{"id":"https://openalex.org/W4402156441","doi":"https://doi.org/10.1109/icc51166.2024.10622485","title":"Multi-Stage Defense: Enhancing Robustness in Sequence-Based Log Anomaly Detection","display_name":"Multi-Stage Defense: Enhancing Robustness in Sequence-Based Log Anomaly Detection","publication_year":2024,"publication_date":"2024-06-09","ids":{"openalex":"https://openalex.org/W4402156441","doi":"https://doi.org/10.1109/icc51166.2024.10622485"},"language":"en","primary_location":{"id":"doi:10.1109/icc51166.2024.10622485","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icc51166.2024.10622485","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICC 2024 - IEEE International Conference on Communications","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100602906","display_name":"Kai Tan","orcid":"https://orcid.org/0009-0002-7149-4637"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Tan","raw_affiliation_strings":["School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038927310","display_name":"Dongyang Zhan","orcid":"https://orcid.org/0000-0003-1981-5878"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dongyang Zhan","raw_affiliation_strings":["School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091032374","display_name":"Zhaofeng Yu","orcid":"https://orcid.org/0000-0003-2114-8533"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhaofeng Yu","raw_affiliation_strings":["School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112656134","display_name":"Lin Ye","orcid":null},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lin Ye","raw_affiliation_strings":["School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100417306","display_name":"Hongli Zhang","orcid":"https://orcid.org/0000-0001-7674-8339"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongli Zhang","raw_affiliation_strings":["School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5113587199","display_name":"Binxing Fang","orcid":null},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Binxing Fang","raw_affiliation_strings":["School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Science, Harbin Institute of Technology,Harbin,China,150001","institution_ids":["https://openalex.org/I204983213"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I204983213"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2725","last_page":"2730"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.7655726671218872},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6214206218719482},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5607742071151733},{"id":"https://openalex.org/keywords/stage","display_name":"Stage (stratigraphy)","score":0.49649888277053833},{"id":"https://openalex.org/keywords/sequence","display_name":"Sequence (biology)","score":0.47989213466644287},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.33609288930892944},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.32400330901145935},{"id":"https://openalex.org/keywords/geology","display_name":"Geology","score":0.07038870453834534},{"id":"https://openalex.org/keywords/gene","display_name":"Gene","score":0.06646749377250671},{"id":"https://openalex.org/keywords/chemistry","display_name":"Chemistry","score":0.05266469717025757}],"concepts":[{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.7655726671218872},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6214206218719482},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5607742071151733},{"id":"https://openalex.org/C146357865","wikidata":"https://www.wikidata.org/wiki/Q1123245","display_name":"Stage (stratigraphy)","level":2,"score":0.49649888277053833},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.47989213466644287},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33609288930892944},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32400330901145935},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.07038870453834534},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.06646749377250671},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.05266469717025757},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icc51166.2024.10622485","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icc51166.2024.10622485","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICC 2024 - IEEE International Conference on Communications","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Climate action","id":"https://metadata.un.org/sdg/13","score":0.6800000071525574}],"awards":[{"id":"https://openalex.org/G5400368817","display_name":null,"funder_award_id":"62302122,62172123","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W2039157918","https://openalex.org/W2064675550","https://openalex.org/W2107263349","https://openalex.org/W2157331557","https://openalex.org/W2739032812","https://openalex.org/W2767094836","https://openalex.org/W2911919851","https://openalex.org/W2963250244","https://openalex.org/W2965838158","https://openalex.org/W2970597249","https://openalex.org/W3024411467","https://openalex.org/W3048804154","https://openalex.org/W3127712067","https://openalex.org/W3154489205","https://openalex.org/W3183138634","https://openalex.org/W3201518827","https://openalex.org/W4288283362","https://openalex.org/W4308740425","https://openalex.org/W6741734642","https://openalex.org/W6758026774","https://openalex.org/W6763701032","https://openalex.org/W6765602453"],"related_works":["https://openalex.org/W2329386257","https://openalex.org/W2503350049","https://openalex.org/W2770593030","https://openalex.org/W2397616145","https://openalex.org/W3154990682","https://openalex.org/W2560201613","https://openalex.org/W2397320258","https://openalex.org/W2171975302","https://openalex.org/W2022352247","https://openalex.org/W2105642232"],"abstract_inverted_index":{"Sequence-based":[0],"deep":[1],"learning":[2,171],"models":[3,34],"are":[4],"commonly":[5],"used":[6],"to":[7,13,88,101,120,141,148],"detect":[8],"anomalies":[9],"in":[10,154,163],"system":[11],"logs":[12],"ensure":[14,102],"the":[15,47,80,114,122,143,155,170,188],"security":[16],"of":[17,108,118,125,172],"communication":[18],"and":[19,199],"information":[20],"systems.":[21],"However,":[22],"recent":[23],"research":[24],"has":[25,195],"shown":[26],"that":[27,97,192],"adversarial":[28,73,109,164,203],"attack":[29,126],"methods":[30],"against":[31,105,178,201],"these":[32,41],"detection":[33,69,82,197],"reveal":[35],"their":[36],"vulnerabilities.":[37],"Attackers":[38],"can":[39],"bypass":[40],"sequence-based":[42,66],"classifiers":[43],"by":[44],"tampering":[45],"with":[46],"sequence":[48,53,160],"(e.g.,":[49],"adding":[50],"or":[51],"replacing":[52],"events).":[54],"In":[55],"this":[56,77],"paper,":[57],"we":[58,112,132],"propose":[59,133],"a":[60,93,106,134],"novel":[61,135],"Multi-Stage":[62],"Defensive":[63],"strategy":[64,78],"for":[65],"log":[67],"anomaly":[68,89],"aimed":[70],"at":[71],"combating":[72],"attacks.":[74,110,204],"Systematically":[75],"integrated,":[76],"spans":[79],"entire":[81],"process,":[83],"from":[84],"data":[85],"embedding":[86],"representation":[87],"classification,":[90],"thereby":[91],"forming":[92],"robust":[94],"defensive":[95],"approach":[96,167,194],"is":[98],"strategically":[99],"orchestrated":[100],"comprehensive":[103],"protection":[104],"variety":[107],"Firstly,":[111],"compress":[113],"semantic":[115],"feature":[116],"space":[117],"sequences":[119],"enhance":[121],"anti-interference":[123],"ability":[124],"operations":[127],"on":[128,184],"substitution":[129],"sequences.":[130,165],"Then,":[131],"adaptive":[136],"sparse":[137],"multi-head":[138],"attention":[139],"mechanism":[140],"improve":[142],"Transformer":[144],"model,":[145],"allowing":[146],"it":[147],"adaptively":[149],"extract":[150],"different":[151,202],"key":[152],"patterns":[153],"sequence,":[156],"thus":[157],"eliminating":[158],"irrelevant":[159],"events":[161],"added":[162],"Our":[166],"also":[168],"integrates":[169],"temporal":[173],"patterns,":[174],"offering":[175],"enhanced":[176],"robustness":[177,200],"deletion":[179],"operations.":[180],"Through":[181],"extensive":[182],"experiments":[183],"two":[185],"public":[186],"datasets,":[187],"experimental":[189],"results":[190],"demonstrate":[191],"our":[193],"high":[196],"performance":[198]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}