{"id":"https://openalex.org/W3185502221","doi":"https://doi.org/10.1109/tifs.2021.3098977","title":"TRACE: Enterprise-Wide Provenance Tracking for Real-Time APT Detection","display_name":"TRACE: Enterprise-Wide Provenance Tracking for Real-Time APT Detection","publication_year":2021,"publication_date":"2021-01-01","ids":{"openalex":"https://openalex.org/W3185502221","doi":"https://doi.org/10.1109/tifs.2021.3098977","mag":"3185502221"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2021.3098977","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2021.3098977","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086332357","display_name":"Hassaan Irshad","orcid":"https://orcid.org/0000-0002-3771-7844"},"institutions":[{"id":"https://openalex.org/I1298353152","display_name":"SRI International","ror":"https://ror.org/05s570m15","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1298353152"]},{"id":"https://openalex.org/I4210099336","display_name":"Menlo School","ror":"https://ror.org/01240pn49","country_code":"US","type":"education","lineage":["https://openalex.org/I4210099336"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hassaan Irshad","raw_affiliation_strings":["SRI International, Menlo Park, CA, USA"],"raw_orcid":"https://orcid.org/0000-0002-3771-7844","affiliations":[{"raw_affiliation_string":"SRI International, Menlo Park, CA, USA","institution_ids":["https://openalex.org/I1298353152","https://openalex.org/I4210099336"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073756906","display_name":"Gabriela Ciocarlie","orcid":"https://orcid.org/0000-0002-4405-0742"},"institutions":[{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Gabriela Ciocarlie","raw_affiliation_strings":["Department of Electrical and Computer Engineering (ECE), The University of Texas, San Antonio, TX, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering (ECE), The University of Texas, San Antonio, TX, USA","institution_ids":["https://openalex.org/I45438204"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035466033","display_name":"Ashish Gehani","orcid":"https://orcid.org/0000-0002-3940-2467"},"institutions":[{"id":"https://openalex.org/I1298353152","display_name":"SRI International","ror":"https://ror.org/05s570m15","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1298353152"]},{"id":"https://openalex.org/I4210099336","display_name":"Menlo School","ror":"https://ror.org/01240pn49","country_code":"US","type":"education","lineage":["https://openalex.org/I4210099336"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ashish Gehani","raw_affiliation_strings":["SRI International, Menlo Park, CA, USA"],"raw_orcid":"https://orcid.org/0000-0002-3940-2467","affiliations":[{"raw_affiliation_string":"SRI International, Menlo Park, CA, USA","institution_ids":["https://openalex.org/I1298353152","https://openalex.org/I4210099336"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085002486","display_name":"Vinod Yegneswaran","orcid":"https://orcid.org/0000-0003-0718-6605"},"institutions":[{"id":"https://openalex.org/I1298353152","display_name":"SRI International","ror":"https://ror.org/05s570m15","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1298353152"]},{"id":"https://openalex.org/I4210099336","display_name":"Menlo School","ror":"https://ror.org/01240pn49","country_code":"US","type":"education","lineage":["https://openalex.org/I4210099336"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vinod Yegneswaran","raw_affiliation_strings":["SRI International, Menlo Park, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SRI International, Menlo Park, CA, USA","institution_ids":["https://openalex.org/I1298353152","https://openalex.org/I4210099336"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033440818","display_name":"Kyu Hyoung Lee","orcid":"https://orcid.org/0000-0001-6843-6706"},"institutions":[{"id":"https://openalex.org/I165733156","display_name":"University of Georgia","ror":"https://ror.org/00te3t702","country_code":"US","type":"education","lineage":["https://openalex.org/I165733156"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kyu Hyung Lee","raw_affiliation_strings":["Department of Computer Science, University of Georgia (UGA), Athens, GA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Georgia (UGA), Athens, GA, USA","institution_ids":["https://openalex.org/I165733156"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069237428","display_name":"Jignesh M. Patel","orcid":"https://orcid.org/0000-0003-3653-2538"},"institutions":[{"id":"https://openalex.org/I135310074","display_name":"University of Wisconsin\u2013Madison","ror":"https://ror.org/01y2jtd41","country_code":"US","type":"education","lineage":["https://openalex.org/I135310074"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jignesh Patel","raw_affiliation_strings":["Department of Computer Sciences, University of Wisconsin\u2013Madison, Madison, WI, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Sciences, University of