{"id":"https://openalex.org/W4312890671","doi":"https://doi.org/10.1109/dasc/picom/cbdcom/cy55231.2022.9927863","title":"A Conceptual Framework for Automated Rule Generation in Provenance-based Intrusion Detection Systems","display_name":"A Conceptual Framework for Automated Rule Generation in Provenance-based Intrusion Detection Systems","publication_year":2022,"publication_date":"2022-09-12","ids":{"openalex":"https://openalex.org/W4312890671","doi":"https://doi.org/10.1109/dasc/picom/cbdcom/cy55231.2022.9927863"},"language":"en","primary_location":{"id":"doi:10.1109/dasc/picom/cbdcom/cy55231.2022.9927863","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dasc/picom/cbdcom/cy55231.2022.9927863","pdf_url":null,"source":{"id":"https://openalex.org/S4363605495","display_name":"2022 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"http://hdl.handle.net/10072/422399","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068745152","display_name":"Michael Zipperle","orcid":"https://orcid.org/0000-0003-3957-9331"},"institutions":[{"id":"https://openalex.org/I188329596","display_name":"University of Canberra","ror":"https://ror.org/04s1nv328","country_code":"AU","type":"education","lineage":["https://openalex.org/I188329596"]},{"id":"https://openalex.org/I4394709116","display_name":"UNSW Canberra","ror":"https://ror.org/0125wpx05","country_code":null,"type":"education","lineage":["https://openalex.org/I31746571","https://openalex.org/I4394709116"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Michael Zipperle","raw_affiliation_strings":["UNSW Canberra,School of Business,Cyber Security Cooperative Research Centre,Canberra,Australia","Cyber Security Cooperative Research Centre, School of Business, UNSW Canberra, Canberra, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UNSW Canberra,School of Business,Cyber Security Cooperative Research Centre,Canberra,Australia","institution_ids":["https://openalex.org/I188329596"]},{"raw_affiliation_string":"Cyber Security Cooperative Research Centre, School of Business, UNSW Canberra, Canberra, Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I4394709116"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001882744","display_name":"Florian Gottwalt","orcid":"https://orcid.org/0000-0002-7173-4226"},"institutions":[{"id":"https://openalex.org/I188329596","display_name":"University of Canberra","ror":"https://ror.org/04s1nv328","country_code":"AU","type":"education","lineage":["https://openalex.org/I188329596"]},{"id":"https://openalex.org/I4394709116","display_name":"UNSW Canberra","ror":"https://ror.org/0125wpx05","country_code":null,"type":"education","lineage":["https://openalex.org/I31746571","https://openalex.org/I4394709116"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Florian Gottwalt","raw_affiliation_strings":["UNSW Canberra,School of Business,Canberra,Australia","School of Business, UNSW Canberra, Canberra, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UNSW Canberra,School of Business,Canberra,Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I4394709116"]},{"raw_affiliation_string":"School of Business, UNSW Canberra, Canberra, Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I4394709116"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100433414","display_name":"Yu Zhang","orcid":"https://orcid.org/0000-0001-7889-2676"},"institutions":[{"id":"https://openalex.org/I188329596","display_name":"University of Canberra","ror":"https://ror.org/04s1nv328","country_code":"AU","type":"education","lineage":["https://openalex.org/I188329596"]},{"id":"https://openalex.org/I4394709116","display_name":"UNSW Canberra","ror":"https://ror.org/0125wpx05","country_code":null,"type":"education","lineage":["https://openalex.org/I31746571","https://openalex.org/I4394709116"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yu Zhang","raw_affiliation_strings":["UNSW Canberra,School of Business,Canberra,Australia","School of Business, UNSW Canberra, Canberra, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UNSW Canberra,School of Business,Canberra,Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I4394709116"]},{"raw_affiliation_string":"School of Business, UNSW Canberra, Canberra, Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I4394709116"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048583478","display_name":"Omar Khadeer Hussain","orcid":"https://orcid.org/0000-0002-5738-6560"},"institutions":[{"id":"https://openalex.org/I188329596","display_name":"University of Canberra","ror":"https://ror.org/04s1nv328","country_code":"AU","type":"education","lineage":["https://openalex.org/I188329596"]},{"id":"https://openalex.org/I4394709116","display_name":"UNSW Canberra","ror":"https://ror.org/0125wpx05","country_code":null,"type":"education","lineage":["https://openalex.org/I31746571","https://openalex.org/I4394709116"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Omar Hussain","raw_affiliation_strings":["UNSW Canberra,School of Business,Canberra,Australia","School of Business, UNSW Canberra, Canberra, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UNSW Canberra,School of Business,Canberra,Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I4394709116"]},{"raw_affiliation_string":"School of Business, UNSW Canberra, Canberra, Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I4394709116"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031465905","display_name":"Elizabeth Chang","orcid":"https://orcid.org/0000-0002-4439-1854"},"institutions":[{"id":"https://openalex.org/I11701301","display_name":"Griffith