{"id":"https://openalex.org/W2964325548","doi":"https://doi.org/10.1145/3269206.3272013","title":"Collaborative Alert Ranking for Anomaly Detection","display_name":"Collaborative Alert Ranking for Anomaly Detection","publication_year":2018,"publication_date":"2018-10-17","ids":{"openalex":"https://openalex.org/W2964325548","doi":"https://doi.org/10.1145/3269206.3272013","mag":"2964325548"},"language":"en","primary_location":{"id":"doi:10.1145/3269206.3272013","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3269206.3272013","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 27th ACM International Conference on Information and Knowledge Management","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101505037","display_name":"Ying Lin","orcid":null},"institutions":[{"id":"https://openalex.org/I44461941","display_name":"University of Houston","ror":"https://ror.org/048sx0r50","country_code":"US","type":"education","lineage":["https://openalex.org/I44461941"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ying Lin","raw_affiliation_strings":["University of Houston, Houston, TX, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Houston, Houston, TX, USA","institution_ids":["https://openalex.org/I44461941"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075127080","display_name":"Zhengzhang Chen","orcid":"https://orcid.org/0000-0002-6803-0535"},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhengzhang Chen","raw_affiliation_strings":["NEC Laboratories America, Princeton, NJ, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America, Princeton, NJ, USA","institution_ids":["https://openalex.org/I20089843"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101509118","display_name":"Cheng Cao","orcid":"https://orcid.org/0000-0003-0329-6188"},"institutions":[{"id":"https://openalex.org/I1311688040","display_name":"Amazon (United States)","ror":"https://ror.org/04mv4n011","country_code":"US","type":"company","lineage":["https://openalex.org/I1311688040"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Cheng Cao","raw_affiliation_strings":["Amazon, Seattle, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Amazon, Seattle, WA, USA","institution_ids":["https://openalex.org/I1311688040"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086816138","display_name":"Lu\u2010An Tang","orcid":null},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lu-An Tang","raw_affiliation_strings":["NEC Laboratories America, Princeton, NJ, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America, Princeton, NJ, USA","institution_ids":["https://openalex.org/I20089843"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100324038","display_name":"Kai Zhang","orcid":"https://orcid.org/0000-0002-8719-9491"},"institutions":[{"id":"https://openalex.org/I84392919","display_name":"Temple University","ror":"https://ror.org/00kx1jb78","country_code":"US","type":"education","lineage":["https://openalex.org/I84392919"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kai Zhang","raw_affiliation_strings":["Temple University, Philadelphia, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Temple University, Philadelphia, PA, USA","institution_ids":["https://openalex.org/I84392919"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037724644","display_name":"Wei Cheng","orcid":"https://orcid.org/0000-0001-5456-626X"},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wei Cheng","raw_affiliation_strings":["NEC Laboratories America, Princeton, NJ, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America, Princeton, NJ, USA","institution_ids":["https://openalex.org/I20089843"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5108134931","display_name":"Zhichun Li","orcid":null},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhichun Li","raw_affiliation_strings":["NEC Laboratories America, Princeton, NJ, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America, Princeton, NJ, USA","institution_ids":["https://openalex.org/I20089843"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":17,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1987","last_page":"1995"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9939000010490417,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/categorical-variable","display_name":"Categorical variable","score":0.8509486317634583},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8150968551635742},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.6553202867507935},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6476149559020996},{"id":"https://openalex.org/keywords/ranking","display_name":"Ranking (information retrieval)","score":0.6344154477119446},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6285541653633118},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5111973881721497},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.45318031311035156},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.38410845398902893},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3201461434364319},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.15606316924095154}],"concepts":[{"id":"https://openalex.org/C5274069","wikidata":"https://www.wikidata.org/wiki/Q2285707","display_name":"Categorical