background.bib

@inproceedings{king2003backtracking,
  title={Backtracking intrusions},
  author={King, Samuel T and Chen, Peter M},
  booktitle={Proceedings of the nineteenth ACM symposium on Operating systems principles},
  pages={223--236},
  year={2003}
}

@inproceedings{goel2005taser,
  title={The taser intrusion recovery system},
  author={Goel, Ashvin and Po, Kenneth and Farhadi, Kamran and Li, Zheng and De Lara, Eyal},
  booktitle={Proceedings of the twentieth ACM symposium on Operating systems principles},
  pages={163--176},
  year={2005}
}

@inproceedings{lee2013high,
  title={High Accuracy Attack Provenance via Binary-based Execution Partition.},
  author={Lee, Kyu Hyung and Zhang, Xiangyu and Xu, Dongyan},
  booktitle={NDSS},
  year={2013}
}

@inproceedings{king2005enriching,
  title={Enriching Intrusion Alerts Through Multi-Host Causality.},
  author={King, Samuel T and Mao, Zhuoqing Morley and Lucchetti, Dominic G and Chen, Peter M},
  booktitle={NDSS},
  year={2005}
}

@inproceedings{liu2018towards,
  title={Towards a Timely Causality Analysis for Enterprise Security.},
  author={Liu, Yushan and Zhang, Mu and Li, Ding and Jee, Kangkook and Li, Zhichun and Wu, Zhenyu and Rhee, Junghwan and Mittal, Prateek},
  booktitle={NDSS},
  year={2018}
}


@inproceedings{ma2016protracer,
  title={Protracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting.},
  author={Ma, Shiqing and Zhang, Xiangyu and Xu, Dongyan},
  booktitle={NDSS},
  year={2016}
}

@article{paxson1999bro,
  title={Bro: a system for detecting network intruders in real-time},
  author={Paxson, Vern},
  journal={Computer networks},
  volume={31},
  number={23-24},
  pages={2435--2463},
  year={1999},
  publisher={Elsevier}
}


@inproceedings{vigna2003designing,
  title={Designing and implementing a family of intrusion detection systems},
  author={Vigna, Giovanni and Valeur, Fredrik and Kemmerer, Richard A},
  booktitle={Proceedings of the 9th European software engineering conference held jointly with 11th ACM SIGSOFT international symposium on Foundations of software engineering},
  pages={88--97},
  year={2003}
}

@inproceedings{lindqvist1999detecting,
  title={Detecting computer and network misuse through the production-based expert system toolset (P-BEST)},
  author={Lindqvist, Ulf and Porras, Phillip A},
  booktitle={Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No. 99CB36344)},
  pages={146--161},
  year={1999},
  organization={IEEE}
}

@inproceedings{roesch1999snort,
  title={Snort: Lightweight intrusion detection for networks.},
  author={Roesch, Martin},
  booktitle={Lisa},
  volume={99},
  number={1},
  pages={229--238},
  year={1999}
}
@inproceedings{bugiel2012towards,
  title={Towards Taming Privilege-Escalation Attacks on Android.},
  author={Bugiel, Sven and Davi, Lucas and Dmitrienko, Alexandra and Fischer, Thomas and Sadeghi, Ahmad-Reza and Shastry, Bhargava},
  booktitle={NDSS},
  volume={17},
  pages={19},
  year={2012},
  organization={Citeseer}
}

@inproceedings{forrest1996sense,
  title={A sense of self for unix processes},
  author={Forrest, Stephanie and Hofmeyr, Steven A and Somayaji, Anil and Longstaff, Thomas A},
  booktitle={Proceedings 1996 IEEE Symposium on Security and Privacy},
  pages={120--128},
  year={1996},
  organization={IEEE}
}

@article{lee1998data,
  title={Data mining approaches for intrusion detection},
  author={Lee, Wenke and Stolfo, Salvatore},
  year={1998}
}


