXiv preprint arXiv:1709.05584 (2017)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2983323.2983358"},{"key":"e_1_3_2_1_18_1","volume-title":"Unicorn: Runtime provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525","author":"Han Xueyuan","year":"2020","unstructured":"Xueyuan Han, Thomas Pasquier, Adam Bates, James Mickens, and Margo Seltzer. 2020. Unicorn: Runtime provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525 (2020)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23141"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24270"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014072"},{"key":"e_1_3_2_1_24_1","volume-title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data. In 26th { USENIX} Security Symposium ({ USENIX} Security 17).","author":"Hossain Md\u00a0Nahid","year":"2017","unstructured":"Md\u00a0Nahid Hossain, Sadegh\u00a0M Milajerdi, Junao Wang, Birhanu Eshete, Rigel Gjomemo, R Sekar, Scott Stoller, and VN Venkatakrishnan. 2017. SLEUTH: Real-time attack scenario reconstruction from COTS audit data. In 26th { USENIX} Security Symposium ({ USENIX} Security 17)."},{"key":"e_1_3_2_1_25_1","volume-title":"Dependence-Preserving Data Compaction for Scalable Forensic Analysis. In 27th USENIX Security Symposium (USENIX Security 18)","author":"Hossain Md\u00a0Nahid","year":"2018","unstructured":"Md\u00a0Nahid Hossain, Junao Wang, R. Sekar, and Scott\u00a0D. Stoller. 2018. Dependence-Preserving Data Compaction for Scalable Forensic Analysis. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association."},{"key":"e_1_3_2_1_26_1","volume-title":"NestedGNN: Detecting Malicious Network Activity with Nested Graph Neural Networks. In ICC 2022 - IEEE International Conference on Communications. 2694\u20132699","author":"Ji Yuede","unstructured":"Yuede Ji and H. Howie\u00a0Huang. 2022. NestedGNN: Detecting Malicious Network Activity with Nested Graph Neural Networks. In ICC 2022 - IEEE International Conference on Communications. 2694\u20132699."},{"key":"e_1_3_2_1_27_1","volume-title":"DCtheGeek, mcleanbyron, drewbatgit, and msatranjr.","year":"2021","unstructured":"Karl-Bridge-MIcrosoft, v kents, DCtheGeek, mcleanbyron, drewbatgit, and msatranjr. 2021. Event Tracing. https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/etw\/event-tracing-portal."},{"key":"e_1_3_2_1_28_1","volume-title":"Proceedings of the 20th international conference on machine learning (ICML-03)","author":"Kashima Hisashi","year":"2003","unstructured":"Hisashi Kashima, Koji Tsuda, and Akihiro Inokuchi. 2003. Marginalized kernels between labeled graphs. In Proceedings of the 20th international conference on machine learning (ICML-03). 321\u2013328."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24107"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607201"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945467"},{"key":"e_1_3_2_1_32_1","volume-title":"Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907","author":"Kipf N","year":"2016","unstructured":"Thomas\u00a0N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)."},{"key":"e_1_3_2_1_33_1","unstructured":"Kyu\u00a0Hyung Lee Xiangyu Zhang and Dongyan Xu. 2013. LogGC: garbage collecting audit log. In SIGSAC."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2783258.2783406"},{"key":"e_1_3_2_1_35_1","volume-title":"Gated graph sequence neural networks. arXiv preprint arXiv:1511.05493","author":"Li Yujia","year":"2015","unstructured":"Yujia Li, Daniel Tarlow, Marc Brockschmidt, and Richard Zemel. 2015. Gated graph sequence neural networks. arXiv preprint arXiv:1511.05493 (2015)."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363224"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"e_1_3_2_1_38_1","volume-title":"Protracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting.. In NDSS.","author":"Ma Shiqing","year":"2016","unstructured":"Shiqing Ma, Xiangyu Zhang, and Dongyan Xu. 2016. Protracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting.. In NDSS."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"e_1_3_2_1_40_1","unstructured":"Lochheed Martin. 2022. The Cyber Kill Chain. https:\/\/www.lockheedmartin.com\/en-us\/capabilities\/cyber\/cyber-kill-chain.html."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196321.3196340"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"e_1_3_2_1_44_1","unstructured":"Neo4J. 2022. Neo4j Graph Database. https:\/\/neo4j.com\/product\/neo4j-graph-database\/."},{"key":"e_1_3_2_1_45_1","unstructured":"Thor Olavsrud. 2014. 11 Steps Attackers Took to Crack Target. https:\/\/www.csoonline.com\/article\/2601021\/11-steps-attackers-took-to-crack-target.html."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243776"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"e_1_3_2_1_49_1","unstructured":"Nicole Perlroth. 2017. All 3 Billion Yahoo Accounts Were Affected by 2013 Attack. https:\/\/www.nytimes.com\/2017\/10\/03\/technology\/yahoo-hack-3-billion-users.html."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420989"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1093\/bioinformatics\/btl301"},{"key":"e_1_3_2_1_52_1","volume-title":"Proceedings of the first international workshop on mining graphs, trees and sequences. 65\u201374","author":"Ramon Jan","year":"2003","unstructured":"Jan Ramon and Thomas G\u00e4rtner. 2003. Expressivity versus efficiency of graph kernels. In Proceedings of the first international workshop on mining graphs, trees and sequences. 