{"id":"https://openalex.org/W4311165754","doi":"https://doi.org/10.1145/3564625.3567972","title":"MADDC: Multi-Scale Anomaly Detection, Diagnosis and Correction for Discrete Event Logs","display_name":"MADDC: Multi-Scale Anomaly Detection, Diagnosis and Correction for Discrete Event Logs","publication_year":2022,"publication_date":"2022-12-03","ids":{"openalex":"https://openalex.org/W4311165754","doi":"https://doi.org/10.1145/3564625.3567972"},"language":"en","primary_location":{"id":"doi:10.1145/3564625.3567972","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3564625.3567972","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 38th Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100367715","display_name":"Xiaolei Wang","orcid":"https://orcid.org/0000-0002-5342-4275"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaolei Wang","raw_affiliation_strings":["College of Computer, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0000-0002-5342-4275","affiliations":[{"raw_affiliation_string":"College of Computer, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065320956","display_name":"Lin Yang","orcid":"https://orcid.org/0000-0001-8845-7539"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lin Yang","raw_affiliation_strings":["Systems Engineering Institute, Academy of Military Science, China"],"raw_orcid":"https://orcid.org/0000-0001-8845-7539","affiliations":[{"raw_affiliation_string":"Systems Engineering Institute, Academy of Military Science, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100459326","display_name":"Dongyang Li","orcid":"https://orcid.org/0000-0003-0818-2526"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dongyang Li","raw_affiliation_strings":["Systems Engineering Institute, Academy of Military Science, China"],"raw_orcid":"https://orcid.org/0000-0003-0818-2526","affiliations":[{"raw_affiliation_string":"Systems Engineering Institute, Academy of Military Science, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067868458","display_name":"Linru Ma","orcid":"https://orcid.org/0000-0002-4530-5401"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Linru Ma","raw_affiliation_strings":["Systems Engineering Institute, Academy of Military Science, China"],"raw_orcid":"https://orcid.org/0000-0002-4530-5401","affiliations":[{"raw_affiliation_string":"Systems Engineering Institute, Academy of Military Science, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062071294","display_name":"Yongzhong He","orcid":"https://orcid.org/0000-0003-0045-4128"},"institutions":[{"id":"https://openalex.org/I21193070","display_name":"Beijing Jiaotong University","ror":"https://ror.org/01yj56c84","country_code":"CN","type":"education","lineage":["https://openalex.org/I21193070"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yongzhong He","raw_affiliation_strings":["School of Computer and Information Technology, Beijing Jiaotong University, China"],"raw_orcid":"https://orcid.org/0000-0003-0045-4128","affiliations":[{"raw_affiliation_string":"School of Computer and Information Technology, Beijing Jiaotong University, China","institution_ids":["https://openalex.org/I21193070"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071016470","display_name":"Junchao Xiao","orcid":"https://orcid.org/0000-0002-8450-2483"},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junchao Xiao","raw_affiliation_strings":["School of Systems Science and Engineering, Sun Yat-Sen University, China"],"raw_orcid":"https://orcid.org/0000-0002-8450-2483","affiliations":[{"raw_affiliation_string":"School of Systems Science and Engineering, Sun Yat-Sen University, China","institution_ids":["https://openalex.org/I157773358"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100657881","display_name":"Jiyuan Liu","orcid":"https://orcid.org/0000-0001-5702-4941"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiyuan Liu","raw_affiliation_strings":["College of Computer, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0000-0001-5702-4941","affiliations":[{"raw_affiliation_string":"College of Computer, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5054764811","display_name":"Yuexiang Yang","orcid":"https://orcid.org/0000-0002-8495-7795"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuexiang Yang","raw_affiliation_strings":["College of Computer, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0000-0002-8495-7795","affiliations":[{"raw_affiliation_string":"College of Computer, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"769","last_page":"784"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9916999936103821,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.8278213739395142},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.788811445236206},{"id":"https://openalex.org/keywords/overfitting","display_name":"Overfitting","score":0.7823696732521057},{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.6562061309814453},{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.6198115348815918},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.6123753190040588},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5647509694099426},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5163503885269165},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5044828653335571},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4754568934440613},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4736194312572479},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.45669370889663696},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.3227952718734741},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.14900797605514526}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