{"id":"https://openalex.org/W4320024068","doi":"https://doi.org/10.1109/bigdata55660.2022.10020336","title":"Anomaly Detection in Cybersecurity Events Through Graph Neural Network and Transformer Based Model: A Case Study with BETH Dataset","display_name":"Anomaly Detection in Cybersecurity Events Through Graph Neural Network and Transformer Based Model: A Case Study with BETH Dataset","publication_year":2022,"publication_date":"2022-12-17","ids":{"openalex":"https://openalex.org/W4320024068","doi":"https://doi.org/10.1109/bigdata55660.2022.10020336"},"language":"en","primary_location":{"id":"doi:10.1109/bigdata55660.2022.10020336","is_oa":false,"landing_page_url":"https://doi.org/10.1109/bigdata55660.2022.10020336","pdf_url":null,"source":{"id":"https://openalex.org/S4363607709","display_name":"2022 IEEE International Conference on Big Data (Big Data)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE International Conference on Big Data (Big Data)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5056949073","display_name":"Bishal Lakha","orcid":null},"institutions":[{"id":"https://openalex.org/I120156002","display_name":"Boise State University","ror":"https://ror.org/02e3zdp86","country_code":"US","type":"education","lineage":["https://openalex.org/I120156002"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bishal Lakha","raw_affiliation_strings":["Boise State University,Dept. of Computer Science,Boise,Idaho,USA","Dept. of Computer Science, Boise State University, Boise, Idaho, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Boise State University,Dept. of Computer Science,Boise,Idaho,USA","institution_ids":["https://openalex.org/I120156002"]},{"raw_affiliation_string":"Dept. of Computer Science, Boise State University, Boise, Idaho, USA","institution_ids":["https://openalex.org/I120156002"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088674326","display_name":"Sara Lilly Mount","orcid":null},"institutions":[{"id":"https://openalex.org/I120156002","display_name":"Boise State University","ror":"https://ror.org/02e3zdp86","country_code":"US","type":"education","lineage":["https://openalex.org/I120156002"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sara Lilly Mount","raw_affiliation_strings":["Boise State University,Dept. of Computer Science,Boise,Idaho,USA","Dept. of Computer Science, Boise State University, Boise, Idaho, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Boise State University,Dept. of Computer Science,Boise,Idaho,USA","institution_ids":["https://openalex.org/I120156002"]},{"raw_affiliation_string":"Dept. of Computer Science, Boise State University, Boise, Idaho, USA","institution_ids":["https://openalex.org/I120156002"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009094578","display_name":"Edoardo Serra","orcid":"https://orcid.org/0000-0003-0689-5063"},"institutions":[{"id":"https://openalex.org/I120156002","display_name":"Boise State University","ror":"https://ror.org/02e3zdp86","country_code":"US","type":"education","lineage":["https://openalex.org/I120156002"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Edoardo Serra","raw_affiliation_strings":["Boise State University,Dept. of Computer Science,Boise,Idaho,USA","Dept. of Computer Science, Boise State University, Boise, Idaho, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Boise State University,Dept. of Computer Science,Boise,Idaho,USA","institution_ids":["https://openalex.org/I120156002"]},{"raw_affiliation_string":"Dept. of Computer Science, Boise State University, Boise, Idaho, USA","institution_ids":["https://openalex.org/I120156002"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053225136","display_name":"Alfredo Cuzzocrea","orcid":"https://orcid.org/0000-0002-7104-6415"},"institutions":[{"id":"https://openalex.org/I45204951","display_name":"University of Calabria","ror":"https://ror.org/02rc97e94","country_code":"IT","type":"education","lineage":["https://openalex.org/I45204951"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Alfredo Cuzzocrea","raw_affiliation_strings":["University of Calabria,iDEA Lab,Rende,Calabria,Italy","iDEA Lab, University of Calabria, Rende, Calabria, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Calabria,iDEA Lab,Rende,Calabria,Italy","institution_ids":["https://openalex.org/I45204951"]},{"raw_affiliation_string":"iDEA Lab, University of Calabria, Rende, Calabria, Italy","institution_ids":["https://openalex.org/I45204951"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":15,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"5756","last_page":"5764"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7893111109733582},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.693220317363739},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5524234771728516},{"id":"https://openalex.org/keywords/encode","display_name":"ENCODE","score":0.5218707323074341},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.5212157964706421},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.510480523109436},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.48384276032447815},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.48366817831993103},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4296513795852661},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.18340131640434265},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.10741627216339111}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7893111109733582},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.693220317363739},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5524234771728516},{"id":"https://openalex.org/C66746571","wikidata":"https://www.wikidata.org/wiki/Q1134833","display_name":"ENCODE","level":3,"score":0.5218707323074341},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.5212157964706421},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.510480523109436},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.48384276032447815},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.48366817831993103},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4296513795852661},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.18340131640434265},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.10741627216339111},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C165801399","wikidata":"https://www.wikidata.org/wiki/Q25428","display_name":"Voltage","level":2,"score":0.0},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/bigdata55660.2022.10020336","is_oa":false,"landing_page_url":"https://doi.org/10.1109/bigdata55660.2022.10020336","pdf_url":null,"source":{"id":"https://openalex.org/S4363607709","display_name":"2022 