{"id":"https://openalex.org/W4403914972","doi":"https://doi.org/10.1051/sands/2024019","title":"Uncovering multi-step attacks with threat knowledge graph reasoning","display_name":"Uncovering multi-step attacks with threat knowledge graph reasoning","publication_year":2024,"publication_date":"2024-10-30","ids":{"openalex":"https://openalex.org/W4403914972","doi":"https://doi.org/10.1051/sands/2024019"},"language":"en","primary_location":{"id":"doi:10.1051/sands/2024019","is_oa":true,"landing_page_url":"https://doi.org/10.1051/sands/2024019","pdf_url":"https://sands.edpsciences.org/articles/sands/pdf/2025/01/sands20240007.pdf","source":{"id":"https://openalex.org/S4387281467","display_name":"Security and Safety","issn_l":"2826-1275","issn":["2826-1275","2097-2121"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319748","host_organization_name":"EDP Sciences","host_organization_lineage":["https://openalex.org/P4310319748"],"host_organization_lineage_names":["EDP Sciences"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Security and Safety","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://sands.edpsciences.org/articles/sands/pdf/2025/01/sands20240007.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5080217676","display_name":"Xiayu Xiang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiayu Xiang","raw_affiliation_strings":["Peng Cheng Laboratory, Shenzhen, 518000, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peng Cheng Laboratory, Shenzhen, 518000, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113190756","display_name":"Changchang Ma","orcid":null},"institutions":[{"id":"https://openalex.org/I4210110195","display_name":"China Energy Engineering Corporation (China)","ror":"https://ror.org/01nvzzy80","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210110195"]},{"id":"https://openalex.org/I4210122556","display_name":"Energy Foundation","ror":"https://ror.org/02w769767","country_code":"CN","type":"nonprofit","lineage":["https://openalex.org/I4210122556"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changchang Ma","raw_affiliation_strings":["CHN Energy, Beijing, 100000, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CHN Energy, Beijing, 100000, China","institution_ids":["https://openalex.org/I4210122556","https://openalex.org/I4210110195"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101632919","display_name":"Liyi Zeng","orcid":"https://orcid.org/0009-0009-1627-5811"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liyi Zeng","raw_affiliation_strings":["Peng Cheng Laboratory, Shenzhen, 518000, China"],"raw_orcid":"https://orcid.org/0009-0009-1627-5811","affiliations":[{"raw_affiliation_string":"Peng Cheng Laboratory, Shenzhen, 518000, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113205160","display_name":"Wenying Feng","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenying Feng","raw_affiliation_strings":["Peng Cheng Laboratory, Shenzhen, 518000, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peng Cheng Laboratory, Shenzhen, 518000, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100558325","display_name":"Yushun Xie","orcid":null},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]},{"id":"https://openalex.org/I3045169105","display_name":"Southern University of Science and Technology","ror":"https://ror.org/049tv2d57","country_code":"CN","type":"education","lineage":["https://openalex.org/I3045169105"]},{"id":"https://openalex.org/I4210152380","display_name":"Shenzhen Technology University","ror":"https://ror.org/04qzpec27","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210152380"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yushun Xie","raw_affiliation_strings":["University of Electronic Science and Technology of China, Shenzhen, 518110, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Electronic Science and Technology of China, Shenzhen, 518110, China","institution_ids":["https://openalex.org/I4210152380","https://openalex.org/I3045169105","https://openalex.org/I150229711"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070856186","display_name":"Zhaoquan Gu","orcid":"https://orcid.org/0000-0001-7546-852X"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]},{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhaoquan Gu","raw_affiliation_strings":["Harbin Institute of Technology (Shenzhen), Shenzhen, 518055, China","Peng Cheng Laboratory, Shenzhen, 518000, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Harbin Institute of Technology (Shenzhen), Shenzhen, 518055, China","institution_ids":["https://openalex.org/I204983213"]},{"raw_affiliation_string":"Peng Cheng Laboratory, Shenzhen, 518000, China","institution_ids":["https://openalex.org/I4210136793"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.2792,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.85905948,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":96},"biblio":{"volume":"4","issue":null,"first_page":"2024019","last_page":"2024019"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9477999806404114,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9477999806404114,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10994","display_name":"Terrorism, Counterterrorism, and Political Violence","score":0.9333000183105469,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.9043999910354614,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6610631346702576},{"id":"https://openalex.org/keywords/knowledge-graph","display_name":"Knowledge graph","score":0.5188235640525818},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4589475393295288},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.40643030405044556},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3931884169578552},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2621506154537201}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6610631346702576},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.5188235640525818},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4589475393295288},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.40643030405044556},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3931884169578552},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2621506154537201}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1051/sands/2024019","is_oa":true,"landing_page_url":"https://doi.org/10.1051/sands/2024019","pdf_url":"https://sands.edpsciences.org/articles/sands/pdf/2025/01/sands20240007.pdf","source":{"id":"https://openalex.org/S4387281467","display_name":"Security