.8278213739395142},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.788811445236206},{"id":"https://openalex.org/C22019652","wikidata":"https://www.wikidata.org/wiki/Q331309","display_name":"Overfitting","level":3,"score":0.7823696732521057},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.6562061309814453},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.6198115348815918},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6123753190040588},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5647509694099426},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5163503885269165},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5044828653335571},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4754568934440613},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4736194312572479},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.45669370889663696},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3227952718734741},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.14900797605514526},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3564625.3567972","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3564625.3567972","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 38th Annual Computer Security Applications Conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W1965626898","https://openalex.org/W2026493302","https://openalex.org/W2038819732","https://openalex.org/W2039157918","https://openalex.org/W2064675550","https://openalex.org/W2098250644","https://openalex.org/W2102632804","https://openalex.org/W2103867289","https://openalex.org/W2105442001","https://openalex.org/W2114554028","https://openalex.org/W2296509296","https://openalex.org/W2326344342","https://openalex.org/W2559091447","https://openalex.org/W2611119600","https://openalex.org/W2739928414","https://openalex.org/W2767094836","https://openalex.org/W2786762216","https://openalex.org/W2947815220","https://openalex.org/W2984666763","https://openalex.org/W2990630613","https://openalex.org/W3034706923","https://openalex.org/W3167623949","https://openalex.org/W4226139354","https://openalex.org/W4248949446","https://openalex.org/W4288080168"],"related_works":["https://openalex.org/W1574414179","https://openalex.org/W4362597605","https://openalex.org/W2810330923","https://openalex.org/W3186512740","https://openalex.org/W3017266184","https://openalex.org/W2918377632","https://openalex.org/W3202913553","https://openalex.org/W3046391934","https://openalex.org/W3194885736","https://openalex.org/W4363671829"],"abstract_inverted_index":{"Anomaly":[0,123],"detection":[1,83,226],"for":[2,10,128,151],"discrete":[3,129],"event":[4,130,195],"logs":[5],"can":[6],"provide":[7],"critical":[8],"information":[9,90],"building":[11],"secure":[12],"and":[13,28,45,54,126,132,160,197,201,246],"reliable":[14],"systems":[15],"in":[16,49,106,184,223],"various":[17],"application":[18],"domains,":[19],"such":[20,73],"as":[21,75],"large":[22],"scale":[23],"data":[24,57],"centers,":[25],"autonomous":[26],"driving,":[27],"intrusion":[29],"detection.":[30,166],"However,":[31],"the":[32,39,50,55,82,96,190,232],"task":[33],"is":[34,58],"very":[35],"challenging":[36],"due":[37],"to":[38,91,118,157,179,234],"lack":[40],"of":[41,47,169,193,225],"a":[42,111,147],"clear":[43],"understanding":[44],"definition":[46],"anomaly":[48,149,165,203],"specific":[51],"problem":[52],"space,":[53],"log":[56],"often":[59],"highly":[60],"complex":[61],"with":[62,88,99],"temporal":[63],"correlation.":[64],"Existing":[65],"deep":[66],"learning":[67],"based":[68,139,155],"methods":[69,222],"mostly":[70],"suffer":[71],"from":[72,237],"issues":[74],"overfitting,":[76],"uncertainty":[77],"or":[78],"low":[79],"interpretability;":[80],"consequently,":[81],"results":[84],"may":[85],"be":[86],"inaccurate,":[87],"little":[89],"help":[92,134,198],"security":[93,242],"analysts":[94,135,243],"diagnose":[95],"reported":[97],"anomalies":[98,138,245],"high":[100],"confidence.":[101],"To":[102],"tackle":[103],"this":[104,107],"challenge,":[105],"research,":[108],"we":[109,144,173],"propose":[110],"general":[112],"framework":[113],"named":[114],"MADDC,":[115],"which":[116,188],"aims":[117],"(1)":[119],"accurately":[120],"perform":[121,199],"Multi-scale":[122],"Detection,":[124],"Diagnosis":[125],"Correction":[127],"logs,":[131],"(2)":[133],"further":[136,248],"mitigate":[137],"on":[140,210],"diagnosis":[141,204],"results.":[142],"Specifically,":[143],"first":[145],"design":[146],"new":[148],"critic":[150],"LSTM":[152],"variational":[153],"autoencoder":[154],"model":[156],"alleviate":[158],"overfitting":[159],"reduce":[161],"false":[162],"negatives":[163],"during":[164],"As":[167],"one":[168],"our":[170],"main":[171],"contributions,":[172],"then":[174],"introduce":[175],"process":[176],"mining":[177],"technique":[178],"build":[180],"process-centric":[181],"workflow":[182],"models":[183],"an":[185,194],"unsupervised":[186],"manner,":[187],"forms":[189],"\u2018normal\u2019":[191],"context":[192],"sequence":[196,207],"accurate":[200],"consistent":[202],"through":[205],"global":[206],"alignment.":[208],"Experiments":[209],"publicly":[211],"available":[212],"datasets":[213],"show":[214],"that":[215],"MADDC":[216],"not":[217],"only":[218],"outperformed":[219],"several":[220],"representative":[221],"terms":[224],"accuracy,":[227],"but":[228],"also":[229],"could":[230],"improve":[231],"visibility":[233],"abnormal":[235],"deviations":[236],"normal":[238],"execution,":[239],"hence":[240],"helping":[241],"understand":[244],"make":[247],"corrections.":[249]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":4}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}