IEEE International Conference on Big Data (Big Data)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE International Conference on Big Data (Big Data)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320311089","display_name":"National Security Agency","ror":"https://ror.org/0047bvr32"},{"id":"https://openalex.org/F4320333147","display_name":"Higher Education Research Council","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":73,"referenced_works":["https://openalex.org/W1959608418","https://openalex.org/W1973451694","https://openalex.org/W2000298149","https://openalex.org/W2001082095","https://openalex.org/W2101234009","https://openalex.org/W2109438750","https://openalex.org/W2122646361","https://openalex.org/W2123840312","https://openalex.org/W2132870739","https://openalex.org/W2154851992","https://openalex.org/W2289015916","https://openalex.org/W2296719434","https://openalex.org/W2785362611","https://openalex.org/W2808896182","https://openalex.org/W2896457183","https://openalex.org/W2904474291","https://openalex.org/W2918639172","https://openalex.org/W2944250323","https://openalex.org/W2952335829","https://openalex.org/W2962711740","https://openalex.org/W2964015378","https://openalex.org/W2965373594","https://openalex.org/W2971019578","https://openalex.org/W2979826702","https://openalex.org/W2998038410","https://openalex.org/W3009381467","https://openalex.org/W3011415199","https://openalex.org/W3022010821","https://openalex.org/W3041629534","https://openalex.org/W3080555959","https://openalex.org/W3093074257","https://openalex.org/W3098957257","https://openalex.org/W3104097132","https://openalex.org/W3126355536","https://openalex.org/W3127712067","https://openalex.org/W3132426156","https://openalex.org/W3137717089","https://openalex.org/W3139552648","https://openalex.org/W3160144061","https://openalex.org/W3191490876","https://openalex.org/W3210162706","https://openalex.org/W3211625747","https://openalex.org/W3214665350","https://openalex.org/W4205185172","https://openalex.org/W4206503836","https://openalex.org/W4221150215","https://openalex.org/W4225512856","https://openalex.org/W4226139354","https://openalex.org/W4286858940","https://openalex.org/W4287633338","https://openalex.org/W4288089799","https://openalex.org/W4294558607","https://openalex.org/W4309038730","https://openalex.org/W4385245566","https://openalex.org/W4385605314","https://openalex.org/W6640963894","https://openalex.org/W6726873649","https://openalex.org/W6738964360","https://openalex.org/W6739901393","https://openalex.org/W6754929296","https://openalex.org/W6755207826","https://openalex.org/W6756486467","https://openalex.org/W6766673545","https://openalex.org/W6769627184","https://openalex.org/W6774263817","https://openalex.org/W6780707658","https://openalex.org/W6781932242","https://openalex.org/W6784628404","https://openalex.org/W6792270330","https://openalex.org/W6803412108","https://openalex.org/W6803832874","https://openalex.org/W6809904528","https://openalex.org/W6905010448"],"related_works":["https://openalex.org/W2468279273","https://openalex.org/W2354198838","https://openalex.org/W1989130879","https://openalex.org/W2103419012","https://openalex.org/W2988126442","https://openalex.org/W1974414866","https://openalex.org/W2063982682","https://openalex.org/W2338543196","https://openalex.org/W1544691147","https://openalex.org/W2113565103"],"abstract_inverted_index":{"With":[0],"the":[1,5,35,38,67,71,112,127,170,180],"increasing":[2],"prevalence":[3],"of":[4,37,66,70,91,111],"internet,":[6],"detecting":[7],"malicious":[8],"behavior":[9,36],"is":[10,43,62,107],"becoming":[11],"a":[12,53,83,156],"greater":[13],"need.":[14],"This":[15],"problem":[16],"can":[17,147],"be":[18,124,149],"formulated":[19],"as":[20,32,116,130,155,177],"an":[21,102],"anomaly":[22,159,166],"detection":[23,167],"task":[24],"on":[25,48],"provenance":[26],"data,":[27],"where":[28],"attacks":[29],"are":[30,140],"detectable":[31],"anomalies":[33],"in":[34,73,101,126,132,151],"system.":[39],"While":[40],"network":[41,86],"data":[42],"quite":[44],"prevalent,":[45],"we":[46],"focus":[47],"system":[49],"logs":[50,72],"and":[51,78,122],"propose":[52],"novel":[54],"approach":[55],"with":[56],"two":[57,162],"main":[58],"components.":[59],"The":[60,105],"first":[61],"to":[63,88,108,179],"make":[64,109],"use":[65,110],"graph-like":[68],"structure":[69],"which":[74,94,119],"processes":[75],"enact":[76],"events":[77,100],"generate":[79],"additional":[80],"processes,":[81],"using":[82,143],"graph":[84],"neural":[85],"(GNN)":[87],"produce":[89],"representations":[90],"each":[92],"event":[93],"encode":[95],"information":[96],"about":[97],"their":[98],"neighboring":[99],"unsupervised":[103],"manner.":[104],"second":[106],"complex":[113],"features":[114,131,139,183],"such":[115,154],"command":[117],"arguments":[118],"vary":[120],"widely":[121],"cannot":[123],"used":[125,150],"presented":[128],"format":[129],"typical":[133],"machine":[134],"learning":[135],"algorithms.":[136],"If":[137],"these":[138],"instead":[141],"encoded":[142],"transformer":[144],"models,":[145],"they":[146],"then":[148],"other":[152],"algorithms":[153],"GNN":[157],"or":[158],"detector.":[160],"These":[161],"approaches":[163],"combined":[164],"improve":[165],"results":[168],"for":[169],"BETH":[171],"dataset":[172],"by":[173],"around":[174],"8":[175],"percent":[176],"compared":[178],"manually":[181],"engineered":[182],"alone.":[184]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}