{"id":"https://openalex.org/W2889727957","doi":"https://doi.org/10.1145/3243734.3243763","title":"NodeMerge","display_name":"NodeMerge","publication_year":2018,"publication_date":"2018-10-15","ids":{"openalex":"https://openalex.org/W2889727957","doi":"https://doi.org/10.1145/3243734.3243763","mag":"2889727957"},"language":"en","primary_location":{"id":"doi:10.1145/3243734.3243763","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3243734.3243763","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053221786","display_name":"Yutao Tang","orcid":null},"institutions":[{"id":"https://openalex.org/I267592682","display_name":"Williams (United States)","ror":"https://ror.org/007zhvp17","country_code":"US","type":"company","lineage":["https://openalex.org/I267592682"]},{"id":"https://openalex.org/I16285277","display_name":"William & Mary","ror":"https://ror.org/03hsf0573","country_code":"US","type":"education","lineage":["https://openalex.org/I16285277"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Yutao Tang","raw_affiliation_strings":["The College of William and Mary, Williamsburg, VA, USA"],"affiliations":[{"raw_affiliation_string":"The College of William and Mary, Williamsburg, VA, USA","institution_ids":["https://openalex.org/I16285277","https://openalex.org/I267592682"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101945602","display_name":"Ding Li","orcid":"https://orcid.org/0009-0001-2215-978X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ding Li","raw_affiliation_strings":["NEC Laboratories America Inc, Princeton, NJ, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc, Princeton, NJ, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108134931","display_name":"Zhichun Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhichun Li","raw_affiliation_strings":["NEC Laboratories America Inc, Princeton, VA, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc, Princeton, VA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100695047","display_name":"Mu Zhang","orcid":"https://orcid.org/0000-0001-5905-9515"},"institutions":[{"id":"https://openalex.org/I205783295","display_name":"Cornell University","ror":"https://ror.org/05bnh6r87","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mu Zhang","raw_affiliation_strings":["Cornell University, Ithaca, NY, USA"],"affiliations":[{"raw_affiliation_string":"Cornell University, Ithaca, NY, USA","institution_ids":["https://openalex.org/I205783295"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024705395","display_name":"Kangkook Jee","orcid":"https://orcid.org/0000-0003-3797-4637"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kangkook Jee","raw_affiliation_strings":["NEC Laboratories America Inc, Princeton, NJ, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc, Princeton, NJ, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012621594","display_name":"Xusheng Xiao","orcid":"https://orcid.org/0000-0003-4797-4294"},"institutions":[{"id":"https://openalex.org/I58956616","display_name":"Case Western Reserve University","ror":"https://ror.org/051fd9666","country_code":"US","type":"education","lineage":["https://openalex.org/I58956616"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xusheng Xiao","raw_affiliation_strings":["Case Western Reserve University, Cleveland, OH, USA"],"affiliations":[{"raw_affiliation_string":"Case Western Reserve University, Cleveland, OH, USA","institution_ids":["https://openalex.org/I58956616"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103189621","display_name":"Zhenyu Wu","orcid":"https://orcid.org/0000-0003-4345-5075"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhenyu Wu","raw_affiliation_strings":["NEC Laboratories America Inc, Princeton, NJ, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc, Princeton, NJ, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054561146","display_name":"Junghwan Rhee","orcid":"https://orcid.org/0000-0002-4043-9371"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Junghwan Rhee","raw_affiliation_strings":["NEC Laboratories America Inc, Princeton, NJ, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc, Princeton, NJ, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114549816","display_name":"Fengyuan Xu","orcid":"https://orcid.org/0000-0003-3388-7544"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fengyuan Xu","raw_affiliation_strings":["Nanjing