{"id":"https://openalex.org/W2965568183","doi":"https://doi.org/10.24963/ijcai.2019/656","title":"Locate-Then-Detect: Real-time Web Attack Detection via Attention-based Deep Neural Networks","display_name":"Locate-Then-Detect: Real-time Web Attack Detection via Attention-based Deep Neural Networks","publication_year":2019,"publication_date":"2019-07-28","ids":{"openalex":"https://openalex.org/W2965568183","doi":"https://doi.org/10.24963/ijcai.2019/656","mag":"2965568183"},"language":"en","primary_location":{"id":"doi:10.24963/ijcai.2019/656","is_oa":true,"landing_page_url":"https://doi.org/10.24963/ijcai.2019/656","pdf_url":"https://www.ijcai.org/proceedings/2019/0656.pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.ijcai.org/proceedings/2019/0656.pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101958292","display_name":"Tianlong Liu","orcid":"https://orcid.org/0000-0003-3908-6238"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tianlong Liu","raw_affiliation_strings":["Alibaba Cloud Intelligence Business Group, Alibaba Group, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Cloud Intelligence Business Group, Alibaba Group, China","institution_ids":["https://openalex.org/I45928872"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015197477","display_name":"Yu Qi","orcid":"https://orcid.org/0000-0002-9789-8907"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Qi","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083945206","display_name":"Liang Shi","orcid":"https://orcid.org/0000-0002-4442-4679"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liang Shi","raw_affiliation_strings":["AI&Data Department, Dingxiang Tech.Inc, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AI&Data Department, Dingxiang Tech.Inc, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5112459184","display_name":"Jianan Yan","orcid":null},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianan Yan","raw_affiliation_strings":["Alibaba Cloud Intelligence Business Group, Alibaba Group, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Cloud Intelligence Business Group, Alibaba Group, China","institution_ids":["https://openalex.org/I45928872"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.4892,"has_fulltext":false,"cited_by_count":46,"citation_normalized_percentile":{"value":0.98145791,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"4725","last_page":"4731"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8585188984870911},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.6871477365493774},{"id":"https://openalex.org/keywords/sql-injection","display_name":"SQL injection","score":0.5936596393585205},{"id":"https://openalex.org/keywords/web-traffic","display_name":"Web traffic","score":0.5726765394210815},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5360453724861145},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.4909665882587433},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.485477477312088},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.45757150650024414},{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"Cross-site scripting","score":0.4574235677719116},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4572586119174957},{"id":"https://openalex.org/keywords/deep-web","display_name":"Deep Web","score":0.44485610723495483},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.4388037621974945},{"id":"https://openalex.org/keywords/firewall","display_name":"Firewall (physics)","score":0.42842209339141846},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.41386204957962036},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36298489570617676},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3509786128997803},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.32197362184524536},{"id":"https://openalex.org/keywords/web-application-security","display_name":"Web application security","score":0.2960159182548523},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.24690821766853333},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.17329981923103333},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.1446630358695984},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.14411357045173645},{"id":"https://openalex.org/keywords/web-development","display_name":"Web development","score":0.12892594933509827},{"id":"https://openalex.org/keywords/search-engine","display_name":"Search engine","score":0.1017589271068573}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8585188984870911},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.6871477365493774},{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.5936596393585205},{"id":"https://openalex.org/C2777672014","wikidata":"https://www.wikidata.org/wiki/Q1172573","display_name":"Web traffic","level":3,"score":0.5726765394210815},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5360453724861145},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.4909665882587433},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.485477477312088},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.45757150650024414},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.4574235677719116},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4572586119174957},{"id":"https://openalex.org/C46721378","wikidata":"https://www.wikidata.org/wiki/Q221989","display_name":"Deep