{"id":"https://openalex.org/W7134830781","doi":"https://doi.org/10.48550/arxiv.2603.08295","title":"SoK: Harmonizing Attack Graphs and Intrusion Detection Systems","display_name":"SoK: Harmonizing Attack Graphs and Intrusion Detection Systems","publication_year":2026,"publication_date":"2026-03-09","ids":{"openalex":"https://openalex.org/W7134830781","doi":"https://doi.org/10.48550/arxiv.2603.08295"},"language":null,"primary_location":{"id":"pmh:doi:10.48550/arxiv.2603.08295","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"type":"article","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":null,"any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053171685","display_name":"Andrea Agiollo","orcid":"https://orcid.org/0000-0003-0531-1978"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Agiollo, Andrea","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066791167","display_name":"Enkeleda Bardhi","orcid":"https://orcid.org/0000-0002-3099-5374"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bardhi, Enkeleda","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128673609","display_name":"Alessandro Palma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Palma, Alessandro","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011222101","display_name":"Riccardo Lazzeretti","orcid":"https://orcid.org/0000-0003-3835-9679"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lazzeretti, Riccardo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059692428","display_name":"Silvia Bonomi","orcid":"https://orcid.org/0000-0001-9928-5357"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bonomi, Silvia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5069179616","display_name":"Fernando Kuipers","orcid":"https://orcid.org/0000-0002-6686-8350"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kuipers, Fernando","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.2410781,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7599999904632568,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7599999904632568,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.10819999873638153,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.009999999776482582,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.8040000200271606},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.5728999972343445},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.47839999198913574},{"id":"https://openalex.org/keywords/filter","display_name":"Filter (signal processing)","score":0.4113999903202057},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.40290001034736633},{"id":"https://openalex.org/keywords/intrusion-prevention-system","display_name":"Intrusion prevention system","score":0.38850000500679016},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.3345000147819519}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.8040000200271606},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7178999781608582},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5728999972343445},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4875999987125397},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.47839999198913574},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.4113999903202057},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.40290001034736633},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.38850000500679016},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3345000147819519},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.334199994802475},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3314000070095062},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3068000078201294},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.3068000078201294},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.295199990272522},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.27390000224113464},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.2671999931335449},{"id":"https://openalex.org/C29825287","wikidata":"https://www.wikidata.org/wiki/Q1427940","display_name":"Warning system","level":2,"score":0.2529999911785126}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.48550/arxiv.2603.08295","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"doi:10.48550/arxiv.2603.08295","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.08295","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:doi:10.48550/arxiv.2603.08295","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Detecting":[0],"and":[1,40,57,127,159,184],"responding":[2],"to":[3,16,100,109],"cyber":[4],"attacks":[5],"is":[6,90],"increasingly":[7],"difficult":[8],"as":[9,31,97,129],"high-volume,":[10],"complex":[11],"network":[12],"traffic":[13],"allows":[14],"threats":[15],"remain":[17],"concealed.":[18],"While":[19],"Intrusion":[20],"Detection":[21],"Systems":[22],"(IDSs)":[23],"identify":[24],"anomalous":[25],"behavior,":[26],"Attack":[27],"Graphs":[28],"(AGs)":[29],"serve":[30],"the":[32,45,53,67,118,154,175,199],"primary":[33],"threat":[34,182],"model":[35],"for":[36,181,195],"analyzing":[37],"attacker":[38],"strategies":[39],"informing":[41],"any":[42],"response.":[43,186],"Despite":[44],"conceptual":[46],"connection":[47],"being":[48],"recognized":[49],"in":[50,79,163],"early":[51],"research,":[52],"field":[54],"of":[55,71,120,156,178],"AG":[56,157],"IDS":[58,102,107,166],"integration":[59],"lacks":[60],"a":[61,75,83,115,121,130,140,147,171],"common":[62],"structure.":[63],"This":[64,144],"paper":[65],"presents":[66],"first":[68],"systematic":[69],"analysis":[70,113],"AG-IDS":[72,142,200],"integration,":[73],"reviewing":[74],"73":[76],"comprehensive":[77],"works":[78],"literature.":[80],"We":[81,169],"introduce":[82],"novel":[84],"taxonomy":[85],"revealing":[86],"that":[87,124],"current":[88],"research":[89],"dominated":[91],"by":[92,190],"specialized,":[93],"single-purpose":[94],"integrations,":[95],"such":[96],"using":[98,106],"AGs":[99,128],"filter":[101],"false":[103],"positives":[104],"or":[105],"alerts":[108],"prune":[110],"AGs.":[111],"Our":[112],"highlights":[114],"critical":[116],"gap:":[117],"absence":[119],"unifying":[122],"framework":[123,145],"treats":[125],"IDSs":[126,152],"cohesive,":[131],"integrated":[132],"system.":[133],"To":[134],"address":[135],"this":[136,179],"gap,":[137],"we":[138,188],"propose":[139],"formal":[141],"lifecycle.":[143],"establishes":[146],"continuous":[148],"feedback":[149],"loop":[150],"where":[151],"refine":[153],"accuracy":[155],"models,":[158,162],"those":[160],"updated":[161],"turn,":[164],"enhance":[165],"detection":[167,183],"capabilities.":[168],"provide":[170],"proof-of-concept":[172],"implementation":[173],"demonstrating":[174],"practical":[176],"advantages":[177],"lifecycle":[180],"incident":[185],"Finally,":[187],"conclude":[189],"elaborating":[191],"on":[192],"significant":[193],"opportunities":[194],"future":[196],"development":[197],"within":[198],"domain.":[201]},"counts_by_year":[],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2026-03-11T00:00:00"}