{"id":"https://openalex.org/W7171507828","doi":"https://doi.org/10.1109/conit69683.2026.11621345","title":"GAP-Net: A Temporal Graph Neural Framework for Predictive Attack Path Forecasting in Enterprise Networks","display_name":"GAP-Net: A Temporal Graph Neural Framework for Predictive Attack Path Forecasting in Enterprise Networks","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7171507828","doi":"https://doi.org/10.1109/conit69683.2026.11621345"},"language":"en","primary_location":{"id":"doi:10.1109/conit69683.2026.11621345","doi":"https://doi.org/10.1109/conit69683.2026.11621345","is_oa":true,"landing_page_url":"https://doi.org/10.1109/conit69683.2026.11621345","pdf_url":null,"source":{"id":"https://openalex.org/S4363607811","display_name":"International Conference on Intelligent Technologies (CONIT)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 6th International Conference on Intelligent Technologies (CONIT)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/conit69683.2026.11621345","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5143853878","display_name":"Anshul Sharma","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I135428043","display_name":"Cisco Systems (United States)","ror":"https://ror.org/03yt1ez60","country_code":"US","type":"company","lineage":["https://openalex.org/I135428043"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Anshul Sharma","raw_affiliation_strings":["Cisco Systems"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cisco Systems","institution_ids":["https://openalex.org/I135428043"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5106883450","display_name":"Rajesh Kotha","orcid":"https://orcid.org/0009-0004-3594-2206","observed_orcids":["https://orcid.org/0009-0004-3594-2206"]},"institutions":[{"id":"https://openalex.org/I4210142508","display_name":"Fiserv (United States)","ror":"https://ror.org/03tmyjv73","country_code":"US","type":"company","lineage":["https://openalex.org/I4210142508"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rajesh Kotha","raw_affiliation_strings":["Fiserv"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fiserv","institution_ids":["https://openalex.org/I4210142508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5118602721","display_name":"Pavan Kumar Mantha -","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pavan Kumar Mantha","raw_affiliation_strings":["Synchrony"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Synchrony","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140252418","display_name":"Manisha Nagpal","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I101407740","display_name":"Chandigarh University","ror":"https://ror.org/05t4pvx35","country_code":"IN","type":"education","lineage":["https://openalex.org/I101407740"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Manisha Nagpal","raw_affiliation_strings":["University Institute of Computing, Chandigarh University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University Institute of Computing, Chandigarh University","institution_ids":["https://openalex.org/I101407740"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119636418","display_name":"Biky Chouhan","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I101407740","display_name":"Chandigarh University","ror":"https://ror.org/05t4pvx35","country_code":"IN","type":"education","lineage":["https://openalex.org/I101407740"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Biky Chouhan","raw_affiliation_strings":["University Institute of Computing, Chandigarh University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University Institute of Computing, Chandigarh University","institution_ids":["https://openalex.org/I101407740"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5118585875","display_name":"Anurag Reddy Ekkati","orcid":"https://orcid.org/0009-0000-2693-4969","observed_orcids":["https://orcid.org/0009-0000-2693-4969"]},"institutions":[{"id":"https://openalex.org/I4210108451","display_name":"Palo Alto Networks (United States)","ror":"https://ror.org/01rn6rn86","country_code":"US","type":"company","lineage":["https://openalex.org/I4210108451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Anurag Reddy Ekkati","raw_affiliation_strings":["Palo Alto Networks Inc"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Palo Alto Networks Inc","institution_ids":["https://openalex.org/I4210108451"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6664999723434448,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6664999723434448,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.2159000039100647,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.04399999976158142,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/attack-path-prediction","display_name":"attack path prediction","score":0.8199999928474426},{"id":"https://openalex.org/keywords/multi-step-attacks","display_name":"multi-stage attacks","score":0.6179999709129333},{"id":"https://openalex.org/keywords/enterprise-networks","display_name":"enterprise networks","score":0.7590000033378601},{"id":"https://openalex.org/keywords/temporal-graph-neural-networks","display_name":"temporal graph neural networks","score":0.9599999785423279},{"id":"https://openalex.org/keywords/attacker-behavior-modeling","display_name":"attacker behavior modeling","score":0.5839999914169312},{"id":"https://openalex.org/keywords/threat-hunting","display_name":"threat hunting","score":0.8360000252723694},{"id":"https://openalex.org/keywords/cyber-defense","display_name":"cyber defense","score":0.5099999904632568},{"id":"https://openalex.org/keywords/early-warning","display_name":"early