{"id":"https://openalex.org/W7225138648","doi":"https://doi.org/10.5281/zenodo.23905465","title":"AI/ML-Based Multi-Stage Detection and Automated Defence Against Advanced Persistent Threats: A Review and Conceptual Framework","display_name":"AI/ML-Based Multi-Stage Detection and Automated Defence Against Advanced Persistent Threats: A Review and Conceptual Framework","publication_year":2026,"publication_date":"2026-11-03","ids":{"openalex":"https://openalex.org/W7225138648","doi":"https://doi.org/10.5281/zenodo.23905465"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.23905465","doi":"https://doi.org/10.5281/zenodo.23905465","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23905465","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"JournalArticle"},"volume":null,"type":"article","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.23905465","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5160392674","display_name":"Sajid Tadvi","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sajid Tadvi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5134024492","display_name":"Geeta Kodabagi","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Prof. Geeta Kodabagi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.84445081,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.9990000128746033},{"id":"https://openalex.org/keywords/multi-stage-detection","display_name":"multi-stage detection","score":0.75},{"id":"https://openalex.org/keywords/next-action-prediction","display_name":"next action prediction","score":0.7620000243186951},{"id":"https://openalex.org/keywords/multi-source-data-fusion","display_name":"multi-source data fusion","score":0.8050000071525574},{"id":"https://openalex.org/keywords/automatic-responses","display_name":"automated response","score":0.7429999709129333},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"security information and event management","score":0.7879999876022339},{"id":"https://openalex.org/keywords/event-correlation","display_name":"event correlation","score":0.8379999995231628},{"id":"https://openalex.org/keywords/behavior-analysis","display_name":"behavior analysis","score":0.746999979019165},{"id":"https://openalex.org/keywords/deep-learning-detector","display_name":"deep learning detector","score":0.6069999933242798},{"id":"https://openalex.org/keywords/evaluation-protocol","display_name":"evaluation protocol","score":0.39899998903274536},{"id":"https://openalex.org/keywords/cyberattack-detection","display_name":"cyberattack detection","score":0.5559999942779541}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6855999827384949},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.6226000189781189},{"id":"https://openalex.org/C14224292","wikidata":"https://www.wikidata.org/wiki/Q13600188","display_name":"Conceptual framework","level":2,"score":0.4934999942779541},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.44449999928474426},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.427700012922287},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.36340001225471497},{"id":"https://openalex.org/C2987896495","wikidata":"https://www.wikidata.org/wiki/Q5416716","display_name":"Event data","level":3,"score":0.3296999931335449},{"id":"https://openalex.org/C13606891","wikidata":"https://www.wikidata.org/wiki/Q2623243","display_name":"Conceptual model","level":2,"score":0.3073999881744385},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3050999939441681},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.29159998893737793},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2913999855518341},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.27379998564720154},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.27149999141693115},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2702000141143799},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.26739999651908875},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.26170000433921814},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2612000107765198},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.25870001316070557}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.23905465","doi":"https://doi.org/10.5281/zenodo.23905465","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23905465","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"JournalArticle"},{"id":"doi:10.5281/zenodo.23905466","doi":"https://doi.org/10.5281/zenodo.23905466","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23905466","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"JournalArticle"}],"best_oa_location":{"id":"doi:10.5281/zenodo.23905465","doi":"https://doi.org/10.5281/zenodo.23905465","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23905465","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"JournalArticle"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4386042779","https://openalex.org/W3033897840","https://openalex.org/W7123454935","https://openalex.org/W4285179340","https://openalex.org/W2818789173","https://openalex.org/W7084111025","https://openalex.org/W4412148047","https://openalex.org/W7126033898","https://openalex.org/W2765628153","https://openalex.org/W4405011103"],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"are":[4,14,44,157],"targeted,":[5],"long-term":[6],"cyberattacks":[7],"that":[8,60,85],"unfold":[9],"in":[10,110],"several":[11],"stages":[12],"and":[13,37,40,58,65,71,78,106,108,130,135,138,154],"deliberately":[15],"designed":[16],"to":[17,47],"stay":[18],"hidden,":[19],"so":[20],"detecting":[21],"them":[22],"from":[23],"isolated":[24],"alerts":[25],"is":[26,147],"unreliable.":[27],"Machine":[28],"learning":[29],"(ML),":[30],"behavioural":[31],"analysis,":[32],"event":[33,41],"correlation,":[34],"provenance":[35],"analysis":[36],"security":[38],"information":[39],"management":[42],"(SIEM)":[43],"increasingly":[45],"applied":[46],"this":[48,116],"problem.":[49],"This":[50],"paper":[51],"reviews":[52],"fifteen":[53],"studies":[54,90],"published":[55],"between":[56],"2018":[57],"2026":[59],"cover":[61],"APT":[62],"tactics,":[63],"techniques":[64],"procedures":[66],"(TTPs),":[67],"supervised,":[68],"deep,":[69],"hybrid":[70],"evolutionary":[72],"detectors,":[73],"provenance-graph":[74],"learning,":[75],"attack-stage":[76],"prediction":[77,97],"uncertainty-aware":[79,133],"classification.":[80],"A":[81],"criterion-based":[82],"comparison":[83],"shows":[84],"none":[86],"of":[87,98,104],"the":[88,99],"reviewed":[89],"combines":[91],"full-lifecycle":[92],"coverage,":[93],"multi-source":[94,124],"data":[95,125],"fusion,":[96,126],"attacker\u2019s":[100],"next":[101],"action,":[102],"handling":[103],"uncertainty":[105],"drift,":[107],"validation":[109],"a":[111,120],"realistic":[112],"environment.":[113],"To":[114],"address":[115],"need,":[117],"we":[118],"propose":[119],"conceptual":[121],"framework":[122,146],"for":[123,143],"multi-stage":[127],"detection,":[128],"stage":[129],"next-action":[131],"prediction,":[132],"prioritisation":[134],"automated":[136],"response,":[137],"define":[139],"an":[140],"evaluation":[141],"protocol":[142],"it.":[144],"The":[145],"proposed":[148],"rather":[149],"than":[150],"implemented;":[151],"open":[152],"challenges":[153],"future":[155],"directions":[156],"discussed.":[158]},"counts_by_year":[],"updated_date":"2026-11-05T12:25:35.769452","created_date":"2026-11-04T00:00:00"}