{"id":"https://openalex.org/W4411337154","doi":"https://doi.org/10.1109/tifs.2025.3580337","title":"DeepDRAC: Disposition Recommendation for Alert Clusters Based on Security Event Patterns","display_name":"DeepDRAC: Disposition Recommendation for Alert Clusters Based on Security Event Patterns","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4411337154","doi":"https://doi.org/10.1109/tifs.2025.3580337"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3580337","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3580337","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101835164","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0002-4075-1971"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Liu","raw_affiliation_strings":["MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China"],"raw_orcid":"https://orcid.org/0000-0002-4075-1971","affiliations":[{"raw_affiliation_string":"MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I87445476"]},{"raw_affiliation_string":"MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Gaofei Ruan","orcid":"https://orcid.org/0009-0009-3568-1575"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gaofei Ruan","raw_affiliation_strings":["MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China"],"raw_orcid":"https://orcid.org/0009-0009-3568-1575","affiliations":[{"raw_affiliation_string":"MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I87445476"]},{"raw_affiliation_string":"MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109786381","display_name":"Zhenghao Luo","orcid":"https://orcid.org/0009-0003-5057-7764"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zian Luo","raw_affiliation_strings":["MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China"],"raw_orcid":"https://orcid.org/0009-0003-5057-7764","affiliations":[{"raw_affiliation_string":"MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I87445476"]},{"raw_affiliation_string":"MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100643291","display_name":"Shilong Zhang","orcid":"https://orcid.org/0000-0001-5492-0898"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shilong Zhang","raw_affiliation_strings":["MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I87445476"]},{"raw_affiliation_string":"MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101442435","display_name":"Donghao Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]},{"id":"https://openalex.org/I4210135667","display_name":"Xian Mechanical & Electric Institute (China)","ror":"https://ror.org/04d9wma96","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210135667"]},{"id":"https://openalex.org/I4210141776","display_name":"China XD Group (China)","ror":"https://ror.org/04ceqst84","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210141776"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Donghao Liu","raw_affiliation_strings":["Shaanxi Electric Power Corporation Ltd., Xi’an, Shaanxi, China","State Grid Information and Telecommunication Company of Shaanxi Electric Power Corporation Limited, Xi’an, Shaanxi, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shaanxi Electric Power Corporation Ltd., Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I4210135667","https://openalex.org/I4210141776"]},{"raw_affiliation_string":"State Grid Information and Telecommunication Company of Shaanxi Electric Power Corporation Limited, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004581155","display_name":"Xinxiang Fan","orcid":"https://orcid.org/0000-0001-8495-6488"},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]},{"id":"https://openalex.org/I4210135667","display_name":"Xian Mechanical & Electric Institute (China)","ror":"https://ror.org/04d9wma96","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210135667"]},{"id":"https://openalex.org/I4210141776","display_name":"China XD Group (China)","ror":"https://ror.org/04ceqst84","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210141776"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Fan","raw_affiliation_strings":["Shaanxi Electric Power Corporation Ltd., Xi’an, Shaanxi, China","State Grid Information and Telecommunication Company of Shaanxi Electric Power Corporation Limited, Xi’an, Shaanxi, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shaanxi Electric Power Corporation Ltd., Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I4210135667","https://openalex.org/I4210141776"]},{"raw_affiliation_string":"State Grid Information and Telecommunication Company of Shaanxi Electric Power Corporation Limited, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065675742","display_name":"Yadong Zhou","orcid":"https://orcid.org/0000-0003-0345-3518"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yadong Zhou","raw_affiliation_strings":["MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China"],"raw_orcid":"https://orcid.org/0000-0003-0345-3518","affiliations":[{"raw_affiliation_string":"MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I87445476"]},{"raw_affiliation_string":"MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101554099","display_name":"Ting Liu","orcid":"https://orcid.org/0000-0002-7600-0934"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ting Liu","raw_affiliation_strings":["MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China"],"raw_orcid":"https://orcid.org/0000-0002-7600-0934","affiliations":[{"raw_affiliation_string":"MOE KLINNS Laboratory, Xi’an Jiaotong University, Xi’an, Shaanxi, China","institution_ids":["https://openalex.org/I87445476"]},{"raw_affiliation_string":"MOE KLINNS Lab of Xi’an Jiaotong University, Xi’an, Shaanxi