In recommendation systems, Graph Convolutional Networks (GCNs) often suffer from significant computational and memory cost when propagating features across the entire user-item graph. While various sampling strategies have been introduced to reduce the cost, the challenge of neighbor explosion persists, primarily due to the iterative nature of neighbor aggregation. This work focuses on exploring subgraph propagation for scalable recommendation by addressing two primary challenges: efficient and effective subgraph construction and subgraph sparsity . To address these challenges, we propose a novel GCN model for recommendation based on Sub graph propagation, called SubGCN. One key component of SubGCN is BiPPR, a technique that fuses both source- and target-based Personalized PageRank (PPR) approximations, to overcome the challenge of efficient and effective subgraph construction . Furthermore, we propose a source-target contrastive learning scheme to mitigate the impact of subgraph sparsity for SubGCN. We conduct extensive experiments on two large and two medium-sized datasets to evaluate the scalability, efficiency, and effectiveness of SubGCN. On medium-sized datasets, compared to full-graph GCNs, SubGCN achieves competitive accuracy while using only 23.79% training time on Gowalla and 16.3% on Yelp2018. On large datasets, where full-graph GCNs ran out of the GPU memory, our proposed SubGCN outperforms widely used sampling strategies in terms of training efficiency and recommendation accuracy.
{"title":"Accurate and Scalable Graph Convolutional Networks for Recommendation Based on Subgraph Propagation","authors":"Xueqi Li;Guoqing Xiao;Yuedan Chen;Kenli Li;Gao Cong","doi":"10.1109/TKDE.2024.3467333","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3467333","url":null,"abstract":"In recommendation systems, Graph Convolutional Networks (GCNs) often suffer from significant computational and memory cost when propagating features across the entire user-item graph. While various sampling strategies have been introduced to reduce the cost, the challenge of neighbor explosion persists, primarily due to the iterative nature of neighbor aggregation. This work focuses on exploring subgraph propagation for scalable recommendation by addressing two primary challenges: \u0000<italic>efficient and effective subgraph construction</i>\u0000 and \u0000<italic>subgraph sparsity</i>\u0000. To address these challenges, we propose a novel \u0000<underline>GCN</u>\u0000 model for recommendation based on \u0000<underline>Sub</u>\u0000graph propagation, called SubGCN. One key component of SubGCN is BiPPR, a technique that fuses both source- and target-based Personalized PageRank (PPR) approximations, to overcome the challenge of \u0000<italic>efficient and effective subgraph construction</i>\u0000. Furthermore, we propose a source-target contrastive learning scheme to mitigate the impact of \u0000<italic>subgraph sparsity</i>\u0000 for SubGCN. We conduct extensive experiments on two large and two medium-sized datasets to evaluate the scalability, efficiency, and effectiveness of SubGCN. On medium-sized datasets, compared to full-graph GCNs, SubGCN achieves competitive accuracy while using only 23.79% training time on Gowalla and 16.3% on Yelp2018. On large datasets, where full-graph GCNs ran out of the GPU memory, our proposed SubGCN outperforms widely used sampling strategies in terms of training efficiency and recommendation accuracy.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"7556-7568"},"PeriodicalIF":8.9,"publicationDate":"2024-10-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142645549","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2024-10-10DOI: 10.1109/TKDE.2024.3477977
Guofan Liu;Jinghao Zhang;Qiang Liu;Junfei Wu;Shu Wu;Liang Wang
With the rapid expansion of multimodal content in online social media, automatic detection of multimodal fake news has received much attention. Multimodal joint training commonly used in existing methods is expected to benefit from thoroughly leveraging cross-modal features, yet these methods still suffer from insufficient learning of uni-modal features. Due to the heterogeneity of multimodal networks, optimizing a single objective will inevitably make the models prone to rely on specific modality while leaving other modalities under-optimized. On the other hand, simply expecting each modality to play a significant role in identifying all the rumors is also not appropriate as the multimodal fake news often involves tampering in only one modality. Therefore, how to find the genuine tampering on the per-sample basis becomes the key point to unlock the full power of each modality in a good collaborative manner. To address these issues, we propose a U ni-modal E vent-agnostic K nowledge D istillation framework (UEKD), which aims to transfer knowledge contained in the fine-grained prediction from uni-modal teachers to the multimodal student model through modality-specific distillation. Specifically, we find that the uni-modal teachers simply trained on the whole training set are easy to memorize the event-specific noise information to make a correct but biased prediction, failing to reflect the genuine degree of tampering in each modality. To tackle this problem, we propose to train and validate the teacher models on different domains in training dataset through a cross-validation manner, as the predictions from the out-of-domain teachers can be regarded as event-agnostic knowledge without spurious connections with event-specific information. Finally, to balance the convergence speeds across modalities, we dynamically monitor the involvement of each modality during training, through which we could identify the more under-optimized modalities and re-weight the distillation loss accordingly. Our method could be served as a plug-and-play module for existing multimodal fake news detection backbones. Extensive experiments on three public datasets and four state-of-the-art fake news detection backbones show that our proposed method can improve the performance by a large margin.
