{"id":"https://openalex.org/W4402895803","doi":"https://doi.org/10.1109/tifs.2024.3459616","title":"The Last Mile of Attack Investigation: Audit Log Analysis Toward Software Vulnerability Location","display_name":"The Last Mile of Attack Investigation: Audit Log Analysis Toward Software Vulnerability Location","publication_year":2024,"publication_date":"2024-01-01","ids":{"openalex":"https://openalex.org/W4402895803","doi":"https://doi.org/10.1109/tifs.2024.3459616"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2024.3459616","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3459616","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5055027309","display_name":"C.-C. Chen","orcid":"https://orcid.org/0009-0007-0038-7806"},"institutions":[{"id":"https://openalex.org/I4210156423","display_name":"National Engineering Research Center for Information Technology in Agriculture","ror":"https://ror.org/04c3j3t84","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210156423"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changhua Chen","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China"],"raw_orcid":"https://orcid.org/0009-0007-0038-7806","affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China","institution_ids":["https://openalex.org/I4210156423"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108991913","display_name":"TingZhen Yan","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156423","display_name":"National Engineering Research Center for Information Technology in Agriculture","ror":"https://ror.org/04c3j3t84","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210156423"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tingzhen Yan","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China"],"raw_orcid":"https://orcid.org/0009-0009-4731-3390","affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China","institution_ids":["https://openalex.org/I4210156423"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113404292","display_name":"Chunlin Shi","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156423","display_name":"National Engineering Research Center for Information Technology in Agriculture","ror":"https://ror.org/04c3j3t84","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210156423"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chenxuan Shi","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China","institution_ids":["https://openalex.org/I4210156423"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Hao Xi","orcid":"https://orcid.org/0009-0002-5071-5306"},"institutions":[{"id":"https://openalex.org/I4210156423","display_name":"National Engineering Research Center for Information Technology in Agriculture","ror":"https://ror.org/04c3j3t84","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210156423"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Xi","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China"],"raw_orcid":"https://orcid.org/0009-0002-5071-5306","affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China","institution_ids":["https://openalex.org/I4210156423"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zhirui Fan","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156423","display_name":"National Engineering Research Center for Information Technology in Agriculture","ror":"https://ror.org/04c3j3t84","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210156423"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhirui Fan","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China","institution_ids":["https://openalex.org/I4210156423"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073617379","display_name":"Hai Wan","orcid":"https://orcid.org/0000-0002-9608-5808"},"institutions":[{"id":"https://openalex.org/I4210156423","display_name":"National Engineering Research Center for Information Technology in Agriculture","ror":"https://ror.org/04c3j3t84","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210156423"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hai Wan","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-9608-5808","affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China","institution_ids":["https://openalex.org/I4210156423"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100773043","display_name":"Xibin Zhao","orcid":"https://orcid.org/0000-0002-6168-7016"},"institutions":[{"id":"https://openalex.org/I4210156423","display_name":"National Engineering Research Center for Information Technology in Agriculture","ror":"https://ror.org/04c3j3t84","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210156423"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xibin Zhao","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-6168-7016","affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology (BNRist), Beijing, China","institution_ids":["https://openalex.org/I4210156423"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210156423"],"apc_list":null,"apc_paid":null,"fwci":2.6777,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.92220282,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"19","issue":null,"first_page":"9566","last_page":"9581"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9672999978065491,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9672999978065491,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9653000235557556,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9567999839782715,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7554671764373779},{"id":"https://openalex.org/keywords/mile","display_name":"Mile","score":0.579557478427887},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5540010929107666},{"id":"https://openalex.org/keywords/last-mile","display_name":"Last mile (transportation)","score":0.5488210916519165},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5253540873527527},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.5068817734718323},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5020921230316162},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.14817115664482117},{"id":"https://openalex.org/keywords/geography","display_name":"Geography","score":0.11958274245262146},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.08381471037864685}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7554671764373779},{"id":"https://openalex.org/C186379835","wikidata":"https://www.wikidata.org/wiki/Q253276","display_name":"Mile","level":2,"score":0.579557478427887},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5540010929107666},{"id":"https://openalex.org/C45440154","wikidata":"https://www.wikidata.org/wiki/Q6494801","display_name":"Last