{"id":"https://openalex.org/W7082078214","doi":"https://doi.org/10.1109/tdsc.2025.3609834","title":"Alert2Vec: Eliminating Alert Fatigue by Embedding Security Alerts Through Subgraph Learning","display_name":"Alert2Vec: Eliminating Alert Fatigue by Embedding Security Alerts Through Subgraph Learning","publication_year":2025,"publication_date":"2025-09-15","ids":{"openalex":"https://openalex.org/W7082078214","doi":"https://doi.org/10.1109/tdsc.2025.3609834"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2025.3609834","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3609834","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Songyun Wu","orcid":"https://orcid.org/0000-0003-4382-6550"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Songyun Wu","raw_affiliation_strings":["Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-4382-6550","affiliations":[{"raw_affiliation_string":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xiaoqing Sun","orcid":"https://orcid.org/0000-0001-6942-7692"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoqing Sun","raw_affiliation_strings":["Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6942-7692","affiliations":[{"raw_affiliation_string":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Enhuan Dong","orcid":"https://orcid.org/0000-0002-2539-8241"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Enhuan Dong","raw_affiliation_strings":["Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2539-8241","affiliations":[{"raw_affiliation_string":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zhiliang Wang","orcid":"https://orcid.org/0000-0001-6587-820X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiliang Wang","raw_affiliation_strings":["Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6587-820X","affiliations":[{"raw_affiliation_string":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Chen Zhao","orcid":"https://orcid.org/0009-0007-3257-7161"},"institutions":[{"id":"https://openalex.org/I184220567","display_name":"Asian Development Bank Institute","ror":"https://ror.org/04p4ws960","country_code":"JP","type":"facility","lineage":["https://openalex.org/I184220567","https://openalex.org/I4210129130"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Chen Zhao","raw_affiliation_strings":["Information Technology Department of Asian Development Bank, Mandaluyong City, Philippines"],"raw_orcid":"https://orcid.org/0009-0007-3257-7161","affiliations":[{"raw_affiliation_string":"Information Technology Department of Asian Development Bank, Mandaluyong City, Philippines","institution_ids":["https://openalex.org/I184220567"]}]},{"author_position":"last","author":{"id":null,"display_name":"Jiahai Yang","orcid":"https://orcid.org/0000-0001-6109-6737"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiahai Yang","raw_affiliation_strings":["Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6109-6737","affiliations":[{"raw_affiliation_string":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.58445251,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":"1","first_page":"655","last_page":"669"},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6553999781608582,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6553999781608582,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13067","display_name":"Geological Modeling and Analysis","score":0.025699999183416367,"subfield":{"id":"https://openalex.org/subfields/1906","display_name":"Geochemistry and Petrology"},"field":{"id":"https://openalex.org/fields/19","display_name":"Earth and Planetary Sciences"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14311","display_name":"Electrical and Electromagnetic Research","score":0.020099999383091927,"subfield":{"id":"https://openalex.org/subfields/3107","display_name":"Atomic and Molecular Physics, and Optics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.6089000105857849},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.48969998955726624},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4388999938964844},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.4142000079154968},{"id":"https://openalex.org/keywords/subgraph-isomorphism-problem","display_name":"Subgraph isomorphism problem","score":0.3357999920845032},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.29679998755455017}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8478000164031982},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.6089000105857849},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.48969998955726624},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4388999938964844},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.42750000953674316},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.4142000079154968},{"id":"https://openalex.org/C131992880","wikidata":"https://www.wikidata.org/wiki/Q2528185","display_name":"Subgraph