{"title":"Uni-Modal Event-Agnostic Knowledge Distillation for Multimodal Fake News Detection","authors":"Guofan Liu;Jinghao Zhang;Qiang Liu;Junfei Wu;Shu Wu;Liang Wang","doi":"10.1109/TKDE.2024.3477977","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3477977","url":null,"abstract":"With the rapid expansion of multimodal content in online social media, automatic detection of multimodal fake news has received much attention. Multimodal joint training commonly used in existing methods is expected to benefit from thoroughly leveraging cross-modal features, yet these methods still suffer from insufficient learning of uni-modal features. Due to the heterogeneity of multimodal networks, optimizing a single objective will inevitably make the models prone to rely on specific modality while leaving other modalities under-optimized. On the other hand, simply expecting each modality to play a significant role in identifying all the rumors is also not appropriate as the multimodal fake news often involves tampering in only one modality. Therefore, how to find the genuine tampering on the per-sample basis becomes the key point to unlock the full power of each modality in a good collaborative manner. To address these issues, we propose a \u0000<bold><u>U</u></b>\u0000ni-modal \u0000<bold><u>E</u></b>\u0000vent-agnostic \u0000<bold><u>K</u></b>\u0000nowledge \u0000<bold><u>D</u></b>\u0000istillation framework (UEKD), which aims to transfer knowledge contained in the fine-grained prediction from uni-modal teachers to the multimodal student model through modality-specific distillation. Specifically, we find that the uni-modal teachers simply trained on the whole training set are easy to memorize the event-specific noise information to make a correct but biased prediction, failing to reflect the genuine degree of tampering in each modality. To tackle this problem, we propose to train and validate the teacher models on different domains in training dataset through a cross-validation manner, as the predictions from the out-of-domain teachers can be regarded as event-agnostic knowledge without spurious connections with event-specific information. Finally, to balance the convergence speeds across modalities, we dynamically monitor the involvement of each modality during training, through which we could identify the more under-optimized modalities and re-weight the distillation loss accordingly. Our method could be served as a plug-and-play module for existing multimodal fake news detection backbones. Extensive experiments on three public datasets and four state-of-the-art fake news detection backbones show that our proposed method can improve the performance by a large margin.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"9490-9503"},"PeriodicalIF":8.9,"publicationDate":"2024-10-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142600332","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2024-10-10DOI: 10.1109/TKDE.2024.3472906
Peiyao Liu;Junpeng Lin;Chen Zhang
Functional data have been gaining increasing popularity in the field of time series analysis. However, so far modeling heterogeneous multivariate functional time series remains a research gap. To fill it, this paper proposes a time-varying functional state space model (TV-FSSM). It uses functional decomposition to extract features of the functional observations, where the decomposition coefficients are regarded as latent states that evolve according to a tensor autoregressive model. This two-layer structure can on the one hand efficiently extract continuous functional features, and on the other provide a flexible and generalized description of data heterogeneity among different time points. An expectation maximization (EM) framework is developed for parameter estimation, where regularization and constraints are incorporated for better model interoperability. As the sample size grows, an incremental learning version of the EM algorithm is given to efficiently update the model parameters. Some model properties, including model identifiability conditions, convergence issues, time complexities, and bounds of its one-step-ahead prediction errors, are also presented. Extensive experiments on both real and synthetic datasets are performed to evaluate the predictive accuracy and efficiency of the proposed framework.
