{"id":"https://openalex.org/W4385679792","doi":"https://doi.org/10.1109/sp46215.2023.10179402","title":"TeSec: Accurate Server-side Attack Investigation for Web Applications","display_name":"TeSec: Accurate Server-side Attack Investigation for Web Applications","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4385679792","doi":"https://doi.org/10.1109/sp46215.2023.10179402"},"language":"en","primary_location":{"id":"doi:10.1109/sp46215.2023.10179402","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179402","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Ruihua Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ruihua Wang","raw_affiliation_strings":["Tsinghua University,KLISS, TNList, School of Software"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,KLISS, TNList, School of Software","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071254672","display_name":"Yi-Hao Peng","orcid":"https://orcid.org/0000-0002-6335-5904"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yihao Peng","raw_affiliation_strings":["Tsinghua University,KLISS, TNList, School of Software"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,KLISS, TNList, School of Software","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047356461","display_name":"Yilun Sun","orcid":"https://orcid.org/0000-0002-6249-2704"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yilun Sun","raw_affiliation_strings":["Tsinghua University,KLISS, TNList, School of Software"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,KLISS, TNList, School of Software","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009744117","display_name":"Xuancheng Zhang","orcid":"https://orcid.org/0000-0001-6054-733X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuancheng Zhang","raw_affiliation_strings":["Tsinghua University,KLISS, TNList, School of Software"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,KLISS, TNList, School of Software","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073617379","display_name":"Hai Wan","orcid":"https://orcid.org/0000-0002-9608-5808"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hai Wan","raw_affiliation_strings":["Tsinghua University,KLISS, TNList, School of Software"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,KLISS, TNList, School of Software","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100773043","display_name":"Xibin Zhao","orcid":"https://orcid.org/0000-0002-6168-7016"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xibin Zhao","raw_affiliation_strings":["Tsinghua University,KLISS, TNList, School of Software"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,KLISS, TNList, School of Software","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I99065089"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2799","last_page":"2816"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7069449424743652},{"id":"https://openalex.org/keywords/server-side","display_name":"Server-side","score":0.5966061949729919},{"id":"https://openalex.org/keywords/side-channel-attack","display_name":"Side channel attack","score":0.5311433672904968},{"id":"https://openalex.org/keywords/client-side","display_name":"Client-side","score":0.4991798400878906},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.4647378921508789},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4459972381591797},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.42397966980934143},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3352622389793396},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.31482744216918945},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.2192031443119049}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7069449424743652},{"id":"https://openalex.org/C14414571","wikidata":"https://www.wikidata.org/wiki/Q519081","display_name":"Server-side","level":2,"score":0.5966061949729919},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.5311433672904968},{"id":"https://openalex.org/C202477664","wikidata":"https://www.wikidata.org/wiki/Q1352449","display_name":"Client-side","level":2,"score":0.4991798400878906},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.4647378921508789},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4459972381591797},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.42397966980934143},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3352622389793396},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.31482744216918945},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2192031443119049}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46215.2023.10179402","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179402","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320337504","display_name":"Research