{"id":"https://openalex.org/W4388893970","doi":"https://doi.org/10.1109/pst58708.2023.10320173","title":"ThreatLand: Extracting Intelligence from Audit Logs via NLP methods","display_name":"ThreatLand: Extracting Intelligence from Audit Logs via NLP methods","publication_year":2023,"publication_date":"2023-08-21","ids":{"openalex":"https://openalex.org/W4388893970","doi":"https://doi.org/10.1109/pst58708.2023.10320173"},"language":"en","primary_location":{"id":"doi:10.1109/pst58708.2023.10320173","is_oa":false,"landing_page_url":"https://doi.org/10.1109/pst58708.2023.10320173","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 20th Annual International Conference on Privacy, Security and Trust (PST)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5008912765","display_name":"Vinay Sachidananda","orcid":"https://orcid.org/0000-0001-9582-1538"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Vinay Sachidananda","raw_affiliation_strings":["Nanyang Technological University,School of Computer Science and Engineering,Singapore","School of Computer Science and Engineering, Nanyang Technological University, Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University,School of Computer Science and Engineering,Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"School of Computer Science and Engineering, Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067429244","display_name":"Rajendra Patil","orcid":"https://orcid.org/0000-0003-0479-6766"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Rajendra Patil","raw_affiliation_strings":["KTH Royal Institute of Technology,School of Electrical Engineering and Computer Science,Sweden","School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Sweden"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology,School of Electrical Engineering and Computer Science,Sweden","institution_ids":["https://openalex.org/I86987016"]},{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083082430","display_name":"Hongyi Peng","orcid":"https://orcid.org/0000-0002-2720-2628"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Hongyi Peng","raw_affiliation_strings":["Nanyang Technological University,School of Computer Science and Engineering,Singapore","School of Computer Science and Engineering, Nanyang Technological University, Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University,School of Computer Science and Engineering,Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"School of Computer Science and Engineering, Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100355692","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0001-7300-9215"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Liu Yang","raw_affiliation_strings":["Nanyang Technological University,School of Computer Science and Engineering,Singapore","School of Computer Science and Engineering, Nanyang Technological University, Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University,School of Computer Science and Engineering,Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"School of Computer Science and Engineering, Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101720092","display_name":"Kwok\u2010Yan Lam","orcid":"https://orcid.org/0000-0001-7479-7970"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Kwok-Yan Lam","raw_affiliation_strings":["Nanyang Technological University,School of Computer Science and Engineering,Singapore","School of Computer Science and Engineering, Nanyang Technological University, Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University,School of Computer Science and Engineering,Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"School of Computer Science and Engineering, Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8353445529937744},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.583380937576294},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.5327759981155396},{"id":"https://openalex.org/keywords/audit-trail","display_name":"Audit trail","score":0.5035087466239929},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.5011789798736572},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.4774218797683716},{"id":"https://openalex.org/keywords/interactivity","display_name":"Interactivity","score":0.43931907415390015},{"id":"https://openalex.org/keywords/graphical-user-interface","display_name":"Graphical user interface","score":0.42828452587127686},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.41028642654418945},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.3558645248413086},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.34470298886299133},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3440510034561157},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.19002270698547363},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.08286938071250916}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8353445529937744},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.583380937576294},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.5327759981155396},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.5035087466239929},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.5011789798736572},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.4774218797683716},{"id":"https://openalex.org/C144430266","wikidata":"https://www.wikidata.org/wiki/Q839721","display_name":"Interactivity","level":2,"score":0.43931907415390015},{"id":"https://openalex.org/C37789001","wikidata":"https://www.wikidata.org/wiki/Q782543","display_name":"Graphical