mile (transportation)","level":3,"score":0.5488210916519165},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5253540873527527},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.5068817734718323},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5020921230316162},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.14817115664482117},{"id":"https://openalex.org/C205649164","wikidata":"https://www.wikidata.org/wiki/Q1071","display_name":"Geography","level":0,"score":0.11958274245262146},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.08381471037864685},{"id":"https://openalex.org/C121955636","wikidata":"https://www.wikidata.org/wiki/Q4116214","display_name":"Accounting","level":1,"score":0.0},{"id":"https://openalex.org/C13280743","wikidata":"https://www.wikidata.org/wiki/Q131089","display_name":"Geodesy","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2024.3459616","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3459616","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1100049447","display_name":null,"funder_award_id":"6212780016","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4836703075","display_name":null,"funder_award_id":"2022-233-225","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7091651887","display_name":null,"funder_award_id":"62021002","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G760460541","display_name":null,"funder_award_id":"62076146","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8356187857","display_name":null,"funder_award_id":"U20A6003","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W168132470","https://openalex.org/W1813893391","https://openalex.org/W2009232481","https://openalex.org/W2096347345","https://openalex.org/W2108747667","https://openalex.org/W2124873267","https://openalex.org/W2146431583","https://openalex.org/W2213728018","https://openalex.org/W2579106964","https://openalex.org/W2747669027","https://openalex.org/W2792591096","https://openalex.org/W2891196279","https://openalex.org/W2907338990","https://openalex.org/W2970528944","https://openalex.org/W2979357014","https://openalex.org/W2988200900","https://openalex.org/W2998038410","https://openalex.org/W2999907777","https://openalex.org/W3000073896","https://openalex.org/W3007878096","https://openalex.org/W3008508243","https://openalex.org/W3016038045","https://openalex.org/W3092300773","https://openalex.org/W3138838255","https://openalex.org/W3212661259","https://openalex.org/W4230613728","https://openalex.org/W4245671428","https://openalex.org/W4285490477","https://openalex.org/W4308338538","https://openalex.org/W4362498864","https://openalex.org/W6628457668","https://openalex.org/W6712595259","https://openalex.org/W6712810931","https://openalex.org/W6796237833"],"related_works":["https://openalex.org/W4224920455","https://openalex.org/W2974961843","https://openalex.org/W4387715617","https://openalex.org/W2736109931","https://openalex.org/W2075280196","https://openalex.org/W4391768511","https://openalex.org/W4387147337","https://openalex.org/W2263936574","https://openalex.org/W2997910527","https://openalex.org/W3043199642"],"abstract_inverted_index":{"Cyberattacks":[0],"have":[1],"caused":[2],"significant":[3],"damage":[4],"and":[5,22,41,75,103,127,144,153,170,178,197],"losses":[6],"in":[7,115],"various":[8],"domains.":[9],"While":[10],"existing":[11],"attack":[12,24,60,91,168],"investigations":[13],"against":[14],"cyberattacks":[15],"focus":[16],"on":[17,65,165],"identifying":[18],"compromised":[19],"system":[20,72,135],"entities":[21],"reconstructing":[23],"stories,":[25],"there":[26],"is":[27,207],"a":[28,51,82,194],"lack":[29],"of":[30,84,113,160,176,201],"information":[31],"that":[32,132,185],"security":[33],"analysts":[34],"can":[35,94],"use":[36],"to":[37,57,187],"locate":[38],"software":[39,53],"vulnerabilities":[40,114,177],"thus":[42],"fix":[43],"them.":[44],"In":[45],"this":[46],"paper,":[47],"we":[48,162],"present":[49],"AiVl,":[50,161],"novel":[52],"vulnerability":[54,189],"location":[55,112],"method":[56],"push":[58],"the":[59,69,79,96,105,111,116,142,150,158,204],"investigation":[61],"further.":[62],"AiVl":[63,93,122,192],"relies":[64],"logs":[66,102],"collected":[67],"by":[68,138],"default":[70],"built-in":[71],"auditing":[73],"tool":[74],"program":[76,130,154,179],"binaries":[77],"within":[78],"system.":[80],"Given":[81],"sequence":[83],"malicious":[85],"log":[86,151],"entries":[87],"obtained":[88],"through":[89],"traditional":[90],"investigations,":[92],"identify":[95],"functions":[97],"responsible":[98],"for":[99],"generating":[100],"these":[101],"trace":[104],"corresponding":[106],"function":[107],"call":[108,136],"paths,":[109],"namely":[110],"source":[117],"code.":[118],"To":[119,156],"achieve":[120],"this,":[121],"proposes":[123],"an":[124,171,198],"accurate,":[125],"concise,":[126],"complete":[128],"specific-domain":[129],"modeling":[131],"constructs":[133],"all":[134],"flows":[137],"static-dynamic":[139],"techniques":[140],"from":[141],"binary,":[143],"develops":[145],"effective":[146],"matching-based":[147],"algorithms":[148],"between":[149],"sequences":[152],"models.":[155],"evaluate":[157],"effectiveness":[159],"conduct":[163],"experiments":[164],"18":[166],"real-world":[167],"scenarios":[169],"APT,":[172],"covering":[173],"comprehensive":[174],"categories":[175],"execution":[180],"classes.":[181],"The":[182],"results":[183],"show":[184],"compared":[186],"actual":[188],"remediation":[190],"reports,":[191],"achieves":[193],"100%":[195],"precision":[196],"average":[199],"recall":[200],"90%.":[202],"Besides,":[203],"runtime":[205],"overhead":[206],"reasonable,":[208],"averaging":[209],"at":[210],"7%.":[211]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-21T08:15:58.654021","created_date":"2024-09-27T00:00:00"}