Wisconsin\u2013Madison, Madison, WI, USA","institution_ids":["https://openalex.org/I135310074"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088826068","display_name":"Somesh Jha","orcid":"https://orcid.org/0000-0001-5877-0436"},"institutions":[{"id":"https://openalex.org/I135310074","display_name":"University of Wisconsin\u2013Madison","ror":"https://ror.org/01y2jtd41","country_code":"US","type":"education","lineage":["https://openalex.org/I135310074"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Somesh Jha","raw_affiliation_strings":["Department of Computer Sciences, University of Wisconsin\u2013Madison, Madison, WI, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Sciences, University of Wisconsin\u2013Madison, Madison, WI, USA","institution_ids":["https://openalex.org/I135310074"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053834185","display_name":"Yonghwi Kwon","orcid":"https://orcid.org/0000-0002-0021-2850"},"institutions":[{"id":"https://openalex.org/I51556381","display_name":"University of Virginia","ror":"https://ror.org/0153tk833","country_code":"US","type":"education","lineage":["https://openalex.org/I51556381"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yonghwi Kwon","raw_affiliation_strings":["Department of Computer Science, University of Virginia, Charlottesville, VA, USA"],"raw_orcid":"https://orcid.org/0000-0002-0021-2850","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Virginia, Charlottesville, VA, USA","institution_ids":["https://openalex.org/I51556381"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108280598","display_name":"Dongyan Xu","orcid":null},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dongyan Xu","raw_affiliation_strings":["Department of Computer Science, Purdue University, West Lafayette, IN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Purdue University, West Lafayette, IN, USA","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100362472","display_name":"Xiangyu Zhang","orcid":"https://orcid.org/0000-0003-4857-2318"},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiangyu Zhang","raw_affiliation_strings":["Department of Computer Science, Purdue University, West Lafayette, IN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Purdue University, West Lafayette, IN, USA","institution_ids":["https://openalex.org/I219193219"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":17.4496,"has_fulltext":false,"cited_by_count":65,"citation_normalized_percentile":{"value":0.98711417,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":100},"biblio":{"volume":"16","issue":null,"first_page":"4363","last_page":"4376"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9902999997138977,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9868000149726868,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8327330946922302},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.7060256004333496},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.7057406902313232},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.6122766137123108},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.5527721643447876},{"id":"https://openalex.org/keywords/fidelity","display_name":"Fidelity","score":0.45845240354537964},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.35994839668273926},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.33502593636512756},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.246233731508255},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.18240177631378174},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.0956733226776123}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8327330946922302},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.7060256004333496},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.7057406902313232},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.6122766137123108},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.5527721643447876},{"id":"https://openalex.org/C2776459999","wikidata":"https://www.wikidata.org/wiki/Q2119376","display_name":"Fidelity","level":2,"score":0.45845240354537964},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.35994839668273926},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.33502593636512756},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.246233731508255},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.18240177631378174},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0956733226776123},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2021.3098977","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2021.3098977","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.4099999964237213,"display_name":"Industry, innovation and