{"id":"https://openalex.org/W4281617473","doi":"https://doi.org/10.1109/noms54207.2022.9789931","title":"Detecting Multi-Step Attacks: A Modular Approach for Programmable Data Plane","display_name":"Detecting Multi-Step Attacks: A Modular Approach for Programmable Data Plane","publication_year":2022,"publication_date":"2022-04-25","ids":{"openalex":"https://openalex.org/W4281617473","doi":"https://doi.org/10.1109/noms54207.2022.9789931"},"language":"en","primary_location":{"id":"doi:10.1109/noms54207.2022.9789931","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms54207.2022.9789931","pdf_url":null,"source":{"id":"https://openalex.org/S4363605650","display_name":"NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5087457372","display_name":"Abir Laraba","orcid":"https://orcid.org/0000-0001-7792-8796"},"institutions":[{"id":"https://openalex.org/I90183372","display_name":"Universit\u00e9 de Lorraine","ror":"https://ror.org/04vfs2w97","country_code":"FR","type":"education","lineage":["https://openalex.org/I90183372"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Abir Laraba","raw_affiliation_strings":["Université de Lorraine,Inria,France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Université de Lorraine,Inria,France","institution_ids":["https://openalex.org/I90183372"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035034365","display_name":"J\u00e9r\u00f4me Fran\u00e7ois","orcid":"https://orcid.org/0000-0002-7457-458X"},"institutions":[{"id":"https://openalex.org/I90183372","display_name":"Universit\u00e9 de Lorraine","ror":"https://ror.org/04vfs2w97","country_code":"FR","type":"education","lineage":["https://openalex.org/I90183372"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Jerome Francois","raw_affiliation_strings":["Université de Lorraine,Inria,France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Université de Lorraine,Inria,France","institution_ids":["https://openalex.org/I90183372"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108107086","display_name":"Isabelle Chrisment","orcid":null},"institutions":[{"id":"https://openalex.org/I90183372","display_name":"Universit\u00e9 de Lorraine","ror":"https://ror.org/04vfs2w97","country_code":"FR","type":"education","lineage":["https://openalex.org/I90183372"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Isabelle Chrisment","raw_affiliation_strings":["Université de Lorraine,Inria,France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Université de Lorraine,Inria,France","institution_ids":["https://openalex.org/I90183372"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5055538536","display_name":"Shihabur Rahman Chowdhury","orcid":"https://orcid.org/0000-0002-6232-2027"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Shihabur Rahman Chowdhury","raw_affiliation_strings":["University of Waterloo,Canada","University of Waterloo, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Waterloo,Canada","institution_ids":["https://openalex.org/I151746483"]},{"raw_affiliation_string":"University of Waterloo, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5038723583","display_name":"Raouf Boutaba","orcid":"https://orcid.org/0000-0001-7936-6862"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Raouf Boutaba","raw_affiliation_strings":["University of Waterloo,Canada","University of Waterloo, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Waterloo,Canada","institution_ids":["https://openalex.org/I151746483"]},{"raw_affiliation_string":"University of Waterloo, Canada","institution_ids":["https://openalex.org/I151746483"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7839122414588928},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.770824670791626},{"id":"https://openalex.org/keywords/field-programmable-gate-array","display_name":"Field-programmable gate array","score":0.46347320079803467},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.4588613510131836},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.3819984793663025},{"id":"https://openalex.org/keywords/computer-architecture","display_name":"Computer architecture","score":0.36121997237205505},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.25171899795532227}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7839122414588928},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.770824670791626},{"id":"https://openalex.org/C42935608","wikidata":"https://www.wikidata.org/wiki/Q190411","display_name":"Field-programmable gate