{"id":"https://openalex.org/W4362571069","doi":"https://doi.org/10.14569/ijacsa.2023.0140303","title":"Strategic Monitoring for Efficient Detection of Simultaneous APT Attacks with Limited Resources","display_name":"Strategic Monitoring for Efficient Detection of Simultaneous APT Attacks with Limited Resources","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4362571069","doi":"https://doi.org/10.14569/ijacsa.2023.0140303"},"language":"en","primary_location":{"id":"doi:10.14569/ijacsa.2023.0140303","doi":"https://doi.org/10.14569/ijacsa.2023.0140303","is_oa":true,"landing_page_url":"https://doi.org/10.14569/ijacsa.2023.0140303","pdf_url":"http://thesai.org/Downloads/Volume14No3/Paper_3-Strategic_Monitoring_for_Efficient_Detection_of_Simultaneous_APT_Attacks.pdf","source":{"id":"https://openalex.org/S23629721","display_name":"International Journal of Advanced Computer Science and Applications","issn_l":"2156-5570","issn":["2156-5570","2158-107X"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-20","russia-white-list-3","vabb-shw"],"host_organization":"https://openalex.org/P4310311819","host_organization_name":"Science and Information Organization","host_organization_lineage":["https://openalex.org/P4310311819"],"host_organization_lineage_names":["Science and Information Organization"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Advanced Computer Science and Applications","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"http://thesai.org/Downloads/Volume14No3/Paper_3-Strategic_Monitoring_for_Efficient_Detection_of_Simultaneous_APT_Attacks.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100591717","display_name":"Shen Fan","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I188538660","display_name":"University of Colorado Boulder","ror":"https://ror.org/02ttsq026","country_code":"US","type":"education","lineage":["https://openalex.org/I188538660"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Fan Shen","raw_affiliation_strings":["Department of Computer Science , University of Colorado Boulder Boulder , Colorado 80309","Department of Computer Science, University of Colorado Boulder Boulder, Colorado 80309"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science , University of Colorado Boulder Boulder , Colorado 80309","institution_ids":["https://openalex.org/I188538660"]},{"raw_affiliation_string":"Department of Computer Science, University of Colorado Boulder Boulder, Colorado 80309","institution_ids":["https://openalex.org/I188538660"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100320723","display_name":"Zhiyuan Liu","orcid":"https://orcid.org/0000-0002-7709-2543","observed_orcids":["https://orcid.org/0000-0002-7709-2543","https://orcid.org/0009-0002-0195-7114"]},"institutions":[{"id":"https://openalex.org/I188538660","display_name":"University of Colorado Boulder","ror":"https://ror.org/02ttsq026","country_code":"US","type":"education","lineage":["https://openalex.org/I188538660"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiyuan Liu","raw_affiliation_strings":["Department of Computer Science , University of Colorado Boulder Boulder , Colorado 80309","Department of Computer Science, University of Colorado Boulder Boulder, Colorado 80309"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science , University of Colorado Boulder Boulder , Colorado 80309","institution_ids":["https://openalex.org/I188538660"]},{"raw_affiliation_string":"Department of Computer Science, University of Colorado Boulder Boulder, Colorado 80309","institution_ids":["https://openalex.org/I188538660"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5062705810","display_name":"Levi Perigo","orcid":"https://orcid.org/0000-0001-8434-3278","observed_orcids":["https://orcid.org/0000-0001-8434-3278"]},"institutions":[{"id":"https://openalex.org/I188538660","display_name":"University of Colorado Boulder","ror":"https://ror.org/02ttsq026","country_code":"US","type":"education","lineage":["https://openalex.org/I188538660"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Levi Perigo","raw_affiliation_strings":["Department of Computer Science , University of Colorado Boulder Boulder , Colorado 80309","Department of Computer Science, University of Colorado Boulder Boulder, Colorado 80309"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science , University of Colorado Boulder Boulder , Colorado 80309","institution_ids":["https://openalex.org/I188538660"]},{"raw_affiliation_string":"Department of Computer Science, University of Colorado Boulder Boulder, Colorado 