<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04930539v1</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-19T15:26:33+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Anomaly Detection using Knowledge Graphs: A Survey for Network Management and Cybersecurity Application</title>
            <author role="aut">
              <persName>
                <forename type="first">Lionel</forename>
                <surname>Tailhardat</surname>
              </persName>
              <email type="md5">c54d73925d069c40a02455a92c39694b</email>
              <email type="domain">orange.fr</email>
              <idno type="idhal" notation="string">lionel-tailhardat</idno>
              <idno type="idhal" notation="numeric">1379512</idno>
              <idno type="halauthorid" notation="string">1097768-1379512</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-5887-899X</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=L3-8tGYAAAAJ</idno>
              <idno type="IDREF">https://www.idref.fr/281983178</idno>
              <affiliation ref="#struct-365900"/>
              <affiliation ref="#struct-421532"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Yoan</forename>
                <surname>Chabot</surname>
              </persName>
              <email type="md5">ed2f42e2c774fd5aa8651920a4334a31</email>
              <email type="domain">orange.com</email>
              <idno type="idhal" notation="numeric">1268049</idno>
              <idno type="halauthorid" notation="string">20550-1268049</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-5639-1504</idno>
              <affiliation ref="#struct-365900"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Raphaël</forename>
                <surname>Troncy</surname>
              </persName>
              <email type="md5">e14fa68ad8e76e16dfd996a17513ec23</email>
              <email type="domain">eurecom.fr</email>
              <idno type="idhal" notation="string">raphael-troncy</idno>
              <idno type="idhal" notation="numeric">21317</idno>
              <idno type="halauthorid" notation="string">29079-21317</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.com/citations?user=1BxhcigAAAAJ&amp;hl=en</idno>
              <idno type="IDREF">https://www.idref.fr/106969250</idno>
              <idno type="ORCID">https://orcid.org/0000-0003-0457-1436</idno>
              <affiliation ref="#struct-421532"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Lionel</forename>
                <surname>Tailhardat</surname>
              </persName>
              <email type="md5">c54d73925d069c40a02455a92c39694b</email>
              <email type="domain">orange.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2025-02-05 12:26:28</date>
              <date type="whenWritten">2025-02-04</date>
              <date type="whenModified">2026-03-18 10:26:37</date>
              <date type="whenReleased">2025-02-13 11:07:00</date>
              <date type="whenProduced">2025-02-04</date>
              <date type="whenEndEmbargoed">2025-02-05</date>
              <ref type="file" target="https://hal.science/hal-04930539v1/document">
                <date notBefore="2025-02-05"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-04930539v1/file/NORIA_SotA_preprint_2025-02-05.pdf" id="file-4930539-4279298">
                <date notBefore="2025-02-05"/>
              </ref>
            </edition>
            <edition n="v2">
              <date type="whenSubmitted">2026-02-25 19:01:28</date>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="477632">
                <persName>
                  <forename>Lionel</forename>
                  <surname>Tailhardat</surname>
                </persName>
                <email type="md5">c54d73925d069c40a02455a92c39694b</email>
                <email type="domain">orange.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04930539</idno>
            <idno type="halUri">https://hal.science/hal-04930539</idno>
            <idno type="halBibtex">tailhardat:hal-04930539</idno>
            <idno type="halRefHtml">2025</idno>
            <idno type="halRef">2025</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-4930539-4279298"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt/>
          <notesStmt/>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Anomaly Detection using Knowledge Graphs: A Survey for Network Management and Cybersecurity Application</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Lionel</forename>
                    <surname>Tailhardat</surname>
                  </persName>
                  <email type="md5">c54d73925d069c40a02455a92c39694b</email>
                  <email type="domain">orange.fr</email>
                  <idno type="idhal" notation="string">lionel-tailhardat</idno>
                  <idno type="idhal" notation="numeric">1379512</idno>
                  <idno type="halauthorid" notation="string">1097768-1379512</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-5887-899X</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=L3-8tGYAAAAJ</idno>
                  <idno type="IDREF">https://www.idref.fr/281983178</idno>
                  <affiliation ref="#struct-365900"/>
                  <affiliation ref="#struct-421532"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Yoan</forename>
                    <surname>Chabot</surname>
                  </persName>
                  <email type="md5">ed2f42e2c774fd5aa8651920a4334a31</email>
                  <email type="domain">orange.com</email>
                  <idno type="idhal" notation="numeric">1268049</idno>
                  <idno type="halauthorid" notation="string">20550-1268049</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-5639-1504</idno>
                  <affiliation ref="#struct-365900"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Raphaël</forename>
                    <surname>Troncy</surname>
                  </persName>
                  <email type="md5">e14fa68ad8e76e16dfd996a17513ec23</email>
                  <email type="domain">eurecom.fr</email>
                  <idno type="idhal" notation="string">raphael-troncy</idno>
                  <idno type="idhal" notation="numeric">21317</idno>
                  <idno type="halauthorid" notation="string">29079-21317</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.com/citations?user=1BxhcigAAAAJ&amp;hl=en</idno>
                  <idno type="IDREF">https://www.idref.fr/106969250</idno>
                  <idno type="ORCID">https://orcid.org/0000-0003-0457-1436</idno>
                  <affiliation ref="#struct-421532"/>
                </author>
              </analytic>
              <monogr>
                <imprint/>
              </monogr>
              <ref target="https://w3id.org/noria/docs/sota" type="seeAlso"/>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Network operations</term>
                <term xml:lang="en">Incident management</term>
                <term xml:lang="en">Semantic Web</term>
                <term xml:lang="en">Linked data</term>
                <term xml:lang="en">Reasoning</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-ai">Computer Science [cs]/Artificial Intelligence [cs.AI]</classCode>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halDomain" n="info.info-fl">Computer Science [cs]/Formal Languages and Automata Theory [cs.FL]</classCode>
              <classCode scheme="halDomain" n="info.info-sy">Computer Science [cs]/Systems and Control [cs.SY]</classCode>
              <classCode scheme="halTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
              <classCode scheme="halOldTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
              <classCode scheme="halTreeTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Incident management on telecom and computer networks, whether it is related to infrastructure or cybersecurity issues, requires the ability to simultaneously and quickly correlate and interpret a large number of heterogeneous technical information sources. Drawing on the understanding that knowledge representation and reasoning are inherently linked, this survey scrutinizes both aspects in tandem by delving into explicit knowledge representations of networks, and exploring their direct utilization or integration with artificial intelligence techniques for anomaly model learning and detection. More formally, we map these two aspects in order to address the question of how to define an anomaly model in a dynamic technical environment with various interdependencies, and what form this model should take to be shareable among practitioners (network designers and administrators, cybersecurity analysts, etc.) and directly usable in anomaly detection tools and decision support systems. Through our work, we demonstrate that while data heterogeneity and interrelatedness between data entities (distinct and persistent units of information) appear to be cornerstones for advancing the capabilities of Network Monitoring System (NMS) and Security Information and Event Management (SIEM) systems, several semantic models and algorithmic methods for anomaly detection share common properties that could help constructing a rich representation of networks and their ecosystem that can be used by one or a combination of several inference techniques.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-365900" status="VALID">
          <orgName>Orange Labs</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-421532" status="VALID">
          <orgName>Eurecom [Sophia Antipolis]</orgName>
          <desc>
            <address>
              <addrLine>Campus SophiaTech, 450 Route des Chappes, CS 50193 - 06904 Biot Sophia Antipolis cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.eurecom.fr/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>