函数数据在时间序列分析领域越来越受欢迎。然而，迄今为止，异质多变量函数时间序列建模仍是一个研究空白。为了填补这一空白，本文提出了时变函数状态空间模型（TV-FSSM）。它使用函数分解来提取函数观测值的特征，其中分解系数被视为根据张量自回归模型演化的潜在状态。这种双层结构一方面可以有效地提取连续的函数特征，另一方面可以灵活、概括地描述不同时间点之间的数据异质性。为参数估计开发了期望最大化（EM）框架，其中包含了正则化和约束条件，以实现更好的模型互操作性。随着样本量的增加，给出了 EM 算法的增量学习版本，以有效更新模型参数。此外，还介绍了一些模型特性，包括模型可识别性条件、收敛问题、时间复杂性及其一步预测误差的界限。在真实数据集和合成数据集上进行了广泛的实验，以评估所提出框架的预测准确性和效率。
{"title":"Heterogeneous Multivariate Functional Time Series Modeling: A State Space Approach","authors":"Peiyao Liu;Junpeng Lin;Chen Zhang","doi":"10.1109/TKDE.2024.3472906","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3472906","url":null,"abstract":"Functional data have been gaining increasing popularity in the field of time series analysis. However, so far modeling heterogeneous multivariate functional time series remains a research gap. To fill it, this paper proposes a time-varying functional state space model (TV-FSSM). It uses functional decomposition to extract features of the functional observations, where the decomposition coefficients are regarded as latent states that evolve according to a tensor autoregressive model. This two-layer structure can on the one hand efficiently extract continuous functional features, and on the other provide a flexible and generalized description of data heterogeneity among different time points. An expectation maximization (EM) framework is developed for parameter estimation, where regularization and constraints are incorporated for better model interoperability. As the sample size grows, an incremental learning version of the EM algorithm is given to efficiently update the model parameters. Some model properties, including model identifiability conditions, convergence issues, time complexities, and bounds of its one-step-ahead prediction errors, are also presented. Extensive experiments on both real and synthetic datasets are performed to evaluate the predictive accuracy and efficiency of the proposed framework.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"8421-8433"},"PeriodicalIF":8.9,"publicationDate":"2024-10-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142600234","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sequential recommendation is a critical part of the flourishing online applications by suggesting appealing items on users’ next interactions, where global dependencies among items have proven to be indispensable for enhancing the quality of item representations toward a better understanding of user dynamic preferences. Existing methods rely on pre-defined graphs with shallow Graph Neural Networks to capture such necessary dependencies due to the constraint of the over-smoothing problem. However, this graph representation learning paradigm makes them difficult to satisfy the original expectation because of noisy graph structures and the limited ability of shallow architectures for modeling high-order relations. In this paper, we propose a novel Graph Diffusion Representation-enhanced Attention Network for sequential recommendation, which explores the construction of deeper networks by utilizing graph diffusion on adaptive graph structures for generating expressive item representations. Specifically, we design an adaptive graph generation strategy via leveraging similarity learning between item embeddings, automatically optimizing the input graph topology under the guidance of downstream recommendation tasks. Afterward, we propose a novel graph diffusion paradigm with robustness to over-smoothing, which enriches the learned item representations with sufficient global dependencies for attention-based sequential modeling. Moreover, extensive experiments demonstrate the effectiveness of our approach over state-of-the-art baselines.
