{"id":"https://openalex.org/W4281617842","doi":"https://doi.org/10.1145/3529466.3529480","title":"One-Class Directed Heterogeneous Graph Neural Network for Intrusion Detection","display_name":"One-Class Directed Heterogeneous Graph Neural Network for Intrusion Detection","publication_year":2022,"publication_date":"2022-03-04","ids":{"openalex":"https://openalex.org/W4281617842","doi":"https://doi.org/10.1145/3529466.3529480"},"language":"en","primary_location":{"id":"doi:10.1145/3529466.3529480","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3529466.3529480","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 the 6th International Conference on Innovation in Artificial Intelligence (ICIAI)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102301195","display_name":"Zeqi Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Zeqi Huang","raw_affiliation_strings":["Beijing Key Laboratory of Intelligent Telecommunications Software and Multimedia, School of Computer Science, Beijing University of Posts and Telecommunications, China"],"affiliations":[{"raw_affiliation_string":"Beijing Key Laboratory of Intelligent Telecommunications Software and Multimedia, School of Computer Science, Beijing University of Posts and Telecommunications, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100621678","display_name":"Yonghao Gu","orcid":"https://orcid.org/0000-0001-8021-097X"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yonghao Gu","raw_affiliation_strings":["Beijing Key Laboratory of Intelligent Telecommunications Software and Multimedia, School of Computer Science, Beijing University of Posts and Telecommunications, China and Guangdong Provincial Key Laboratory of Information Security Technology, Sun Yat-Sen University, China"],"affiliations":[{"raw_affiliation_string":"Beijing Key Laboratory of Intelligent Telecommunications Software and Multimedia, School of Computer Science, Beijing University of Posts and Telecommunications, China and Guangdong Provincial Key Laboratory of Information Security Technology, Sun Yat-Sen University, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100365847","display_name":"Qing Zhao","orcid":"https://orcid.org/0000-0002-9816-3611"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qing Zhao","raw_affiliation_strings":["Beijing Fibrlink Communications Co.Ltd, China"],"affiliations":[{"raw_affiliation_string":"Beijing Fibrlink Communications Co.Ltd, China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5102301195"],"corresponding_institution_ids":["https://openalex.org/I139759216"],"apc_list":null,"apc_paid":null,"fwci":0.5696,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":{"value":0.67085746,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"178","last_page":"184"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.995199978351593,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.745735228061676},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.548976480960846},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.5302291512489319},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5051642060279846},{"id":"https://openalex.org/keywords/graph-embedding","display_name":"Graph embedding","score":0.43606171011924744},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.43170446157455444},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.41033047437667847},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3644132614135742}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.745735228061676},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.548976480960846},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5302291512489319},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5051642060279846},{"id":"https://openalex.org/C75564084","wikidata":"https://www.wikidata.org/wiki/Q5597085","display_name":"Graph embedding","level":3,"score":0.43606171011924744},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.43170446157455444},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.41033047437667847},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3644132614135742}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3529466.3529480","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3529466.3529480","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 the 6th International Conference on Innovation in Artificial Intelligence (ICIAI)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W1614298861","https://openalex.org/W2296719434","https://openalex.org/W2519887557","https://openalex.org/W2624431344","https://openalex.org/W2751114427","https://openalex.org/W2904890881","https://openalex.org/W2944250323","https://openalex.org/W2962703433","https://openalex.org/W2963626623","https://openalex.org/W2970398671","https://openalex.org/W2978956219","https://openalex.org/W6751494907"],"related_works":["https://openalex.org/W3149439221","https://openalex.org/W4287763734","https://openalex.org/W3035116611","https://openalex.org/W3211302945","https://openalex.org/W2932872266","https://openalex.org/W4312932141","https://openalex.org/W3094552683","https://openalex.org/W4213102553","https://openalex.org/W2939638899","https://openalex.org/W4313343743"],"abstract_inverted_index":{"The":[0],"Host-based":[1],"Intrusion":[2],"Detection":[3],"System":[4],"(HIDS)":[5],"is":[6,24,78,143,194],"widely":[7],"used":[8,144],"to":[9,48,52,80,145,179,196],"safeguard":[10],"the":[11,14,18,25,33,38,53,61,65,83,116,124,128,147,150,154,158,161,165,168,181,197],"security":[12],"of":[13,22,32,85,149,160,167],"enterprise":[15,188],"environment":[16],"and":[17,42,153,164],"main":[19],"detection":[20,104,108],"target":[21],"HIDS":[23,28],"provenance":[26,34,54,66,125],"graph.":[27,131],"makes":[29],"extensive":[30],"use":[31],"graph":[35,55,67,112,126,138,152,163],"which":[36,142],"models":[37],"interactions":[39,63],"between":[40],"processes":[41],"other":[43],"system":[44],"entities":[45],"(e.g.":[46],"files),":[47],"assign":[49],"anomaly":[50,103,182],"scores":[51],"based":[56],"on":[57,64,186],"expert":[58,72],"experience.":[59,73],"However,":[60],"nonlinear":[62],"cannot":[68],"be":[69],"captured":[70],"by":[71,109],"In":[74],"addition,":[75],"attack":[76],"data":[77,189],"difficult":[79],"obtain":[81,146],"in":[82],"field":[84],"intrusion":[86,107],"detection.":[87],"To":[88],"tackle":[89],"these":[90],"problems,":[91],"we":[92,121,133],"propose":[93,134],"OC-DHetGNN":[94,193],"(One-Class":[95],"Directed":[96],"Heterogeneous":[97],"Graph":[98],"Neural":[99],"Network),":[100],"an":[101],"unsupervised":[102],"method":[105],"for":[106],"combining":[110],"heterogeneous":[111,130,137,151,162],"neural":[113,118,139,175],"networks":[114],"with":[115],"one-class":[117,174],"network.":[119],"Specifically,":[120],"first":[122],"model":[123],"as":[127],"attributed":[129],"Then":[132],"a":[135],"directed":[136],"network":[140,176],"module,":[141],"embedding":[148,159,166],"nodes.":[155],"After":[156],"that,":[157],"node":[169],"are":[170],"fed":[171],"into":[172],"two":[173],"modules":[177],"respectively":[178],"output":[180],"score.":[183],"Extensive":[184],"experiments":[185],"real":[187],"sets":[190],"have":[191],"verified":[192],"superior":[195],"baseline.":[198]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2}],"updated_date":"2026-03-03T08:47:05.690250","created_date":"2025-10-10T00:00:00"}