{"id":"https://openalex.org/W4416582925","doi":"https://doi.org/10.1109/access.2025.3636501","title":"XAPT: Explainable Anomaly-Driven Prediction of Threat Stages in APT Campaigns","display_name":"XAPT: Explainable Anomaly-Driven Prediction of Threat Stages in APT Campaigns","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4416582925","doi":"https://doi.org/10.1109/access.2025.3636501","pmid":"https://pubmed.ncbi.nlm.nih.gov/41497322"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3636501","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3636501","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3636501","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5039346080","display_name":"Wei Lu","orcid":"https://orcid.org/0000-0002-4150-8674"},"institutions":[{"id":"https://openalex.org/I150638750","display_name":"Keene State College","ror":"https://ror.org/04c1gbz02","country_code":"US","type":"education","lineage":["https://openalex.org/I150638750"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wei Lu","raw_affiliation_strings":["Department of Computer Science, Keene State College, Keene, NH, USA","Department of Computer Science, Keene State College, USNH, Keene, NH, USA"],"raw_orcid":"https://orcid.org/0000-0002-4150-8674","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Keene State College, Keene, NH, USA","institution_ids":["https://openalex.org/I150638750"]},{"raw_affiliation_string":"Department of Computer Science, Keene State College, USNH, Keene, NH, USA","institution_ids":["https://openalex.org/I150638750"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041277719","display_name":"Issa Traor\u00e9","orcid":"https://orcid.org/0000-0003-2987-8047"},"institutions":[{"id":"https://openalex.org/I212119943","display_name":"University of Victoria","ror":"https://ror.org/04s5mat29","country_code":"CA","type":"education","lineage":["https://openalex.org/I212119943"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Issa Traor\u00e9","raw_affiliation_strings":["Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada"],"raw_orcid":"https://orcid.org/0000-0003-2987-8047","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada","institution_ids":["https://openalex.org/I212119943"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058166217","display_name":"Isaac Woungang","orcid":"https://orcid.org/0000-0003-2484-4649"},"institutions":[{"id":"https://openalex.org/I530967","display_name":"Toronto Metropolitan University","ror":"https://ror.org/05g13zd79","country_code":"CA","type":"education","lineage":["https://openalex.org/I530967"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Isaac Woungang","raw_affiliation_strings":["Department of Computer Science, Toronto Metropolitan University, Toronto, ON, Canada"],"raw_orcid":"https://orcid.org/0000-0003-2484-4649","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Toronto Metropolitan University, Toronto, ON, Canada","institution_ids":["https://openalex.org/I530967"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102469050","display_name":"Eric Brown","orcid":"https://orcid.org/0009-0000-9450-7782"},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Eric Brown","raw_affiliation_strings":["Department of Computer Science, Dartmouth College, Hanover, NH, USA"],"raw_orcid":"https://orcid.org/0009-0000-9450-7782","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073495903","display_name":"Marcelo Luiz Brocardo","orcid":"https://orcid.org/0009-0003-2585-5187"},"institutions":[{"id":"https://openalex.org/I164790352","display_name":"Universidade do Estado de Santa Catarina","ror":"https://ror.org/03ztsbk67","country_code":"BR","type":"education","lineage":["https://openalex.org/I164790352"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Marcelo Luiz Brocardo","raw_affiliation_strings":["Santa Catarina State University (UDESC), Florianópolis, Santa Catarina, Brazil","Santa Catarina State University - UDESC, Florianopolis, SC, Brazil"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Santa Catarina State University (UDESC), Florianópolis, Santa Catarina, Brazil","institution_ids":["https://openalex.org/I164790352"]},{"raw_affiliation_string":"Santa Catarina State University - UDESC, Florianopolis, SC, Brazil","institution_ids":["https://openalex.org/I164790352"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043556165","display_name":"Qiaoyan Yu","orcid":"https://orcid.org/0000-0002-7232-8529"},"institutions":[{"id":"https://openalex.org/I161057412","display_name":"University of New Hampshire","ror":"https://ror.org/01rmh9n78","country_code":"US","type":"education","lineage":["https://openalex.org/I161057412"]},{"id":"https://openalex.org/I2800453862","display_name":"University System of New Hampshire","ror":"https://ror.org/0061x0487","country_code":"US","type":"education","lineage":["https://openalex.org/I2800453862"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qiaoyan Yu","raw_affiliation_strings":["Department of Electrical and Computer Engineering, University of New Hampshire, Durham, NH, USA","Department of Electrical and Computer Engineering, University of New Hampshire, USNH, Durham, NH, USA"],"raw_orcid":"https://orcid.org/0000-0002-7232-8529","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, University of New Hampshire, Durham, NH, USA","institution_ids":["https://openalex.org/I161057412"]},{"raw_affiliation_string":"Department of Electrical and Computer Engineering, University of New Hampshire, USNH, Durham, NH, USA","institution_ids":["https://openalex.org/I161057412","https://openalex.org/I2800453862"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5116057059","display_name":"Ornella Lucresse Soh","orcid":null},"institutions":[{"id":"https://openalex.org/I212119943","display_name":"University of Victoria","ror":"https://ror.org/04s5mat29","country_code":"CA","type":"education","lineage":["https://openalex.org/I212119943"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Ornella Lucresse Soh","raw_affiliation_strings":["Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada","institution_ids":["https://openalex.org/I212119943"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":1.9739,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.88558014,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"13","issue":null,"first_page":"199737","last_page":"199756"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1891999989748001,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1891999989748001,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.17820000648498535,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.15360000729560852,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7634999752044678},{"id":"https://openalex.org/keywords/probabilistic-logic","display_name":"Probabilistic