warning","score":0.4690000116825104}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6392999887466431},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5157999992370605},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4368000030517578},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4203999936580658},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4018999934196472},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3625999987125397},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30720001459121704},{"id":"https://openalex.org/C151406439","wikidata":"https://www.wikidata.org/wiki/Q186588","display_name":"Time series","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.2833999991416931},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2793999910354614},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.25519999861717224}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/conit69683.2026.11621345","doi":"https://doi.org/10.1109/conit69683.2026.11621345","is_oa":true,"landing_page_url":"https://doi.org/10.1109/conit69683.2026.11621345","pdf_url":null,"source":{"id":"https://openalex.org/S4363607811","display_name":"International Conference on Intelligent Technologies (CONIT)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 6th International Conference on Intelligent Technologies (CONIT)","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1109/conit69683.2026.11621345","doi":"https://doi.org/10.1109/conit69683.2026.11621345","is_oa":true,"landing_page_url":"https://doi.org/10.1109/conit69683.2026.11621345","pdf_url":null,"source":{"id":"https://openalex.org/S4363607811","display_name":"International Conference on Intelligent Technologies (CONIT)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 6th International Conference on Intelligent Technologies (CONIT)","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W3057932465","https://openalex.org/W3120672188","https://openalex.org/W4409328574","https://openalex.org/W4409426571","https://openalex.org/W4410342786","https://openalex.org/W4412950662","https://openalex.org/W4414248759","https://openalex.org/W4415092744","https://openalex.org/W4415643629","https://openalex.org/W4416249804","https://openalex.org/W4416925150","https://openalex.org/W4417109168","https://openalex.org/W7118005082","https://openalex.org/W7125504366","https://openalex.org/W7128376840","https://openalex.org/W7131070291","https://openalex.org/W7131095266","https://openalex.org/W7131129467","https://openalex.org/W7162398821","https://openalex.org/W7162428127","https://openalex.org/W7162429586"],"related_works":["https://openalex.org/W7166810075","https://openalex.org/W7203671523","https://openalex.org/W93933837","https://openalex.org/W4210768953","https://openalex.org/W4312325568","https://openalex.org/W6903464478","https://openalex.org/W7128549808","https://openalex.org/W7169650432","https://openalex.org/W7223083501","https://openalex.org/W7220833201"],"abstract_inverted_index":{"Predicting":[0],"multi-stage":[1],"attacker":[2,50,194],"movement":[3],"in":[4,14,168,219],"enterprise":[5,220],"networks":[6],"is":[7,66],"an":[8,103],"important":[9],"step":[10,46,49],"to":[11,24,43,166,180],"be":[12,178],"proactive":[13],"the":[15,26,98,137,199],"cyber":[16],"defence,":[17],"but":[18],"current":[19],"approaches":[20],"find":[21,95],"it":[22],"difficult":[23],"model":[25,65],"structural":[27],"and":[28,47,60,77,82,91,113,117,122,131,159],"temporal":[29,57,162],"complexity":[30],"of":[31,105,108,111,115,127,139,145,151,184,192,201],"real-life":[32],"attack":[33],"movement.":[34],"This":[35],"paper":[36],"introduces":[37],"GAP-Net,":[38],"which":[39],"builds":[40],"a":[41],"framework":[42],"predict":[44],"next":[45],"multi":[48],"actions":[51],"based":[52],"on":[53,97],"attention-driven":[54],"message":[55],"passing,":[56],"graph":[58],"snapshots,":[59],"structured":[61,152],"path":[62,124,153],"decoder.":[63],"The":[64,196],"tested":[67],"over":[68],"two":[69],"real-world":[70],"data-sets,":[71],"i.e.,":[72],"DARPA":[73,99],"TC":[74],"Engagement":[75],"dataset":[76,81],"LANL":[78],"Cyber":[79],"Security":[80],"showcases":[83],"its":[84],"superior":[85],"performance":[86],"than":[87],"GCN,":[88],"GAT,":[89],"GraphSAGE,":[90],"LSTM":[92],"baselines.":[93],"We":[94],"that":[96,174],"dataset,":[100],"GAP-Net":[101,175],"achieves":[102,118],"accuracy":[104,158,165],"0.91,":[106,132],"precision":[107],"0.90,":[109],"recall":[110],"0.88":[112],"F1-score":[114],"0.89;":[116],"Top-1,":[119],"Top-3,":[120],"Top-5":[121,157],"Top-10":[123],"prediction":[125],"accuracies":[126],"0.62,":[128],"0.78,":[129],"0.84":[130],"respectively.":[133],"Ablation":[134],"studies":[135],"emphasise":[136],"dependency":[138],"each":[140],"architectural":[141],"component":[142],"as":[143,213,215],"removal":[144,150],"attention":[146],"causes":[147],"0.87":[148],"accuracy,":[149],"decoder":[154],"gives":[155],"0.75":[156],"lastly,":[160],"eliminating":[161],"context":[163],"decreases":[164],"0.82":[167],"total":[169],"accuracy.":[170],"These":[171],"results":[172,197],"demonstrate":[173],"can":[176],"indeed":[177],"used":[179],"capture":[181],"dynamic":[182],"patterns":[183],"adversary":[185],"behavior":[186],"while":[187],"giving":[188],"reliable":[189],"ranked":[190],"predictions":[191],"future":[193],"behavior.":[195],"highlight":[198],"possibilities":[200],"GNN-based":[202],"predictive":[203],"models":[204],"for":[205],"improved":[206],"threat":[207,209],"hunting,":[208],"Defence":[210],"action":[211],"priority,":[212],"well":[214],"early":[216],"warning":[217],"function":[218],"security":[221],"operation":[222],"support.":[223]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-07-29T00:00:00"}