and Safety","issn_l":"2826-1275","issn":["2826-1275","2097-2121"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319748","host_organization_name":"EDP Sciences","host_organization_lineage":["https://openalex.org/P4310319748"],"host_organization_lineage_names":["EDP Sciences"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Security and Safety","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:ca3b342411944709bfe2c0881efebc2e","is_oa":true,"landing_page_url":"https://doaj.org/article/ca3b342411944709bfe2c0881efebc2e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Security and Safety, Vol 4, p 2024019 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1051/sands/2024019","is_oa":true,"landing_page_url":"https://doi.org/10.1051/sands/2024019","pdf_url":"https://sands.edpsciences.org/articles/sands/pdf/2025/01/sands20240007.pdf","source":{"id":"https://openalex.org/S4387281467","display_name":"Security and Safety","issn_l":"2826-1275","issn":["2826-1275","2097-2121"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319748","host_organization_name":"EDP Sciences","host_organization_lineage":["https://openalex.org/P4310319748"],"host_organization_lineage_names":["EDP Sciences"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Security and Safety","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.5299999713897705}],"awards":[{"id":"https://openalex.org/G2987336565","display_name":null,"funder_award_id":"Major Key Project of PCL (Grant No. PCL2024A05)","funder_id":"https://openalex.org/F4320318558","funder_display_name":"Peng Cheng Laboratory"}],"funders":[{"id":"https://openalex.org/F4320318558","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4403914972.pdf","grobid_xml":"https://content.openalex.org/works/W4403914972.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W1426956448","https://openalex.org/W1533230146","https://openalex.org/W2127795553","https://openalex.org/W2207457333","https://openalex.org/W2283196293","https://openalex.org/W2750886690","https://openalex.org/W2759136286","https://openalex.org/W2790843555","https://openalex.org/W2792581684","https://openalex.org/W2795990847","https://openalex.org/W2909137510","https://openalex.org/W2910711617","https://openalex.org/W2996740343","https://openalex.org/W3003265726","https://openalex.org/W3012968643","https://openalex.org/W3200978589","https://openalex.org/W4210556785","https://openalex.org/W4383559238","https://openalex.org/W4390679729","https://openalex.org/W4401227068","https://openalex.org/W6718112784"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"The":[0,208],"rapid":[1],"advancement":[2],"of":[3,46,104,117,213],"information":[4],"technologies":[5],"has":[6],"significantly":[7,198],"intensified":[8],"the":[9,58,102,114,211],"focus":[10],"on":[11,90],"cyberspace":[12],"security":[13,91,169],"across":[14],"various":[15],"sectors.":[16],"In":[17,128],"this":[18,129,196],"evolving":[19],"landscape,":[20],"attackers":[21],"deploy":[22],"many":[23],"techniques-":[24],"including":[25],"exploits,":[26],"weakness":[27],"identification,":[28],"and":[29,62,70,75,82,93,107,144,162,176],"complex":[30,181],"multi-step":[31,177],"attacks-":[32],"to":[33,37,48,165,226],"gain":[34],"unauthorized":[35],"access":[36],"systems.":[38],"Conversely,":[39],"defenders":[40],"harness":[41],"insights":[42],"from":[43,134],"a":[44,97,139,146,186],"variety":[45],"sources":[47,137],"pinpoint":[49],"potential":[50,225],"threats.":[51],"Prominent":[52],"public":[53],"cybersecurity":[54,105,228],"databases":[55],"such":[56,171],"as":[57,172],"Adversarial":[59],"Tactics,":[60],"Techniques,":[61],"Common":[63,66,73,78,83],"Knowledge":[64,154],"(ATT&CK),":[65],"Attack":[67],"Pattern":[68],"Enumeration":[69,80,85],"Classification":[71],"(CAPEC),":[72],"Vulnerabilities":[74],"Exposures":[76],"(CVE),":[77],"Weakness":[79],"(CWE),":[81],"Platform":[84],"(CPE)":[86],"provide":[87],"extensive":[88,192],"data":[89,133],"entities":[92,170],"their":[94],"interrelations,":[95],"playing":[96],"pivotal":[98],"role":[99],"in":[100,109,203,218],"enriching":[101],"understanding":[103],"challenges":[106],"assisting":[108],"comprehensive":[110],"defensive":[111],"analyses.":[112],"However,":[113],"semantic":[115],"cross-analysis":[116],"these":[118,135,206],"databases,":[119],"crucial":[120],"for":[121],"identifying":[122],"obscure":[123],"threat":[124,141,215],"patterns,":[125],"remains":[126],"underexploited.":[127],"study,":[130],"we":[131],"amalgamate":[132],"disparate":[136],"into":[138],"cohesive":[140],"knowledge":[142,148,216],"graph":[143,217],"introduce":[145],"novel":[147],"representation":[149],"learning":[150],"approach,":[151],"A4CKGE":[152],"(ATT&CK-CAPEC-CWE-CVE-CPE":[153],"Graph":[155],"Embedding).":[156],"This":[157],"method":[158],"utilizes":[159],"advanced":[160],"structural":[161],"textual":[163],"analytics":[164],"predict":[166],"interactions":[167],"among":[168],"products,":[173],"vulnerabilities,":[174],"weaknesses,":[175],"attack":[178,182],"sequences,":[179],"employing":[180],"templates":[183],"generated":[184],"through":[185],"Large":[187],"Language":[188],"Model":[189],"(LLM).":[190],"Our":[191],"experiments":[193],"demonstrate":[194],"that":[195],"approach":[197],"outperforms":[199],"existing":[200],"state-of-the-art":[201],"methods":[202],"effectively":[204],"predicting":[205],"relationships.":[207],"findings":[209],"validate":[210],"efficacy":[212],"our":[214],"unveiling":[219],"hidden":[220],"connections,":[221],"thereby":[222],"highlighting":[223],"its":[224],"strengthen":[227],"defenses":[229],"substantially.":[230]},"counts_by_year":[{"year":2025,"cited_by_count":2}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2024-10-31T00:00:00"}