{"title":"Graph Diffusion-Based Representation Learning for Sequential Recommendation","authors":"Zhaobo Wang;Yanmin Zhu;Chunyang Wang;Xuhao Zhao;Bo Li;Jiadi Yu;Feilong Tang","doi":"10.1109/TKDE.2024.3477621","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3477621","url":null,"abstract":"Sequential recommendation is a critical part of the flourishing online applications by suggesting appealing items on users’ next interactions, where global dependencies among items have proven to be indispensable for enhancing the quality of item representations toward a better understanding of user dynamic preferences. Existing methods rely on pre-defined graphs with shallow Graph Neural Networks to capture such necessary dependencies due to the constraint of the over-smoothing problem. However, this graph representation learning paradigm makes them difficult to satisfy the original expectation because of noisy graph structures and the limited ability of shallow architectures for modeling high-order relations. In this paper, we propose a novel Graph Diffusion Representation-enhanced Attention Network for sequential recommendation, which explores the construction of deeper networks by utilizing graph diffusion on adaptive graph structures for generating expressive item representations. Specifically, we design an adaptive graph generation strategy via leveraging similarity learning between item embeddings, automatically optimizing the input graph topology under the guidance of downstream recommendation tasks. Afterward, we propose a novel graph diffusion paradigm with robustness to over-smoothing, which enriches the learned item representations with sufficient global dependencies for attention-based sequential modeling. Moreover, extensive experiments demonstrate the effectiveness of our approach over state-of-the-art baselines.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"8395-8407"},"PeriodicalIF":8.9,"publicationDate":"2024-10-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142600389","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2024-10-07DOI: 10.1109/TKDE.2024.3475809
Qianli Ma;Zhen Liu;Zhenjing Zheng;Ziyang Huang;Siying Zhu;Zhongzhong Yu;James T. Kwok
Time-Series Mining (TSM) is an important research area since it shows great potential in practical applications. Deep learning models that rely on massive labeled data have been utilized for TSM successfully. However, constructing a large-scale well-labeled dataset is difficult due to data annotation costs. Recently, pre-trained models have gradually attracted attention in the time series domain due to their remarkable performance in computer vision and natural language processing. In this survey, we provide a comprehensive review of Time-Series Pre-Trained Models (TS-PTMs), aiming to guide the understanding, applying, and studying TS-PTMs. Specifically, we first briefly introduce the typical deep learning models employed in TSM. Then, we give an overview of TS-PTMs according to the pre-training techniques. The main categories we explore include supervised, unsupervised, and self-supervised TS-PTMs. Further, extensive experiments involving 27 methods, 434 datasets, and 679 transfer learning scenarios are conducted to analyze the advantages and disadvantages of transfer learning strategies, Transformer-based models, and representative TS-PTMs. Finally, we point out some potential directions of TS-PTMs for future work.
{"title":"A Survey on Time-Series Pre-Trained Models","authors":"Qianli Ma;Zhen Liu;Zhenjing Zheng;Ziyang Huang;Siying Zhu;Zhongzhong Yu;James T. Kwok","doi":"10.1109/TKDE.2024.3475809","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3475809","url":null,"abstract":"Time-Series Mining (TSM) is an important research area since it shows great potential in practical applications. Deep learning models that rely on massive labeled data have been utilized for TSM successfully. However, constructing a large-scale well-labeled dataset is difficult due to data annotation costs. Recently, pre-trained models have gradually attracted attention in the time series domain due to their remarkable performance in computer vision and natural language processing. In this survey, we provide a comprehensive review of Time-Series Pre-Trained Models (TS-PTMs), aiming to guide the understanding, applying, and studying TS-PTMs. Specifically, we first briefly introduce the typical deep learning models employed in TSM. Then, we give an overview of TS-PTMs according to the pre-training techniques. The main categories we explore include supervised, unsupervised, and self-supervised TS-PTMs. Further, extensive experiments involving 27 methods, 434 datasets, and 679 transfer learning scenarios are conducted to analyze the advantages and disadvantages of transfer learning strategies, Transformer-based models, and representative TS-PTMs. Finally, we point out some potential directions of TS-PTMs for future work.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"7536-7555"},"PeriodicalIF":8.9,"publicationDate":"2024-10-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142645397","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Molecular interaction prediction plays a crucial role in forecasting unknown interactions between molecules, such as drug-target interaction (DTI) and drug-drug interaction (DDI), which are essential in the field of drug discovery and therapeutics. Although previous prediction methods have yielded promising results by leveraging the rich semantics and topological structure of biomedical knowledge graphs (KGs), they have primarily focused on enhancing predictive performance without addressing the presence of inevitable noise and inconsistent semantics. This limitation has hindered the advancement of KG-based prediction methods. To address this limitation, we propose BioKDN ( Bio medical K nowledge Graph D enoising N etwork) for robust molecular interaction prediction. BioKDN refines the reliable structure of local subgraphs by denoising noisy links in a learnable manner, providing a general module for extracting task-relevant interactions. To enhance the reliability of the refined structure, BioKDN maintains consistent and robust semantics by smoothing relations around the target interaction. By maximizing the mutual information between reliable structure and smoothed relations, BioKDN emphasizes informative semantics to enable precise predictions. Experimental results on real-world datasets show that BioKDN surpasses state-of-the-art models in DTI and DDI prediction tasks, confirming the effectiveness and robustness of BioKDN in denoising unreliable interactions within contaminated KGs.
