{"id":"https://openalex.org/W4414165965","doi":"https://doi.org/10.1109/ojcs.2025.3607975","title":"Cross-Modal Attention Networks for Multi-Modal Anomaly Detection in System Software","display_name":"Cross-Modal Attention Networks for Multi-Modal Anomaly Detection in System Software","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414165965","doi":"https://doi.org/10.1109/ojcs.2025.3607975"},"language":"en","primary_location":{"id":"doi:10.1109/ojcs.2025.3607975","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcs.2025.3607975","pdf_url":null,"source":{"id":"https://openalex.org/S4210176459","display_name":"IEEE Open Journal of the Computer Society","issn_l":"2644-1268","issn":["2644-1268"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Computer Society","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/ojcs.2025.3607975","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Suchuan Xing","orcid":"https://orcid.org/0009-0005-5213-4371"},"institutions":[{"id":"https://openalex.org/I170897317","display_name":"Duke University","ror":"https://ror.org/00py81415","country_code":"US","type":"education","lineage":["https://openalex.org/I170897317"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Suchuan Xing","raw_affiliation_strings":["Duke University, Durham, NC, USA"],"affiliations":[{"raw_affiliation_string":"Duke University, Durham, NC, USA","institution_ids":["https://openalex.org/I170897317"]}]},{"author_position":"last","author":{"id":null,"display_name":"Yihan Wang","orcid":"https://orcid.org/0009-0002-1781-5233"},"institutions":[{"id":"https://openalex.org/I79576946","display_name":"University of Pennsylvania","ror":"https://ror.org/00b30xv10","country_code":"US","type":"education","lineage":["https://openalex.org/I79576946"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yihan Wang","raw_affiliation_strings":["University of Pennsylvania, Philadelphia, PA, USA"],"affiliations":[{"raw_affiliation_string":"University of Pennsylvania, Philadelphia, PA, USA","institution_ids":["https://openalex.org/I79576946"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I170897317"],"apc_list":{"value":1750,"currency":"USD","value_usd":1750},"apc_paid":{"value":1750,"currency":"USD","value_usd":1750},"fwci":7.0371,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":{"value":0.97233912,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":98},"biblio":{"volume":"6","issue":null,"first_page":"1463","last_page":"1474"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6972000002861023},{"id":"https://openalex.org/keywords/metric","display_name":"Metric (unit)","score":0.6906999945640564},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.6085000038146973},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5640000104904175},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.5302000045776367},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5031999945640564},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.46799999475479126},{"id":"https://openalex.org/keywords/spark","display_name":"SPARK (programming language)","score":0.40799999237060547},{"id":"https://openalex.org/keywords/software-system","display_name":"Software system","score":0.390500009059906}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7454000115394592},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6972000002861023},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.6906999945640564},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.6085000038146973},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.583299994468689},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5640000104904175},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.5302000045776367},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5031999945640564},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.46799999475479126},{"id":"https://openalex.org/C2781215313","wikidata":"https://www.wikidata.org/wiki/Q3493345","display_name":"SPARK (programming language)","level":2,"score":0.40799999237060547},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.390500009059906},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3808000087738037},{"id":"https://openalex.org/C82214349","wikidata":"https://www.wikidata.org/wiki/Q657339","display_name":"Software metric","level":5,"score":0.37049999833106995},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.3695000112056732},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35659998655319214},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.34599998593330383},{"id":"https://openalex.org/C2780898871","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Performance metric","level":2,"score":0.33079999685287476},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.32260000705718994},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.32100000977516174},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3154999911785126},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.28870001435279846},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2863999903202057},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.28619998693466187},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.2549999952316284},{"id":"https://openalex.org/C77277458","wikidata":"https://www.wikidata.org/wiki/Q1969246","display_name":"Temporal