{"id":"https://openalex.org/W4416926010","doi":"https://doi.org/10.1109/access.2025.3639270","title":"Adaptive Detection of Advanced Persistent Threats (APT) With Graph Neural Networks and Rehearsal-Based Continual Learning on Wazuh EDR Telemetry","display_name":"Adaptive Detection of Advanced Persistent Threats (APT) With Graph Neural Networks and Rehearsal-Based Continual Learning on Wazuh EDR Telemetry","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4416926010","doi":"https://doi.org/10.1109/access.2025.3639270"},"language":null,"primary_location":{"id":"doi:10.1109/access.2025.3639270","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3639270","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3639270","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016464024","display_name":"Auttapon Pomsathit","orcid":"https://orcid.org/0009-0006-7418-1790"},"institutions":[{"id":"https://openalex.org/I91538806","display_name":"King Mongkut's Institute of Technology Ladkrabang","ror":"https://ror.org/055mf0v62","country_code":"TH","type":"education","lineage":["https://openalex.org/I91538806"]}],"countries":["TH"],"is_corresponding":true,"raw_author_name":"Auttapon Pomsathit","raw_affiliation_strings":["Department of IoT and Information Engineering, School of Engineering, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, Thailand","Department of IoT, Information Engineering, School of Engineering, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, Thailand"],"raw_orcid":"https://orcid.org/0009-0006-7418-1790","affiliations":[{"raw_affiliation_string":"Department of IoT and Information Engineering, School of Engineering, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, Thailand","institution_ids":["https://openalex.org/I91538806"]},{"raw_affiliation_string":"Department of IoT, Information Engineering, School of Engineering, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, Thailand","institution_ids":["https://openalex.org/I91538806"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5016464024"],"corresponding_institution_ids":["https://openalex.org/I91538806"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":1.3042,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.86919945,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"13","issue":null,"first_page":"212973","last_page":"212982"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.3192000091075897,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.3192000091075897,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.17399999499320984,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.07750000059604645,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/telemetry","display_name":"Telemetry","score":0.6736000180244446},{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.6424000263214111},{"id":"https://openalex.org/keywords/adaptability","display_name":"Adaptability","score":0.5555999875068665},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4869999885559082},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.44179999828338623},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.41609999537467957},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.34779998660087585}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8155999779701233},{"id":"https://openalex.org/C183121708","wikidata":"https://www.wikidata.org/wiki/Q209867","display_name":"Telemetry","level":2,"score":0.6736000180244446},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.6424000263214111},{"id":"https://openalex.org/C177606310","wikidata":"https://www.wikidata.org/wiki/Q5674297","display_name":"Adaptability","level":2,"score":0.5555999875068665},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.536899983882904},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5112000107765198},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4869999885559082},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.44179999828338623},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.41609999537467957},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.34779998660087585},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3190999925136566},{"id":"https://openalex.org/C147168706","wikidata":"https://www.wikidata.org/wiki/Q1457734","display_name":"Recurrent neural network","level":3,"score":0.29739999771118164},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2971999943256378},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.2856999933719635},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.2824000120162964},{"id":"https://openalex.org/C2776544517","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Unexpected events","level":2,"score":0.2750000059604645},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.26570001244544983},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C125014702","wikidata":"https://www.wikidata.org/wiki/Q4680749","display_name":"Adaptive learning","level":2,"score":0.2556000053882599}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/access.2025.3639270","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3639270","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3639270","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3639270","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W2089554624","https://openalex.org/W2788403449","https://openalex.org/W3110791298","https://openalex.org/W3176393519","https://openalex.org/W4206706211","https://openalex.org/W4312702896","https://openalex.org/W4319863537","https://openalex.org/W4327935688","https://openalex.org/W4385688168","https://openalex.org/W4386211285","https://openalex.org/W4386814691","https://openalex.org/W4388835106","https://openalex.org/W4391620892","https://openalex.org/W4392126138","https://openalex.org/W4393150251","https://openalex.org/W4393860761","https://openalex.org/W4398232772","https://openalex.org/W4399621644","https://openalex.org/W4400120188","https://openalex.org/W4401426188","https://openalex.org/W4403124633","https://openalex.org/W4404036959","https://openalex.org/W4404092543","https://openalex.org/W4406410275","https://openalex.org/W4406580760","https://openalex.org/W4409114333","https://openalex.org/W4412185690","https://openalex.org/W4412190218","https://openalex.org/W4413323615","https://openalex.org/W4414928818","https://openalex.org/W7092283041"],"related_works":[],"abstract_inverted_index":{"In":[0],"the":[1,123],"rapidly":[2],"evolving":[3,34,168],"cybersecurity":[4],"landscape,":[5],"Advanced":[6],"Persistent":[7],"Threats":[8],"(APTs)":[9],"pose":[10],"major":[11],"challenges":[12],"due":[13],"to":[14,49],"their":[15],"stealthy":[16],"and":[17,33,45,81,85,88,103,133,139,156,162,167],"adaptive":[18,58],"behavior.":[19],"Traditional":[20],"detection":[21,60],"methods":[22],"based":[23],"on":[24,112],"signatures":[25],"or":[26],"heuristics":[27],"are":[28],"limited":[29],"in":[30,136],"identifying":[31],"novel":[32],"attacks,":[35],"while":[36],"static":[37,132],"deep":[38],"learning":[39,71,151],"models":[40],"suffer":[41],"from":[42,75],"concept":[43],"drift":[44],"catastrophic":[46],"forgetting,":[47],"leading":[48],"degraded":[50],"performance":[51],"over":[52],"time.":[53],"This":[54],"paper":[55],"proposes":[56],"an":[57,77],"APT":[59,119],"framework":[61],"that":[62,122,145],"integrates":[63],"Graph":[64],"Neural":[65],"Networks":[66],"(GNNs)":[67],"with":[68,117,149],"rehearsal-based":[69],"continual":[70,150],"using":[72],"telemetry":[73,93,115],"data":[74],"Wazuh,":[76],"open-source":[78],"Security":[79],"Information":[80],"Event":[82],"Management":[83],"(SIEM)":[84],"Endpoint":[86,92],"Detection":[87],"Response":[89],"(EDR)":[90],"platform.":[91],"is":[94],"represented":[95],"as":[96],"graphs":[97],"where":[98],"nodes":[99],"denote":[100],"system":[101],"components":[102],"edges":[104],"describe":[105],"behavioral":[106],"interactions":[107],"among":[108],"them.":[109],"Experimental":[110],"evaluations":[111],"real-world":[113],"Wazuh":[114],"augmented":[116],"sandbox-executed":[118],"scenarios":[120],"demonstrate":[121],"proposed":[124],"approach":[125],"consistently":[126],"achieves":[127],"F1-scores":[128],"above":[129],"0.98,":[130],"outperforming":[131],"fine-tuned":[134],"baselines":[135],"both":[137],"adaptability":[138],"knowledge":[140],"retention.":[141],"These":[142],"results":[143],"confirm":[144],"combining":[146],"graph-based":[147],"representations":[148],"offers":[152],"a":[153],"scalable,":[154],"interpretable,":[155],"resilient":[157],"solution":[158],"for":[159],"modern":[160],"SOC":[161],"EDR":[163],"environments":[164],"facing":[165],"advanced":[166],"cyber":[169],"threats.":[170]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-12-02T00:00:00"}