{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T04:02:31Z","timestamp":1730433751564,"version":"3.28.0"},"reference-count":54,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,9,1]],"date-time":"2024-09-01T00:00:00Z","timestamp":1725148800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2024,9]]},"DOI":"10.1016\/j.cose.2024.103944","type":"journal-article","created":{"date-parts":[[2024,6,12]],"date-time":"2024-06-12T18:56:17Z","timestamp":1718218577000},"page":"103944","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":1,"special_numbering":"C","title":["Detecting abnormal logins by discovering anomalous links via graph transformers"],"prefix":"10.1016","volume":"144","author":[{"ORCID":"http:\/\/orcid.org\/0000-0002-5202-4966","authenticated-orcid":false,"given":"Lu\u00eds","family":"Gon\u00e7alves","sequence":"first","affiliation":[]},{"ORCID":"http:\/\/orcid.org\/0000-0001-6421-9747","authenticated-orcid":false,"given":"Cleber","family":"Zanchettin","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"issue":"2","key":"10.1016\/j.cose.2024.103944_b1","doi-asserted-by":"crossref","first-page":"1851","DOI":"10.1109\/COMST.2019.2891891","article-title":"A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities","volume":"21","author":"Alshamrani","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"1","key":"10.1016\/j.cose.2024.103944_b2","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1145\/3469379.3469386","article-title":"Towards next-generation cybersecurity with graph AI","volume":"55","author":"Bowman","year":"2021","journal-title":"SIGOPS Oper. Syst. Rev."},{"key":"10.1016\/j.cose.2024.103944_b3","series-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020)","first-page":"257","article-title":"Detecting lateral movement in enterprise computer networks with unsupervised graph AI","author":"Bowman","year":"2020"},{"year":"2018","series-title":"An experimental study of neural networks for variable graphs","author":"Bresson","key":"10.1016\/j.cose.2024.103944_b4"},{"key":"10.1016\/j.cose.2024.103944_b5","unstructured":"Casanova, P.V.G.C.A., Lio, A.R.P., Bengio, Y., 2018. Graph attention networks. In: ICLR. Petar Velickovic Guillem Cucurull Arantxa Casanova Adriana Romero Pietro Li\u00f2 and Yoshua Bengio."},{"key":"10.1016\/j.cose.2024.103944_b6","series-title":"Proceedings of the 39th International Conference on Machine Learning","first-page":"3469","article-title":"Structure-aware transformer for graph representation learning","volume":"vol. 162","author":"Chen","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b7","series-title":"Proceedings of the 39th International Conference on Machine Learning","first-page":"3469","article-title":"Structure-aware transformer for graph representation learning","volume":"vol. 162","author":"Chen","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b8","series-title":"Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval","first-page":"614","article-title":"Structured graph convolutional networks with stochastic masks for recommender systems","author":"Chen","year":"2021"},{"key":"10.1016\/j.cose.2024.103944_b9","series-title":"Proceedings of the ACM Web Conference 2022","first-page":"1955","article-title":"Graph neural transport networks with non-local attentions for recommender systems","author":"Chen","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b10","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2020.102716","article-title":"Applications of link prediction in social networks: A review","volume":"166","author":"Daud","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.cose.2024.103944_b11","series-title":"Proceedings of the 34th International Conference on Machine Learning","first-page":"933","article-title":"Language modeling with gated convolutional networks","volume":"vol. 70","author":"Dauphin","year":"2017"},{"key":"10.1016\/j.cose.2024.103944_b12","doi-asserted-by":"crossref","first-page":"213","DOI":"10.1007\/s00354-019-00065-z","article-title":"Temporal link prediction: A survey","volume":"38","author":"Divakaran","year":"2020","journal-title":"New Gener. Comput."},{"key":"10.1016\/j.cose.2024.103944_b13","series-title":"2020 IEEE International Conference on Data Mining","first-page":"1002","article-title":"AANE: Anomaly aware network embedding for anomalous link detection","author":"Duan","year":"2020"},{"key":"10.1016\/j.cose.2024.103944_b14","series-title":"Proceedings of the 34th International Conference on Machine Learning","first-page":"1263","article-title":"Neural message passing for quantum chemistry","volume":"vol. 70","author":"Gilmer","year":"2017"},{"key":"10.1016\/j.cose.2024.103944_b15","series-title":"2013 IEEE Security and Privacy Workshops","first-page":"98","article-title":"Bridging the gap: A pragmatic approach to generating insider threat data","author":"Glasser","year":"2013"},{"key":"10.1016\/j.cose.2024.103944_b16","series-title":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","first-page":"855","article-title":"Node2vec: Scalable feature learning for networks","author":"Grover","year":"2016"},{"issue":"3","key":"10.1016\/j.cose.2024.103944_b17","first-page":"1","article-title":"Graph representation learning","volume":"14","author":"Hamilton","year":"2020","journal-title":"Synth. Lect. Artif. Intell. Mach. Learn."