分子相互作用预测在预测分子间未知相互作用（如药物-靶点相互作用（DTI）和药物-药物相互作用（DDI））方面发挥着至关重要的作用，这些相互作用在药物发现和治疗领域至关重要。虽然以前的预测方法利用生物医学知识图（KG）丰富的语义和拓扑结构取得了可喜的成果，但它们主要侧重于提高预测性能，而没有解决不可避免的噪声和语义不一致的问题。这一局限性阻碍了基于 KG 的预测方法的发展。为了解决这一局限性，我们提出了用于稳健分子相互作用预测的 BioKDN（生物医学知识图谱去噪网络）。BioKDN 通过以可学习的方式去噪链接来完善局部子图的可靠结构，为提取任务相关的相互作用提供了一个通用模块。为了提高精炼结构的可靠性，BioKDN 通过平滑目标交互周围的关系来保持一致和稳健的语义。通过最大化可靠结构与平滑关系之间的互信息，BioKDN 强调了信息语义，从而实现了精确预测。在真实世界数据集上的实验结果表明，BioKDN 在 DTI 和 DDI 预测任务中超越了最先进的模型，证实了 BioKDN 在去噪受污染 KG 中不可靠相互作用方面的有效性和鲁棒性。
{"title":"Learning to Denoise Biomedical Knowledge Graph for Robust Molecular Interaction Prediction","authors":"Tengfei Ma;Yujie Chen;Wen Tao;Dashun Zheng;Xuan Lin;Patrick Cheong-Iao Pang;Yiping Liu;Yijun Wang;Longyue Wang;Bosheng Song;Xiangxiang Zeng;Philip S. Yu","doi":"10.1109/TKDE.2024.3471508","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3471508","url":null,"abstract":"Molecular interaction prediction plays a crucial role in forecasting unknown interactions between molecules, such as drug-target interaction (DTI) and drug-drug interaction (DDI), which are essential in the field of drug discovery and therapeutics. Although previous prediction methods have yielded promising results by leveraging the rich semantics and topological structure of biomedical knowledge graphs (KGs), they have primarily focused on enhancing predictive performance without addressing the presence of inevitable noise and inconsistent semantics. This limitation has hindered the advancement of KG-based prediction methods. To address this limitation, we propose BioKDN (\u0000<bold>Bio</b>\u0000medical \u0000<bold>K</b>\u0000nowledge Graph \u0000<bold>D</b>\u0000enoising \u0000<bold>N</b>\u0000etwork) for robust molecular interaction prediction. BioKDN refines the reliable structure of local subgraphs by denoising noisy links in a learnable manner, providing a general module for extracting task-relevant interactions. To enhance the reliability of the refined structure, BioKDN maintains consistent and robust semantics by smoothing relations around the target interaction. By maximizing the mutual information between reliable structure and smoothed relations, BioKDN emphasizes informative semantics to enable precise predictions. Experimental results on real-world datasets show that BioKDN surpasses state-of-the-art models in DTI and DDI prediction tasks, confirming the effectiveness and robustness of BioKDN in denoising unreliable interactions within contaminated KGs.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"8682-8694"},"PeriodicalIF":8.9,"publicationDate":"2024-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142645399","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
The complexity and ongoing evolution of Advanced Persistent Threats (APTs) compromise the efficacy of conventional cybersecurity measures. Firewalls, intrusion detection systems, and antivirus software, which are dependent on static rules and predefined signatures, are increasingly ineffective against these sophisticated threats. Moreover, the use of system audit logs for threat hunting involves a retrospective review of cybersecurity incidents to reconstruct attack paths for attribution, which affects the timeliness and effectiveness of threat detection and response. Even when the attacker is identified, this method does not prevent cyber attacks. To address these challenges, we introduce ThreatInsight, a novel early-stage threat detection solution that minimizes reliance on system audit logs. ThreatInsight detects potential threats by analyzing IPs captured from HoneyPoints. These IPs are processed through threat data mining and threat feature modeling. By employing fact-based and semantic reasoning techniques based on the APT Threat Intelligence Knowledge Graph (APT-TI-KG), ThreatInsight identifies and attributes attackers. The system generates analysis reports detailing the threat knowledge concerning IPs and attributed attackers, equipping analysts with actionable insights and defense strategies. The system architecture includes modules for HoneyPoint IP extraction, Threat Intelligence (TI) data analysis, attacker attribution, and analysis report generation. ThreatInsight facilitates real-time analysis and the identification of potential threats at early stages, thereby enhancing the early detection capabilities of cybersecurity defense systems and improving overall threat detection and proactive defense effectiveness.