Web","level":3,"score":0.44485610723495483},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.4388037621974945},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.42842209339141846},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.41386204957962036},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36298489570617676},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3509786128997803},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.32197362184524536},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.2960159182548523},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.24690821766853333},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.17329981923103333},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.1446630358695984},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.14411357045173645},{"id":"https://openalex.org/C79373723","wikidata":"https://www.wikidata.org/wiki/Q386275","display_name":"Web development","level":3,"score":0.12892594933509827},{"id":"https://openalex.org/C97854310","wikidata":"https://www.wikidata.org/wiki/Q19541","display_name":"Search engine","level":2,"score":0.1017589271068573},{"id":"https://openalex.org/C115304011","wikidata":"https://www.wikidata.org/wiki/Q72755","display_name":"Schwarzschild radius","level":3,"score":0.0},{"id":"https://openalex.org/C124017977","wikidata":"https://www.wikidata.org/wiki/Q11412","display_name":"Gravitation","level":2,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C74650414","wikidata":"https://www.wikidata.org/wiki/Q11397","display_name":"Classical mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C183915046","wikidata":"https://www.wikidata.org/wiki/Q1316152","display_name":"Charged black hole","level":4,"score":0.0},{"id":"https://openalex.org/C194222762","wikidata":"https://www.wikidata.org/wiki/Q114486","display_name":"Query by Example","level":4,"score":0.0},{"id":"https://openalex.org/C164120249","wikidata":"https://www.wikidata.org/wiki/Q995982","display_name":"Web search query","level":3,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.24963/ijcai.2019/656","is_oa":true,"landing_page_url":"https://doi.org/10.24963/ijcai.2019/656","pdf_url":"https://www.ijcai.org/proceedings/2019/0656.pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.24963/ijcai.2019/656","is_oa":true,"landing_page_url":"https://doi.org/10.24963/ijcai.2019/656","pdf_url":"https://www.ijcai.org/proceedings/2019/0656.pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2965568183.pdf","grobid_xml":"https://content.openalex.org/works/W2965568183.grobid-xml"},"referenced_works_count":18,"referenced_works":["https://openalex.org/W157193387","https://openalex.org/W639708223","https://openalex.org/W1522301498","https://openalex.org/W1536680647","https://openalex.org/W1832693441","https://openalex.org/W1938755728","https://openalex.org/W1979931683","https://openalex.org/W2022597053","https://openalex.org/W2062394878","https://openalex.org/W2070218579","https://openalex.org/W2114271194","https://openalex.org/W2146764106","https://openalex.org/W2252335727","https://openalex.org/W2520812144","https://openalex.org/W2531409750","https://openalex.org/W2769291631","https://openalex.org/W2951559648","https://openalex.org/W2952230511"],"related_works":["https://openalex.org/W4312406950","https://openalex.org/W3188339517","https://openalex.org/W2611747598","https://openalex.org/W2549898710","https://openalex.org/W2166381878","https://openalex.org/W2955734438","https://openalex.org/W2504194819","https://openalex.org/W3132720240","https://openalex.org/W4256450364","https://openalex.org/W3069109132"],"abstract_inverted_index":{"Web":[0,11,63,158,174],"attacks":[1],"such":[2],"as":[3],"Cross-Site":[4],"Scripting":[5],"and":[6,19,118,156,169,193],"SQL":[7],"Injection":[8],"are":[9,24,150],"serious":[10],"threats":[12,64],"that":[13,32,59],"lead":[14],"to":[15,82,99],"catastrophic":[16],"data":[17],"leaking":[18],"loss.":[20],"Because":[21],"attack":[22],"payloads":[23],"often":[25],"short":[26],"segments":[27,117],"hidden":[28],"in":[29,43,65],"URL":[30,89,147],"requests/posts":[31],"can":[33,60,111,130,136,179],"be":[34,131,180],"very":[35],"long,":[36],"classical":[37],"machine":[38],"learning":[39,44,115],"approaches":[40],"have":[41],"difficulties":[42],"useful":[45],"patterns":[46],"from":[47,87,104],"them.":[48],"In":[49,107],"this":[50,108],"study,":[51],"we":[52],"propose":[53,83],"a":[54,92,170],"novel":[55],"Locate-Then-Detect":[56],"(LTD)":[57],"system":[58],"precisely":[61],"detect":[62],"real-time":[66,197],"by":[67,126,143],"using":[68],"attention-based":[69],"deep":[70],"neural":[71],"networks.":[72],"Firstly,":[73],"an":[74,163,186],"efficient":[75],"Payload":[76,93],"Locating":[77],"Network":[78,95],"(PLN)":[79],"is":[80,97],"employed":[81],"most":[84],"suspicious":[85,105],"regions":[86,103],"large":[88,145],"requests/posts.":[90],"Then":[91],"Classification":[94],"(PCN)":[96],"adopted":[98],"accurately":[100],"classify":[101],"malicious":[102,116],"candidates.":[106],"way,":[109],"PCN":[110],"focus":[112],"more":[113],"on":[114,153,183],"highly":[119],"increase":[120],"detection":[121,188],"accuracy.":[122],"The":[123,160],"noise":[124],"induced":[125],"irrelevant":[127,146],"background":[128],"strings":[129],"largely":[132],"eliminated.":[133],"Besides,":[134],"LTD":[135,161],"greatly":[137],"reduce":[138],"computational":[139],"costs":[140],"(82.6%":[141],"less)":[142],"ignoring":[144],"content.":[148],"Experiments":[149],"carried":[151],"out":[152],"both":[154],"benchmarks":[155],"real":[157],"traffic.":[159],"outperforms":[162],"HMM-based":[164],"approach,":[165],"the":[166],"Libinjection":[167],"system,":[168],"leading":[171],"commercial":[172],"rule-based":[173],"Application":[175],"Firewall.":[176],"Our":[177],"method":[178],"efficiently":[181],"implemented":[182],"GPUs":[184],"with":[185],"average":[187],"time":[189],"of":[190],"about":[191],"5ms":[192],"well":[194],"qualified":[195],"for":[196],"applications.":[198]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":7},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":14},{"year":2021,"cited_by_count":6},{"year":2020,"cited_by_count":7}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}