{"id":"https://openalex.org/W4404386119","doi":"https://doi.org/10.1145/3698038.3698533","title":"Zero-SAD: Zero-Shot Learning Using Synthetic Abnormal Data for Abnormal Behavior Detection on Private Cloud","display_name":"Zero-SAD: Zero-Shot Learning Using Synthetic Abnormal Data for Abnormal Behavior Detection on Private Cloud","publication_year":2024,"publication_date":"2024-11-14","ids":{"openalex":"https://openalex.org/W4404386119","doi":"https://doi.org/10.1145/3698038.3698533"},"language":"en","primary_location":{"id":"doi:10.1145/3698038.3698533","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3698038.3698533","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Symposium on Cloud Computing","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076607185","display_name":"Jae-Seok Kim","orcid":"https://orcid.org/0000-0001-7728-2278"},"institutions":[{"id":"https://openalex.org/I4921948","display_name":"Pusan National University","ror":"https://ror.org/01an57a31","country_code":"KR","type":"education","lineage":["https://openalex.org/I4921948"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jae-Seok Kim","raw_affiliation_strings":["Pusan National University, Busan, South Korea"],"raw_orcid":"https://orcid.org/0000-0001-7728-2278","affiliations":[{"raw_affiliation_string":"Pusan National University, Busan, South Korea","institution_ids":["https://openalex.org/I4921948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110262118","display_name":"Joonho Seo","orcid":"https://orcid.org/0009-0007-9467-5146"},"institutions":[{"id":"https://openalex.org/I4921948","display_name":"Pusan National University","ror":"https://ror.org/01an57a31","country_code":"KR","type":"education","lineage":["https://openalex.org/I4921948"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Joonho Seo","raw_affiliation_strings":["Pusan National University, Busan, South Korea"],"raw_orcid":"https://orcid.org/0009-0007-9467-5146","affiliations":[{"raw_affiliation_string":"Pusan National University, Busan, South Korea","institution_ids":["https://openalex.org/I4921948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011777829","display_name":"Seon-Jin Hwang","orcid":"https://orcid.org/0000-0002-5097-3439"},"institutions":[{"id":"https://openalex.org/I4921948","display_name":"Pusan National University","ror":"https://ror.org/01an57a31","country_code":"KR","type":"education","lineage":["https://openalex.org/I4921948"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Seon-Jin Hwang","raw_affiliation_strings":["Pusan National University, Busan, South Korea"],"raw_orcid":"https://orcid.org/0000-0002-5097-3439","affiliations":[{"raw_affiliation_string":"Pusan National University, Busan, South Korea","institution_ids":["https://openalex.org/I4921948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023643663","display_name":"Jinmyeong Shin","orcid":"https://orcid.org/0000-0001-8580-6887"},"institutions":[{"id":"https://openalex.org/I4921948","display_name":"Pusan National University","ror":"https://ror.org/01an57a31","country_code":"KR","type":"education","lineage":["https://openalex.org/I4921948"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jinmyeong Shin","raw_affiliation_strings":["Pusan National University, Busan, South Korea"],"raw_orcid":"https://orcid.org/0000-0001-8580-6887","affiliations":[{"raw_affiliation_string":"Pusan National University, Busan, South Korea","institution_ids":["https://openalex.org/I4921948"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5068130953","display_name":"Yoon-Ho Choi","orcid":"https://orcid.org/0000-0002-3556-5082"},"institutions":[{"id":"https://openalex.org/I4921948","display_name":"Pusan National University","ror":"https://ror.org/01an57a31","country_code":"KR","type":"education","lineage":["https://openalex.org/I4921948"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Yoon-Ho Choi","raw_affiliation_strings":["Pusan National University, Busan, South Korea"],"raw_orcid":"https://orcid.org/0000-0002-3556-5082","affiliations":[{"raw_affiliation_string":"Pusan National University, Busan, South Korea","institution_ids":["https://openalex.org/I4921948"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4921948"],"apc_list":null,"apc_paid":null,"fwci":1.0668,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.80007395,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"111","last_page":"125"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11775","display_name":"COVID-19 diagnosis using AI","score":0.9764999747276306,"subfield":{"id":"https://openalex.org/subfields/2741","display_name":"Radiology, Nuclear Medicine and Imaging"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/zero","display_name":"Zero (linguistics)","score":0.8296225070953369},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.6448878049850464},{"id":"https://openalex.org/keywords/ground-zero","display_name":"Ground zero","score":0.5589449405670166},{"id":"https://openalex.org/keywords/shot","display_name":"Shot (pellet)","score":0.5297425985336304},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.4331338703632355},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.36648499965667725},{"id":"https://openalex.org/keywords/physics","display_name":"Physics","score":0.21673157811164856},{"id":"https://openalex.org/keywords/materials-science","display_name":"Materials