{"id":"https://openalex.org/W7203839282","doi":"https://doi.org/10.1109/tifs.2026.3725546","title":"R 3 S: Attack-Mitigation Reasoning in Security Knowledge Graphs","display_name":"R 3 S: Attack-Mitigation Reasoning in Security Knowledge Graphs","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7203839282","doi":"https://doi.org/10.1109/tifs.2026.3725546"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2026.3725546","doi":"https://doi.org/10.1109/tifs.2026.3725546","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3725546","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","ccf-a","cwts-core","dongbi-a","jufo-2","norway-2","poland-200","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/tifs.2026.3725546","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102016935","display_name":"Zeqing Li","orcid":"https://orcid.org/0000-0001-7514-4701","observed_orcids":["https://orcid.org/0000-0001-7514-4701","https://orcid.org/0009-0003-5088-2136"]},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zeqing Li","raw_affiliation_strings":["Sichuan University"],"raw_orcid":"https://orcid.org/0009-0003-5088-2136","affiliations":[{"raw_affiliation_string":"Sichuan University","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075394107","display_name":"Cheng Huang","orcid":"https://orcid.org/0000-0002-5871-946X","observed_orcids":["https://orcid.org/0000-0002-5871-946X"]},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cheng Huang","raw_affiliation_strings":["Sichuan University"],"raw_orcid":"https://orcid.org/0000-0002-5871-946X","affiliations":[{"raw_affiliation_string":"Sichuan University","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147641904","display_name":"Jiaren Peng","orcid":"https://orcid.org/0009-0001-8686-5288","observed_orcids":["https://orcid.org/0009-0001-8686-5288"]},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiaren Peng","raw_affiliation_strings":["Sichuan University"],"raw_orcid":"https://orcid.org/0009-0001-8686-5288","affiliations":[{"raw_affiliation_string":"Sichuan University","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147535886","display_name":"Xuan Tian","orcid":"https://orcid.org/0009-0001-1995-2170","observed_orcids":["https://orcid.org/0009-0001-1995-2170"]},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuan Tian","raw_affiliation_strings":["Sichuan University"],"raw_orcid":"https://orcid.org/0009-0001-1995-2170","affiliations":[{"raw_affiliation_string":"Sichuan University","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031836499","display_name":"Chenxin Zhou","orcid":"https://orcid.org/0009-0005-7725-4441","observed_orcids":["https://orcid.org/0009-0005-7725-4441","https://orcid.org/0000-0003-3071-3370"]},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chenxin Zhou","raw_affiliation_strings":["Sichuan University"],"raw_orcid":"https://orcid.org/0009-0005-7725-4441","affiliations":[{"raw_affiliation_string":"Sichuan University","institution_ids":["https://openalex.org/I24185976"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5019916687","display_name":"Pengsen Cheng","orcid":"https://orcid.org/0000-0002-5100-9772","observed_orcids":["https://orcid.org/0000-0002-5100-9772"]},"institutions":[{"id":"https://openalex.org/I24185976","display_name":"Sichuan University","ror":"https://ror.org/011ashp19","country_code":"CN","type":"education","lineage":["https://openalex.org/I24185976"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengsen Cheng","raw_affiliation_strings":["Sichuan University"],"raw_orcid":"https://orcid.org/0000-0002-5100-9772","affiliations":[{"raw_affiliation_string":"Sichuan University","institution_ids":["https://openalex.org/I24185976"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I24185976"],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":{"value":2645,"currency":"USD","value_usd":2645},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.59555274,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"21","issue":null,"first_page":"8096","last_page":"8106"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9570000171661377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9570000171661377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.009600000455975533,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10215","display_name":"Semantic Web and Ontologies","score":0.008200000040233135,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/attack-mitigation","display_name":"attack mitigation","score":0.36899998784065247},{"id":"https://openalex.org/keywords/knowledge-graph-reasoning","display_name":"knowledge graph reasoning","score":0.550000011920929}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8109999895095825},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.5476999878883362},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.44749999046325684},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.4146000146865845},{"id":"https://openalex.org/C115925183","wikidata":"https://www.wikidata.org/wiki/Q1412694","display_name":"Knowledge-based systems","level":2,"score":0.3495999872684479},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.31949999928474426},{"id":"https://openalex.org/C195344581","wikidata":"https://www.wikidata.org/wiki/Q2555318","display_name":"Automated reasoning","level":2,"score":0.3027999997138977},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.2799000144004822},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.27869999408721924},{"id":"https://openalex.org/C234837","wikidata":"https://www.wikidata.org/wiki/Q1420493","display_name":"Conceptual graph","level":3,"score":0.27410000562667847},{"id":"https://openalex.org/C102993220","wikidata":"https://www.wikidata.org/wiki/Q387196","display_name":"Description logic","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2623000144958496},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.25949999690055847},{"id":"https://openalex.org/C159032336","wikidata":"https://www.wikidata.org/wiki/Q2488768","display_name":"Non-monotonic