高级持续性威胁（APTs）的复杂性和不断演变削弱了传统网络安全措施的效力。防火墙、入侵检测系统和防病毒软件依赖于静态规则和预定义签名，对这些复杂的威胁越来越无能为力。此外，使用系统审计日志进行威胁追捕需要对网络安全事件进行回顾性审查，以重建攻击路径，从而确定归因，这影响了威胁检测和响应的及时性和有效性。即使找出了攻击者，这种方法也无法阻止网络攻击。为了应对这些挑战，我们推出了 ThreatInsight，这是一种新型的早期威胁检测解决方案，可最大限度地减少对系统审计日志的依赖。ThreatInsight 通过分析从 HoneyPoint 捕捉到的 IP 来检测潜在威胁。这些 IP 会通过威胁数据挖掘和威胁特征建模进行处理。通过采用基于 APT 威胁情报知识图谱（APT-TI-KG）的事实和语义推理技术，ThreatInsight 可以识别攻击者并确定其属性。系统会生成分析报告，详细介绍有关 IP 和归属攻击者的威胁知识，为分析人员提供可操作的见解和防御策略。系统架构包括 HoneyPoint IP 提取、威胁情报 (TI) 数据分析、攻击者归属和分析报告生成模块。ThreatInsight 有助于实时分析和早期识别潜在威胁，从而增强网络安全防御系统的早期检测能力，提高整体威胁检测和主动防御的有效性。
{"title":"ThreatInsight: Innovating Early Threat Detection Through Threat-Intelligence-Driven Analysis and Attribution","authors":"Ziyu Wang;Yinghai Zhou;Hao Liu;Jing Qiu;Binxing Fang;Zhihong Tian","doi":"10.1109/TKDE.2024.3474792","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3474792","url":null,"abstract":"The complexity and ongoing evolution of Advanced Persistent Threats (APTs) compromise the efficacy of conventional cybersecurity measures. Firewalls, intrusion detection systems, and antivirus software, which are dependent on static rules and predefined signatures, are increasingly ineffective against these sophisticated threats. Moreover, the use of system audit logs for threat hunting involves a retrospective review of cybersecurity incidents to reconstruct attack paths for attribution, which affects the timeliness and effectiveness of threat detection and response. Even when the attacker is identified, this method does not prevent cyber attacks. To address these challenges, we introduce ThreatInsight, a novel early-stage threat detection solution that minimizes reliance on system audit logs. ThreatInsight detects potential threats by analyzing IPs captured from HoneyPoints. These IPs are processed through threat data mining and threat feature modeling. By employing fact-based and semantic reasoning techniques based on the APT Threat Intelligence Knowledge Graph (APT-TI-KG), ThreatInsight identifies and attributes attackers. The system generates analysis reports detailing the threat knowledge concerning IPs and attributed attackers, equipping analysts with actionable insights and defense strategies. The system architecture includes modules for HoneyPoint IP extraction, Threat Intelligence (TI) data analysis, attacker attribution, and analysis report generation. ThreatInsight facilitates real-time analysis and the identification of potential threats at early stages, thereby enhancing the early detection capabilities of cybersecurity defense systems and improving overall threat detection and proactive defense effectiveness.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"9388-9402"},"PeriodicalIF":8.9,"publicationDate":"2024-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142600439","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2024-10-04DOI: 10.1109/TKDE.2024.3474051
Tingxuan Chen;Jun Long;Zidong Wang;Shuai Luo;Jincai Huang;Liu Yang
Temporal Knowledge Graphs (TKGs) serve as indispensable tools for dynamic facts storage and reasoning. However, predicting future facts in TKGs presents a formidable challenge due to the unknowable nature of future facts. Existing temporal reasoning models depend on fact recurrence and periodicity, leading to information degradation over prolonged temporal evolution. In particular, the occurrence of one fact may influence the likelihood of another. To this end, we propose THCN, a novel Temporal Causal Convolutional Network based on Hawkes processes, designed for temporal reasoning under the extrapolation setting. Specifically, THCN harnesses a temporal causal convolutional network with dilated factors to capture historical dependencies among facts spanning diverse time intervals. Then, we construct a conditional intensity function based on Hawkes processes for fitting the likelihood of fact occurrence. Importantly, THCN pioneers a dual-level dynamic modeling mechanism, enabling the simultaneous capture of the collective features of nodes and the individual characteristics of facts. Extensive experiments on six real-world TKG datasets demonstrate our method significantly outperforms the state-of-the-art across all four evaluation metrics, indicating that THCN is more applicable for extrapolation reasoning in TKGs.