variable","level":2,"score":0.8509486317634583},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8150968551635742},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6553202867507935},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6476149559020996},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.6344154477119446},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6285541653633118},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5111973881721497},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.45318031311035156},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.38410845398902893},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3201461434364319},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.15606316924095154},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3269206.3272013","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3269206.3272013","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 27th ACM International Conference on Information and Knowledge Management","raw_type":"proceedings-article"},{"id":"pmh:oai:scholarshare.temple.edu:20.500.12613/4387","is_oa":false,"landing_page_url":"http://hdl.handle.net/20.500.12613/4387","pdf_url":null,"source":{"id":"https://openalex.org/S4306402624","display_name":"TUScholarShare (Temple University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I84392919","host_organization_name":"Temple University","host_organization_lineage":["https://openalex.org/I84392919"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Partnerships for the goals","score":0.4399999976158142,"id":"https://metadata.un.org/sdg/17"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W42722137","https://openalex.org/W87822204","https://openalex.org/W1554596310","https://openalex.org/W1562135275","https://openalex.org/W1968701380","https://openalex.org/W1999448603","https://openalex.org/W2021702566","https://openalex.org/W2040029451","https://openalex.org/W2048030021","https://openalex.org/W2048125321","https://openalex.org/W2051103587","https://openalex.org/W2059513841","https://openalex.org/W2075665712","https://openalex.org/W2085789144","https://openalex.org/W2108867737","https://openalex.org/W2109288443","https://openalex.org/W2110413449","https://openalex.org/W2113777721","https://openalex.org/W2117831564","https://openalex.org/W2122646361","https://openalex.org/W2131218529","https://openalex.org/W2136561182","https://openalex.org/W2152668193","https://openalex.org/W2152790380","https://openalex.org/W2152941988","https://openalex.org/W2157874452","https://openalex.org/W2162774438","https://openalex.org/W2165840237","https://openalex.org/W2399473281","https://openalex.org/W2405593966","https://openalex.org/W2407812036","https://openalex.org/W2524714597","https://openalex.org/W2767206826","https://openalex.org/W2809401017","https://openalex.org/W2950133940","https://openalex.org/W3003678146"],"related_works":["https://openalex.org/W17155033","https://openalex.org/W3207760230","https://openalex.org/W1496222301","https://openalex.org/W1590307681","https://openalex.org/W2536018345","https://openalex.org/W4312814274","https://openalex.org/W4285370786","https://openalex.org/W2296488620","https://openalex.org/W2358353312","https://openalex.org/W2353836703"],"abstract_inverted_index":{"Given":[0],"a":[1,75,94,137],"large":[2],"number":[3],"of":[4],"low-quality":[5],"heterogeneous":[6,88,125],"categorical":[7,89,126],"alerts":[8,23,122,144,167],"collected":[9],"from":[10,87],"an":[11,110],"anomaly":[12],"detection":[13,61],"system,":[14],"how":[15],"to":[16,28,51,59,98,116],"characterize":[17],"the":[18,53,118,171,175],"complex":[19],"relationships":[20],"between":[21,121],"different":[22],"and":[24,63,84,102,133,145,154,168],"deliver":[25],"trustworthy":[26],"rankings":[27],"end":[29],"users?":[30],"While":[31],"existing":[32],"techniques":[33],"focus":[34],"on":[35],"either":[36],"mining":[37],"alert":[38,77,107,148,158],"patterns":[39],"or":[40],"filtering":[41],"out":[42],"false":[43],"positive":[44,166],"alerts,":[45],"it":[46],"can":[47,162],"be":[48],"more":[49],"advantageous":[50],"consider":[52],"two":[54],"perspectives":[55],"simultaneously":[56],"in":[57,105],"order":[58],"improve":[60],"accuracy":[62],"better":[64],"understand":[65],"abnormal":[66],"system":[67],"behaviors.":[68],"In":[69],"this":[70],"paper,":[71],"we":[72],"propose":[73],"CAR,":[74],"collaborative":[76],"ranking":[78],"framework":[79],"that":[80,160],"exploits":[81],"both":[82,100,131,143,152],"temporal":[83,132],"content":[85,119,134],"correlations":[86,120],"alerts.":[90],"CAR":[91,141,161],"first":[92],"builds":[93],"hierarchical":[95],"Bayesian":[96],"model":[97,113],"capture":[99],"short-term":[101],"long-term":[103],"dependencies":[104,135],"each":[106],"sequence.":[108],"Then,":[109],"entity":[111],"embedding-based":[112],"is":[114],"proposed":[115],"learn":[117],"via":[123],"their":[124,146],"attributes.":[127],"Finally,":[128],"by":[129],"incorporating":[130],"into":[136],"unified":[138],"optimization":[139],"framework,":[140],"ranks":[142],"corresponding":[147],"patterns.":[149],"Our":[150],"experiments-using":[151],"synthetic":[153],"real-world":[155],"enterprise":[156],"security":[157],"data-show":[159],"accurately":[163],"identify":[164],"true":[165],"successfully":[169],"reconstruct":[170],"attack":[172],"scenarios":[173],"at":[174],"same":[176],"time.":[177]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}