infrastructure"}],"awards":[{"id":"https://openalex.org/G6091103392","display_name":null,"funder_award_id":"ACI-1547467","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7202700851","display_name":null,"funder_award_id":"CNS-1514503","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8456866689","display_name":null,"funder_award_id":"FA8650-15-C-7562","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":64,"referenced_works":["https://openalex.org/W168132470","https://openalex.org/W1444906800","https://openalex.org/W1584150393","https://openalex.org/W1821004526","https://openalex.org/W2009232481","https://openalex.org/W2052897520","https://openalex.org/W2089745089","https://openalex.org/W2093406244","https://openalex.org/W2093427535","https://openalex.org/W2096347345","https://openalex.org/W2099204735","https://openalex.org/W2108747667","https://openalex.org/W2112582917","https://openalex.org/W2119251836","https://openalex.org/W2128226234","https://openalex.org/W2129167530","https://openalex.org/W2133089788","https://openalex.org/W2134633067","https://openalex.org/W2135275550","https://openalex.org/W2143546156","https://openalex.org/W2144789413","https://openalex.org/W2144992712","https://openalex.org/W2148135249","https://openalex.org/W2159357881","https://openalex.org/W2160595851","https://openalex.org/W2170646878","https://openalex.org/W2295705535","https://openalex.org/W2397699236","https://openalex.org/W2401617229","https://openalex.org/W2747669027","https://openalex.org/W2751114427","https://openalex.org/W2751844787","https://openalex.org/W2790557990","https://openalex.org/W2792591096","https://openalex.org/W2806057024","https://openalex.org/W2885157095","https://openalex.org/W2886539179","https://openalex.org/W2892116995","https://openalex.org/W2962703433","https://openalex.org/W2962785074","https://openalex.org/W2963556271","https://openalex.org/W2978956219","https://openalex.org/W2998038410","https://openalex.org/W3006711782","https://openalex.org/W3008508243","https://openalex.org/W3015650867","https://openalex.org/W3080678972","https://openalex.org/W3099203541","https://openalex.org/W3101089035","https://openalex.org/W3105223459","https://openalex.org/W3105780912","https://openalex.org/W3128423322","https://openalex.org/W4205777466","https://openalex.org/W4239813889","https://openalex.org/W4255411440","https://openalex.org/W6628457668","https://openalex.org/W6679379537","https://openalex.org/W6712595259","https://openalex.org/W6713252871","https://openalex.org/W6743841043","https://openalex.org/W6751629095","https://openalex.org/W6753967410","https://openalex.org/W6782167706","https://openalex.org/W6785336966"],"related_works":["https://openalex.org/W2381850946","https://openalex.org/W4380449851","https://openalex.org/W3125091513","https://openalex.org/W4318832338","https://openalex.org/W2389214306","https://openalex.org/W4248383205","https://openalex.org/W4234745530","https://openalex.org/W2146383839","https://openalex.org/W2231829109","https://openalex.org/W2061122711"],"abstract_inverted_index":{"We":[0,58,110],"present":[1],"TRACE,":[2],"a":[3,53,65],"comprehensive":[4],"provenance":[5,29],"tracking":[6],"system":[7,74,86,123,130,136],"for":[8],"scalable,":[9],"real-time,":[10],"enterprise-wide":[11,55],"APT":[12,126,146],"detection.":[13],"TRACE":[14,63,153],"uses":[15],"static":[16],"analysis":[17,150],"to":[18,49,72,92,143,157,180],"identify":[19],"program":[20],"unit":[21],"structures":[22],"and":[23,79,97,104,128,173,182],"inter-unit":[24],"dependences,":[25],"such":[26],"that":[27,152],"the":[28,35,39,60,73,85,95,162,169],"of":[30,52,62,107,122,161],"an":[31,119],"output":[32],"event":[33],"includes":[34],"input":[36,133],"events":[37],"within":[38],"same":[40],"unit.":[41],"Provenance":[42],"collected":[43],"from":[44,114,134],"individual":[45],"hosts":[46],"are":[47],"integrated":[48],"facilitate":[50],"construction":[51],"distributed":[54],"causal":[56],"graph.":[57],"describe":[59],"evolution":[61],"over":[64,102,159],"four-year":[66],"period,":[67],"during":[68],"which":[69],"our":[70,135],"improvements":[71],"focused":[75],"on":[76],"performance,":[77],"scalability,":[78],"fidelity.":[80],"In":[81],"this":[82],"time":[83,96],"span,":[84],"call":[87],"coverage":[88],"increased":[89],"(from":[90],"47":[91],"66)":[93],"while":[94],"space":[98],"overhead":[99,175],"reduced":[100,178],"by":[101,139],"one":[103],"two":[105],"orders":[106],"magnitude,":[108],"respectively.":[109,184],"also":[111],"provide":[112],"results":[113],"five":[115],"adversarial":[116],"engagements":[117],"where":[118],"independent":[120],"team":[121],"evaluators":[124],"conducted":[125],"attacks":[127],"assessed":[129],"performance.":[131],"The":[132],"was":[137],"used":[138],"three":[140],"other":[141],"teams":[142],"implement":[144],"real-time":[145],"detection":[147],"logic.":[148],"Retrospective":[149],"revealed":[151],"provided":[154],"sufficient":[155],"evidence":[156],"detect":[158],"80%":[160],"attack":[163],"stages":[164],"across":[165],"all":[166],"evaluations.":[167],"By":[168],"last":[170],"engagement,":[171],"temporal":[172],"spatial":[174],"had":[176],"been":[177],"significantly":[179],"18%":[181],"10%,":[183]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":23},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":15},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":3}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}