Search Results for author:
Found 2 papers, 1 papers with code
Interpreting GNN-based IDS Detections Using Provenance Graph Structural Features
PROVEXPLAINER allowed simple DT models to achieve 95% fidelity to the GNN on program classification tasks with general graph structural features, and 99% fidelity on malware detection tasks with a task-specific feature package tailored for direct interpretation.
SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
To facilitate the task of expressing anomalies based on expert knowledge, our system provides a domain-specific query language, SAQL, which allows analysts to express models for (1) rule-based anomalies, (2) time-series anomalies, (3) invariant-based anomalies, and (4) outlier-based anomalies.
Cryptography and Security Databases