@inproceedings{warrender1999detecting,
  title={Detecting intrusions using system calls: Alternative data models},
  author={Warrender, Christina and Forrest, Stephanie and Pearlmutter, Barak},
  booktitle={Proceedings of the 1999 IEEE symposium on security and privacy (Cat. No. 99CB36344)},
  pages={133--145},
  year={1999},
  organization={IEEE}
}


@article{mutz2006anomalous,
  title={Anomalous system call detection},
  author={Mutz, Darren and Valeur, Fredrik and Vigna, Giovanni and Kruegel, Christopher},
  journal={ACM Transactions on Information and System Security (TISSEC)},
  volume={9},
  number={1},
  pages={61--93},
  year={2006},
  publisher={ACM New York, NY, USA}
}


@inproceedings{du2017deeplog,
  title={Deeplog: Anomaly detection and diagnosis from system logs through deep learning},
  author={Du, Min and Li, Feifei and Zheng, Guineng and Srikumar, Vivek},
  booktitle={Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security},
  pages={1285--1298},
  year={2017}
}


@misc{symantecmalware,
  title = {{Symantec Internet Security Threat Report, 2019}},
  howpublished = {\url{https://www-west.symantec.com/content/dam/symantec/docs/reports/istr-24-2019-en.pdf}},
  key = "symantec malware"
}


@inproceedings{Gheorghescu2006ANAV,
  title={AN AUTOMATED VIRUS CLASSIFICATION SYSTEM},
  author={Marius Gheorghescu},
  year={2006}
}

@article{dullien2005graph,
  title={Graph-based comparison of executable objects (english version)},
  author={Dullien, Thomas and Rolles, Rolf},
  journal={SSTIC},
  volume={5},
  number={1},
  pages={3},
  year={2005}
}


@inproceedings{rieck2008learning,
  title={Learning and classification of malware behavior},
  author={Rieck, Konrad and Holz, Thorsten and Willems, Carsten and D{\"u}ssel, Patrick and Laskov, Pavel},
  booktitle={International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment},
  pages={108--125},
  year={2008},
  organization={Springer}
}


@article{lee2006behavioral,
  title={Behavioral classification},
  author={Lee, Tony},
  journal={Proceedings of EICAR 2006, 4},
  year={2006}
}

@inproceedings{bailey2007automated,
  title={Automated classification and analysis of internet malware},
  author={Bailey, Michael and Oberheide, Jon and Andersen, Jon and Mao, Z Morley and Jahanian, Farnam and Nazario, Jose},
  booktitle={International Workshop on Recent Advances in Intrusion Detection},
  pages={178--197},
  year={2007},
  organization={Springer}
}


@inproceedings{bayer2009scalable,
  title={Scalable, behavior-based malware clustering.},
  author={Bayer, Ulrich and Comparetti, Paolo Milani and Hlauschek, Clemens and Kruegel, Christopher and Kirda, Engin},
  booktitle={NDSS},
  volume={9},
  pages={8--11},
  year={2009},
  organization={Citeseer}
}


@inproceedings{wang2004gatekeeper,
  title={Gatekeeper: Monitoring Auto-Start Extensibility Points (ASEPs) for Spyware Management.},
  author={Wang, Yi-Min and Roussev, Roussi and Verbowski, Chad and Johnson, Aaron and Wu, Ming-Wei and Huang, Yennun and Kuo, Sy-Yen},
  booktitle={LISA},
  volume={4},
  pages={33--46},
  year={2004}
}

@article{bulter2004vice,
  title={VICE–catch the hookers!},
  author={J. Butler and G. Hoglund.},
  journal={In Black Hat USA, July 2004},
  year={2004}
}


@inproceedings{kirda2006behavior,
  title={Behavior-based Spyware Detection.},
  author={Kirda, Engin and Kruegel, Christopher and Banks, Greg and Vigna, Giovanni and Kemmerer, Richard},
  booktitle={Usenix Security Symposium},
  pages={694},
  year={2006}
}


@inproceedings{yin2007panorama,
  title={Panorama: capturing system-wide information flow for malware detection and analysis},
  author={Yin, Heng and Song, Dawn and Egele, Manuel and Kruegel, Christopher and Kirda, Engin},
  booktitle={Proceedings of the 14th ACM conference on Computer and communications security},
  pages={116--127},
  year={2007}
}


