{"id":"https://openalex.org/W4311703141","doi":"https://doi.org/10.1145/3539605","title":"Provenance-based Intrusion Detection Systems: A Survey","display_name":"Provenance-based Intrusion Detection Systems: A Survey","publication_year":2022,"publication_date":"2022-06-11","ids":{"openalex":"https://openalex.org/W4311703141","doi":"https://doi.org/10.1145/3539605"},"language":"en","primary_location":{"id":"doi:10.1145/3539605","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3539605","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3539605","source":{"id":"https://openalex.org/S157921468","display_name":"ACM Computing Surveys","issn_l":"0360-0300","issn":["0360-0300","1557-7341"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Computing Surveys","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3539605","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068745152","display_name":"Michael Zipperle","orcid":"https://orcid.org/0000-0003-3957-9331"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Michael Zipperle","raw_affiliation_strings":["University of New South Wales, Canberra, Australia and Cyber Security Cooperative Research Centre, Australia"],"raw_orcid":"https://orcid.org/0000-0003-3957-9331","affiliations":[{"raw_affiliation_string":"University of New South Wales, Canberra, Australia and Cyber Security Cooperative Research Centre, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001882744","display_name":"Florian Gottwalt","orcid":"https://orcid.org/0000-0002-7173-4226"},"institutions":[{"id":"https://openalex.org/I188329596","display_name":"University of Canberra","ror":"https://ror.org/04s1nv328","country_code":"AU","type":"education","lineage":["https://openalex.org/I188329596"]},{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Florian Gottwalt","raw_affiliation_strings":["University of New South Wales, Canberra, Australia"],"raw_orcid":"https://orcid.org/0000-0002-7173-4226","affiliations":[{"raw_affiliation_string":"University of New South Wales, Canberra, Australia","institution_ids":["https://openalex.org/I188329596","https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031465905","display_name":"Elizabeth Chang","orcid":"https://orcid.org/0000-0002-4439-1854"},"institutions":[{"id":"https://openalex.org/I11701301","display_name":"Griffith University","ror":"https://ror.org/02sc3r913","country_code":"AU","type":"education","lineage":["https://openalex.org/I11701301"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Elizabeth Chang","raw_affiliation_strings":["Griffith University, Gold Coast, Australia"],"raw_orcid":"https://orcid.org/0000-0002-4439-1854","affiliations":[{"raw_affiliation_string":"Griffith University, Gold Coast, Australia","institution_ids":["https://openalex.org/I11701301"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5049421085","display_name":"Tharam S. Dillon","orcid":"https://orcid.org/0000-0002-7527-129X"},"institutions":[{"id":"https://openalex.org/I196829312","display_name":"La Trobe University","ror":"https://ror.org/01rxfrp27","country_code":"AU","type":"education","lineage":["https://openalex.org/I196829312"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Tharam Dillon","raw_affiliation_strings":["La Trobe University, Melbourne, Australia"],"raw_orcid":"https://orcid.org/0000-0002-7527-129X","affiliations":[{"raw_affiliation_string":"La Trobe University, Melbourne, Australia","institution_ids":["https://openalex.org/I196829312"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":12.6135,"has_fulltext":true,"cited_by_count":133,"citation_normalized_percentile":{"value":0.99235895,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":"55","issue":"7","first_page":"1","last_page":"36"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9904999732971191,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8575111627578735},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7568507194519043},{"id":"https://openalex.org/keywords/automatic-summarization","display_name":"Automatic summarization","score":0.5886542797088623},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.5199090838432312},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.45069676637649536},{"id":"https://openalex.org/keywords/sophistication","display_name":"Sophistication","score":0.4404095709323883},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.4222240447998047},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4090292453765869},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.26843321323394775},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.181115061044693}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8575111627578735},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7568507194519043},{"id":"https://openalex.org/C170858558","wikidata":"https://www.wikidata.org/wiki/Q1394144","display_name":"Automatic summarization","level":2,"score":0.5886542797088623},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.5199090838432312},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.45069676637649536},{"id":"https://openalex.org/C168725872","wikidata":"https://www.wikidata.org/wiki/Q991663","display_name":"Sophistication","level":2,"score":0.4404095709323883},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.4222240447998047},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4090292453765869},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.26843321323394775},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.181115061044693},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3539605","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3539605","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3539605","source":{"id":"https://openalex.org/S157921468","display_name":"ACM Computing Surveys","issn_l":"0360-0300","issn":["0360-0300","1557-7341"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Computing Surveys","raw_type":"journal-article"},{"id":"pmh:oai:research-repository.griffith.edu.au:10072/424008","is_oa":true,"landing_page_url":"http://hdl.handle.net/10072/424008","pdf_url":null,"source":{"id":"https://openalex.org/S4306402548","display_name":"Griffith