{"id":"https://openalex.org/W4387870754","doi":"https://doi.org/10.1109/icc45041.2023.10279468","title":"Tell Me More: Black Box Explainability for APT Detection on System Provenance Graphs","display_name":"Tell Me More: Black Box Explainability for APT Detection on System Provenance Graphs","publication_year":2023,"publication_date":"2023-05-28","ids":{"openalex":"https://openalex.org/W4387870754","doi":"https://doi.org/10.1109/icc45041.2023.10279468"},"language":"en","primary_location":{"id":"doi:10.1109/icc45041.2023.10279468","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1109/icc45041.2023.10279468","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICC 2023 - IEEE International Conference on Communications","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104187072","display_name":"Felix Welter","orcid":null},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Felix Welter","raw_affiliation_strings":["Universität Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Hamburg","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091520073","display_name":"Florian Wilkens","orcid":"https://orcid.org/0000-0003-2300-4293"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Florian Wilkens","raw_affiliation_strings":["Universität Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Hamburg","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033270363","display_name":"Mathias Fischer","orcid":"https://orcid.org/0000-0002-6254-8288"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mathias Fischer","raw_affiliation_strings":["Universität Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Hamburg","institution_ids":["https://openalex.org/I159176309"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I159176309"],"apc_list":null,"apc_paid":null,"fwci":0.6534,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.69520586,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"3817","last_page":"3823"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9929999709129333,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9929999709129333,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9922000169754028,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9815999865531921,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7906225919723511},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6714869737625122},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6040073037147522},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.5159212350845337},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.49539363384246826},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.47001388669013977},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.4525149166584015},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4216681122779846},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4120739996433258},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3531090021133423},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3474789559841156},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.29943299293518066},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.1590961515903473}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7906225919723511},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6714869737625122},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6040073037147522},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5159212350845337},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.49539363384246826},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.47001388669013977},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.4525149166584015},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4216681122779846},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4120739996433258},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3531090021133423},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3474789559841156},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.29943299293518066},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.1590961515903473},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icc45041.2023.10279468","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1109/icc45041.2023.10279468","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICC 2023 - IEEE International Conference on Communications","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.6399999856948853}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W1772700132","https://openalex.org/W1857789879","https://openalex.org/W1985987493","https://openalex.org/W1992705187","https://openalex.org/W2102636708","https://openalex.org/W2282821441","https://openalex.org/W2284900416","https://openalex.org/W2614510834","https://openalex.org/W2747669027","https://openalex.org/W2790557990","https://openalex.org/W2889379876","https://openalex.org/W2891503716","https://openalex.org/W2911964244","https://openalex.org/W2962862931","https://openalex.org/W2963807402","https://openalex.org/W2981731882","https://openalex.org/W2998038410","https://openalex.org/W3139317474","https://openalex.org/W4245608944","https://openalex.org/W4311833010","https://openalex.org/W6737785282","https://openalex.org/W6737947904","https://openalex.org/W6751955181"],"related_works":["https://openalex.org/W2337148208","https://openalex.org/W3004832009","https://openalex.org/W2806741695","https://openalex.org/W3036013726","https://openalex.org/W1971929717","https://openalex.org/W1724519426","https://openalex.org/W2351051591","https://openalex.org/W2369534771","https://openalex.org/W2357468538","https://openalex.org/W1548126107"],"abstract_inverted_index":{"Nowadays,":[0],"companies,":[1],"critical":[2],"infrastructure":[3],"and":[4,15,42,135,171,219],"governments":[5],"face":[6],"cyber":[7],"attacks":[8,18],"every":[9],"day":[10],"ranging":[11],"from":[12],"simple":[13],"denial-of-service":[14],"password":[16],"guessing":[17],"to":[19,38,81,105,112,146,175],"complex":[20,104],"nationstate":[21],"attack":[22],"campaigns,":[23],"so-called":[24],"advanced":[25],"persistent":[26],"threats":[27],"(APTs).":[28],"Defenders":[29],"employ":[30],"intrusion":[31],"detection":[32,51,69,124,165,188],"systems":[33,57,78],"(IDSs)":[34],"among":[35],"other":[36],"tools":[37],"detect":[39],"malicious":[40],"activity":[41],"protect":[43],"network":[44],"assets.":[45],"With":[46],"the":[47,95,98,129,137,150,157,163,207,222,232],"evolution":[48],"of":[49,63,72,120,132,143,149,206,246],"threats,":[50],"techniques":[52],"have":[53],"followed":[54],"with":[55,243],"modern":[56],"usually":[58],"relying":[59],"on":[60,182],"some":[61],"form":[62],"artificial":[64],"intelligence":[65],"(AI)":[66],"or":[67],"anomaly":[68,123,134,164],"as":[70,97,167],"part":[71,205],"their":[73],"defense":[74],"portfolio.":[75],"While":[76],"these":[77,238],"are":[79,101,153,203,240],"able":[80],"achieve":[82],"higher":[83,225],"accuracy":[84],"in":[85],"detecting":[86],"APT":[87,187],"activity,":[88],"they":[89],"cannot":[90],"provide":[91],"much":[92],"context":[93],"about":[94],"attack,":[96],"underlying":[99],"models":[100],"often":[102],"too":[103],"interpret.":[106],"This":[107],"paper":[108],"presents":[109],"an":[110,133],"approach":[111,161,198],"explain":[113],"single":[114],"predictions":[115],"(i.":[116],"e.,":[117],"detected":[118,158],"attacks)":[119],"any":[121,176],"graphbased":[122],"systems.":[125],"By":[126],"systematically":[127],"modifying":[128],"input":[130],"graph":[131,151],"observing":[136],"output,":[138],"we":[139],"leverage":[140],"a":[141,168,244],"variation":[142],"permutation":[144],"importance":[145],"identify":[147,200],"parts":[148],"that":[152,196,202,237],"likely":[154,204],"responsible":[155],"for":[156,186,226],"anomaly.":[159,208],"Our":[160,180],"treats":[162],"function":[166],"black":[169],"box":[170],"is":[172,224],"thus":[173],"applicable":[174],"whole-graph":[177],"explanation":[178],"problems.":[179],"results":[181,239],"two":[183],"established":[184],"datasets":[185],"(StreamSpot":[189],"&":[190],"DARPA":[191],"TC":[192],"Engagement":[193],"Three)":[194],"indicate":[195],"our":[197,213],"can":[199],"nodes":[201],"We":[209],"quantify":[210],"this":[211],"through":[212],"area":[214],"under":[215],"baseline":[216],"(AuB)":[217],"metric":[218],"show":[220],"how":[221],"AuB":[223],"anomalous":[227],"graphs.":[228],"Further":[229],"analysis":[230],"via":[231],"Wilcoxon":[233],"rank-sum":[234],"test":[235],"confirms":[236],"statistically":[241],"significant":[242],"p-value":[245],"0.0041%.":[247]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}