{"id":"https://openalex.org/W7170178805","doi":"https://doi.org/10.1007/978-3-032-32519-8_25","title":"The Simulator\u2019s Blueprint: Automata Learning from Cybersecurity Logs","display_name":"The Simulator\u2019s Blueprint: Automata Learning from Cybersecurity Logs","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7170178805","doi":"https://doi.org/10.1007/978-3-032-32519-8_25"},"language":"en","primary_location":{"id":"doi:10.1007/978-3-032-32519-8_25","is_oa":true,"landing_page_url":"https://doi.org/10.1007/978-3-032-32519-8_25","pdf_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-32519-8_25.pdf","source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-32519-8_25.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134778828","display_name":"Tudor Braicu","orcid":null},"institutions":[{"id":"https://openalex.org/I205783295","display_name":"Cornell University","ror":"https://ror.org/05bnh6r87","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Tudor Braicu","raw_affiliation_strings":["Cornell University, Ithaca, USA"],"raw_orcid":"https://orcid.org/0009-0001-0119-2353","affiliations":[{"raw_affiliation_string":"Cornell University, Ithaca, USA","institution_ids":["https://openalex.org/I205783295"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054470518","display_name":"Benjamin Ylvisaker","orcid":null},"institutions":[{"id":"https://openalex.org/I205783295","display_name":"Cornell University","ror":"https://ror.org/05bnh6r87","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Benjamin Ylvisaker","raw_affiliation_strings":["Cornell University, Ithaca, USA"],"raw_orcid":"https://orcid.org/0000-0002-8608-7404","affiliations":[{"raw_affiliation_string":"Cornell University, Ithaca, USA","institution_ids":["https://openalex.org/I205783295"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004651445","display_name":"Nicolas Espinosa Dice","orcid":null},"institutions":[{"id":"https://openalex.org/I205783295","display_name":"Cornell University","ror":"https://ror.org/05bnh6r87","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nicolas Espinosa Dice","raw_affiliation_strings":["Cornell University, Ithaca, USA"],"raw_orcid":"https://orcid.org/0000-0001-7802-6196","affiliations":[{"raw_affiliation_string":"Cornell University, Ithaca, USA","institution_ids":["https://openalex.org/I205783295"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101508336","display_name":"Yuehua Chen","orcid":"https://orcid.org/0000-0002-4646-4017"},"institutions":[{"id":"https://openalex.org/I205783295","display_name":"Cornell University","ror":"https://ror.org/05bnh6r87","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yiding Chen","raw_affiliation_strings":["Cornell University, Ithaca, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cornell University, Ithaca, USA","institution_ids":["https://openalex.org/I205783295"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100671808","display_name":"Yiyi Zhang","orcid":"https://orcid.org/0000-0001-9180-8512"},"institutions":[{"id":"https://openalex.org/I205783295","display_name":"Cornell University","ror":"https://ror.org/05bnh6r87","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yiyi Zhang","raw_affiliation_strings":["Cornell University, Ithaca, USA"],"raw_orcid":"https://orcid.org/0000-0001-9180-8512","affiliations":[{"raw_affiliation_string":"Cornell University, Ithaca, USA","institution_ids":["https://openalex.org/I205783295"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013378091","display_name":"Nate Foster","orcid":"https://orcid.org/0000-0002-6557-684X"},"institutions":[{"id":"https://openalex.org/I26128692","display_name":"The Jane Goodall Institute","ror":"https://ror.org/029d3gv02","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I26128692"]},{"id":"https://openalex.org/I4401726835","display_name":"Jane Street (United States)","ror":"https://ror.org/05p5v2j38","country_code":null,"type":"company","lineage":["https://openalex.org/I4401726835"]},{"id":"https://openalex.org/I5124864","display_name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne","ror":"https://ror.org/02s376052","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I5124864"]}],"countries":["CH","US"],"is_corresponding":false,"raw_author_name":"Nate