{"title":"THCN: A Hawkes Process Based Temporal Causal Convolutional Network for Extrapolation Reasoning in Temporal Knowledge Graphs","authors":"Tingxuan Chen;Jun Long;Zidong Wang;Shuai Luo;Jincai Huang;Liu Yang","doi":"10.1109/TKDE.2024.3474051","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3474051","url":null,"abstract":"Temporal Knowledge Graphs (TKGs) serve as indispensable tools for dynamic facts storage and reasoning. However, predicting future facts in TKGs presents a formidable challenge due to the unknowable nature of future facts. Existing temporal reasoning models depend on fact recurrence and periodicity, leading to information degradation over prolonged temporal evolution. In particular, the occurrence of one fact may influence the likelihood of another. To this end, we propose THCN, a novel Temporal Causal Convolutional Network based on Hawkes processes, designed for temporal reasoning under the extrapolation setting. Specifically, THCN harnesses a temporal causal convolutional network with dilated factors to capture historical dependencies among facts spanning diverse time intervals. Then, we construct a conditional intensity function based on Hawkes processes for fitting the likelihood of fact occurrence. Importantly, THCN pioneers a dual-level dynamic modeling mechanism, enabling the simultaneous capture of the collective features of nodes and the individual characteristics of facts. Extensive experiments on six real-world TKG datasets demonstrate our method significantly outperforms the state-of-the-art across all four evaluation metrics, indicating that THCN is more applicable for extrapolation reasoning in TKGs.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"9374-9387"},"PeriodicalIF":8.9,"publicationDate":"2024-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142600274","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2024-10-04DOI: 10.1109/TKDE.2024.3474728
Mengyuan Li;Xiaohong Zhang;Jiaoyan Shang;Yingcang Ma
Fuzzy rough sets are important mathematical tool for processing data using existing knowledge. Fuzzy rough sets have been widely studied and used into various fields, such as data reduction and image processing, etc. In extensive literature we have studied, general quasi overlap functions and fuzzy neighborhood systems are broader than other all fuzzy operators and knowledge used in existing fuzzy rough sets, respectively. In this article, a novel fuzzy rough sets model (shortly ( I , Q , NS )-fuzzy rough sets) is proposed using fuzzy implications, general quasi overlap functions and fuzzy neighborhood systems, which contains almost all existing fuzzy rough sets. Then, a novel feature selection algorithm (called IQNS-FS algorithm) is proposed and implemented using ( I , Q , NS )-fuzzy rough sets, dependency and specificity measure. The results of 12 datasets indicate that IQNS-FS algorithm performs better than others. Finally, we input the results of IQNS-FS algorithm into single hidden layer neural networks and other classification algorithms, the results illustrate that the IQNS-FS algorithm can be better connected with neural networks than other classification algorithms. The high classification accuracy of single hidden layer neural networks (a very simple structure) further shows that the attributes selected by the IQNS-FS algorithm are important which can express the features of the datasets.