@article{androutsopoulos2000evaluation,
  title={An evaluation of naive bayesian anti-spam filtering},
  author={Androutsopoulos, Ion and Koutsias, John and Chandrinos, Konstantinos V and Paliouras, George and Spyropoulos, Constantine D},
  journal={arXiv preprint cs/0006013},
  year={2000}
}

@inproceedings{sahami1998bayesian,
  title={A Bayesian approach to filtering junk e-mail},
  author={Sahami, Mehran and Dumais, Susan and Heckerman, David and Horvitz, Eric},
  booktitle={Learning for Text Categorization: Papers from the 1998 workshop},
  volume={62},
  pages={98--105},
  year={1998},
  organization={Madison, Wisconsin}
}

@inproceedings{schneider2003comparison,
  title={A comparison of event models for Naive Bayes anti-spam e-mail filtering},
  author={Schneider, Karl-Michael},
  booktitle={Proceedings of the tenth conference on European chapter of the Association for Computational Linguistics-Volume 1},
  pages={307--314},
  year={2003},
  organization={Association for Computational Linguistics}
}


@inproceedings{cohen1996learning,
  title={Learning rules that classify e-mail},
  author={Cohen, William W},
  booktitle={AAAI spring symposium on machine learning in information access},
  volume={18},
  pages={25},
  year={1996},
  organization={Stanford, CA}
}


@article{drucker1999support,
  title={Support vector machines for spam categorization},
  author={Drucker, Harris and Wu, Donghui and Vapnik, Vladimir N},
  journal={IEEE Transactions on Neural networks},
  volume={10},
  number={5},
  pages={1048--1054},
  year={1999},
  publisher={IEEE}
}


@article{androutsopoulos2000learning,
  title={Learning to filter spam e-mail: A comparison of a naive bayesian and a memory-based approach},
  author={Androutsopoulos, Ion and Paliouras, Georgios and Karkaletsis, Vangelis and Sakkis, Georgios and Spyropoulos, Constantine D and Stamatopoulos, Panagiotis},
  journal={arXiv preprint cs/0009009},
  year={2000}
}


@article{carreras2001boosting,
  title={Boosting trees for anti-spam email filtering},
  author={Carreras, Xavier and Marquez, Lluis},
  journal={arXiv preprint cs/0109015},
  year={2001}
}

@inproceedings{zhang2003filtering,
  title={Filtering junk mail with a maximum entropy model},
  author={Zhang, Le and Yao, Tian-shun},
  booktitle={Proceeding of 20th international conference on computer processing of oriental languages (ICCPOL03)},
  pages={446--453},
  year={2003}
}


@inproceedings{fette2007learning,
  title={Learning to detect phishing emails},
  author={Fette, Ian and Sadeh, Norman and Tomasic, Anthony},
  booktitle={Proceedings of the 16th international conference on World Wide Web},
  pages={649--656},
  year={2007}
}


@inproceedings{abu2007comparison,
  title={A comparison of machine learning techniques for phishing detection},
  author={Abu-Nimeh, Saeed and Nappa, Dario and Wang, Xinlei and Nair, Suku},
  booktitle={Proceedings of the anti-phishing working groups 2nd annual eCrime researchers summit},
  pages={60--69},
  year={2007}
}

@inproceedings{chandrasekaran2006phishing,
  title={Phishing email detection based on structural properties},
  author={Chandrasekaran, Madhusudhanan and Narayanan, Krishnan and Upadhyaya, Shambhu},
  booktitle={NYS cyber security conference},
  volume={3},
  year={2006},
  organization={Albany, New York}
}

@inproceedings{wu2006security,
  title={Do security toolbars actually prevent phishing attacks?},
  author={Wu, Min and Miller, Robert C and Garfinkel, Simson L},
  booktitle={Proceedings of the SIGCHI conference on Human Factors in computing systems},
  pages={601--610},
  year={2006}
}


