{"id":"https://openalex.org/W4388858673","doi":"https://doi.org/10.1145/3576915.3623187","title":"ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search","display_name":"ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search","publication_year":2023,"publication_date":"2023-11-15","ids":{"openalex":"https://openalex.org/W4388858673","doi":"https://doi.org/10.1145/3576915.3623187"},"language":"en","primary_location":{"id":"doi:10.1145/3576915.3623187","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3576915.3623187","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5045310755","display_name":"Enes Alt\u0131n\u0131\u015f\u0131k","orcid":"https://orcid.org/0000-0001-9300-6564"},"institutions":[{"id":"https://openalex.org/I1301390666","display_name":"Qatar Airways (Qatar)","ror":"https://ror.org/01hx00y13","country_code":"QA","type":"company","lineage":["https://openalex.org/I1301390666"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Enes Altinisik","raw_affiliation_strings":["Qatar Computing Research Institute, HBKU, Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0001-9300-6564","affiliations":[{"raw_affiliation_string":"Qatar Computing Research Institute, HBKU, Doha, Qatar","institution_ids":["https://openalex.org/I1301390666"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026666412","display_name":"Fatih Deniz","orcid":"https://orcid.org/0000-0001-9987-9569"},"institutions":[{"id":"https://openalex.org/I1301390666","display_name":"Qatar Airways (Qatar)","ror":"https://ror.org/01hx00y13","country_code":"QA","type":"company","lineage":["https://openalex.org/I1301390666"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Fatih Deniz","raw_affiliation_strings":["Qatar Computing Research Institute, HBKU, Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0001-9987-9569","affiliations":[{"raw_affiliation_string":"Qatar Computing Research Institute, HBKU, Doha, Qatar","institution_ids":["https://openalex.org/I1301390666"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5086101517","display_name":"H\u00fcsrev Taha Sencar","orcid":"https://orcid.org/0000-0001-6910-6194"},"institutions":[{"id":"https://openalex.org/I1301390666","display_name":"Qatar Airways (Qatar)","ror":"https://ror.org/01hx00y13","country_code":"QA","type":"company","lineage":["https://openalex.org/I1301390666"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"H\u00fcsrev Taha Sencar","raw_affiliation_strings":["Qatar Computing Research Institute, HBKU, Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0001-6910-6194","affiliations":[{"raw_affiliation_string":"Qatar Computing Research Institute, HBKU, Doha, Qatar","institution_ids":["https://openalex.org/I1301390666"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I1301390666"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":35,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2247","last_page":"2261"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9957000017166138,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7237176895141602},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.5620760321617126},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.5578958988189697},{"id":"https://openalex.org/keywords/subgraph-isomorphism-problem","display_name":"Subgraph isomorphism problem","score":0.5099674463272095},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5037690997123718},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.4790195822715759},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.24449265003204346},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.16536226868629456}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7237176895141602},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.5620760321617126},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.5578958988189697},{"id":"https://openalex.org/C131992880","wikidata":"https://www.wikidata.org/wiki/Q2528185","display_name":"Subgraph isomorphism