array","level":2,"score":0.46347320079803467},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.4588613510131836},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.3819984793663025},{"id":"https://openalex.org/C118524514","wikidata":"https://www.wikidata.org/wiki/Q173212","display_name":"Computer architecture","level":1,"score":0.36121997237205505},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.25171899795532227}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/noms54207.2022.9789931","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms54207.2022.9789931","pdf_url":null,"source":{"id":"https://openalex.org/S4363605650","display_name":"NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3172997804","display_name":"Isite LUE","funder_award_id":"ANR-15-IDEX-0004","funder_id":"https://openalex.org/F4320320883","funder_display_name":"Agence Nationale de la Recherche"}],"funders":[{"id":"https://openalex.org/F4320320883","display_name":"Agence Nationale de la Recherche","ror":"https://ror.org/00rbzpz17"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":44,"referenced_works":["https://openalex.org/W1649901946","https://openalex.org/W1744212210","https://openalex.org/W1972914730","https://openalex.org/W1983720905","https://openalex.org/W1994926493","https://openalex.org/W1996201018","https://openalex.org/W2013325737","https://openalex.org/W2096904182","https://openalex.org/W2098081907","https://openalex.org/W2107081940","https://openalex.org/W2114258378","https://openalex.org/W2122408829","https://openalex.org/W2124285852","https://openalex.org/W2129975948","https://openalex.org/W2134519279","https://openalex.org/W2137559158","https://openalex.org/W2143665444","https://openalex.org/W2151077395","https://openalex.org/W2400995703","https://openalex.org/W2763340581","https://openalex.org/W2790508427","https://openalex.org/W2792044364","https://openalex.org/W2792581684","https://openalex.org/W2918782330","https://openalex.org/W2919933302","https://openalex.org/W2940715617","https://openalex.org/W2985576788","https://openalex.org/W3008207353","https://openalex.org/W3015773798","https://openalex.org/W3045669326","https://openalex.org/W3094464018","https://openalex.org/W3096245080","https://openalex.org/W3101799469","https://openalex.org/W3122635809","https://openalex.org/W3155942320","https://openalex.org/W3179226991","https://openalex.org/W3181082379","https://openalex.org/W6646334227","https://openalex.org/W6760642972","https://openalex.org/W6762132567","https://openalex.org/W6781251668","https://openalex.org/W6785927035","https://openalex.org/W6787327537","https://openalex.org/W6798376852"],"related_works":["https://openalex.org/W2111241003","https://openalex.org/W2355315220","https://openalex.org/W4200391368","https://openalex.org/W2096844293","https://openalex.org/W2363944576","https://openalex.org/W2351041855","https://openalex.org/W2570254841","https://openalex.org/W1967938402","https://openalex.org/W2386041993","https://openalex.org/W1608572506"],"abstract_inverted_index":{"The":[0],"increasing":[1],"sophistication":[2],"of":[3,13,46,50,58,72,113,123,130],"attacks":[4,75],"over":[5],"the":[6,11,26,121,128,139],"last":[7],"years":[8],"such":[9],"as":[10],"proliferation":[12],"complex":[14],"multi-steps":[15],"attacks,":[16],"calls":[17],"for":[18,24,87],"new":[19],"monitoring":[20,43],"models":[21],"and":[22,29,53,60,137],"methods":[23],"diagnosing":[25],"attacks\u2019":[27],"severity":[28],"mitigating":[30],"them":[31],"in":[32],"a":[33,48,67,77,85,89,95,105,131,142],"timely":[34],"manner.":[35],"In":[36],"this":[37,81],"paper,":[38],"we":[39,83],"propose":[40,84],"an":[41],"in-network":[42],"approach":[44,63],"capable":[45,71],"detecting":[47],"set":[49],"composed":[51],"behaviors":[52],"consequently":[54],"triggering":[55],"different":[56],"levels":[57],"alerts":[59],"reactions.":[61],"Our":[62],"is":[64],"based":[65],"on":[66,104,141],"Petri":[68,96],"Net":[69],"model":[70,140],"aggregating":[73],"individual":[74],"into":[76],"multi-step":[78,132],"composition.":[79],"To":[80],"end,":[82],"method":[86],"deriving":[88],"Match-Action":[90],"Table":[91],"(MAT)":[92],"abstraction":[93],"from":[94],"net":[97],"model.":[98],"MATs":[99],"can":[100],"be":[101],"then":[102],"deployed":[103],"P4":[106,143],"programmable":[107,144],"data":[108,145],"plane,":[109],"enabling":[110],"flexible":[111],"re-composition":[112],"attack":[114,136],"detection":[115,129],"steps":[116],"at":[117],"runtime.":[118],"We":[119],"demonstrate":[120],"feasibility":[122],"our":[124],"proposal":[125],"by":[126],"modeling":[127],"DNS":[133],"cache":[134],"poisoning":[135],"implementing":[138],"plane.":[146]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}