{"id":"https://openalex.org/W7154692030","doi":"https://doi.org/10.48550/arxiv.2604.14685","title":"Beyond Nodes vs. Edges: A Multi-View Fusion Framework for Provenance-Based Intrusion Detection","display_name":"Beyond Nodes vs. Edges: A Multi-View Fusion Framework for Provenance-Based Intrusion Detection","publication_year":2026,"publication_date":"2026-04-16","ids":{"openalex":"https://openalex.org/W7154692030","doi":"https://doi.org/10.48550/arxiv.2604.14685"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.14685","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.14685","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.14685","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133848692","display_name":"Fan Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Fan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133909068","display_name":"Binyan Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Binyan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133868398","display_name":"Di Tang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tang, Di","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5008237643","display_name":"Kehuan Zhang","orcid":"https://orcid.org/0000-0003-1519-0057"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Kehuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7257999777793884,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7257999777793884,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.0681999996304512,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.02630000002682209,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7922999858856201},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.7504000067710876},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7472000122070312},{"id":"https://openalex.org/keywords/granularity","display_name":"Granularity","score":0.6876999735832214},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.6330999732017517},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.6164000034332275},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.4512999951839447}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7922999858856201},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.7504000067710876},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7472000122070312},{"id":"https://openalex.org/C177774035","wikidata":"https://www.wikidata.org/wiki/Q1246948","display_name":"Granularity","level":2,"score":0.6876999735832214},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.675599992275238},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6606000065803528},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.6330999732017517},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.6164000034332275},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.4512999951839447},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.45010000467300415},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.36340001225471497},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.3594000041484833},{"id":"https://openalex.org/C158525013","wikidata":"https://www.wikidata.org/wiki/Q2593739","display_name":"Fusion","level":2,"score":0.3594000041484833},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.35589998960494995},{"id":"https://openalex.org/C2779304628","wikidata":"https://www.wikidata.org/wiki/Q3503480","display_name":"Face (sociological concept)","level":2,"score":0.3490000069141388},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.296999990940094},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.2953999936580658},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.2599000036716461}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.14685","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.14685","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.14685","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.14685","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7756046056747437,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Provenance-based":[0],"intrusion":[1,215],"detection":[2,99,175],"has":[3],"emerged":[4],"as":[5,47],"a":[6,82,97,131,136,159,207],"promising":[7],"approach":[8],"for":[9,212],"analyzing":[10],"complex":[11],"attack":[12],"behaviors":[13],"through":[14,120,130],"system-level":[15],"provenance":[16],"graphs.":[17],"However,":[18],"existing":[19],"defense":[20],"methods":[21],"face":[22],"an":[23],"inherent":[24],"granularity":[25],"limitation.":[26],"Node-centric":[27],"detectors,":[28,52],"which":[29,53],"evaluate":[30],"anomalies":[31,157],"using":[32],"entities'":[33],"attributes":[34],"and":[35,87,112,124,139,155,177,184,209],"local":[36],"structural":[37],"patterns,":[38],"may":[39,58],"misclassify":[40],"benign":[41],"behavioral":[42],"changes":[43],"or":[44],"configuration":[45],"modifications":[46],"suspicious.":[48],"In":[49],"contrast,":[50],"edge-centric":[51,88,185],"focus":[54],"more":[55,137],"on":[56,164],"interactions,":[57],"lack":[59],"sufficient":[60],"contextual":[61],"awareness":[62],"of":[63,142],"the":[64,126,193],"involved":[65],"entities,":[66],"leading":[67],"to":[68,149],"missed":[69],"detections":[70],"when":[71],"compromised":[72],"entities":[73],"perform":[74],"seemingly":[75],"ordinary":[76],"operations.":[77],"These":[78],"analytical":[79],"biases":[80],"highlight":[81],"persistent":[83],"gap":[84],"between":[85],"node-centric":[86],"analyses.":[89],"To":[90],"mitigate":[91],"this":[92],"gap,":[93],"we":[94],"present":[95],"PROVFUSION,":[96],"multi-view":[98,198],"framework":[100,115],"that":[101,171,196],"integrates":[102],"anomaly":[103,118,128,199],"signals":[104,119],"from":[105],"three":[106],"distinct":[107],"views":[108],"(i.e.,":[109],"attribute,":[110],"structure,":[111],"causality).":[113],"The":[114],"fuses":[116],"heterogeneous":[117],"lightweight":[121],"fusion":[122,200],"schemes":[123],"determines":[125],"final":[127],"decisions":[129],"voting-based":[132,203],"integration":[133],"process,":[134],"providing":[135],"consistent":[138,160],"context-aware":[140],"assessment":[141],"system":[143],"behavior.":[144],"This":[145],"design":[146],"enables":[147],"PROVFUSION":[148,172],"capture":[150],"both":[151],"entity":[152],"level":[153],"deviations":[154],"interaction-level":[156],"within":[158],"analytic":[161],"pipeline.":[162],"Experiments":[163],"nine":[165],"widely":[166],"used":[167],"benchmark":[168],"datasets":[169],"demonstrate":[170],"achieves":[173],"higher":[174],"accuracy":[176],"lower":[178],"false-positive":[179],"rates":[180],"than":[181],"single":[182],"node-":[183],"baselines,":[186],"maintaining":[187],"stable":[188],"performance":[189],"across":[190],"scenarios.":[191],"Overall,":[192],"results":[194],"suggest":[195],"our":[197],"together":[201],"with":[202],"decision":[204],"aggregation":[205],"offers":[206],"practical":[208],"effective":[210],"direction":[211],"advancing":[213],"provenance-based":[214],"detection.":[216]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-18T00:00:00"}