Research Online (Griffith University, Queensland, Australia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I11701301","host_organization_name":"Griffith University","host_organization_lineage":["https://openalex.org/I11701301"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Journal article"}],"best_oa_location":{"id":"doi:10.1145/3539605","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3539605","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3539605","source":{"id":"https://openalex.org/S157921468","display_name":"ACM Computing Surveys","issn_l":"0360-0300","issn":["0360-0300","1557-7341"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Computing Surveys","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/17","display_name":"Partnerships for the goals","score":0.4300000071525574}],"awards":[],"funders":[{"id":"https://openalex.org/F4320315885","display_name":"Australian Government","ror":"https://ror.org/0314h5y94"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4311703141.pdf","grobid_xml":"https://content.openalex.org/works/W4311703141.grobid-xml"},"referenced_works_count":61,"referenced_works":["https://openalex.org/W168132470","https://openalex.org/W1489073918","https://openalex.org/W1511544592","https://openalex.org/W1577933227","https://openalex.org/W1772700132","https://openalex.org/W1981738628","https://openalex.org/W2009232481","https://openalex.org/W2031163547","https://openalex.org/W2056736956","https://openalex.org/W2096347345","https://openalex.org/W2151135920","https://openalex.org/W2153579005","https://openalex.org/W2183325936","https://openalex.org/W2215262239","https://openalex.org/W2291470926","https://openalex.org/W2302058010","https://openalex.org/W2400243382","https://openalex.org/W2468321486","https://openalex.org/W2482544674","https://openalex.org/W2514361410","https://openalex.org/W2532844970","https://openalex.org/W2560810941","https://openalex.org/W2609517807","https://openalex.org/W2734941459","https://openalex.org/W2744536417","https://openalex.org/W2747669027","https://openalex.org/W2755094099","https://openalex.org/W2766852928","https://openalex.org/W2767094836","https://openalex.org/W2781700989","https://openalex.org/W2790316935","https://openalex.org/W2885157095","https://openalex.org/W2889379876","https://openalex.org/W2889727957","https://openalex.org/W2891432086","https://openalex.org/W2894542239","https://openalex.org/W2900713154","https://openalex.org/W2907338990","https://openalex.org/W2947745012","https://openalex.org/W2962756421","https://openalex.org/W2962936633","https://openalex.org/W2971635970","https://openalex.org/W2986944522","https://openalex.org/W2988790801","https://openalex.org/W2995410217","https://openalex.org/W2997780732","https://openalex.org/W3008202598","https://openalex.org/W3009144758","https://openalex.org/W3015650867","https://openalex.org/W3016038045","https://openalex.org/W3043266264","https://openalex.org/W3048000332","https://openalex.org/W3094213939","https://openalex.org/W3126165507","https://openalex.org/W3133235094","https://openalex.org/W3183032573","https://openalex.org/W4245671428","https://openalex.org/W4288125320","https://openalex.org/W4294170691","https://openalex.org/W6712810931","https://openalex.org/W6959882703"],"related_works":["https://openalex.org/W2366403280","https://openalex.org/W1495108544","https://openalex.org/W3148229873","https://openalex.org/W2150160875","https://openalex.org/W4242223894","https://openalex.org/W4241263575","https://openalex.org/W2364419519","https://openalex.org/W2017948608","https://openalex.org/W2360767377","https://openalex.org/W2360951146"],"abstract_inverted_index":{"Traditional":[0],"Intrusion":[1,66,94],"Detection":[2,67,95],"Systems":[3,68,96],"(IDS)":[4],"cannot":[5],"cope":[6],"with":[7],"the":[8,29,103,119,132,160],"increasing":[9],"number":[10],"and":[11,28,55,108,143,153,174],"sophistication":[12],"of":[13,32,106,121,128,162,167],"cyberattacks":[14],"such":[15],"as":[16,70,87],"Advanced":[17],"Persistent":[18],"Threats":[19],"(APT)":[20],".":[21,92],"Due":[22],"to":[23,35,44,75,101,113,151,156],"their":[24],"high":[25],"false-positive":[26],"rate":[27],"required":[30],"effort":[31],"security":[33],"experts":[34],"validate":[36],"them,":[37],"incidents":[38],"can":[39],"remain":[40],"undetected":[41],"for":[42,64,138],"up":[43],"several":[45],"months.":[46],"As":[47],"a":[48,125,135],"result,":[49],"enterprises":[50],"suffer":[51],"from":[52],"data":[53,62,73,99,168],"loss":[54],"severe":[56],"financial":[57],"damage.":[58],"Recent":[59],"research":[60,130,146],"explored":[61],"provenance":[63,80,100],"Host-based":[65],"(HIDS)":[69],"one":[71],"promising":[72],"source":[74],"tackle":[76],"this":[77],"issue.":[78],"Data":[79],"represents":[81],"information":[82],"flows":[83],"between":[84],"system":[85],"entities":[86],"Direct":[88],"Acyclic":[89],"Graph":[90],"(DAG)":[91],"Provenance-based":[93],"(PIDS)":[97],"utilize":[98],"enhance":[102],"detection":[104],"performance":[105],"intrusions":[107],"reduce":[109],"false-alarm":[110],"rates":[111],"compared":[112],"traditional":[114],"IDS.":[115],"This":[116,148],"survey":[117,149],"demonstrates":[118],"potential":[120,144],"PIDS":[122,163],"by":[123,164],"providing":[124],"detailed":[126],"evaluation":[127],"recent":[129],"in":[131,159],"field,":[133],"proposing":[134],"novel":[136],"taxonomy":[137],"PIDS,":[139],"discussing":[140],"current":[141],"issues,":[142],"future":[145],"directions.":[147],"aims":[150],"help":[152],"motivate":[154],"researchers":[155],"get":[157],"started":[158],"field":[161],"tackling":[165],"issues":[166],"collection,":[169],"graph":[170],"summarization,":[171],"intrusion":[172],"detection,":[173],"developing":[175],"real-world":[176],"benchmark":[177],"datasets.":[178]},"counts_by_year":[{"year":2026,"cited_by_count":22},{"year":2025,"cited_by_count":49},{"year":2024,"cited_by_count":41},{"year":2023,"cited_by_count":20},{"year":2022,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}