{"id":"https://openalex.org/W3110889769","doi":"https://doi.org/10.1145/3427228.3427255","title":"This is Why We Can\u2019t Cache Nice Things: Lightning-Fast Threat Hunting using Suspicion-Based Hierarchical Storage","display_name":"This is Why We Can\u2019t Cache Nice Things: Lightning-Fast Threat Hunting using Suspicion-Based Hierarchical Storage","publication_year":2020,"publication_date":"2020-12-07","ids":{"openalex":"https://openalex.org/W3110889769","doi":"https://doi.org/10.1145/3427228.3427255","mag":"3110889769"},"language":"en","primary_location":{"id":"doi:10.1145/3427228.3427255","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3427228.3427255","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089936565","display_name":"Wajih Ul Hassan","orcid":"https://orcid.org/0000-0002-5676-6027"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wajih Ul Hassan","raw_affiliation_strings":["University of Illinois at Urbana-Champaign, United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign, United States of America","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039182822","display_name":"Ding Li","orcid":"https://orcid.org/0000-0001-7558-9137"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ding Li","raw_affiliation_strings":["Peking University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University, China","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024705395","display_name":"Kangkook Jee","orcid":"https://orcid.org/0000-0003-3797-4637"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kangkook Jee","raw_affiliation_strings":["University of Texas at Dallas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Texas at Dallas","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047060039","display_name":"Xiao Yu","orcid":"https://orcid.org/0000-0002-4473-3068"},"institutions":[{"id":"https://openalex.org/I4210107353","display_name":"NEC (United States)","ror":"https://ror.org/01v791m31","country_code":"US","type":"company","lineage":["https://openalex.org/I118347220","https://openalex.org/I4210107353"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiao Yu","raw_affiliation_strings":["NEC Laboratories America Inc., United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc., United States of America","institution_ids":["https://openalex.org/I4210107353"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061658828","display_name":"Kexuan Zou","orcid":null},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kexuan Zou","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100445424","display_name":"Dawei Wang","orcid":"https://orcid.org/0000-0001-9981-3623"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dawei Wang","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075127080","display_name":"Zhengzhang Chen","orcid":"https://orcid.org/0000-0002-6803-0535"},"institutions":[{"id":"https://openalex.org/I4210107353","display_name":"NEC (United States)","ror":"https://ror.org/01v791m31","country_code":"US","type":"company","lineage":["https://openalex.org/I118347220","https://openalex.org/I4210107353"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhengzhang Chen","raw_affiliation_strings":["NEC Laboratories America Inc., United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc., United States of America","institution_ids":["https://openalex.org/I4210107353"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102024215","display_name":"Zhichun Li","orcid":"https://orcid.org/0009-0006-8481-5304"},"institutions":[{"id":"https://openalex.org/I4210107353","display_name":"NEC (United States)","ror":"https://ror.org/01v791m31","country_code":"US","type":"company","lineage":["https://openalex.org/I118347220","https://openalex.org/I4210107353"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhichun Li","raw_affiliation_strings":["NEC Laboratories America Inc., United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc., United States of America","institution_ids":["https://openalex.org/I4210107353"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054561146","display_name":"Junghwan Rhee","orcid":"https://orcid.org/0000-0002-4043-9371"},"institutions":[{"id":"https://openalex.org/I139325414","display_name":"University of Central Oklahoma","ror":"https://ror.org/02n455404","country_code":"US","type":"education","lineage":["https://openalex.org/I139325414"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Junghwan Rhee","raw_affiliation_strings":["University of Central Oklahoma"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Central Oklahoma","institution_ids":["https://openalex.org/I139325414"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002240947","display_name":"Jiaping Gui","orcid":"https://orcid.org/0009-0001-4272-9604"},"institutions":[{"id":"https://openalex.org/I4210107353","display_name":"NEC (United States)","ror":"https://ror.org/01v791m31","country_code":"US","type":"company","lineage":["https://openalex.org/I118347220","https://openalex.org/I4210107353"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiaping Gui","raw_affiliation_strings":["NEC Laboratories America Inc., United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NEC Laboratories America Inc., United States of America","institution_ids":["https://openalex.org/I4210107353"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5021649580","display_name":"Adam Bates","orcid":"https://orcid.org/0000-0003-1511-4951"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Adam Bates","raw_affiliation_strings":["University of Illinois at Urbana-Champaign, United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign, United States of America","institution_ids":["https://openalex.org/I157725225"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.1073,"has_fulltext":false,"cited_by_count":33,"citation_normalized_percentile":{"value":0.88013324,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"165","last_page":"178"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8453693389892578},{"id":"https://openalex.org/keywords/cache","display_name":"Cache","score":0.5335588455200195},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5134080648422241},{"id":"https://openalex.org/keywords/asynchronous-communication","display_name":"Asynchronous communication","score":0.4957233667373657},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.4608362317085266},{"id":"https://openalex.org/keywords/memory-footprint","display_name":"Memory footprint","score":0.4560529887676239},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.4509059488773346},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.4184170365333557},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.32462626695632935},{"id":"https://openalex.org/keywords/parallel-computing","display_name":"Parallel