{"id":"https://openalex.org/W4406832453","doi":"https://doi.org/10.1186/s42400-024-00311-y","title":"Angus: efficient active learning strategies for provenance based intrusion detection","display_name":"Angus: efficient active learning strategies for provenance based intrusion detection","publication_year":2025,"publication_date":"2025-01-27","ids":{"openalex":"https://openalex.org/W4406832453","doi":"https://doi.org/10.1186/s42400-024-00311-y"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-024-00311-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-024-00311-y","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-024-00311-y","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-024-00311-y","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Lin Wu","orcid":"https://orcid.org/0009-0006-6498-6173"},"institutions":[{"id":"https://openalex.org/I4210152380","display_name":"Shenzhen Technology University","ror":"https://ror.org/04qzpec27","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210152380"]},{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lin Wu","raw_affiliation_strings":["Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China","Shenzhen Huazhong University of Science and Technology Research institute, Shenzhen, China"],"raw_orcid":"https://orcid.org/0009-0006-6498-6173","affiliations":[{"raw_affiliation_string":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China","institution_ids":["https://openalex.org/I47720641"]},{"raw_affiliation_string":"Shenzhen Huazhong University of Science and Technology Research institute, Shenzhen, China","institution_ids":["https://openalex.org/I4210152380"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054468864","display_name":"Yulai Xie","orcid":"https://orcid.org/0000-0001-5757-4396"},"institutions":[{"id":"https://openalex.org/I4210152380","display_name":"Shenzhen Technology University","ror":"https://ror.org/04qzpec27","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210152380"]},{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Yulai Xie","raw_affiliation_strings":["Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China","Shenzhen Huazhong University of Science and Technology Research institute, Shenzhen, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China","institution_ids":["https://openalex.org/I47720641"]},{"raw_affiliation_string":"Shenzhen Huazhong University of Science and Technology Research institute, Shenzhen, China","institution_ids":["https://openalex.org/I4210152380"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100686683","display_name":"Jin Li","orcid":"https://orcid.org/0000-0003-3340-1516"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jin Li","raw_affiliation_strings":["Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057421680","display_name":"Dan Feng","orcid":"https://orcid.org/0000-0002-4674-6006"},"institutions":[{"id":"https://openalex.org/I4210138186","display_name":"Wuhan National Laboratory for Optoelectronics","ror":"https://ror.org/03c9ncn37","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210138186"]},{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dan Feng","raw_affiliation_strings":["School of Science and Technology, Wuhan National Laboratory for Optoelectronics, Key Laboratory of Information Storage, Huazhong University of Science and Technology, Wuhan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Science and Technology, Wuhan National Laboratory for Optoelectronics, Key Laboratory of Information Storage, Huazhong University of Science and Technology, Wuhan, China","institution_ids":["https://openalex.org/I4210138186","https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002116560","display_name":"Jinyuan Liang","orcid":"https://orcid.org/0000-0002-3812-4506"},"institutions":[{"id":"https://openalex.org/I141945490","display_name":"University of British Columbia","ror":"https://ror.org/03rmrcq20","country_code":"CA","type":"education","lineage":["https://openalex.org/I141945490"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Jinyuan Liang","raw_affiliation_strings":["University of British Columbia Vancouver British Columbia, Vancouver, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of British Columbia Vancouver British Columbia, Vancouver, Canada","institution_ids":["https://openalex.org/I141945490"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5091678461","display_name":"Yafeng Wu","orcid":"https://orcid.org/0009-0007-3157-5340"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yafeng Wu","raw_affiliation_strings":["Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan, 430074, China","institution_ids":["https://openalex.org/I47720641"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5054468864"],"corresponding_institution_ids":["https://openalex.org/I4210152380","https://openalex.org/I47720641"],"apc_list":{"value":1230,"currency":"USD","value_usd":1230},"apc_paid":{"value":1230,"currency":"USD","value_usd":1230},"fwci":2.568,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.87920605,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"8","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9890999794006348,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.566294252872467},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5157783031463623},{"id":"https://openalex.org/keywords/provenance","display_name":"Provenance","score":0.48600682616233826},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.42868366837501526},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3575616180896