University","ror":"https://ror.org/02sc3r913","country_code":"AU","type":"education","lineage":["https://openalex.org/I11701301"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Elizabeth Chang","raw_affiliation_strings":["Griffith University,School of ICT,Gold Coast,Australia","School of ICT, Griffith University, Gold Coast, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Griffith University,School of ICT,Gold Coast,Australia","institution_ids":["https://openalex.org/I11701301"]},{"raw_affiliation_string":"School of ICT, Griffith University, Gold Coast, Australia","institution_ids":["https://openalex.org/I11701301"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5049421085","display_name":"Tharam S. Dillon","orcid":"https://orcid.org/0000-0002-7527-129X"},"institutions":[{"id":"https://openalex.org/I196829312","display_name":"La Trobe University","ror":"https://ror.org/01rxfrp27","country_code":"AU","type":"education","lineage":["https://openalex.org/I196829312"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Tharam Dillon","raw_affiliation_strings":["La Trobe University,Melbourne,Australia","La Trobe University, Melbourne, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"La Trobe University,Melbourne,Australia","institution_ids":["https://openalex.org/I196829312"]},{"raw_affiliation_string":"La Trobe University, Melbourne, Australia","institution_ids":["https://openalex.org/I196829312"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.5392,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.59296277,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"4"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7296257019042969},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7203319668769836},{"id":"https://openalex.org/keywords/provenance","display_name":"Provenance","score":0.41289329528808594},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.37998056411743164}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7296257019042969},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7203319668769836},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.41289329528808594},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.37998056411743164},{"id":"https://openalex.org/C5900021","wikidata":"https://www.wikidata.org/wiki/Q163082","display_name":"Petrology","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/dasc/picom/cbdcom/cy55231.2022.9927863","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dasc/picom/cbdcom/cy55231.2022.9927863","pdf_url":null,"source":{"id":"https://openalex.org/S4363605495","display_name":"2022 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)","raw_type":"proceedings-article"},{"id":"pmh:oai:research-repository.griffith.edu.au:10072/422399","is_oa":true,"landing_page_url":"http://hdl.handle.net/10072/422399","pdf_url":null,"source":null,"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference output"}],"best_oa_location":{"id":"pmh:oai:research-repository.griffith.edu.au:10072/422399","is_oa":true,"landing_page_url":"http://hdl.handle.net/10072/422399","pdf_url":null,"source":null,"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference output"},"sustainable_development_goals":[{"score":0.699999988079071,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":8,"referenced_works":["https://openalex.org/W2751114427","https://openalex.org/W2806057024","https://openalex.org/W2887200831","https://openalex.org/W3016038045","https://openalex.org/W4311703141","https://openalex.org/W6743841043","https://openalex.org/W6751629095","https://openalex.org/W6754333932"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2748952813","https://openalex.org/W2354627941","https://openalex.org/W2347483153","https://openalex.org/W2353379336","https://openalex.org/W2379683085","https://openalex.org/W2364419519","https://openalex.org/W2360767377","https://openalex.org/W2017948608","https://openalex.org/W2360951146"],"abstract_inverted_index":{"Traditional":[0],"Intrusion":[1,27],"Detection":[2,28],"Systems":[3,29],"(IDS)":[4],"are":[5,75],"struggling":[6],"to":[7,35,52,101,105,120],"keep":[8],"up":[9],"with":[10],"the":[11,23,41,59],"increase":[12],"in":[13,118],"sophisticated":[14],"cyber-attacks":[15],"such":[16],"as":[17],"Advanced":[18],"Persistent":[19],"Threats":[20],"(APT)":[21],"over":[22],"past":[24],"years.":[25],"Provenance-based":[26],"(PIDS)":[30],"utilize":[31],"data":[32],"provenance":[33],"concepts":[34],"enable":[36],"fine-grained":[37],"event":[38],"correlation,":[39],"and":[40,47,69,84,124],"results":[42],"show":[43],"increased":[44],"detection":[45,64,71],"accuracy":[46],"reduced":[48],"false-alarm":[49],"rates":[50],"compared":[51],"traditional":[53],"IDS.":[54],"Especially,":[55],"rule-based":[56],"approaches":[57],"for":[58],"PIDS":[60,119],"have":[61],"demonstrated":[62],"high":[63],"accuracy,":[65],"low":[66],"false":[67],"alarm,":[68],"fast":[70],"time.":[72],"However,":[73],"rules":[74,104,114],"manually":[76],"created":[77],"by":[78],"security":[79],"experts,":[80],"which":[81],"is":[82],"time-consuming":[83],"doesn\u2019t":[85],"ensure":[86],"high-quality":[87,113],"rule":[88,98],"standards.":[89],"To":[90],"address":[91],"this":[92],"issue,":[93],"we":[94],"propose":[95],"an":[96],"automated":[97],"generation":[99],"framework":[100],"generate":[102],"robust":[103],"describe":[106],"malicious":[107],"files":[108],"automatically.":[109],"As":[110],"a":[111],"result,":[112],"can":[115],"be":[116],"used":[117],"identify":[121],"similar":[122],"attacks":[123],"other":[125],"affected":[126],"systems":[127],"promptly.":[128]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}