{"title":"General Quasi Overlap Functions and Fuzzy Neighborhood Systems-Based Fuzzy Rough Sets With Their Applications","authors":"Mengyuan Li;Xiaohong Zhang;Jiaoyan Shang;Yingcang Ma","doi":"10.1109/TKDE.2024.3474728","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3474728","url":null,"abstract":"Fuzzy rough sets are important mathematical tool for processing data using existing knowledge. Fuzzy rough sets have been widely studied and used into various fields, such as data reduction and image processing, etc. In extensive literature we have studied, general quasi overlap functions and fuzzy neighborhood systems are broader than other all fuzzy operators and knowledge used in existing fuzzy rough sets, respectively. In this article, a novel fuzzy rough sets model (shortly (\u0000<italic>I</i>\u0000, \u0000<italic>Q</i>\u0000, \u0000<italic>NS</i>\u0000)-fuzzy rough sets) is proposed using fuzzy implications, general quasi overlap functions and fuzzy neighborhood systems, which contains almost all existing fuzzy rough sets. Then, a novel feature selection algorithm (called IQNS-FS algorithm) is proposed and implemented using (\u0000<italic>I</i>\u0000, \u0000<italic>Q</i>\u0000, \u0000<italic>NS</i>\u0000)-fuzzy rough sets, dependency and specificity measure. The results of 12 datasets indicate that IQNS-FS algorithm performs better than others. Finally, we input the results of IQNS-FS algorithm into single hidden layer neural networks and other classification algorithms, the results illustrate that the IQNS-FS algorithm can be better connected with neural networks than other classification algorithms. The high classification accuracy of single hidden layer neural networks (a very simple structure) further shows that the attributes selected by the IQNS-FS algorithm are important which can express the features of the datasets.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"8349-8361"},"PeriodicalIF":8.9,"publicationDate":"2024-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142600333","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Exploratory Data Analysis (EDA) is the interactive process of gaining insights from a dataset. Comparisons are popular insights that can be specified with comparison queries, i.e., specifications of the comparison of subsets of data. In this work, we consider the problem of automatically computing sequences of comparison queries that are coherent, significant and whose overall cost is bounded. Such an automation is usually done by either generating all insights and solving a multi-criteria optimization problem, or using reinforcement learning. In the first case, a large search space has to be explored using exponential algorithms or dedicated heuristics. In the second case, a dataset-specific, time and energy-consuming training, is necessary. We contribute with a novel approach, consisting of decomposing the optimization problem in two: the original problem, that is solved over a smaller search space, and a new problem of generating comparison queries, aiming at generating only queries improving existing solutions of the first problem. This allows to explore only a portion of the search space, without resorting to reinforcement learning. We show that this approach is effective, in that it finds good solutions to the original multi-criteria optimization problem, and efficient, allowing to generate sequences of comparisons in reasonable time.
{"title":"Comparison Queries Generation Using Mathematical Programming for Exploratory Data Analysis","authors":"Alexandre Chanson;Nicolas Labroche;Patrick Marcel;Vincent T'Kindt","doi":"10.1109/TKDE.2024.3474828","DOIUrl":"https://doi.org/10.1109/TKDE.2024.3474828","url":null,"abstract":"Exploratory Data Analysis (EDA) is the interactive process of gaining insights from a dataset. Comparisons are popular insights that can be specified with comparison queries, i.e., specifications of the comparison of subsets of data. In this work, we consider the problem of automatically computing sequences of comparison queries that are coherent, significant and whose overall cost is bounded. Such an automation is usually done by either generating all insights and solving a multi-criteria optimization problem, or using reinforcement learning. In the first case, a large search space has to be explored using exponential algorithms or dedicated heuristics. In the second case, a dataset-specific, time and energy-consuming training, is necessary. We contribute with a novel approach, consisting of decomposing the optimization problem in two: the original problem, that is solved over a smaller search space, and a new problem of generating comparison queries, aiming at generating only queries improving existing solutions of the first problem. This allows to explore only a portion of the search space, without resorting to reinforcement learning. We show that this approach is effective, in that it finds good solutions to the original multi-criteria optimization problem, and efficient, allowing to generate sequences of comparisons in reasonable time.","PeriodicalId":13496,"journal":{"name":"IEEE Transactions on Knowledge and Data Engineering","volume":"36 12","pages":"7792-7804"},"PeriodicalIF":8.9,"publicationDate":"2024-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142636482","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：