80309","institution_ids":["https://openalex.org/I188538660"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I188538660"],"apc_list":null,"apc_paid":null,"fwci":0.4454,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.60296327,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":96},"biblio":{"volume":"14","issue":"3","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8939999938011169,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8939999938011169,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.024900000542402267,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.021199999377131462,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.9919999837875366},{"id":"https://openalex.org/keywords/apt-detection","display_name":"APT detection","score":0.9070000052452087},{"id":"https://openalex.org/keywords/provenance-graphs","display_name":"provenance graphs","score":0.8460000157356262},{"id":"https://openalex.org/keywords/process-dependencies","display_name":"process dependencies","score":0.7080000042915344},{"id":"https://openalex.org/keywords/multi-armed-bandits","display_name":"multi-armed bandits","score":0.9300000071525574},{"id":"https://openalex.org/keywords/upper-confidence-bound","display_name":"upper confidence bound","score":0.9599999785423279},{"id":"https://openalex.org/keywords/lstm","display_name":"LSTM","score":0.6110000014305115},{"id":"https://openalex.org/keywords/exploration-exploitation-trade-off","display_name":"exploration-exploitation balance","score":0.8650000095367432},{"id":"https://openalex.org/keywords/resource-allocation","display_name":"resource allocation","score":0.38199999928474426}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9049699902534485},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5240640640258789},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4424033463001251},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.44207707047462463},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.11899697780609131},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.14569/ijacsa.2023.0140303","doi":"https://doi.org/10.14569/ijacsa.2023.0140303","is_oa":true,"landing_page_url":"https://doi.org/10.14569/ijacsa.2023.0140303","pdf_url":"http://thesai.org/Downloads/Volume14No3/Paper_3-Strategic_Monitoring_for_Efficient_Detection_of_Simultaneous_APT_Attacks.pdf","source":{"id":"https://openalex.org/S23629721","display_name":"International Journal of Advanced Computer Science and Applications","issn_l":"2156-5570","issn":["2156-5570","2158-107X"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-20","russia-white-list-3","vabb-shw"],"host_organization":"https://openalex.org/P4310311819","host_organization_name":"Science and Information Organization","host_organization_lineage":["https://openalex.org/P4310311819"],"host_organization_lineage_names":["Science and Information Organization"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Advanced Computer Science and Applications","raw_type":"journal-article"},{"id":"pmh:oai:thesai.org:6923ea35-40c2-4111-b794-ffba6e8ef6a7","doi":null,"is_oa":true,"landing_page_url":"https://thesai.org/Publications/ViewPaper?Volume=14&Issue=3&Code=IJACSA&SerialNo=3","pdf_url":"https://thesai.org/Downloads/Volume14No3/Paper_3-Strategic_Monitoring_for_Efficient_Detection_of_Simultaneous_APT_Attacks.pdf","source":{"id":"https://openalex.org/S23629721","display_name":"International Journal of Advanced Computer Science and Applications","issn_l":"2156-5570","issn":["2156-5570","2158-107X"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-20","russia-white-list-3","vabb-shw"],"host_organization":"https://openalex.org/P4310311819","host_organization_name":"Science and Information Organization","host_organization_lineage":["https://openalex.org/P4310311819"],"host_organization_lineage_names":["Science and Information Organization"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"International Journal of Advanced Computer Science and Applications, Vol. 14, No. 3 (2023), ISSN 2158-107X","raw_type":"text"}],"best_oa_location":{"id":"doi:10.14569/ijacsa.2023.0140303","doi":"https://doi.org/10.14569/ijacsa.2023.0140303","is_oa":true,"landing_page_url":"https://doi.org/10.14569/ijacsa.2023.0140303","pdf_url":"http://thesai.org/Downloads/Volume14No3/Paper_3-Strategic_Monitoring_for_Efficient_Detection_of_Simultaneous_APT_Attacks.pdf","source":{"id":"https://openalex.org/S23629721","display_name":"International Journal of Advanced Computer Science and Applications","issn_l":"2156-5570","issn":["2156-5570","2158-107X"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-20","russia-white-list-3","vabb-shw"],"host_organization":"https://openalex.org/P4310311819","host_organization_name":"Science and Information Organization","host_organization_lineage":["https://openalex.org/P4310311819"],"host_organization_lineage_names":["Science and Information