{"id":"https://openalex.org/W4405022749","doi":"https://doi.org/10.1109/tr.2024.3491894","title":"BiCAM: A Bidirectional Contextualized Attentive Model for Analyzing the Correlation of Heterogeneous Security Events","display_name":"BiCAM: A Bidirectional Contextualized Attentive Model for Analyzing the Correlation of Heterogeneous Security Events","publication_year":2024,"publication_date":"2024-12-04","ids":{"openalex":"https://openalex.org/W4405022749","doi":"https://doi.org/10.1109/tr.2024.3491894"},"language":"en","primary_location":{"id":"doi:10.1109/tr.2024.3491894","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tr.2024.3491894","pdf_url":null,"source":{"id":"https://openalex.org/S87725633","display_name":"IEEE Transactions on Reliability","issn_l":"0018-9529","issn":["0018-9529","1558-1721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Reliability","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/tr.2024.3491894","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101981613","display_name":"Xi Luo","orcid":"https://orcid.org/0000-0003-2478-1529"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xi Luo","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019232164","display_name":"J.J. Wang","orcid":"https://orcid.org/0009-0007-2522-3832"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junhui Wang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0007-2522-3832","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100411650","display_name":"Lihua Yin","orcid":"https://orcid.org/0000-0001-8829-4442"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lihua Yin","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-8829-4442","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090818485","display_name":"Kaiyan Zhao","orcid":"https://orcid.org/0009-0004-8665-5813"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaiyan Zhao","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0004-8665-5813","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044543293","display_name":"Kexiang Qian","orcid":"https://orcid.org/0009-0000-3166-4043"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kexiang Qian","raw_affiliation_strings":["School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058417883","display_name":"Daojuan Zhang","orcid":"https://orcid.org/0009-0000-7173-8895"},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Daojuan Zhang","raw_affiliation_strings":["State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, SGRI Power Grid Digitizing Technology Department, State Grid Smart Grid Research Institute Company, Ltd., Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, SGRI Power Grid Digitizing Technology Department, State Grid Smart Grid Research Institute Company, Ltd., Beijing, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078467158","display_name":"Kai Chen","orcid":"https://orcid.org/0000-0001-9520-4273"},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Chen","raw_affiliation_strings":["State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, SGRI Power Grid Digitizing Technology Department, State Grid Smart Grid Research Institute Company, Ltd., Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, SGRI Power Grid Digitizing Technology Department, State Grid Smart Grid Research Institute Company, Ltd., Beijing, China","institution_ids":["https://openalex.org/I17442442"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.5583,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.92022423,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"74","issue":"2","first_page":"2640","last_page":"2654"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9936000108718872,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9936000108718872,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9433000087738037,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9208999872207642,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6432725787162781},{"id":"https://openalex.org/keywords/correlation","display_name":"Correlation","score":0.5314710736274719},{"id":"https://openalex.org/keywords/reliability-theory","display_name":"Reliability theory","score":0.4291679263114929},{"id":"https://openalex.org/keywords/reliability-engineering","display_name":"Reliability engineering","score":0.3193472921848297},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.19891107082366943},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.17126977443695068}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6432725787162781},{"id":"https://openalex.org/C117220453","wikidata":"https://www.wikidata.org/wiki/Q5172842","display_name":"Correlation","level":2,"score":0.5314710736274719},{"id":"https://openalex.org/C201729545","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability theory","level":3,"score":0.4291679263114929},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.3193472921848297},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.19891107082366943},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.17126977443695068},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C163164238","wikidata":"https://www.wikidata.org/wiki/Q2737027","display_name":"Failure rate","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tr.2024.3491894","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tr.2024.3491894","pdf_url":null,"source":{"id":"https://openalex.org/S87725633","display_name":"IEEE Transactions on Reliability","issn_l":"0018-9529","issn":["0018-9529","1558-1721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Reliability","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/tr.2024.3491894","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tr.2024.3491894","pdf_url":null,"source":{"id":"https://openalex.org/S87725633","display_name":"IEEE