Foster","raw_affiliation_strings":["EPFL, Lausanne, Switzerland","Jane Street, New York City, USA"],"raw_orcid":"https://orcid.org/0000-0002-6557-684X","affiliations":[{"raw_affiliation_string":"EPFL, Lausanne, Switzerland","institution_ids":["https://openalex.org/I5124864"]},{"raw_affiliation_string":"Jane Street, New York City, USA","institution_ids":["https://openalex.org/I26128692","https://openalex.org/I4401726835"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5014085893","display_name":"Hossein Hojjat","orcid":"https://orcid.org/0000-0002-4743-8750"},"institutions":[{"id":"https://openalex.org/I4210127068","display_name":"Pasargad Institute for Advanced Innovative Solutions","ror":"https://ror.org/033mn5m13","country_code":"IR","type":"education","lineage":["https://openalex.org/I4210127068"]}],"countries":["IR"],"is_corresponding":false,"raw_author_name":"Hossein Hojjat","raw_affiliation_strings":["Tehran Institute for Advanced Studies, Tehran, Iran"],"raw_orcid":"https://orcid.org/0000-0002-4743-8750","affiliations":[{"raw_affiliation_string":"Tehran Institute for Advanced Studies, Tehran, Iran","institution_ids":["https://openalex.org/I4210127068"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5134778828"],"corresponding_institution_ids":["https://openalex.org/I205783295"],"apc_list":{"value":5000,"currency":"EUR","value_usd":5392},"apc_paid":{"value":5000,"currency":"EUR","value_usd":5392},"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"497","last_page":"510"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":null,"topics":[],"keywords":[{"id":"https://openalex.org/keywords/automaton","display_name":"Automaton","score":0.7879999876022339},{"id":"https://openalex.org/keywords/learning-automata","display_name":"Learning automata","score":0.7580999732017517},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.6897000074386597},{"id":"https://openalex.org/keywords/finite-state-machine","display_name":"Finite-state machine","score":0.5351999998092651},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5169000029563904},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.5084999799728394},{"id":"https://openalex.org/keywords/fidelity","display_name":"Fidelity","score":0.45660001039505005},{"id":"https://openalex.org/keywords/automata-theory","display_name":"Automata theory","score":0.4235999882221222},{"id":"https://openalex.org/keywords/model-checking","display_name":"Model checking","score":0.36500000953674316}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8949000239372253},{"id":"https://openalex.org/C112505250","wikidata":"https://www.wikidata.org/wiki/Q787116","display_name":"Automaton","level":2,"score":0.7879999876022339},{"id":"https://openalex.org/C2776807809","wikidata":"https://www.wikidata.org/wiki/Q6510160","display_name":"Learning automata","level":3,"score":0.7580999732017517},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.6897000074386597},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.5698999762535095},{"id":"https://openalex.org/C167822520","wikidata":"https://www.wikidata.org/wiki/Q176452","display_name":"Finite-state machine","level":2,"score":0.5351999998092651},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5169000029563904},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.5084999799728394},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4738999903202057},{"id":"https://openalex.org/C2776459999","wikidata":"https://www.wikidata.org/wiki/Q2119376","display_name":"Fidelity","level":2,"score":0.45660001039505005},{"id":"https://openalex.org/C116248031","wikidata":"https://www.wikidata.org/wiki/Q214526","display_name":"Automata theory","level":3,"score":0.4235999882221222},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.36800000071525574},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.36500000953674316},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3531000018119812},{"id":"https://openalex.org/C75606506","wikidata":"https://www.wikidata.org/wiki/Q1049183","display_name":"Formal methods","level":2,"score":0.33739998936653137},{"id":"https://openalex.org/C146499914","wikidata":"https://www.wikidata.org/wiki/Q5469969","display_name":"Formal semantics (linguistics)","level":2,"score":0.3287000060081482},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.3244999945163727},{"id":"https://openalex.org/C156325763","wikidata":"https://www.wikidata.org/wiki/Q1930895","display_name":"Operational semantics","level":3,"score":0.3197000026702881},{"id":"https://openalex.org/C146072743","wikidata":"https://www.wikidata.org/wiki/Q192161","display_name":"Formal language","level":2,"score":0.3057999908924103},{"id":"https://openalex.org/C104091681","wikidata":"https://www.wikidata.org/wiki/Q837528","display_name":"Deterministic finite automaton","level":3,"score":0.29809999465942383},{"id":"https://openalex.org/C111498074","wikidata":"https://www.wikidata.org/wiki/Q173326","display_name":"Formal verification","level":2,"score":0.2937000095844269},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.28450000286102295},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.2842999994754791},{"id":"https://openalex.org/C116253237","wikidata":"https://www.wikidata.org/wiki/Q1437424","display_name":"Formal specification","level":2,"score":0.2818000018596649},{"id":"https://openalex.org/C50348692","wikidata":"https://www.wikidata.org/wiki/Q6887056","display_name":"Mobile automaton","level":4,"score":0.2696000039577484},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.26669999957084656}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/978-3-032-32519-8_25","is_oa":true,"landing_page_url":"https://doi.org/10.1007/978-3-032-32519-8_25","pdf_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-32519-8_25.pdf","source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"}],"best_oa_location":{"id":"doi:10.1007/978-3-032-32519-8_25","is_oa":true,"landing_page_url":"https://doi.org/10.1007/978-3-032-32519-8_25","pdf_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-32519-8_25.pdf","source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7170178805.pdf","grobid_xml":"https://content.openalex.org/works/W7170178805.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W140384553","https://openalex.org/W1486103693","https://openalex.org/W1559171143","https://openalex.org/W1989445634","https://openalex.org/W2583228413","https://openalex.org/W2754517384","https://openalex.org/W2766807698","https://openalex.org/W2954019045","https://openalex.org/W2972500268","https://openalex.org/W3022566517","https://openalex.org/W3190977274","https://openalex.org/W4220762789","https://openalex.org/W4241372395","https://openalex.org/W4287022721","https://openalex.org/W4297094130","https://openalex.org/W4384471267","https://openalex.org/W4386794596","https://openalex.org/W4407244886","https://openalex.org/W4411269315","https://openalex.org/W4412544401","https://openalex.org/W4412544495"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"We":[1,44,70],"show":[2,93],"how":[3],"to":[4,9,35,86,118],"use":[5],"passive":[6],"automata":[7,40,78],"learning":[8],"infer":[10,36],"models":[11,97],"of":[12,75,89,106],"attacker-defender":[13],"interactions":[14],"in":[15,24],"cybersecurity.":[16,119],"By":[17],"treating":[18],"system":[19],"event":[20],"logs":[21],"as":[22,33],"words":[23],"a":[25,49,59,102,109],"formal":[26,96],"language,":[27],"we":[28],"can":[29,98],"apply":[30],"algorithms":[31],"such":[32],"RPNI":[34],"compact":[37],"deterministic":[38],"finite":[39],"from":[41,101],"observed":[42],"traces.":[43],"evaluate":[45],"this":[46],"approach":[47],"through":[48],"case":[50],"study":[51],"on":[52],"the":[53,72,76,87],"Cyber":[54],"Operations":[55],"Research":[56],"Gymnasium":[57],"(CybORG),":[58],"widely-used":[60],"simulation":[61],"framework":[62],"for":[63],"training":[64],"defensive":[65],"agents":[66],"using":[67],"machine":[68],"learning.":[69],"analyze":[71],"structural":[73],"properties":[74],"inferred":[77],"and":[79,115],"assess":[80],"their":[81],"empirical":[82],"fidelity":[83],"with":[84],"respect":[85],"semantics":[88],"CybORG.":[90],"Our":[91],"results":[92],"that":[94],"accurate":[95],"be":[99],"learned":[100],"relatively":[103],"small":[104],"number":[105],"traces,":[107],"suggesting":[108],"promising":[110],"path":[111],"toward":[112],"more":[113],"automated":[114],"data-driven":[116],"approaches":[117]},"counts_by_year":[],"updated_date":"2026-07-25T05:54:39.514286","created_date":"2026-07-24T00:00:00"}