logic","score":0.6758999824523926},{"id":"https://openalex.org/keywords/bayesian-probability","display_name":"Bayesian probability","score":0.5386000275611877},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.4959000051021576},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.43630000948905945},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.43220001459121704},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4300999939441681},{"id":"https://openalex.org/keywords/attribution","display_name":"Attribution","score":0.366100013256073}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7634999752044678},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7196999788284302},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.6758999824523926},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5903000235557556},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.5386000275611877},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.49959999322891235},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.4959000051021576},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.43630000948905945},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.43220001459121704},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4300999939441681},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4068000018596649},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.366100013256073},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3553999960422516},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.3513999879360199},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.32899999618530273},{"id":"https://openalex.org/C52001869","wikidata":"https://www.wikidata.org/wiki/Q812530","display_name":"Naive Bayes classifier","level":3,"score":0.3199999928474426},{"id":"https://openalex.org/C160234255","wikidata":"https://www.wikidata.org/wiki/Q812535","display_name":"Bayesian inference","level":3,"score":0.29100000858306885},{"id":"https://openalex.org/C33724603","wikidata":"https://www.wikidata.org/wiki/Q812540","display_name":"Bayesian network","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.2648000121116638},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.26080000400543213},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.25839999318122864}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/access.2025.3636501","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3636501","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmid:41497322","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/41497322","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE access : practical innovations, open solutions","raw_type":null},{"id":"pmh:oai:doaj.org/article:3456b95c16dc465cb6ffb333c5269cf6","is_oa":true,"landing_page_url":"https://doaj.org/article/3456b95c16dc465cb6ffb333c5269cf6","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 199737-199756 (2025)","raw_type":"article"},{"id":"pmh:oai:pubmedcentral.nih.gov:12768332","is_oa":true,"landing_page_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC12768332/","pdf_url":null,"source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3636501","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3636501","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2506200671","display_name":null,"funder_award_id":"R15 EB036778","funder_id":"https://openalex.org/F4320337363","funder_display_name":"National Institute of Biomedical Imaging and Bioengineering"},{"id":"https://openalex.org/G714850121","display_name":null,"funder_award_id":"1R15EB036778-01","funder_id":"https://openalex.org/F4320337363","funder_display_name":"National Institute of Biomedical Imaging and Bioengineering"},{"id":"https://openalex.org/G916817351","display_name":"An Explainable Artificial Intelligence Based Hybrid Intrusion Detection System for Enhancing Healthcare Security","funder_award_id":"1r15eb036778-01","funder_id":"https://openalex.org/F4320332161","funder_display_name":"National Institutes of Health"}],"funders":[{"id":"https://openalex.org/F4320332161","display_name":"National Institutes of Health","ror":"https://ror.org/01cwqze88"},{"id":"https://openalex.org/F4320337363","display_name":"National Institute of Biomedical Imaging and Bioengineering","ror":"https://ror.org/00372qc85"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"are":[4,69],"long-lived,":[5],"targeted":[6],"cyberattacks":[7],"that":[8,113,125],"progress":[9],"through":[10],"multiple":[11],"stages,":[12],"characterized":[13],"by":[14],"strong":[15],"stealth":[16],"and":[17,22,50,83,94,103,136,143],"intent.":[18],"To":[19],"achieve":[20],"accurate":[21],"interpretable":[23,144],"stage-level":[24,117],"prediction,":[25],"we":[26,45],"propose":[27],"XAPT,":[28],"an":[29],"eXplainable,":[30],"anomaly-driven":[31],"framework":[32],"for":[33,77,146],"APT":[34],"campaign":[35],"analysis.":[36,128],"XAPT":[37,114,139],"is":[38],"centered":[39],"on":[40],"three":[41],"key":[42],"innovations.":[43],"First,":[44],"derive":[46],"PCA-based":[47],"reconstruction":[48],"errors":[49],"transform":[51],"them":[52],"into":[53,71],"calibrated":[54,67,131],"probabilistic":[55],"anomaly":[56,92,132],"scores,":[57],"enabling":[58],"principled":[59],"quantification":[60],"of":[61,108],"the":[62],"event":[63],"abnormality.":[64],"Second,":[65],"these":[66],"scores":[68,93],"incorporated":[70],"a":[72,141],"Bayesian":[73,134],"Network-based":[74],"multiclass":[75],"classifier":[76],"cyber-kill-chain":[78],"stage":[79],"inference,":[80,135],"capturing":[81],"uncertainty":[82],"inter-feature":[84],"dependencies.":[85],"Third,":[86],"SHAP-based":[87],"feature":[88],"attribution":[89],"reveals":[90],"how":[91],"other":[95],"features":[96],"contribute":[97],"to":[98],"classification":[99],"outcomes,":[100],"offering":[101],"transparent":[102],"analytically":[104],"friendly":[105],"explanations.":[106],"Evaluation":[107],"two":[109],"public":[110],"datasets":[111],"shows":[112],"achieves":[115],"high":[116],"detection":[118],"accuracy":[119],"while":[120],"producing":[121],"actionable":[122],"feature-level":[123],"interpretations":[124],"support":[126],"operational":[127],"By":[129],"unifying":[130],"scoring,":[133],"SHAP":[137],"explanation,":[138],"offers":[140],"comprehensive":[142],"solution":[145],"advanced":[147],"threat":[148],"detection.":[149]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2025-11-25T00:00:00"}