and Development","ror":"https://ror.org/027s68j25"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W56903481","https://openalex.org/W168132470","https://openalex.org/W747516962","https://openalex.org/W1537258151","https://openalex.org/W1545566155","https://openalex.org/W1985108724","https://openalex.org/W2001496424","https://openalex.org/W2009232481","https://openalex.org/W2029129836","https://openalex.org/W2098087513","https://openalex.org/W2099964107","https://openalex.org/W2103499520","https://openalex.org/W2145969515","https://openalex.org/W2213728018","https://openalex.org/W2237023204","https://openalex.org/W2276979642","https://openalex.org/W2579106964","https://openalex.org/W2604395162","https://openalex.org/W2747669027","https://openalex.org/W2752929869","https://openalex.org/W2792591096","https://openalex.org/W2793337260","https://openalex.org/W2885157095","https://openalex.org/W2947745012","https://openalex.org/W2998038410","https://openalex.org/W3007878096","https://openalex.org/W3008508243","https://openalex.org/W3022067606","https://openalex.org/W3102912121","https://openalex.org/W3109217941","https://openalex.org/W3126165507","https://openalex.org/W3138838255","https://openalex.org/W3195954353","https://openalex.org/W3216595328","https://openalex.org/W4205220950","https://openalex.org/W4245671428","https://openalex.org/W6601859066","https://openalex.org/W6628457668","https://openalex.org/W6696473490","https://openalex.org/W6712595259","https://openalex.org/W6737388319","https://openalex.org/W6743841043","https://openalex.org/W6754375631"],"related_works":["https://openalex.org/W3005688497","https://openalex.org/W4302890120","https://openalex.org/W4322735059","https://openalex.org/W4301042531","https://openalex.org/W4319448716","https://openalex.org/W2993438822","https://openalex.org/W3003811204","https://openalex.org/W3014448854","https://openalex.org/W1979999931","https://openalex.org/W3123819699"],"abstract_inverted_index":{"The":[0,89,112,190,227],"user":[1],"interface":[2],"(UI)":[3],"of":[4,12,28,84,87,151,230],"web":[5,13,36,44,78,110,188],"applications":[6],"is":[7,27,204],"usually":[8],"the":[9,20,25,103,126,131,144,148,152,170,180,195,202],"entry":[10],"point":[11],"attacks":[14],"against":[15],"enterprises":[16],"and":[17,35,100,109,130,141,172,201,234,242],"organizations.":[18],"Finding":[19],"UI":[21,45,79,132,145,199,218],"elements":[22,219],"utilized":[23],"by":[24,98,116],"intruders":[26],"great":[29],"importance":[30],"both":[31],"for":[32,77,222],"attack":[33,40,74],"interception":[34],"application":[37],"fixing.":[38],"Current":[39],"investigation":[41,75],"methods":[42],"targeting":[43],"either":[46],"provide":[47],"rough":[48],"analysis":[49,64],"results":[50,192],"or":[51],"have":[52],"poor":[53],"performance":[54],"in":[55,158,169],"high":[56,159],"concurrency":[57,160],"scenarios,":[58],"which":[59],"leads":[60],"to":[61,166,176,212],"heavy":[62],"manual":[63],"work.":[65],"In":[66],"this":[67],"paper,":[68],"we":[69],"propose":[70],"TeSec,":[71],"an":[72,117,155],"accurate":[73],"method":[76],"applications.":[80,189],"TeSec":[81,138,163,185],"makes":[82],"use":[83],"two":[85,136],"kinds":[86],"correlations.":[88],"first":[90],"one,":[91,114],"built":[92,120],"from":[93,154,179],"annotated":[94],"audit":[95,106,235],"log":[96,107,236],"partitioned":[97],"PID/TID":[99],"delimiter-logs,":[101],"captures":[102,125],"correspondence":[104,127],"between":[105,128,198],"entries":[108],"requests.":[111],"second":[113],"modeled":[115],"Aho-Corasick":[118],"automaton":[119],"during":[121],"system":[122],"testing":[123],"period,":[124],"requests":[129],"elements/events.":[133],"Leveraging":[134],"these":[135],"correlations,":[137],"can":[139],"accurately":[140],"automatically":[142],"locate":[143],"elements/events":[146],"(i.e.,":[147],"root":[149],"cause":[150],"alarm)":[153],"alarm,":[156],"even":[157],"scenarios.":[161],"Furthermore,":[162],"only":[164,210],"needs":[165],"be":[167],"deployed":[168],"server":[171],"does":[173],"not":[174],"need":[175,211],"collect":[177],"logs":[178],"client-side":[181],"browsers.":[182],"We":[183],"evaluate":[184],"on":[186,220],"12":[187],"experimental":[191],"show":[193],"that":[194],"matching":[196],"accuracy":[197],"events/elements":[200],"alarm":[203],"above":[205],"99.6%.":[206],"And":[207],"security":[208],"analysts":[209],"check":[213],"no":[214],"more":[215],"than":[216],"2":[217],"average":[221,231],"each":[223],"individual":[224],"forensics":[225],"analysis.":[226],"maximum":[228],"overhead":[229,238],"response":[232],"time":[233],"space":[237],"are":[239],"low":[240],"(4.3%":[241],"4.6%":[243],"respectively).":[244]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}