{"id":"https://openalex.org/W4409158044","doi":"https://doi.org/10.1145/3690624.3709218","title":"Wedjat: Detecting Sophisticated Evasion Attacks via Real-time Causal Analysis","display_name":"Wedjat: Detecting Sophisticated Evasion Attacks via Real-time Causal Analysis","publication_year":2025,"publication_date":"2025-04-04","ids":{"openalex":"https://openalex.org/W4409158044","doi":"https://doi.org/10.1145/3690624.3709218"},"language":"en","primary_location":{"id":"doi:10.1145/3690624.3709218","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3690624.3709218","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104076003","display_name":"Li Gao","orcid":"https://orcid.org/0009-0001-3636-5218"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Li Gao","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0001-3636-5218","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072990224","display_name":"Chuanpu Fu","orcid":"https://orcid.org/0000-0003-4568-6125"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chuanpu Fu","raw_affiliation_strings":["Tsinghua University, Bejing, China"],"raw_orcid":"https://orcid.org/0000-0003-4568-6125","affiliations":[{"raw_affiliation_string":"Tsinghua University, Bejing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068492222","display_name":"Xinhao Deng","orcid":"https://orcid.org/0000-0002-4366-4777"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinhao Deng","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-4366-4777","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100665814","display_name":"Ke Xu","orcid":"https://orcid.org/0000-0003-2587-8517"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ke Xu","raw_affiliation_strings":["Tsinghua University, BeiJing, China & Zhongguancun Lab, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-2587-8517","affiliations":[{"raw_affiliation_string":"Tsinghua University, BeiJing, China & Zhongguancun Lab, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100350165","display_name":"Qi Li","orcid":"https://orcid.org/0000-0001-8776-8730"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qi Li","raw_affiliation_strings":["Tsinghua University, Beijing, China & Zhongguancun Lab, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-8776-8730","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China & Zhongguancun Lab, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I99065089"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"342","last_page":"353"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.6710736751556396},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6682251691818237},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4586816132068634}],"concepts":[{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.6710736751556396},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6682251691818237},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4586816132068634},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3690624.3709218","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3690624.3709218","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W1674877186","https://openalex.org/W1986007546","https://openalex.org/W2100738695","https://openalex.org/W2111942706","https://openalex.org/W2114996745","https://openalex.org/W2157949690","https://openalex.org/W2293768274","https://openalex.org/W2350778671","https://openalex.org/W2614419969","https://openalex.org/W2743556905","https://openalex.org/W2765227388","https://openalex.org/W2783301790","https://openalex.org/W2789780249","https://openalex.org/W2789828921","https://openalex.org/W2809376420","https://openalex.org/W2919493784","https://openalex.org/W3007265242","https://openalex.org/W3007562398","https://openalex.org/W3008176860","https://openalex.org/W3023021572","https://openalex.org/W3047194494","https://openalex.org/W3047608117","https://openalex.org/W3082884087","https://openalex.org/W3099114729","https://openalex.org/W3103367901","https://openalex.org/W3104793015","https://openalex.org/W3120227884","https://openalex.org/W3128341305","https://openalex.org/W3136284412","https://openalex.org/W3173170122","https://openalex.org/W3189612867","https://openalex.org/W3203398299","https://openalex.org/W3214040448","https://openalex.org/W4212863985","https://openalex.org/W4224315052","https://openalex.org/W4226054001","https://openalex.org/W4289639938","https://openalex.org/W4308632271","https://openalex.org/W4312610636","https://openalex.org/W4388867311","https://openalex.org/W4389328382","https://openalex.org/W6791875987"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2373230814","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890"],"abstract_inverted_index":{"Traffic":[0],"encryption":[1],"has":[2],"been":[3],"widely":[4],"adopted":[5],"to":[6,22,42,66],"protect":[7],"the":[8,56],"confidentiality":[9],"and":[10,84],"integrity":[11],"of":[12,97,113],"Internet":[13],"traffic.":[14,25],"However,":[15],"attackers":[16],"can":[17,161],"also":[18],"abuse":[19],"such":[20,74],"mechanism":[21],"deliver":[23],"malicious":[24,31,82],"Particularly,":[26],"existing":[27,131],"methods":[28],"detecting":[29,117],"encrypted":[30],"traffic":[32,41,44,83],"are":[33,133],"not":[34],"robust":[35],"against":[36,48,149],"evasion":[37,49,89,124],"attacks":[38,50],"that":[39,75,80,108,144],"manipulate":[40],"obfuscate":[43],"features.":[45],"Robust":[46],"detection":[47,157],"remains":[51],"an":[52,111,155],"open":[53],"problem.":[54],"To":[55],"end,":[57],"we":[58],"develop":[59],"Wedjat,":[60],"which":[61,126],"utilizes":[62],"a":[63,101],"causal":[64],"network":[65],"model":[67],"benign":[68],"packet":[69,164],"interactions":[70],"among":[71],"relevant":[72],"flows,":[73],"it":[76,160],"recognizes":[77],"abnormal":[78],"causality":[79,86],"represents":[81],"disrupted":[85],"incurred":[87],"by":[88,136],"attacks.":[90,120],"We":[91],"extensively":[92],"evaluate":[93],"Wedjat":[94,109,137,145],"with":[95,138],"millions":[96],"flows":[98],"collected":[99],"from":[100],"real-world":[102],"enterprise.":[103],"The":[104],"experimental":[105],"results":[106],"demonstrate":[107],"achieves":[110,146],"accuracy":[112],"0.957":[114],"F1-score":[115],"when":[116],"various":[118],"advanced":[119],"Notably,":[121],"five":[122],"sophisticated":[123],"attacks,":[125],"have":[127],"successfully":[128],"evaded":[129],"all":[130],"methods,":[132],"accurately":[134],"detected":[135],"over":[139],"0.915":[140],"F1.":[141],"It":[142],"demonstrates":[143],"exceptional":[147],"robustness":[148],"evasions.":[150],"Meanwhile,":[151],"Wed-":[152],"jat":[153],"maintains":[154],"outstanding":[156],"latency,":[158],"i.e.,":[159],"predict":[162],"each":[163],"in":[165],"less":[166],"than":[167],"0.125":[168],"seconds.":[169]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}