isomorphism problem","level":3,"score":0.3357999920845032},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C75564084","wikidata":"https://www.wikidata.org/wiki/Q5597085","display_name":"Graph embedding","level":3,"score":0.29420000314712524},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.28700000047683716},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.2718999981880188},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.2712000012397766},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.26910001039505005},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2678999900817871},{"id":"https://openalex.org/C2777035058","wikidata":"https://www.wikidata.org/wiki/Q1662634","display_name":"Clique","level":2,"score":0.26489999890327454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2025.3609834","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3609834","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/13","score":0.6736485958099365,"display_name":"Climate action"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":33,"referenced_works":["https://openalex.org/W1888005072","https://openalex.org/W2008857988","https://openalex.org/W2154851992","https://openalex.org/W2157331557","https://openalex.org/W2284900416","https://openalex.org/W2393319904","https://openalex.org/W2471008588","https://openalex.org/W2565555529","https://openalex.org/W2604942799","https://openalex.org/W2607500032","https://openalex.org/W2743104969","https://openalex.org/W2788359323","https://openalex.org/W2808803559","https://openalex.org/W2891316582","https://openalex.org/W2891432086","https://openalex.org/W2947745012","https://openalex.org/W2962756421","https://openalex.org/W2978956219","https://openalex.org/W2998038410","https://openalex.org/W2998714163","https://openalex.org/W3015650867","https://openalex.org/W3047409962","https://openalex.org/W3198775197","https://openalex.org/W3211484264","https://openalex.org/W3212665059","https://openalex.org/W3212868562","https://openalex.org/W4210262502","https://openalex.org/W4220880333","https://openalex.org/W4285292284","https://openalex.org/W4288057803","https://openalex.org/W4387011098","https://openalex.org/W4400762160","https://openalex.org/W4402265033"],"related_works":[],"abstract_inverted_index":{"With":[0,98],"increasingly":[1,41],"sophisticated":[2],"attacks":[3,20],"in":[4,170],"cyberspace,":[5],"a":[6,32,91,122,136],"growing":[7],"number":[8],"of":[9,26,51,83,158],"security":[10,27,36,84,116],"devices":[11],"are":[12,164],"deployed":[13],"on":[14,35,102,148,183,189],"the":[15,45,49,103,130,155],"organization":[16],"network":[17],"to":[18,67,69,128,143,180],"prevent":[19],"comprehensively.":[21],"However,":[22],"they":[23],"produce":[24],"thousands":[25],"alerts":[28],"each":[29],"day,":[30],"causing":[31],"severe":[33],"burden":[34],"analysts.":[37],"Thus,":[38],"it":[39],"is":[40,65,109,141,178],"concerned":[42],"about":[43],"capturing":[44],"significant":[46],"threats":[47],"from":[48],"jumble":[50],"alerts.":[52,134,159],"Previous":[53],"works":[54],"only":[55],"provided":[56],"scene-specific":[57],"algorithms":[58],"for":[59,76,111],"given":[60],"applications":[61],"or":[62,172],"services,":[63],"which":[64],"hard":[66],"extend":[68],"other":[70],"scenarios":[71],"and":[72,114,192],"consequently":[73],"not":[74],"adequate":[75],"large":[77],"organizations":[78],"that":[79,152],"deploy":[80],"multiple":[81],"kinds":[82],"devices.":[85,117],"To":[86],"address":[87],"this,":[88],"we":[89],"propose":[90],"general":[92],"alert":[93,145,162],"classification":[94,175],"approach":[95],"named":[96],"Alert2vec.":[97],"subgraph":[99,138],"learning":[100],"methods":[101],"Heterogeneous":[104],"Information":[105],"Network":[106],"(HIN),":[107],"Alert2vec":[108,119,177],"applicable":[110],"both":[112,190],"network-level":[113,191],"host-level":[115,193],"Specifically,":[118],"first":[120],"builds":[121],"heterogeneous":[123],"Alert":[124],"Intelligence":[125],"Graph":[126],"(AIG)":[127],"catch":[129],"correlation":[131],"between":[132],"different":[133],"Then,":[135],"novel":[137],"representation":[139],"method":[140],"applied":[142],"generate":[144],"vectors":[146,163],"based":[147],"six":[149],"graph":[150],"properties":[151],"can":[153],"reveal":[154],"threat":[156,168],"level":[157],"Finally,":[160],"these":[161],"labeled":[165],"with":[166],"various":[167],"levels":[169],"semi-automatic":[171],"fully":[173],"automatic":[174],"mode.":[176],"proven":[179],"be":[181],"effective":[182],"real-world":[184],"datasets,":[185],"outperforming":[186],"all":[187],"baselines":[188],"scenarios.":[194]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}