@article{whittaker2010large,
  title={Large-scale automatic classification of phishing pages},
  author={Whittaker, Colin and Ryner, Brian and Nazif, Marria},
  year={2010}
}

@inproceedings{zhang2007cantina,
  title={Cantina: a content-based approach to detecting phishing web sites},
  author={Zhang, Yue and Hong, Jason I and Cranor, Lorrie F},
  booktitle={Proceedings of the 16th international conference on World Wide Web},
  pages={639--648},
  year={2007}
}

@inproceedings{wardman2008automating,
  title={Automating phishing website identification through deep MD5 matching},
  author={Wardman, Brad and Warner, Gary},
  booktitle={2008 eCrime Researchers Summit},
  pages={1--7},
  year={2008},
  organization={IEEE}
}


@misc{ibmxforce,
  title = {{IBM X-Force Exchange}},
  howpublished = {\url{https://exchange.xforce.ibmcloud.com/}},
  _note = {Accessed: 2020-04-20},
  key = "IBM X-Force Exchange",
}


@misc{alienvaultotx,
  title = {{AlienVault Open Threat Exchange}},
  howpublished = {\url{https://otx.alienvault.com/}},
  _note = {Accessed: 2020-04-20},
  key = "AlienVault Open Threat Exchange",
}


@misc{facebookthreatexchange,
  title = {{Facebook ThreatExchange}},
  howpublished = {\url{https://developers.facebook.com/programs/threatexchange/}},
  _note = {Accessed: 2020-04-20},
  key = "Facebook ThreatExchange",
}


@misc{cyberthreatalliance,
  title = {{Cyber Threat Alliance}},
  howpublished = {\url{https://www.cyberthreatalliance.org/}},
  _note = {Accessed: 2020-04-20},
  key = "Cyber Threat Alliance",
}


@misc{snortids,
  title = {{Snort - Network Intrusion Detection and Prevention System}},
  howpublished = {\url{https://www.snort.org/}},
  _note = {Accessed: 2020-04-20},
  key = "Snort",
}


@misc{zeekids,
  title = {{Zeek Network Security Monitoring}},
  howpublished = {\url{https://zeek.org/}},
  _note = {Accessed: 2020-04-20},
  key = "Zeek",
}


@misc{paloaltofirewall,
  title = {{Palo Alto Networks Next-Generation Firewall}},
  howpublished = {\url{https://www.paloaltonetworks.com/network-security/next-generation-firewall}},
  _note = {Accessed: 2020-04-20},
  key = "paloaltofirewall",
}


@misc{fortinetfirewall,
  title = {{Fortinet Next-Generation Firewall}},
  howpublished = {\url{https://www.fortinet.com/products/next-generation-firewall.html}},
  _note = {Accessed: 2020-04-20},
  key = "fortinetfirewall",
}


@misc{ciscofirewall,
  title = {{Cisco Next-Generation Firewall}},
  howpublished = {\url{https://www.cisco.com/c/en/us/products/security/firewalls/index.html}},
  _note = {Accessed: 2020-04-20},
  key = "ciscofirewall",
}


@misc{sumologic,
  title = {{Sumo Logic Continuous Intelligence Platform}},
  howpublished = {\url{https://www.sumologic.com/}},
  _note = {Accessed: 2020-04-20},
  key = "sumologic",
}

@misc{logrhythm,
  title = {{LogRhythm Security Information and Event Management}},
  howpublished = {\url{https://logrhythm.com/solutions/security/siem/}},
  _note = {Accessed: 2020-04-20},
  key = "logrhythm",
}


@misc{splunk,
  title = {{Splunk> SIEM}},
  howpublished = {\url{https://www.splunk.com/}},
  _note = {Accessed: 2020-04-20},
  key = "splunk",
}

@inproceedings{liu2017don,
  title={Don't let one rotten apple spoil the whole barrel: Towards automated detection of shadowed domains},
  author={Liu, Daiping and Li, Zhou and Du, Kun and Wang, Haining and Liu, Baojun and Duan, Haixin},
  booktitle={Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security},
  pages={537--552},
  year={2017}
}