University, Nanjing, China"],"affiliations":[{"raw_affiliation_string":"Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100426184","display_name":"Qun Li","orcid":"https://orcid.org/0000-0003-2231-6615"},"institutions":[{"id":"https://openalex.org/I267592682","display_name":"Williams (United States)","ror":"https://ror.org/007zhvp17","country_code":"US","type":"company","lineage":["https://openalex.org/I267592682"]},{"id":"https://openalex.org/I16285277","display_name":"William & Mary","ror":"https://ror.org/03hsf0573","country_code":"US","type":"education","lineage":["https://openalex.org/I16285277"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qun Li","raw_affiliation_strings":["The College of William and Mary, Williamsburg, VA, USA"],"affiliations":[{"raw_affiliation_string":"The College of William and Mary, Williamsburg, VA, USA","institution_ids":["https://openalex.org/I16285277","https://openalex.org/I267592682"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":10,"corresponding_author_ids":["https://openalex.org/A5053221786"],"corresponding_institution_ids":["https://openalex.org/I16285277","https://openalex.org/I267592682"],"apc_list":null,"apc_paid":null,"fwci":4.8751,"has_fulltext":false,"cited_by_count":84,"citation_normalized_percentile":{"value":0.9554081,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1324","last_page":"1337"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10101","display_name":"Cloud Computing and Resource Management","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8327094912528992},{"id":"https://openalex.org/keywords/causality","display_name":"Causality (physics)","score":0.560533881187439},{"id":"https://openalex.org/keywords/raw-data","display_name":"Raw data","score":0.5179544687271118},{"id":"https://openalex.org/keywords/reduction","display_name":"Reduction (mathematics)","score":0.5065416097640991},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5053485035896301},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.4767487943172455},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4440295696258545},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.441873162984848},{"id":"https://openalex.org/keywords/data-quality","display_name":"Data quality","score":0.4157659113407135},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.12411588430404663},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.09161919355392456}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8327094912528992},{"id":"https://openalex.org/C64357122","wikidata":"https://www.wikidata.org/wiki/Q1149766","display_name":"Causality (physics)","level":2,"score":0.560533881187439},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.5179544687271118},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.5065416097640991},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5053485035896301},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.4767487943172455},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4440295696258545},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.441873162984848},{"id":"https://openalex.org/C24756922","wikidata":"https://www.wikidata.org/wiki/Q1757694","display_name":"Data quality","level":3,"score":0.4157659113407135},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.12411588430404663},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.09161919355392456},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C21547014","wikidata":"https://www.wikidata.org/wiki/Q1423657","display_name":"Operations management","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3243734.3243763","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3243734.3243763","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.4399999976158142,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1482810056","https://openalex.org/W1486762028","https://openalex.org/W1576185228","https://openalex.org/W1993478093","https://openalex.org/W2009766178","https://openalex.org/W2021201118","https://openalex.org/W2021238570","https://openalex.org/W2056910091","https://openalex.org/W2064853889","https://openalex.org/W2093406244","https://openalex.org/W2094227925","https://openalex.org/W2096347345","https://openalex.org/W2112127916","https://openalex.org/W2112525062","https://openalex.org/W2114665058","https://openalex.org/W2124545752","https://openalex.org/W2126381420","https://openalex.org/W2130433404","https://openalex.org/W2133089788","https://