759},{"id":"https://openalex.org/keywords/geology","display_name":"Geology","score":0.179928719997406},{"id":"https://openalex.org/keywords/geochemistry","display_name":"Geochemistry","score":0.08420193195343018}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.566294252872467},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5157783031463623},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.48600682616233826},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.42868366837501526},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3575616180896759},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.179928719997406},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.08420193195343018}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-024-00311-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-024-00311-y","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-024-00311-y","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:4301928d28ed4ecd9744b08b5c68894e","is_oa":true,"landing_page_url":"https://doaj.org/article/4301928d28ed4ecd9744b08b5c68894e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 8, Iss 1, Pp 1-17 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-024-00311-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-024-00311-y","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-024-00311-y","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2413230818","display_name":null,"funder_award_id":"61821003","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3604809996","display_name":"\u57fa\u4e8e\u8c31\u56fe\u7406\u8bba\u7684\u591a\u5206\u8fa8\u7387\u56fe\u5377\u79ef\u795e\u7ecf\u7f51\u7edc\u7814\u7a76","funder_award_id":"61972009","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5634352352","display_name":"\u9762\u5411\u5165\u4fb5\u884c\u4e3a\u7684\u5927\u6570\u636e\u9ad8\u6548\u5b58\u50a8\u4e0e\u7cbe\u51c6\u68c0\u6d4b\u7814\u7a76","funder_award_id":"61972449","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5817064308","display_name":"\u534f\u4f5c\u5f0f\u79fb\u52a8\u8fb9\u7f18\u8ba1\u7b97\u4e2d\u7684\u9690\u79c1\u4fdd\u62a4\u7814\u7a76","funder_award_id":"61972448","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4406832453.pdf"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W168132470","https://openalex.org/W2081276694","https://openalex.org/W2115389098","https://openalex.org/W2143559571","https://openalex.org/W2170689836","https://openalex.org/W2265043488","https://openalex.org/W2291470926","https://openalex.org/W2532844970","https://openalex.org/W2574867284","https://openalex.org/W2762176006","https://openalex.org/W2762390651","https://openalex.org/W2783748519","https://openalex.org/W2790316935","https://openalex.org/W2790557990","https://openalex.org/W2800118084","https://openalex.org/W2889379876","https://openalex.org/W2889727957","https://openalex.org/W2890708726","https://openalex.org/W2924259647","https://openalex.org/W2947745012","https://openalex.org/W2980962597","https://openalex.org/W2998038410","https://openalex.org/W3105939760","https://openalex.org/W3135578542","https://openalex.org/W3172594102","https://openalex.org/W4388675532","https://openalex.org/W6833178388"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2354627941","https://openalex.org/W2347483153","https://openalex.org/W2364419519","https://openalex.org/W2133389611","https://openalex.org/W2360767377","https://openalex.org/W2017948608","https://openalex.org/W2360951146"],"abstract_inverted_index":{"Abstract":[0],"As":[1],"modern":[2],"attack":[3],"methods":[4],"become":[5],"more":[6],"concealed":[7],"and":[8,57,73,79,113,141,176],"complex,":[9],"obtaining":[10],"many":[11],"labeled":[12],"samples":[13,122,137],"in":[14],"big":[15],"data":[16],"streams":[17],"is":[18,62,87],"difficult.":[19],"Active":[20],"learning":[21,68,94,105],"has":[22],"long":[23],"been":[24],"used":[25],"to":[26,65,123,129,162],"achieve":[27],"better":[28],"intrusion":[29,55,98],"detection":[30,164],"performance":[31,175],"by":[32,46,157],"using":[33,158],"only":[34],"a":[35,63],"small":[36],"number":[37],"of":[38,131],"training":[39,126,147],"samples.":[40],"Intrusion":[41],"behaviors":[42],"can":[43],"be":[44],"described":[45],"provenance":[47,78,86,132],"graphs":[48,133],"that":[49,70,81],"record":[50],"the":[51,58,75,82,107,114,125,145,153,159],"dependency":[52],"relationships":[53],"between":[54],"processes":[56],"infected":[59],"files.":[60],"It":[61],"challenge":[64],"develop":[66],"active":[67,93,104],"strategies":[69,156],"consider":[71],"defining":[72],"selecting":[74],"most":[76,108],"valuable":[77],"ensure":[80],"strategy":[83,112],"for":[84,96],"querying":[85],"efficient.":[88],"We":[89,100],"present":[90],"Angus,":[91],"an":[92],"framework":[95],"provenance-based":[97],"detection.":[99],"propose":[101],"two":[102],"novel":[103],"strategies:":[106],"similar":[109],"graph":[110],"query":[111,117,155,161],"maximum":[115],"difference":[116],"strategy.":[118],"They":[119],"either":[120],"select":[121,136],"update":[124],"set":[127],"according":[128],"similarities":[130],"or":[134],"preferentially":[135],"with":[138],"low":[139],"redundancy":[140],"large":[142],"differences":[143],"from":[144],"current":[146],"set.":[148],"Besides,":[149],"we":[150],"also":[151],"improve":[152],"above":[154],"parallel":[160],"reduce":[163],"time":[165],"overheads.":[166],"The":[167],"experiments":[168],"on":[169],"various":[170],"real-world":[171],"applications":[172],"demonstrate":[173],"their":[174],"efficiency.":[177]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}