{"id":"https://openalex.org/W7163030583","doi":"https://doi.org/10.1016/j.cose.2026.104988","title":"Debapt: Ontology-driven multi-agent debate for APT adversary profile construction from cyber threat intelligence","display_name":"Debapt: Ontology-driven multi-agent debate for APT adversary profile construction from cyber threat intelligence","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7163030583","doi":"https://doi.org/10.1016/j.cose.2026.104988"},"language":"en","primary_location":{"id":"doi:10.1016/j.cose.2026.104988","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104988","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.cose.2026.104988","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137573843","display_name":"Xinyun Zhao","orcid":"https://orcid.org/0009-0005-6961-5550"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinyun Zhao","raw_affiliation_strings":["Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","College of Electronic Engineering, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0009-0005-6961-5550","affiliations":[{"raw_affiliation_string":"Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","institution_ids":[]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137522384","display_name":"Lanlan Qi","orcid":"https://orcid.org/0009-0007-5882-0430"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lanlan Qi","raw_affiliation_strings":["Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","College of Electronic Engineering, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0009-0007-5882-0430","affiliations":[{"raw_affiliation_string":"Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","institution_ids":[]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137566554","display_name":"Yongheng Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yongheng Zhang","raw_affiliation_strings":["Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","College of Electronic Engineering, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0000-0002-8787-4995","affiliations":[{"raw_affiliation_string":"Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","institution_ids":[]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014418513","display_name":"Y. F. Guan","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yingxiao Guan","raw_affiliation_strings":["Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","College of Electronic Engineering, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0009-0007-0950-4001","affiliations":[{"raw_affiliation_string":"Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","institution_ids":[]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137526954","display_name":"Guozheng Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guozheng Yang","raw_affiliation_strings":["Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","College of Electronic Engineering, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0000-0001-7025-926X","affiliations":[{"raw_affiliation_string":"Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","institution_ids":[]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137588300","display_name":"Yuliang Lu","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Yuliang Lu","raw_affiliation_strings":["Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","College of Electronic Engineering, National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0000-0002-8502-9907","affiliations":[{"raw_affiliation_string":"Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei, China","institution_ids":[]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5137542085","display_name":"Xiang Wang","orcid":"https://orcid.org/0000-0002-6148-6329"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiang Wang","raw_affiliation_strings":["University of Science and Technology of China, China"],"raw_orcid":"https://orcid.org/0000-0002-6148-6329","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, China","institution_ids":["https://openalex.org/I126520041"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5137588300"],"corresponding_institution_ids":["https://openalex.org/I170215575"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.6823883,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"170","issue":null,"first_page":"104988","last_page":"104988"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.11169999837875366,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.11169999837875366,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10456","display_name":"Multi-Agent Systems and Negotiation","score":0.08110000193119049,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.052299998700618744,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.7860999703407288},{"id":"https://openalex.org/keywords/cyberwarfare","display_name":"Cyberwarfare","score":0.529699981212616},{"id":"https://openalex.org/keywords/intelligence-analysis","display_name":"Intelligence analysis","score":0.489300012588501},{"id":"https://openalex.org/keywords/cyber-threats","display_name":"Cyber threats","score":0.45660001039505005},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.3709999918937683},{"id":"https://openalex.org/keywords/business-intelligence","display_name":"Business