openalex.org/W2137842875","https://openalex.org/W2142753309","https://openalex.org/W2145969515","https://openalex.org/W2159357881","https://openalex.org/W2168103835","https://openalex.org/W2213728018","https://openalex.org/W2276979642","https://openalex.org/W2295705535","https://openalex.org/W2397699236","https://openalex.org/W2461250372","https://openalex.org/W2532844970","https://openalex.org/W2547643923","https://openalex.org/W2579106964","https://openalex.org/W2601206855","https://openalex.org/W2604395162","https://openalex.org/W2755094099","https://openalex.org/W2790557990","https://openalex.org/W2887200831","https://openalex.org/W2963556271","https://openalex.org/W4240553966","https://openalex.org/W4245671428","https://openalex.org/W4245857357","https://openalex.org/W4252403066","https://openalex.org/W4255411440"],"related_works":["https://openalex.org/W2081494945","https://openalex.org/W2389053294","https://openalex.org/W2067317451","https://openalex.org/W1970893504","https://openalex.org/W4312071518","https://openalex.org/W2901208600","https://openalex.org/W1677090476","https://openalex.org/W2154771632","https://openalex.org/W3033117735","https://openalex.org/W2746208547"],"abstract_inverted_index":{"Today's":[0],"enterprises":[1,24],"are":[2],"exposed":[3],"to":[4,41],"sophisticated":[5],"attacks,":[6,12,23],"such":[7,76],"as":[8,241,243,255,257],"Advanced":[9],"Persistent":[10],"Threats~(APT)":[11],"which":[13,220],"usually":[14],"consist":[15],"of":[16,72,80,97,107,141,170,182,200,217,226,235,250],"stealthy":[17],"multiple":[18],"steps.":[19,54],"To":[20,111,209],"counter":[21],"these":[22],"often":[25],"rely":[26],"on":[27,30,138,149,155],"causality":[28,60,100,109,171,195,271],"analysis":[29,61,101,172,272],"the":[31,43,64,95,105,108,139,150,163,168,174,192,232,247,251,261,270],"system":[32,39,66,126,129,142,229,237],"activity":[33],"data":[34,73,81,98,124,144,147,186,201,239],"collected":[35],"from":[36,48],"a":[37,69,77,88,121,179,215,276],"ubiquitous":[38,65],"monitoring":[40,67],"discover":[42],"initial":[44],"penetration":[45],"point,":[46],"and":[47,74,102,145,246,274,282],"there":[49,86],"identify":[50],"previously":[51],"unknown":[52],"attack":[53],"However,":[55],"one":[56],"major":[57],"challenge":[58],"for":[59,91,99,127,184,194,223],"is":[62,82,87],"that":[63,93,222,265],"generates":[68],"colossal":[70],"amount":[71,79,181],"hosting":[75],"huge":[78],"prohibitively":[83],"expensive.":[84],"Thus,":[85],"strong":[89],"demand":[90],"techniques":[92],"reduce":[94,162,231],"storage":[96,164,233,248],"yet":[103],"preserve":[104],"quality":[106],"analysis.":[110,196],"address":[112],"this":[113,116],"problem,":[114],"in":[115,280],"paper,":[117],"we":[118,213],"propose":[119],"NodeMerge,":[120],"template":[122],"based":[123,154],"reduction":[125,148],"online":[128,185],"event":[130],"storage.":[131],"Specifically,":[132],"our":[133,211,228,266],"approach":[134,253,267],"can":[135,160,202,230],"directly":[136,205],"work":[137],"stream":[140],"dependency":[143,238],"achieve":[146],"read-only":[151],"file":[152],"events":[153],"their":[156],"access":[157],"patterns.":[158],"It":[159],"either":[161],"cost":[165],"or":[166],"improve":[167],"performance":[169],"under":[173],"same":[175],"budget.":[176],"Only":[177],"with":[178,206],"reasonable":[180],"resource":[183],"reduction,":[187],"it":[188],"nearly":[189],"completely":[190],"preserves":[191],"accuracy":[193],"The":[197],"reduced":[198],"form":[199],"be":[203],"used":[204],"little":[207],"overhead.":[208],"evaluate":[210],"approach,":[212],"conducted":[214],"set":[216],"comprehensive":[218],"evaluations,":[219],"show":[221],"different":[224],"categories":[225],"workloads,":[227],"capacity":[234,249],"raw":[236],"by":[240,254],"high":[242,256],"75.7":[244],"times,":[245],"state-of-the-art":[252],"32.6":[258],"times.":[259],"Furthermore,":[260],"results":[262],"also":[263],"demonstrate":[264],"keeps":[268],"all":[269],"information":[273],"has":[275],"reasonably":[277],"small":[278],"overhead":[279],"memory":[281],"hard":[283],"disk.":[284]},"counts_by_year":[{"year":2025,"cited_by_count":18},{"year":2024,"cited_by_count":13},{"year":2023,"cited_by_count":12},{"year":2022,"cited_by_count":16},{"year":2021,"cited_by_count":13},{"year":2020,"cited_by_count":8},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":1}],"updated_date":"2026-03-17T09:09:15.849793","created_date":"2018-09-27T00:00:00"}