65\u201374."},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611974348.22"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/2517349.2522740"},{"key":"e_1_3_2_1_55_1","unstructured":"scikit-learn developers. 2022. One Class SVM. https:\/\/scikit-learn.org\/stable\/modules\/generated\/sklearn.svm.OneClassSVM.html."},{"key":"e_1_3_2_1_56_1","unstructured":"Security-X. 2018. [FireEye]Operation DeputyDog: Zero-Day (CVE-2013-3893) Attack Against Japanese. https:\/\/forum.security-x.fr\/news\/(fireeye)operation-deputydog-zero-day-(cve-2013-3893)-attack-against-j-27872\/."},{"key":"e_1_3_2_1_57_1","unstructured":"SentinalOne. 2022. What Is A Malware File Signature (And How Does It Work)?https:\/\/www.sentinelone.com\/blog\/what-is-a-malware-file-signature-and-how-does-it-work\/."},{"key":"e_1_3_2_1_58_1","volume-title":"Weisfeiler-lehman graph kernels.Journal of Machine Learning Research 12, 9","author":"Shervashidze Nino","year":"2011","unstructured":"Nino Shervashidze, Pascal Schweitzer, Erik\u00a0Jan Van\u00a0Leeuwen, Kurt Mehlhorn, and Karsten\u00a0M Borgwardt. 2011. Weisfeiler-lehman graph kernels.Journal of Machine Learning Research 12, 9 (2011)."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243829"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/3336191.3371851"},{"key":"e_1_3_2_1_62_1","unstructured":"SecureWorld\u00a0News Team. 2020. Data Breach a \u2019Huge Cyber Espionage Campaign Targeting the U.S. Government\u2019. https:\/\/www.secureworldexpo.com\/industry-news\/data-breach-cyber-espionage-campaign-targeting-u.s.-government."},{"key":"e_1_3_2_1_63_1","unstructured":"The Mitre Corporation. 2022. ATT&CK Matrix for Enterprise. https:\/\/attack.mitre.org\/."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/CNSM.2015.7367331"},{"key":"e_1_3_2_1_65_1","volume-title":"Graph attention networks. arXiv preprint arXiv:1710.10903","author":"Veli\u010dkovi\u0107 Petar","year":"2017","unstructured":"Petar Veli\u010dkovi\u0107, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2017. Graph attention networks. arXiv preprint arXiv:1710.10903 (2017)."},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.5555\/1756006.1859891"},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","unstructured":"Dr.\u00a0Carl Weir Rody Arantes Henry Hannon and Marisha Kulseng. 2021. Operationally Transparent Cyber (OpTC). https:\/\/dx.doi.org\/10.21227\/edq8-nk52. https:\/\/doi.org\/10.21227\/edq8-nk52","DOI":"10.21227\/edq8-nk52"},{"key":"e_1_3_2_1_68_1","unstructured":"Wikipedia. 2022. k-medoids. https:\/\/en.wikipedia.org\/wiki\/K-medoids."},{"key":"e_1_3_2_1_69_1","unstructured":"xgboost developers. 2022. XGBoost Classifier. https:\/\/xgboost.readthedocs.io\/en\/stable\/python\/python_api.html."},{"key":"e_1_3_2_1_70_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Xi Zhaohan","year":"2021","unstructured":"Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. 2021. Graph backdoor. In 30th USENIX Security Symposium (USENIX Security 21). 1523\u20131540."},{"key":"e_1_3_2_1_71_1","volume-title":"How powerful are graph neural networks?arXiv preprint arXiv:1810.00826","author":"Xu Keyulu","year":"2018","unstructured":"Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks?arXiv preprint arXiv:1810.00826 (2018)."},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978378"},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2017.64"},{"key":"e_1_3_2_1_74_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Yang Fan","year":"2023","unstructured":"Fan Yang, Jiacen Xu, Chunlin Xiong, Zhou Li, and Kehuan Zhang. 2023. { PROGRAPHER} : An Anomaly Detection System based on Provenance Graph Embedding. In 32nd USENIX Security Symposium (USENIX Security 23). 4355\u20134372."},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"e_1_3_2_1_76_1","volume-title":"Retgk: Graph kernels based on return probabilities of random walks. Advances in Neural Information Processing Systems 31","author":"Zhang Zhen","year":"2018","unstructured":"Zhen Zhang, Mianzhi Wang, Yijian Xiang, Yan Huang, and Arye Nehorai. 2018. Retgk: Graph kernels based on return probabilities of random walks. Advances in Neural Information Processing Systems 31 (2018)."},{"key":"e_1_3_2_1_77_1","doi-asserted-by":"publisher","unstructured":"Michael Zipperle Florian Gottwalt Elizabeth Chang and Tharam Dillon. 2022. Provenance-Based Intrusion Detection Systems: A Survey. ACM Comput. Surv. (2022). https:\/\/doi.org\/10.1145\/3539605","DOI":"10.1145\/3539605"}],"event":{"name":"ARES 2024: The 19th International Conference on Availability, Reliability and Security","location":"Vienna Austria","acronym":"ARES 2024"},"container-title":["Proceedings of the 19th International Conference on Availability, Reliability and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664476.3664494","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3664476.3664494","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T16:52:38Z","timestamp":1755881558000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664476.3664494"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,30]]},"references-count":77,"alternative-id":["10.1145\/3664476.3664494","10.1145\/3664476"],"URL":"https:\/\/doi.org\/10.1145\/3664476.3664494","relation":{},"subject":[],"published":{"date-parts":[[2024,7,30]]},"assertion":[{"value":"2024-07-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}