user interface","level":2,"score":0.42828452587127686},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.41028642654418945},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3558645248413086},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34470298886299133},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3440510034561157},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.19002270698547363},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.08286938071250916},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.0},{"id":"https://openalex.org/C187736073","wikidata":"https://www.wikidata.org/wiki/Q2920921","display_name":"Management","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C97355855","wikidata":"https://www.wikidata.org/wiki/Q11473","display_name":"Thermodynamics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/pst58708.2023.10320173","is_oa":false,"landing_page_url":"https://doi.org/10.1109/pst58708.2023.10320173","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 20th Annual International Conference on Privacy, Security and Trust (PST)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W1811853421","https://openalex.org/W2335999708","https://openalex.org/W2559887352","https://openalex.org/W2560932476","https://openalex.org/W2800740927","https://openalex.org/W2806820837","https://openalex.org/W2810758612","https://openalex.org/W2887127196","https://openalex.org/W2910711617","https://openalex.org/W2963673968","https://openalex.org/W2982379052","https://openalex.org/W3022088706","https://openalex.org/W3131542938","https://openalex.org/W3167506177","https://openalex.org/W3179788886","https://openalex.org/W3198980504","https://openalex.org/W3211888892","https://openalex.org/W4220954340","https://openalex.org/W4394663333","https://openalex.org/W6745040976","https://openalex.org/W6762125437"],"related_works":["https://openalex.org/W2319020389","https://openalex.org/W2001821990","https://openalex.org/W2272707781","https://openalex.org/W2124184151","https://openalex.org/W2750461430","https://openalex.org/W2487194309","https://openalex.org/W2948428544","https://openalex.org/W2374959091","https://openalex.org/W2581634534","https://openalex.org/W2079105056"],"abstract_inverted_index":{"Threat":[0],"intelligence":[1,28,87,157],"and":[2,41,52,59,88,105,116,136,194],"hunting":[3],"using":[4],"various":[5,151],"logs":[6,64,94,193],"has":[7],"evolved":[8],"into":[9],"a":[10,82,118,140,184],"crucial":[11],"component":[12],"of":[13,16,99,153],"remaining":[14],"aware":[15],"the":[17,22,42,123,161,164,173,181,191,196],"ever-changing":[18],"threat":[19,44,54,61,73,90,125,174,198],"landscape.":[20],"Given":[21],"critical":[23],"need":[24],"to":[25,50,155],"extract":[26],"useful":[27],"from":[29,92,113,190],"logs,":[30],"existing":[31],"techniques":[32],"either":[33],"focus":[34],"exclusively":[35],"on":[36,139],"isolated":[37],"records,":[38],"ignoring":[39],"correlation":[40],"overall":[43],"scenario,":[45],"or":[46],"require":[47],"significant":[48],"effort":[49],"filter":[51],"correlate":[53],"records.":[55],"Additionally,":[56],"searching":[57],"for":[58,172],"matching":[60],"behaviors":[62],"in":[63,180],"often":[65],"involves":[66],"non-trivial":[67],"human":[68],"query":[69,129],"construction,":[70],"impeding":[71],"fast":[72,135],"hunting.":[74],"To":[75],"address":[76],"this":[77],"gap,":[78],"we":[79],"present":[80],"ThreatLand,":[81],"system":[83],"that":[84,109,121,132,149],"extracts":[85,110,195],"highlevel":[86],"structured":[89,111],"patterns":[91],"audit":[93],"automatically.":[95],"ThreatLand":[96,162,186],"is":[97,133],"composed":[98],"three":[100],"components":[101],"(1)":[102],"A":[103,128,144],"lightweight":[104],"accurate":[106],"NLP":[107],"pipeline":[108],"meta-data":[112],"alert":[114,192],"descriptions":[115],"generates":[117],"heterogeneous":[119],"graph":[120],"depicts":[122],"entire":[124],"scenario.":[126],"(2)":[127],"execution":[130],"engine":[131],"both":[134],"efficient,":[137],"based":[138],"graphical":[141,145],"database.":[142],"(3)":[143],"user":[146],"interface":[147],"(GUI)":[148],"offers":[150],"sorts":[152],"interactivity":[154],"aid":[156],"exploration.We":[158],"have":[159],"evaluated":[160],"over":[163,176],"dataset":[165],"containing":[166],"9240":[167],"real-time":[168],"EDR":[169],"alerts":[170],"collected":[171],"events":[175],"an":[177],"enterprise":[178],"setup":[179],"lab.":[182],"As":[183],"result,":[185],"presents":[187],"high-level":[188],"insights":[189],"valuable":[197],"patterns.":[199]},"counts_by_year":[{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}