Transactions on Reliability","issn_l":"0018-9529","issn":["0018-9529","1558-1721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Reliability","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","score":0.4399999976158142,"display_name":"Reduced inequalities"}],"awards":[{"id":"https://openalex.org/G3856981783","display_name":null,"funder_award_id":"62102109","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":41,"referenced_works":["https://openalex.org/W1516506771","https://openalex.org/W1965555277","https://openalex.org/W2039157918","https://openalex.org/W2064675550","https://openalex.org/W2079735306","https://openalex.org/W2089468765","https://openalex.org/W2099836119","https://openalex.org/W2131774270","https://openalex.org/W2157331557","https://openalex.org/W2183341477","https://openalex.org/W2529444969","https://openalex.org/W2767094836","https://openalex.org/W2890262614","https://openalex.org/W2891432086","https://openalex.org/W2896457183","https://openalex.org/W2947745012","https://openalex.org/W2970726176","https://openalex.org/W2986944522","https://openalex.org/W2990503390","https://openalex.org/W2998038410","https://openalex.org/W2998714163","https://openalex.org/W3008508243","https://openalex.org/W3108481873","https://openalex.org/W3198775197","https://openalex.org/W3211484264","https://openalex.org/W4205462435","https://openalex.org/W4225596160","https://openalex.org/W4283662573","https://openalex.org/W4288057803","https://openalex.org/W4313644131","https://openalex.org/W4319080536","https://openalex.org/W4381569470","https://openalex.org/W4385245566","https://openalex.org/W4388571717","https://openalex.org/W4391486513","https://openalex.org/W4398186405","https://openalex.org/W4399110474","https://openalex.org/W6640212811","https://openalex.org/W6679434410","https://openalex.org/W6682889407","https://openalex.org/W7066247342"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4300939757","https://openalex.org/W2962655934","https://openalex.org/W2067279514","https://openalex.org/W3144902966"],"abstract_inverted_index":{"As":[0],"the":[1,80,101,166,185,195,230,244,256],"Internet":[2],"continues":[3],"to":[4,16,35,53,63,75,119,126,149,182,194,238,261],"evolve,":[5],"modern":[6],"information":[7,164],"technology":[8],"infrastructures":[9],"are":[10,33],"constantly":[11],"under":[12],"attack":[13],"and":[14,25,45,93,145,153,158,161,228,255],"need":[15],"be":[17],"continuously":[18],"monitored":[19],"for":[20,165],"timely":[21],"responses.":[22],"Different":[23],"devices":[24],"detection":[26],"platforms":[27],"generate":[28],"heterogeneous":[29],"security":[30,36,40,122,167,188,241],"events":[31,44,123,210,242],"that":[32,112,138,220],"sent":[34],"operations":[37],"centers,":[38],"where":[39],"operators":[41],"investigate":[42],"those":[43],"identify":[46],"potential":[47],"threats.":[48],"Unfortunately,":[49],"it":[50],"is":[51,131,251],"impossible":[52],"manually":[54],"analyze":[55],"such":[56],"a":[57,67,107,114,173],"huge":[58],"number":[59],"of":[60,70,82,140,156,187,197,249],"events,":[61,189],"leading":[62],"\u201calert":[64],"fatigue.\u201d":[65],"Despite":[66],"substantial":[68],"amount":[69],"effort":[71],"having":[72],"been":[73],"made":[74],"aggregate":[76],"redundant":[77],"related":[78],"alerts,":[79],"effectiveness":[81],"previous":[83,157],"works":[84],"was":[85],"essentially":[86],"restrained":[87],"by":[88,133,212,253],"their":[89,127],"limited":[90],"relation":[91,125],"learning":[92,117],"explaining":[94],"abilities.":[95],"In":[96,169],"this":[97],"work,":[98],"we":[99,171],"propose":[100],"bidirectional":[102,128,141,174],"contextualized":[103],"attentive":[104],"model":[105,111,203,222],"(BiCAM),":[106],"novel":[108],"contextual":[109],"analysis":[110],"uses":[113],"self-supervised":[115],"deep":[116],"approach":[118],"automatically":[120],"correlate":[121],"in":[124],"context.":[129],"It":[130],"developed":[132],"designing":[134],"an":[135,146],"encoder\u2013decoder":[136],"architecture":[137],"consists":[139],"gated":[142],"recurrent":[143],"units":[144],"attention":[147],"mechanism":[148],"capture":[150],"both":[151],"sequential":[152],"nonsequential":[154],"relations":[155],"subsequent":[159],"alerts":[160],"provide":[162],"explainability":[163],"operators.":[168],"addition,":[170],"introduce":[172],"encoder":[175],"representations":[176],"from":[177,214],"transformers":[178],"(BERT)-based":[179],"embedding":[180],"method":[181],"deal":[183],"with":[184],"heterogeneity":[186],"enhancing":[190],"our":[191,202,221],"model's":[192],"accommodation":[193],"changes":[196],"detectors.":[198],"We":[199,218],"comprehensively":[200],"evaluate":[201],"on":[204],"real-world":[205],"datasets":[206],"containing":[207],"over":[208],"11M":[209],"generated":[211],"detectors":[213],"8":[215],"different":[216],"vendors.":[217],"found":[219],"enables":[223],"accurate,":[224],"unsupervised":[225],"correlation":[226],"extraction;":[227],"outperforms":[229],"state-of-the-art":[231],"(SOTA)":[232],"work":[233],"when":[234],"applying":[235],"event":[236],"relevance":[237],"semiautomatically":[239],"classify":[240],"(e.g.,":[243],"<inline-formula":[245],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[246],"xmlns:xlink=\"http://www.w3.org/1999/xlink\"><tex-math":[247],"notation=\"LaTeX\">$F1$</tex-math></inline-formula>-score":[248],"classification":[250],"improved":[252],"4.3%":[254],"false":[257],"positive":[258],"rate":[259],"dropped":[260],"1.39%).":[262]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2025-12-19T19:40:27.379048","created_date":"2025-10-10T00:00:00"}