intelligence","score":0.32600000500679016}],"concepts":[{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.7860999703407288},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7224000096321106},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5722000002861023},{"id":"https://openalex.org/C171769113","wikidata":"https://www.wikidata.org/wiki/Q849340","display_name":"Cyberwarfare","level":2,"score":0.529699981212616},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.489300012588501},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.45660001039505005},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4296000003814697},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3709999918937683},{"id":"https://openalex.org/C2767350","wikidata":"https://www.wikidata.org/wiki/Q6662173","display_name":"Business intelligence","level":2,"score":0.32600000500679016},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.29280000925064087},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2529999911785126}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.cose.2026.104988","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104988","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.cose.2026.104988","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104988","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320335960","display_name":"National Major Science and Technology Projects of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W1975879668","https://openalex.org/W2148540243","https://openalex.org/W2771963642","https://openalex.org/W2790843555","https://openalex.org/W2925613093","https://openalex.org/W2957763665","https://openalex.org/W2964522977","https://openalex.org/W4281478262","https://openalex.org/W4293024991","https://openalex.org/W4309631954","https://openalex.org/W4310931642","https://openalex.org/W4366505379","https://openalex.org/W4375787811","https://openalex.org/W4380987977","https://openalex.org/W4385688053","https://openalex.org/W4387234384","https://openalex.org/W4389523767","https://openalex.org/W4393253320","https://openalex.org/W4394935726","https://openalex.org/W4399039481","https://openalex.org/W4400612817","https://openalex.org/W4402622967","https://openalex.org/W4403735097","https://openalex.org/W4404600217","https://openalex.org/W4404731747","https://openalex.org/W4404782209","https://openalex.org/W4404782964","https://openalex.org/W4404783929","https://openalex.org/W4411120563","https://openalex.org/W4412051720","https://openalex.org/W4413253786","https://openalex.org/W4416036821"],"related_works":[],"abstract_inverted_index":{"Cyber":[0],"threat":[1,11],"intelligence":[2],"(CTI)":[3],"reports":[4,28,169],"contain":[5],"rich":[6],"information":[7,15,94,110],"about":[8],"advanced":[9],"persistent":[10],"(APT)":[12],"groups.":[13],"This":[14],"is":[16],"useful":[17,230],"for":[18,59],"adversary":[19,31,80,129,173,231],"profile":[20,81,93,130,174],"construction.":[21,175],"However,":[22],"turning":[23],"long":[24,72],"and":[25,42,68,141,153,198,208],"fragmented":[26],"CTI":[27,84,183,214],"into":[29,111],"structured":[30],"profiles":[32],"remains":[33],"difficult.":[34],"Existing":[35],"methods":[36,53],"mainly":[37],"rely":[38],"on":[39],"named":[40],"entity":[41,138,197],"relation":[43,142,199],"extraction":[44,95,139,143,200],"pipelines":[45],"or":[46],"single":[47],"large":[48],"language":[49],"models":[50],"(LLMs).":[51],"These":[52,161],"often":[54],"lack":[55],"explicit":[56],"semantic":[57],"constraints":[58],"profile-oriented":[60,196],"tasks.":[61],"They":[62],"are":[63],"also":[64],"prone":[65],"to":[66,170],"omission":[67],"hallucination":[69],"when":[70],"processing":[71],"reports.":[73,85,215],"In":[74,145],"this":[75,88,99],"paper,":[76],"we":[77,101,179],"study":[78],"APT":[79,128],"construction":[82,131,227],"from":[83,213],"We":[86,114],"formulate":[87],"task":[89],"as":[90],"an":[91,118],"ontology-constrained":[92],"task.":[96],"To":[97,176],"support":[98,171,225],"task,":[100],"develop":[102],"VICTOR,":[103,125],"a":[104,186],"domain-specific":[105],"ontology":[106],"that":[107,193,220],"organizes":[108],"profile-relevant":[109,156,211],"six":[112],"dimensions.":[113],"then":[115],"propose":[116],"Debapt,":[117,178],"ontology-driven":[119],"multi-agent":[120],"debate":[121,134],"framework.":[122],"Guided":[123],"by":[124],"Debapt":[126,194],"performs":[127],"through":[132],"two":[133],"loops":[135],"in":[136],"the":[137,226],"phase":[140],"phase.":[144],"each":[146],"loop,":[147],"role-specialized":[148],"agents":[149],"iteratively":[150],"extract,":[151],"review,":[152],"adjudicate":[154],"candidate":[155],"facts":[157,212],"under":[158,185],"moderator":[159],"supervision.":[160],"extracted":[162,222],"results":[163,191,223],"can":[164,224],"be":[165],"further":[166,218],"aggregated":[167],"across":[168],"actor-centric":[172],"evaluate":[177],"re-annotate":[180],"three":[181],"public":[182],"datasets":[184],"unified":[187],"profiling":[188],"schema.":[189],"Experimental":[190],"show":[192,219],"improves":[195],"over":[201],"competitive":[202],"baselines.":[203],"It":[204],"extracts":[205],"more":[206],"complete":[207],"better":[209],"grounded":[210],"Case":[216],"studies":[217],"these":[221],"of":[228],"analytically":[229],"profiles.":[232]},"counts_by_year":[],"updated_date":"2026-06-19T15:47:20.252518","created_date":"2026-06-02T00:00:00"}