science","score":0.12012344598770142},{"id":"https://openalex.org/keywords/nuclear-physics","display_name":"Nuclear physics","score":0.0684487521648407},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.06281071901321411}],"concepts":[{"id":"https://openalex.org/C2780813799","wikidata":"https://www.wikidata.org/wiki/Q3274237","display_name":"Zero (linguistics)","level":2,"score":0.8296225070953369},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6448878049850464},{"id":"https://openalex.org/C2780518707","wikidata":"https://www.wikidata.org/wiki/Q685332","display_name":"Ground zero","level":2,"score":0.5589449405670166},{"id":"https://openalex.org/C2778344882","wikidata":"https://www.wikidata.org/wiki/Q278938","display_name":"Shot (pellet)","level":2,"score":0.5297425985336304},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4331338703632355},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.36648499965667725},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.21673157811164856},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.12012344598770142},{"id":"https://openalex.org/C185544564","wikidata":"https://www.wikidata.org/wiki/Q81197","display_name":"Nuclear physics","level":1,"score":0.0684487521648407},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.06281071901321411},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C191897082","wikidata":"https://www.wikidata.org/wiki/Q11467","display_name":"Metallurgy","level":1,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3698038.3698533","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3698038.3698533","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Symposium on Cloud Computing","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W1981738628","https://openalex.org/W2056907916","https://openalex.org/W2070164835","https://openalex.org/W2167240430","https://openalex.org/W2785362611","https://openalex.org/W2963545832","https://openalex.org/W3015959599","https://openalex.org/W3093074257","https://openalex.org/W3098957257","https://openalex.org/W3117467144","https://openalex.org/W3124769650","https://openalex.org/W3172037816","https://openalex.org/W3202733154","https://openalex.org/W4224933758","https://openalex.org/W4285787895","https://openalex.org/W4293233618","https://openalex.org/W4311988569","https://openalex.org/W4312949663","https://openalex.org/W4327919569","https://openalex.org/W4386071587"],"related_works":["https://openalex.org/W4300821880","https://openalex.org/W4402779703","https://openalex.org/W4313594480","https://openalex.org/W2285651113","https://openalex.org/W4256031153","https://openalex.org/W3279617","https://openalex.org/W4293365998","https://openalex.org/W2327903337","https://openalex.org/W2768862283","https://openalex.org/W2168002573"],"abstract_inverted_index":{"While":[0],"many":[1],"studies":[2,19],"have":[3],"been":[4],"conducted":[5],"to":[6,24,70],"detect":[7,196],"abnormal":[8,86,121],"behavior":[9,35,87,122],"in":[10,58],"cloud":[11,26,44,92,112,164],"environments":[12,27,165],"by":[13,136,166],"analyzing":[14],"system":[15,50,77,89,96,107,132,185],"call":[16,133],"sequences,":[17],"these":[18,59],"often":[20],"cannot":[21],"be":[22],"applied":[23],"real-world":[25],"since":[28],"they":[29],"do":[30],"not":[31],"consider":[32],"actual":[33,43],"user":[34],"and":[36,118,158,193],"rely":[37],"on":[38],"publicly":[39,155],"available":[40,156],"datasets.":[41,60],"In":[42,79],"environments,":[45],"the":[46,73,111,128,146,170],"frequency":[47],"of":[48,68,98,131,148,177,191],"duplicate":[49,106],"calls":[51,108],"is":[52],"significantly":[53],"higher":[54],"than":[55,201],"that":[56,103,125,183],"observed":[57],"This":[61],"discrepancy":[62],"necessitates":[63],"a":[64,84,99,114,119,140,175],"considerably":[65],"larger":[66],"scale":[67],"analysis":[69],"fully":[71],"understand":[72],"sequential":[74],"relationships":[75],"among":[76],"calls.":[78],"this":[80],"paper,":[81],"we":[82,152],"propose":[83],"practical":[85],"detection":[88,123],"for":[90],"private":[91],"environments.":[93],"The":[94],"proposed":[95,150],"comprises":[97],"deduplicated":[100],"embedding":[101,116],"process":[102,124],"efficiently":[104],"represents":[105],"occurring":[109],"within":[110],"into":[113],"single":[115],"vector":[117],"zero-shot":[120,141],"rapidly":[126],"analyzes":[127],"large":[129],"volume":[130],"sequences":[134],"generated":[135],"numerous":[137],"users":[138],"through":[139],"learning":[142],"model.":[143],"To":[144],"demonstrate":[145],"practicality":[147],"our":[149,184],"system,":[151],"use":[153],"both":[154],"datasets":[157,159],"directly":[160],"collected":[161],"from":[162,169],"real":[163],"implementing":[167],"attacks":[168,197],"MITRE":[171],"ATT&CK":[172],"framework":[173],"as":[174],"proof":[176],"concept":[178],"(PoC).":[179],"Experimental":[180],"results":[181],"show":[182],"achieved":[186],"an":[187,189],"accuracy":[188,190],"92.13%,":[192],"it":[194],"can":[195],"5.48":[198],"times":[199],"faster":[200],"existing":[202],"research.":[203]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}