Province, China","institution_ids":["https://openalex.org/I87445476"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.7465,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.90770613,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"20","issue":null,"first_page":"6443","last_page":"6458"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.9876000285148621,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.961899995803833,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7718389630317688},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.4911455810070038},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3909655511379242}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7718389630317688},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.4911455810070038},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3909655511379242},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3580337","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3580337","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Climate action","score":0.4099999964237213,"id":"https://metadata.un.org/sdg/13"}],"awards":[{"id":"https://openalex.org/G1054163106","display_name":null,"funder_award_id":"2020M683520","funder_id":"https://openalex.org/F4320321543","funder_display_name":"China Postdoctoral Science Foundation"},{"id":"https://openalex.org/G120420423","display_name":null,"funder_award_id":"62293500, 62293501, 62293502, 61833015","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G1366928578","display_name":null,"funder_award_id":"62272373","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3545694276","display_name":null,"funder_award_id":"62293500","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G578531546","display_name":null,"funder_award_id":"2022YFB2703500","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G6442699438","display_name":null,"funder_award_id":"62293502","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7355380096","display_name":null,"funder_award_id":"62293501","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321543","display_name":"China Postdoctoral Science Foundation","ror":"https://ror.org/0426zh255"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W1971421925","https://openalex.org/W2064853889","https://openalex.org/W2095293504","https://openalex.org/W2112262143","https://openalex.org/W2127048411","https://openalex.org/W2131681506","https://openalex.org/W2132202037","https://openalex.org/W2153624566","https://openalex.org/W2155926039","https://openalex.org/W2476002244","https://openalex.org/W2594016977","https://openalex.org/W2789828921","https://openalex.org/W2810662166","https://openalex.org/W2947745012","https://openalex.org/W2964015378","https://openalex.org/W2986291326","https://openalex.org/W2998714163","https://openalex.org/W3119101352","https://openalex.org/W3201572672","https://openalex.org/W3204453541","https://openalex.org/W3211484264","https://openalex.org/W4210262502","https://openalex.org/W4211076842","https://openalex.org/W4281706128","https://openalex.org/W4311165940","https://openalex.org/W4385080331","https://openalex.org/W4387623705","https://openalex.org/W4388571717","https://openalex.org/W4391889560","https://openalex.org/W4401508167","https://openalex.org/W4404316985","https://openalex.org/W4405022749","https://openalex.org/W4408441768","https://openalex.org/W6680132778","https://openalex.org/W6690815549","https://openalex.org/W6736685754","https://openalex.org/W6743979602","https://openalex.org/W6762003241","https://openalex.org/W6772452955","https://openalex.org/W6779686349","https://openalex.org/W6802810016","https://openalex.org/W7000447106"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"In":[0],"the":[1,88,91,124,142,154,159,162,168,172,179,206,250],"security":[2,10,13,40,52,83,92,163,173,176,192],"operation":[3],"center,":[4],"false":[5,120],"positive":[6],"alerts":[7,50,77,121],"generated":[8],"by":[9,123],"devices":[11],"overwhelm":[12],"operators,":[14],"leading":[15],"to":[16,47,78,140],"alert":[17,34,209,243],"fatigue":[18,244],"and":[19,54,102,222,224,247],"inefficiency":[20],"in":[21,129],"identifying":[22],"real":[23],"threats.":[24],"This":[25],"paper":[26],"introduces":[27],"DEEPDRAC,":[28],"a":[29,79,82,106,130,225,229],"disposition":[30,198],"recommendation":[31],"method":[32],"for":[33,184,200],"clusters":[35],"that":[36,113,238],"is":[37,46],"based":[38],"on":[39,115,215],"event":[41,93],"patterns.":[42,61],"Our":[43],"main":[44],"idea":[45],"reconstruct":[48],"isolated":[49],"into":[51,137],"events":[53,177],"capture":[55],"their":[56],"essential":[57],"threat":[58],"characteristics":[59],"as":[60,153],"By":[62],"recommending":[63],"pattern":[64,160,166,181],"information,":[65,151],"we":[66],"enable":[67],"batch":[68,185],"interpretable":[69,138],"disposal":[70],"of":[71,90,161,171,208],"alerts.":[72],"First,":[73],"DEEPDRAC":[74,133,194],"aggregates":[75],"correlated":[76],"graph,":[80],"representing":[81],"event.":[84,164],"Then,":[85],"it":[86],"extracts":[87],"features":[89,98,104,136],"from":[94,228],"two":[95,216,251],"aspects:":[96],"basic":[97,135,143],"via":[99,105],"statistical":[100],"methods":[101],"detailed":[103,149,155],"carefully":[107],"designed":[108],"Graph":[109],"Neural":[110],"Network":[111],"(GNN)":[112],"focuses":[114],"edge":[116],"features.":[117],"Since":[118],"many":[119],"triggered":[122],"same":[125,180],"cause":[126],"often":[127],"recur":[128],"fixed":[131],"pattern,":[132,144,156],"translates":[134],"descriptors":[139],"define":[141],"whereas":[145],"GNN":[146],"embeddings":[147],"complement":[148],"semantic":[150],"serving":[152],"together":[157],"forming":[158],"The":[165,233],"describes":[167],"critical":[169],"information":[170],"event,":[174],"so":[175],"with":[178,188],"are":[182],"clustered":[183],"processing.":[186],"Finally,":[187],"few":[189],"manually":[190],"labeled":[191],"events,":[193],"can":[195,241],"conduct":[196],"automatic":[197],"recommendations":[199],"newly":[201],"arrived":[202],"alerts,":[203],"significantly":[204],"reducing":[205],"workload":[207],"analysis.":[210],"We":[211],"evaluate":[212],"our":[213,239],"approach":[214,240],"benchmark":[217],"datasets":[218],"(i.e.,":[219],"DARPA":[220],"1999":[221],"CIC-IDS2017)":[223],"real-world":[226],"dataset":[227],"large":[230],"power":[231],"company.":[232],"extensive":[234],"experimental":[235],"results":[236],"demonstrate":[237],"alleviate":[242],"more":[245],"efficiently":[246],"accurately":[248],"than":[249],"state-of-the-art":[252],"defense":[253],"approaches":[254],"can.":[255]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}