computing","score":0.25791674852371216},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.25127077102661133},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.14271822571754456},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.14056959748268127}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8453693389892578},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.5335588455200195},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5134080648422241},{"id":"https://openalex.org/C151319957","wikidata":"https://www.wikidata.org/wiki/Q752739","display_name":"Asynchronous communication","level":2,"score":0.4957233667373657},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.4608362317085266},{"id":"https://openalex.org/C74912251","wikidata":"https://www.wikidata.org/wiki/Q6815727","display_name":"Memory footprint","level":2,"score":0.4560529887676239},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4509059488773346},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.4184170365333557},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32462626695632935},{"id":"https://openalex.org/C173608175","wikidata":"https://www.wikidata.org/wiki/Q232661","display_name":"Parallel computing","level":1,"score":0.25791674852371216},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.25127077102661133},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.14271822571754456},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.14056959748268127}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3427228.3427255","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3427228.3427255","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7599999904632568,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G214523780","display_name":null,"funder_award_id":"CNS-16-57534,CNS-17-50024","funder_id":"https://openalex.org/F4320322898","funder_display_name":"Shota Rustaveli National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320322898","display_name":"Shota Rustaveli National Science Foundation","ror":"https://ror.org/00xc87681"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W47175211","https://openalex.org/W168132470","https://openalex.org/W982826035","https://openalex.org/W1444906800","https://openalex.org/W1495304983","https://openalex.org/W1518431406","https://openalex.org/W1559255981","https://openalex.org/W2031006315","https://openalex.org/W2096347345","https://openalex.org/W2103378897","https://openalex.org/W2104593144","https://openalex.org/W2108867737","https://openalex.org/W2213728018","https://openalex.org/W2295705535","https://openalex.org/W2350778671","https://openalex.org/W2397699236","https://openalex.org/W2400243382","https://openalex.org/W2502872391","https://openalex.org/W2539828367","https://openalex.org/W2579106964","https://openalex.org/W2604395162","https://openalex.org/W2614037574","https://openalex.org/W2626975733","https://openalex.org/W2751844787","https://openalex.org/W2766852928","https://openalex.org/W2790316935","https://openalex.org/W2790557990","https://openalex.org/W2792591096","https://openalex.org/W2885157095","https://openalex.org/W2886539179","https://openalex.org/W2887200831","https://openalex.org/W2889727957","https://openalex.org/W2890262614","https://openalex.org/W2922946586","https://openalex.org/W2947745012","https://openalex.org/W2962703433","https://openalex.org/W2978956219","https://openalex.org/W3008508243","https://openalex.org/W3015650867","https://openalex.org/W3016038045","https://openalex.org/W3099203541","https://openalex.org/W3105780912"],"related_works":["https://openalex.org/W2116677773","https://openalex.org/W2155261584","https://openalex.org/W2584231425","https://openalex.org/W2150611273","https://openalex.org/W4207086172","https://openalex.org/W2042919702","https://openalex.org/W4225981436","https://openalex.org/W2156185805","https://openalex.org/W2019887508","https://openalex.org/W3170260665"],"abstract_inverted_index":{"Recent":[0],"advances":[1],"in":[2,115,159,203],"the":[3,18,112,125,135,146,151,160],"causal":[4,15,25,78,113,126,152],"analysis":[5],"can":[6],"accelerate":[7],"incident":[8],"response":[9],"time,":[10],"but":[11],"only":[12,156],"after":[13],"a":[14,67,103,167],"graph":[16,26,79,86,91,114,127,153],"of":[17,111,150,212,214],"attack":[19,51],"has":[20],"been":[21],"constructed.":[22],"Unfortunately,":[23],"existing":[24],"generation":[27,80],"techniques":[28],"are":[29],"mainly":[30],"offline":[31],"and":[32,55,76,93,154,181,199],"may":[33],"take":[34],"hours":[35],"or":[36],"days":[37],"to":[38,40,48,57,121,131,170,176,185],"respond":[39],"investigator":[41],"queries,":[42],"creating":[43],"greater":[44],"opportunity":[45],"for":[46],"attackers":[47],"hide":[49],"their":[50],"footprint,":[52],"gain":[53],"persistency,":[54],"propagate":[56],"other":[58],"machines.":[59],"To":[60,123],"address":[61],"that":[62,71,88,107,128,144,157,194],"limitation,":[63],"we":[64,137],"present":[65],"Swift,":[66],"threat":[68],"investigation":[69],"system":[70,106,174],"provides":[72],"high-throughput":[73],"causality":[74,95],"tracking":[75,96],"real-time":[77,204],"capabilities.":[81],"We":[82,101,163],"design":[83,138],"an":[84,139],"in-memory":[85],"database":[87],"enables":[89],"space-efficient":[90],"storage":[92,105],"online":[94],"with":[97],"minimal":[98],"disk":[99],"operations.":[100],"propose":[102],"hierarchical":[104],"keeps":[108],"forensically-relevant":[109],"part":[110,149,158],"main":[116,161],"memory":[117],"while":[118],"evicting":[119],"rest":[120],"disk.":[122],"identify":[124],"is":[129,196],"likely":[130],"be":[132],"relevant":[133],"during":[134],"investigation,":[136],"asynchronous":[140],"cache":[141],"eviction":[142],"policy":[143],"calculates":[145],"most":[147],"suspicious":[148],"caches":[155],"memory.":[162],"evaluated":[164],"Swift":[165,195],"on":[166],"real-world":[168],"enterprise":[169],"demonstrate":[171],"how":[172,182],"our":[173],"scales":[175],"process":[177],"typical":[178],"event":[179],"loads":[180],"it":[183],"responds":[184],"forensic":[186,201],"queries":[187,202],"when":[188,206],"security":[189],"alerts":[190],"occur.":[191],"Results":[192],"show":[193],"scalable,":[197],"modular,":[198],"answers":[200],"even":[205],"analyzing":[207],"audit":[208],"logs":[209],"containing":[210],"tens":[211],"millions":[213],"events.":[215]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":14},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":1}],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2025-10-10T00:00:00"}