},{"key":"10.1016\/j.cose.2024.103944_b18","article-title":"Inductive representation learning on large graphs","volume":"vol. 30","author":"Hamilton","year":"2017"},{"year":"2017","series-title":"Representation learning on graphs: Methods and applications","author":"Hamilton","key":"10.1016\/j.cose.2024.103944_b19"},{"key":"10.1016\/j.cose.2024.103944_b20","first-page":"1485","article-title":"Attention mechanism for neural machine translation: A survey","volume":"vol. 5","author":"He","year":"2021"},{"key":"10.1016\/j.cose.2024.103944_b21","first-page":"2268","article-title":"Not too little, not too much: a theoretical analysis of graph (over)smoothing","volume":"vol. 35","author":"Keriven","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b22","first-page":"14582","article-title":"Pure transformers are powerful graph learners","volume":"vol. 35","author":"Kim","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b23","doi-asserted-by":"crossref","unstructured":"King, I.J., Huang, H.H., 2022. EULER: Detecting Network Lateral Movement via Scalable Temporal Link Prediction. In: Network and Distributed Systems Security (NDSS) Symposium.","DOI":"10.14722\/ndss.2022.24107"},{"key":"10.1016\/j.cose.2024.103944_b24","unstructured":"Kipf, T.N., Welling, M., 2017. Semi-Supervised Classification with Graph Convolutional Networks. In: International Conference on Learning Representations. ICLR."},{"key":"10.1016\/j.cose.2024.103944_b25","unstructured":"Kitaev, N., Kaiser, L., Levskaya, A., 2019. Reformer: The Efficient Transformer. In: International Conference on Learning Representations."},{"key":"10.1016\/j.cose.2024.103944_b26","series-title":"2022 IEEE International Conference on Big Data (Big Data)","first-page":"5756","article-title":"Anomaly detection in cybersecurity events through graph neural network and transformer based model: A case study with BETH dataset","author":"Lakha","year":"2022"},{"year":"2020","series-title":"PicoDomain: a compact high-fidelity cybersecurity dataset","author":"Laprade","key":"10.1016\/j.cose.2024.103944_b27"},{"key":"10.1016\/j.cose.2024.103944_b28","series-title":"Proceedings of the 36th International Conference on Machine Learning","first-page":"3835","article-title":"Graph matching networks for learning the similarity of graph structured objects","volume":"vol. 97","author":"Li","year":"2019"},{"key":"10.1016\/j.cose.2024.103944_b29","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2023.126441","article-title":"A survey of graph neural network based recommendation in social networks","volume":"549","author":"Li","year":"2023","journal-title":"Neurocomputing"},{"key":"10.1016\/j.cose.2024.103944_b30","series-title":"Proceedings of ICLR\u201916","article-title":"Gated graph sequence neural networks","author":"Li","year":"2016"},{"key":"10.1016\/j.cose.2024.103944_b31","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1016\/j.aiopen.2022.10.001","article-title":"A survey of transformers","volume":"3","author":"Lin","year":"2022","journal-title":"AI Open"},{"key":"10.1016\/j.cose.2024.103944_b32","series-title":"Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing","first-page":"1506","article-title":"Encoding sentences with graph convolutional networks for semantic role labeling","author":"Marcheggiani","year":"2017"},{"key":"10.1016\/j.cose.2024.103944_b33","article-title":"Distributed representations of words and phrases and their compositionality","volume":"vol. 26","author":"Mikolov","year":"2013"},{"key":"10.1016\/j.cose.2024.103944_b34","doi-asserted-by":"crossref","DOI":"10.1016\/j.compbiomed.2021.104772","article-title":"A novel link prediction algorithm for protein-protein interaction networks by attributed graph embedding","volume":"137","author":"Nasiri","year":"2021","journal-title":"Comput. Biol. Med."