{"id":"https://openalex.org/W4310614653","doi":"https://doi.org/10.23919/cnsm55787.2022.9964935","title":"Black-box Attacks to Log-based Anomaly Detection","display_name":"Black-box Attacks to Log-based Anomaly Detection","publication_year":2022,"publication_date":"2022-10-31","ids":{"openalex":"https://openalex.org/W4310614653","doi":"https://doi.org/10.23919/cnsm55787.2022.9964935"},"language":"en","primary_location":{"id":"doi:10.23919/cnsm55787.2022.9964935","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm55787.2022.9964935","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 18th International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5061624006","display_name":"Shaohan Huang","orcid":"https://orcid.org/0000-0003-4324-6337"},"institutions":[{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]},{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shaohan Huang","raw_affiliation_strings":["Beihang University,Sino-German Joint Software Institute,Beijing,China","Sino-German Joint Software Institute, Beihang University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University,Sino-German Joint Software Institute,Beijing,China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]},{"raw_affiliation_string":"Sino-German Joint Software Institute, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100330500","display_name":"Yi Liu","orcid":"https://orcid.org/0000-0002-1571-5442"},"institutions":[{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]},{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yi Liu","raw_affiliation_strings":["Beihang University,Sino-German Joint Software Institute,Beijing,China","Sino-German Joint Software Institute, Beihang University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University,Sino-German Joint Software Institute,Beijing,China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]},{"raw_affiliation_string":"Sino-German Joint Software Institute, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001203568","display_name":"Carol Fung","orcid":"https://orcid.org/0000-0001-5726-4371"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Carol Fung","raw_affiliation_strings":["Concordia University,Concordia Institute for Information Systems Engineering,Montreal,Canada","Concordia Institute for Information Systems Engineering, Concordia University, Montreal, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Concordia Institute for Information Systems Engineering,Montreal,Canada","institution_ids":["https://openalex.org/I60158472"]},{"raw_affiliation_string":"Concordia Institute for Information Systems Engineering, Concordia University, Montreal, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018705589","display_name":"Hailong Yang","orcid":"https://orcid.org/0000-0003-1101-7927"},"institutions":[{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]},{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hailong Yang","raw_affiliation_strings":["Beihang University,Sino-German Joint Software Institute,Beijing,China","Sino-German Joint Software Institute, Beihang University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University,Sino-German Joint Software Institute,Beijing,China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]},{"raw_affiliation_string":"Sino-German Joint Software Institute, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5074183877","display_name":"Zhongzhi Luan","orcid":"https://orcid.org/0000-0002-7186-0556"},"institutions":[{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]},{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhongzhi Luan","raw_affiliation_strings":["Beihang University,Sino-German Joint Software Institute,Beijing,China","Sino-German Joint Software Institute, Beihang University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University,Sino-German Joint Software Institute,Beijing,China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]},{"raw_affiliation_string":"Sino-German Joint Software Institute, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I4210128818","https://openalex.org/I82880672"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"310","last_page":"316"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.982699990272522,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.8441418409347534},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7618486881256104},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.7607337832450867},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5233211517333984},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.514388382434845},{"id":"https://openalex.org/keywords/black-box","display_name":"Black box","score":0.4425075650215149},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2809736430644989},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.13959428668022156}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.8441418409347534},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7618486881256104},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.7607337832450867},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5233211517333984},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.514388382434845},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.4425075650215149},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2809736430644989},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.13959428668022156},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/cnsm55787.2022.9964935","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm55787.2022.9964935","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 18th International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W208057840","https://openalex.org/W1919179112","https://openalex.org/W1965626898","https://openalex.org/W2027380800","https://openalex.org/W2039157918","https://openalex.org/W2094924503","https://openalex.org/W2096017373","https://openalex.org/W2116261113","https://openalex.org/W2156279557","https://openalex.org/W2401686019","https://openalex.org/W2527994611","https://openalex.org/W2583874385","https://openalex.org/W2754665629","https://openalex.org/W2756452435","https://openalex.org/W2762028850","https://openalex.org/W2767094836","https://openalex.org/W2947415936","https://openalex.org/W2947815220","https://openalex.org/W2962816513","https://openalex.org/W2965838158","https://openalex.org/W2988194011","https://openalex.org/W3025408396","https://openalex.org/W3035050709","https://openalex.org/W3035736465","https://openalex.org/W3094313992","https://openalex.org/W3095840026","https://openalex.org/W6608443543","https://openalex.org/W6712994927","https://openalex.org/W6777683407"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W3210364259","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W2667207928","https://openalex.org/W2912112202","https://openalex.org/W4300558037","https://openalex.org/W4377864969","https://openalex.org/W3030345572"],"abstract_inverted_index":{"Anomaly":[0],"detection":[1,34,75],"is":[2,151],"the":[3,17,31,83,94,97,114,123,145,152,159],"key":[4],"to":[5,81,155],"Quality":[6],"of":[7,20,30,85,107,125,147],"Service":[8],"(QoS)":[9],"in":[10,116],"many":[11],"modern":[12],"systems.":[13],"Logs,":[14],"which":[15],"record":[16],"runtime":[18],"information":[19],"system,":[21],"are":[22],"widely":[23],"used":[24],"for":[25],"anomaly":[26,33,53,74,164],"detection.":[27,54,165],"The":[28,105],"security":[29],"log-based":[32,52,163],"has":[35],"not":[36],"been":[37],"well":[38],"investigated.":[39],"In":[40,89],"this":[41,150],"paper,":[42],"we":[43,92],"conduct":[44],"an":[45],"empirical":[46],"study":[47],"on":[48,51,60,67,96,100,162],"black-box":[49],"attacks":[50],"We":[55,77,120],"investigate":[56,156],"eight":[57],"different":[58],"methods":[59,71,99,128],"log":[61,69,73,86,103],"attacking":[62,87],"and":[63,72,129,135,157],"compare":[64,122,158],"their":[65],"performance":[66,95,134,140],"various":[68,126],"parsing":[70],"models.":[76],"propose":[78],"a":[79,131],"method":[80],"evaluate":[82,93],"imperceptibility":[84,124],"methods.":[88],"our":[90,108,148],"experiments,":[91],"attack":[98,127,139,160],"two":[101],"real":[102],"datasets.":[104],"results":[106],"experiments":[109],"show":[110],"that":[111],"LogBug":[112],"outperforms":[113],"others":[115],"almost":[117],"all":[118],"situations.":[119],"also":[121],"find":[130],"trade-off":[132],"between":[133],"imperceptibility,":[136],"where":[137],"better":[138],"means":[141],"worse":[142],"imperceptibility.":[143],"To":[144],"best":[146],"knowledge,":[149],"first":[153],"work":[154],"models":[161]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}