In the rapidly changing cybersecurity landscape, threat hunting has become a critical
proactive defense against sophisticated cyber threats. While traditional security measures …

Security Operations Centres (SOCs) are specialised facilities where security analysts
leverage advanced technologies to monitor, detect, and respond to cyber incidents …

Anomaly detection for discrete event logs can provide critical information for building secure
and reliable systems in various application domains, such as large scale data centers …

Abstract To detect Advanced Persistent Threats (APTs), recent research efforts focus on
modeling the common attack kill chain. The provenance graph is one of the proven …

Alerts reported by intrusion detection systems (IDSes) are often the starting points for attack
campaign discovery and response procedures. However, the sheer number of alerts …

Anomaly-based intrusion detection aims to learn the normal behaviors of a system and
detect activity that deviates from it. One of the best ways to represent the behavior of a …

Provenance tracking has been widely used in the recent literature to debug system
vulnerabilities and find the root causes behind faults, errors, or crashes over a running …

With the increasing prevalence of the internet, detecting malicious behavior is becoming a
greater need. This problem can be formulated as an anomaly detection task on provenance …

Machine Learning (ML) algorithms are largely adopted in modern Network Intrusion
Detection Systems (NIDS). The most recent researches propose the use of Graph Neural …

Advanced persistent threats are an emerging cyber threat to cyber‐physical systems (CPS),
especially those comprising mission‐critical physical assets. However, defense against such …