},{"key":"10.1016\/j.cose.2024.103944_b35","series-title":"Proceedings of the 40th International Conference on Machine Learning","first-page":"25956","article-title":"Revisiting over-smoothing and over-squashing using ollivier-Ricci curvature","volume":"vol. 202","author":"Nguyen","year":"2023"},{"key":"10.1016\/j.cose.2024.103944_b36","series-title":"Proceedings of the ACM\/IEEE 44th International Conference on Software Engineering: Companion Proceedings","first-page":"178","article-title":"Regvd: Revisiting graph neural networks for vulnerability detection","author":"Nguyen","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b37","article-title":"Conditional image generation with pixelcnn decoders","volume":"vol. 29","author":"van den Oord","year":"2016"},{"key":"10.1016\/j.cose.2024.103944_b38","series-title":"Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","first-page":"701","article-title":"DeepWalk: Online learning of social representations","author":"Perozzi","year":"2014"},{"key":"10.1016\/j.cose.2024.103944_b39","series-title":"Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence","first-page":"1548","article-title":"Masked label prediction: Unified message passing model for semi-supervised classification","author":"Shi","year":"2021"},{"key":"10.1016\/j.cose.2024.103944_b40","series-title":"Proceedings of the 40th International Conference on Machine Learning","article-title":"EXPHORMER: sparse transformers for graphs","author":"Shirzad","year":"2023"},{"key":"10.1016\/j.cose.2024.103944_b41","article-title":"End-to-end memory networks","volume":"vol. 28","author":"Sukhbaatar","year":"2015"},{"key":"10.1016\/j.cose.2024.103944_b42","series-title":"2022 IEEE International Performance, Computing, and Communications Conference","first-page":"404","article-title":"Hetglm: Lateral movement detection by discovering anomalous links with heterogeneous graph neural network","author":"Sun","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b43","doi-asserted-by":"crossref","DOI":"10.1016\/j.compeleceng.2022.108261","article-title":"Advanced Persistent Threat intelligent profiling technique: A survey","volume":"103","author":"Tang","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"10.1016\/j.cose.2024.103944_b44","article-title":"Attention is all you need","volume":"vol. 30","author":"Vaswani","year":"2017"},{"issue":"1","key":"10.1016\/j.cose.2024.103944_b45","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1109\/TNNLS.2020.2978386","article-title":"A comprehensive survey on graph neural networks","volume":"32","author":"Wu","year":"2021","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"10.1016\/j.cose.2024.103944_b46","first-page":"27387","article-title":"NodeFormer: A scalable graph structure learning transformer for node classification","volume":"vol. 35","author":"Wu","year":"2022"},{"key":"10.1016\/j.cose.2024.103944_b47","series-title":"International Conference on Learning Representations","article-title":"How powerful are graph neural networks?","author":"Xu","year":"2019"},{"key":"10.1016\/j.cose.2024.103944_b48","series-title":"2020 International Signal Processing, Communications and Engineering Management Conference","first-page":"240","article-title":"A review on application of knowledge graph in cybersecurity","author":"Yan","year":"2020"},{"key":"10.1016\/j.cose.2024.103944_b49","first-page":"28877","article-title":"Do transformers really perform badly for graph representation?","volume":"vol. 34","author":"Ying","year":"2021"},{"key":"10.1016\/j.cose.2024.103944_b50","article-title":"Link prediction based on graph neural networks","volume":"vol. 31","author":"Zhang","year":"2018"},{"issue":"1","key":"10.1016\/j.cose.2024.103944_b51","article-title":"An end-to-end deep learning architecture for graph classification","volume":"vol. 32","author":"Zhang","year":"2018"},{"issue":"5","key":"10.1016\/j.cose.2024.103944_b52","doi-asserted-by":"crossref","DOI":"10.1088\/1757-899X\/768\/5\/052103","article-title":"Review on the application of knowledge graph in cyber security assessment","volume":"768","author":"Zhang","year":"2020","journal-title":"IOP Conf. Ser.: Mater. Sci. Eng."},{"key":"10.1016\/j.cose.2024.103944_b53","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1016\/j.aiopen.2021.01.001","article-title":"Graph neural networks: A review of methods and applications","volume":"1","author":"Zhou","year":"2020","journal-title":"AI Open"},{"key":"10.1016\/j.cose.2024.103944_b54","article-title":"Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks","volume":"vol. 32","author":"Zhou","year":"2019"}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404824002499?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404824002499?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2024,10,31]],"date-time":"2024-10-31T03:50:16Z","timestamp":1730346616000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404824002499"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9]]},"references-count":54,"alternative-id":["S0167404824002499"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2024.103944","relation":{},"ISSN":["0167-4048"],"issn-type":[{"type":"print","value":"0167-4048"}],"subject":[],"published":{"date-parts":[[2024,9]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Detecting abnormal logins by discovering anomalous links via graph transformers","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2024.103944","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2024 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"103944"}}