Organization"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Advanced Computer Science and Applications","raw_type":"journal-article"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[{"display_name":"Peace, justice, and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.4699999988079071}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4362571069.pdf","grobid_xml":"https://content.openalex.org/works/W4362571069.grobid-xml"},"referenced_works_count":18,"referenced_works":["https://openalex.org/W1674877186","https://openalex.org/W2004360894","https://openalex.org/W2015787697","https://openalex.org/W2168405694","https://openalex.org/W2180696299","https://openalex.org/W2260320574","https://openalex.org/W2408793237","https://openalex.org/W2486441280","https://openalex.org/W2501259350","https://openalex.org/W2545820541","https://openalex.org/W2560932476","https://openalex.org/W2818789173","https://openalex.org/W2910711617","https://openalex.org/W2946511964","https://openalex.org/W2962703433","https://openalex.org/W2998244928","https://openalex.org/W3176546664","https://openalex.org/W4290666376"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W2358668433","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W2382290278","https://openalex.org/W2478288626","https://openalex.org/W2350741829","https://openalex.org/W2530322880","https://openalex.org/W1596801655"],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APT)":[3],"are":[4,76,194,302],"a":[5,58,74,224,230],"type":[6],"of":[7,43,57,73,91,135,156,173,191,206,223,242,249,263,323],"sophisticated":[8],"multistage":[9,136],"cyber":[10,85,213],"attack,":[11],"and":[12,69,141,185,216,290,311],"the":[13,40,54,60,71,89,104,114,118,133,147,162,176,182,186,199,204,207,220,236,240,247,261,264,272,278,282,286,294,308,312,316],"defense":[14],"against":[15],"APT":[16,45,110,139,168,250,300,324],"is":[17,151,227,244,268],"challenging.":[18],"Existing":[19],"studies":[20,161],"apply":[21],"signature-based":[22],"or":[23],"behavior-based":[24],"methods":[25],"to":[26,30,39,52,126,165,211,218,270,319],"analyze":[27],"monitoring":[28,124,163,254,296],"data":[29],"detect":[31,167,320],"APT,":[32,88],"but":[33,117],"little":[34],"research":[35,98],"has":[36],"been":[37],"dedicated":[38],"important":[41],"problem":[42,210],"addressing":[44],"detection":[46,248],"with":[47,252],"limited":[48,92,253],"resources.":[49,255],"In":[50],"order":[51],"maintain":[53],"primary":[55],"functionality":[56],"system,":[59,75,116],"resources":[61,94,125],"allocated":[62],"for":[63,66],"security":[64,93,214],"purposes,":[65],"example":[67],"logging":[68],"examining":[70],"behavior":[72],"usually":[77],"constrained.":[78],"Therefore,":[79],"when":[80],"facing":[81],"multiple":[82,108,298],"simultaneous":[83,109,299],"powerful":[84],"attacks":[86,111,140,169,251,301],"like":[87],"allocation":[90],"becomes":[95],"critical.":[96],"The":[97,189,256],"in":[99,113,203,246,285],"this":[100,144,159,192],"paper":[101],"focuses":[102],"on":[103,154,175],"threat":[105],"model":[106],"where":[107],"exist":[112],"defender\u2019s":[115],"defender":[119],"does":[120],"not":[121],"have":[122],"sufficient":[123],"check":[127],"every":[128],"running":[129],"process.":[130],"To":[131],"capture":[132],"footprint":[134],"activities":[137],"including":[138],"benign":[142],"activities,":[143],"work":[145,160,193],"leverages":[146],"provenance":[148,177],"graph":[149],"which":[150,226],"constructed":[152],"based":[153],"dependencies":[155],"processes.":[157],"Furthermore,":[158],"strategy":[164,310],"efficiently":[166,305],"from":[170],"incomplete":[171],"information":[172],"paths":[174],"graph,":[178],"by":[179,229,292],"considering":[180],"both":[181],"\u201cexploitation\u201d":[183],"effect":[184,274],"\u201cexploration\u201d":[187,243],"effect.":[188],"contributions":[190],"two-fold.":[195],"First,":[196],"it":[197,276],"extends":[198],"classic":[200,287],"UCB":[201,288],"algorithm":[202,289],"domain":[205],"multi-armed":[208],"bandit":[209],"solve":[212],"problems,":[215],"proposes":[217],"use":[219,262],"malevolence":[221],"value":[222],"path,":[225],"generated":[228],"novel":[231],"LSTM":[232,265],"neural":[233,266],"network":[234,267],"as":[235,275,281],"exploitation":[237,273,283],"term.":[238],"Second,":[239],"consideration":[241],"innovative":[245],"experimental":[257],"results":[258],"show":[259],"that":[260,291],"beneficial":[269],"enforce":[271],"satisfies":[277],"same":[279,321],"property":[280],"term":[284],"using":[293,307],"proposed":[295],"strategy,":[297,314],"detected":[303],"more":[304],"than":[306],"random":[309],"greedy":[313],"regarding":[315],"time":[317],"needed":[318],"number":[322],"attacks.":[325]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2025-10-10T00:00:00"}