problem","level":3,"score":0.5099674463272095},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5037690997123718},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.4790195822715759},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.24449265003204346},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.16536226868629456},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3576915.3623187","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3576915.3623187","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":44,"referenced_works":["https://openalex.org/W1509240356","https://openalex.org/W1543276876","https://openalex.org/W1592360969","https://openalex.org/W2047944694","https://openalex.org/W2048653843","https://openalex.org/W2096347345","https://openalex.org/W2112200469","https://openalex.org/W2153929049","https://openalex.org/W2284900416","https://openalex.org/W2350778671","https://openalex.org/W2514361410","https://openalex.org/W2560810941","https://openalex.org/W2604314403","https://openalex.org/W2747669027","https://openalex.org/W2790316935","https://openalex.org/W2790557990","https://openalex.org/W2889379876","https://openalex.org/W2906943923","https://openalex.org/W2945827377","https://openalex.org/W2953054275","https://openalex.org/W2962703433","https://openalex.org/W2963843206","https://openalex.org/W2978956219","https://openalex.org/W2986944522","https://openalex.org/W3005127313","https://openalex.org/W3008054143","https://openalex.org/W3012871709","https://openalex.org/W3015650867","https://openalex.org/W3016038045","https://openalex.org/W3094213939","https://openalex.org/W3099203541","https://openalex.org/W3101553402","https://openalex.org/W3110889769","https://openalex.org/W3158906645","https://openalex.org/W3176367300","https://openalex.org/W3212868562","https://openalex.org/W4245671428","https://openalex.org/W4283800464","https://openalex.org/W4293651439","https://openalex.org/W4319663646","https://openalex.org/W4388858673","https://openalex.org/W6600655691","https://openalex.org/W6601258443","https://openalex.org/W6602342606"],"related_works":["https://openalex.org/W2532922352","https://openalex.org/W2604893261","https://openalex.org/W2361654510","https://openalex.org/W2915540008","https://openalex.org/W2382155842","https://openalex.org/W2954463587","https://openalex.org/W2036065890","https://openalex.org/W2604114816","https://openalex.org/W2932872266","https://openalex.org/W2143195194"],"abstract_inverted_index":{"We":[0,45,87],"present":[1],"ProvG-Searcher,":[2],"a":[3,20,54,60,77,104,124,129,153,181],"novel":[4],"approach":[5,16],"for":[6],"detecting":[7,177],"known":[8],"APT":[9],"behaviors":[10,179],"within":[11],"system":[12,36],"security":[13],"logs.":[14],"Our":[15],"leverages":[17],"provenance":[18,32,51,120],"graphs,":[19,121],"comprehensive":[21],"graph":[22,61,125,131],"representation":[23,62],"of":[24,49,68,74,93,119,143,185],"event":[25],"logs,":[26],"to":[27,100,147],"capture":[28],"and":[29,40,58,106,117,128,180],"depict":[30],"data":[31],"relations":[33],"by":[34,114],"mapping":[35],"entities":[37],"as":[38,43,53],"nodes":[39],"their":[41],"interactions":[42],"edges.":[44],"formulate":[46],"the":[47,91,115,144],"task":[48],"searching":[50],"graphs":[52],"subgraph":[55,81,98,108],"matching":[56,99],"problem":[57],"employ":[59],"learning":[63],"method.":[64,133],"The":[65],"central":[66],"component":[67],"our":[69,135],"search":[70,145],"methodology":[71],"involves":[72],"embedding":[73],"subgraphs":[75],"in":[76,176],"vector":[78],"space":[79],"where":[80],"relationships":[82],"can":[83],"be":[84,148],"directly":[85],"evaluated.":[86],"achieve":[88],"this":[89],"through":[90],"use":[92],"order":[94],"embeddings":[95],"that":[96,166],"simplify":[97],"straightforward":[101],"comparisons":[102],"between":[103],"query":[105,158,178],"precomputed":[107],"representations.":[109],"To":[110],"address":[111],"challenges":[112],"posed":[113],"size":[116],"complexity":[118],"we":[122],"propose":[123],"partitioning":[126],"scheme":[127],"behavior-preserving":[130],"reduction":[132],"Overall,":[134],"technique":[136],"offers":[137],"significant":[138],"computational":[139],"efficiency,":[140],"allowing":[141],"most":[142],"computation":[146],"performed":[149],"offline":[150],"while":[151],"incorporating":[152],"lightweight":[154],"comparison":[155],"step":[156],"during":[157],"execution.":[159],"Experimental":[160],"results":[161],"on":[162],"standard":[163],"datasets":[164],"demonstrate":[165],"ProvG-Searcher":[167],"achieves":[168],"superior":[169],"performance,":[170],"with":[171],"an":[172],"accuracy":[173],"exceeding":[174],"99%":[175],"false":[182],"positive":[183],"rate":[184],"approximately":[186],"0.02%,":[187],"outperforming":[188],"other":[189],"approaches.":[190]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":23},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}