database","level":2,"score":0.2540000081062317},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.25270000100135803},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.25099998712539673}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/ojcs.2025.3607975","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcs.2025.3607975","pdf_url":null,"source":{"id":"https://openalex.org/S4210176459","display_name":"IEEE Open Journal of the Computer Society","issn_l":"2644-1268","issn":["2644-1268"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Computer Society","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:92b7a482340c48d9a6204c18832657ef","is_oa":true,"landing_page_url":"https://doaj.org/article/92b7a482340c48d9a6204c18832657ef","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Open Journal of the Computer Society, Vol 6, Pp 1463-1474 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/ojcs.2025.3607975","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcs.2025.3607975","pdf_url":null,"source":{"id":"https://openalex.org/S4210176459","display_name":"IEEE Open Journal of the Computer Society","issn_l":"2644-1268","issn":["2644-1268"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Computer Society","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W2039157918","https://openalex.org/W2107263349","https://openalex.org/W2767094836","https://openalex.org/W2947815220","https://openalex.org/W2950361482","https://openalex.org/W2953352227","https://openalex.org/W2965838158","https://openalex.org/W3095840026","https://openalex.org/W3128634608","https://openalex.org/W3170851865","https://openalex.org/W3187841728","https://openalex.org/W3192648431","https://openalex.org/W3209605437","https://openalex.org/W4206238429","https://openalex.org/W4309623083","https://openalex.org/W4312454513","https://openalex.org/W4376288669","https://openalex.org/W4388212317","https://openalex.org/W4391030526","https://openalex.org/W4402917098","https://openalex.org/W4403031916"],"related_works":[],"abstract_inverted_index":{"Anomaly":[0],"detection":[1,105,237],"in":[2,20,67,86,225],"system":[3,226],"software":[4,227],"traditionally":[5],"relies":[6],"on":[7,100,144,158,191],"single-modal":[8,184],"algorithms":[9],"that":[10,26,38,109,122,238],"analyze":[11],"either":[12],"discrete":[13],"log":[14,46,68,94,134,146],"events":[15,95,147],"or":[16],"continuous":[17],"performance":[18,49,78,170],"metrics":[19,50],"isolation,":[21],"potentially":[22],"missing":[23],"complex":[24],"anomalies":[25,108,150],"manifest":[27],"across":[28,193],"both":[29,114],"modalities.":[30],"We":[31,154],"present":[32],"a":[33,222,231],"novel":[34],"deep":[35],"learning":[36],"framework":[37,220],"leverages":[39],"cross-modal":[40,202],"attention":[41,127,203],"mechanisms":[42],"to":[43,63,76,142,234,240],"jointly":[44],"model":[45,77],"sequences":[47,70],"and":[48,71,96,136,151,163],"for":[51],"enhanced":[52],"anomaly":[53,236],"detection.":[54],"Our":[55,178],"method":[56,179],"proposes":[57],"Long":[58],"Short-Term":[59],"Memory":[60],"(LSTM)":[61],"networks":[62],"capture":[64],"temporal":[65],"dependencies":[66,132],"event":[69],"Temporal":[72],"Convolutional":[73],"Networks":[74],"(TCNs)":[75],"metric":[79,97,137,149],"time":[80],"series.":[81],"The":[82,218],"core":[83],"innovation":[84],"lies":[85],"our":[87,126],"Cross-Modal":[88],"Attention":[89],"Mechanism,":[90],"which":[91],"dynamically":[92],"weighs":[93],"features":[98],"based":[99],"inter-modal":[101],"relationships,":[102],"enabling":[103],"the":[104,131,140,198,201],"of":[106,200],"subtle":[107],"require":[110],"contextual":[111],"information":[112],"from":[113],"data":[115],"sources.":[116],"Unlike":[117],"conventional":[118],"multi-modal":[119,235],"fusion":[120],"techniques":[121],"merely":[123],"concatenate":[124],"features,":[125],"mechanism":[128],"explicitly":[129],"models":[130],"between":[133],"patterns":[135],"behaviors,":[138],"allowing":[139],"network":[141],"focus":[143],"relevant":[145],"during":[148],"vice":[152],"versa.":[153],"conduct":[155],"comprehensive":[156],"experiments":[157,208],"public":[159],"datasets":[160],"including":[161],"HDFS":[162],"BGL":[164],"logs":[165],"paired":[166],"with":[167,186,215],"cloud":[168,176],"computing":[169],"metrics,":[171],"as":[172,174],"well":[173],"real-world":[175],"environments.":[177],"achieves":[180],"significant":[181],"improvements":[182],"over":[183],"baselines,":[185],"F1-scores":[187],"increasing":[188],"by":[189,229],"12.3%":[190],"average":[192],"datasets.":[194],"Ablation":[195],"studies":[196],"confirm":[197],"effectiveness":[199],"mechanism,":[204],"while":[205],"real-time":[206],"deployment":[207],"using":[209],"Apache":[210],"Flink":[211],"demonstrate":[212],"practical":[213],"applicability":[214],"sub-second":[216],"latency.":[217],"proposed":[219],"addresses":[221],"critical":[223],"gap":[224],"monitoring":[228],"providing":[230],"principled":[232],"approach":[233],"scales":[239],"enterprise-level":[241],"deployments.":[242]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4}],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2025-10-10T00:00:00"}