logic","level":2,"score":0.2563999891281128},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.25589999556541443},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2540999948978424}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2026.3725546","doi":"https://doi.org/10.1109/tifs.2026.3725546","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3725546","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","ccf-a","cwts-core","dongbi-a","jufo-2","norway-2","poland-200","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/tifs.2026.3725546","doi":"https://doi.org/10.1109/tifs.2026.3725546","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3725546","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","ccf-a","cwts-core","dongbi-a","jufo-2","norway-2","poland-200","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G5496080866","display_name":null,"funder_award_id":"62472296","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W1943673337","https://openalex.org/W2590364218","https://openalex.org/W2789353435","https://openalex.org/W2795990847","https://openalex.org/W2798046836","https://openalex.org/W2980659949","https://openalex.org/W2995609070","https://openalex.org/W3200978589","https://openalex.org/W4226142803","https://openalex.org/W4252707176","https://openalex.org/W4312613216","https://openalex.org/W4385300690","https://openalex.org/W4385324095","https://openalex.org/W4387369249","https://openalex.org/W4388666761","https://openalex.org/W4388858673","https://openalex.org/W4391026296","https://openalex.org/W4391623704","https://openalex.org/W4392167894","https://openalex.org/W4404057994","https://openalex.org/W4404724789","https://openalex.org/W4405304483","https://openalex.org/W4410610573","https://openalex.org/W4410973753","https://openalex.org/W4412396154"],"related_works":["https://openalex.org/W7160125163","https://openalex.org/W2621515685","https://openalex.org/W4389746699","https://openalex.org/W4387139148","https://openalex.org/W4205647393","https://openalex.org/W4255179959","https://openalex.org/W7214233482","https://openalex.org/W2913620662","https://openalex.org/W3030061880","https://openalex.org/W7160317149"],"abstract_inverted_index":{"In":[0],"recent":[1],"years,":[2],"threat":[3,113,260],"intelligence":[4,151,261],"analysis":[5],"based":[6,194],"on":[7,152,183,195,269],"knowledge":[8,70,134,257],"graphs":[9,71,258],"has":[10],"been":[11],"widely":[12],"regarded":[13],"as":[14],"a":[15,127,143,164,177,184,238],"key":[16,140],"approach":[17,168],"to":[18,36,48,205,242],"achieving":[19],"proactive":[20,61],"defense.":[21],"However,":[22],"existing":[23,88],"research":[24],"still":[25],"suffers":[26],"from":[27,149],"deficiencies":[28],"in":[29,56,95,132,176,210,259],"timeliness":[30],"and":[31,42,83,92,108,124,154,162,173,222,263],"comprehensiveness":[32],"when":[33,77],"it":[34,46],"comes":[35],"supplementing":[37],"malicious":[38],"vulnerabilities,":[39,65],"mitigation":[40,84,146],"measures,":[41],"their":[43],"interrelationships,":[44],"making":[45],"difficult":[47],"support":[49],"systematic":[50],"characterization":[51],"of":[52,59,69,112,138,199,220,232,247,256,275],"complex":[53],"threats.":[54],"Particularly":[55],"the":[57,66,105,158,191,196,207,211,217,244,253,273,276],"process":[58,215],"predicting":[60],"defense":[62],"measures":[63],"for":[64,100,129,226],"modeling":[67],"design":[68],"remains":[72],"imperfect,":[73],"exhibiting":[74],"significant":[75],"limitations":[76],"depicting":[78],"causal":[79],"relationships":[80],"between":[81],"vulnerabilities":[82,153],"measures.":[85],"Furthermore,":[86],"most":[87],"approaches":[89],"model":[90],"semantic":[91,172,200,221],"structural":[93,174,223],"features":[94],"isolation,":[96],"lacking":[97],"effective":[98],"mechanisms":[99],"synergistic":[101,227],"integration.":[102],"This":[103,214,235],"hinders":[104],"deep":[106],"mining":[107],"practical":[109,150],"application":[110],"value":[111],"intelligence.":[114],"To":[115],"address":[116],"these":[117],"challenges,":[118],"we":[119],"propose$\\text":[120],"{R}^{{3}}\\text":[121,136],"{S}$(Reconciling":[122],"Semantic":[123],"Structural":[125],"Signals),":[126],"framework":[128],"attack-mitigation":[130],"reasoning":[131,262],"security":[133],"graphs.$\\text":[135],"{S}$consists":[137],"two":[139],"components:":[141],"H-AIMG,":[142],"hierarchical":[144],"adversary-informed":[145],"graph":[147],"constructed":[148],"attack":[155],"techniques":[156],"within":[157],"APT":[159],"organization":[160],"ecosystem,":[161],"DPSR,":[163],"Dual-Phase":[165],"Semantic\u2013Structural":[166],"Reconciliation":[167],"that":[169],"jointly":[170],"exploits":[171],"perspectives":[175],"coordinated":[178],"manner.":[179],"Rather":[180],"than":[181],"relying":[182],"fixed":[185],"fusion":[186],"mechanism,":[187],"DPSR":[188],"dynamically":[189],"partitions":[190],"candidate":[192,224],"set":[193],"confidence":[197],"gradient":[198],"scores,":[201],"using":[202],"an":[203],"algorithm":[204],"detect":[206],"elbow":[208],"point":[209],"score":[212],"distribution.":[213],"guides":[216],"adaptive":[218],"coordination":[219],"sets":[225],"ranking,":[228],"enabling":[229],"context-sensitive":[230],"integration":[231],"both":[233,248],"perspectives.":[234],"paper":[236],"leverages":[237],"collaborative":[239],"optimization":[240],"strategy":[241],"harness":[243],"complementary":[245],"strengths":[246],"approaches,":[249],"thereby":[250],"significantly":[251],"enhancing":[252],"overall":[254],"effectiveness":[255,274],"attribution.":[264],"Finally,":[265],"extensive":[266],"experiments":[267],"conducted":[268],"H-AIMG":[270],"clearly":[271],"validate":[272],"proposed":[277],"DPSR.":[278]},"counts_by_year":[],"updated_date":"2026-11-03T10:50:19.383937","created_date":"2026-08-21T00:00:00"}