{"id":"https://openalex.org/W7167113830","doi":"https://doi.org/10.1109/access.2026.3709714","title":"APT-CGSV: APT Detection via Contrastive GNNs and Semantic Validation","display_name":"APT-CGSV: APT Detection via Contrastive GNNs and Semantic Validation","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7167113830","doi":"https://doi.org/10.1109/access.2026.3709714"},"language":"en","primary_location":{"id":"doi:10.1109/access.2026.3709714","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3709714","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3709714","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5112641272","display_name":"Ali Shoukat","orcid":null},"institutions":[{"id":"https://openalex.org/I168635309","display_name":"University of Calgary","ror":"https://ror.org/03yjb2x39","country_code":"CA","type":"education","lineage":["https://openalex.org/I168635309"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Ali Shoukat","raw_affiliation_strings":["University of Calgary"],"raw_orcid":"https://orcid.org/0009-0006-5486-9870","affiliations":[{"raw_affiliation_string":"University of Calgary","institution_ids":["https://openalex.org/I168635309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087812213","display_name":"Rubina Akter","orcid":"https://orcid.org/0000-0003-3619-1534"},"institutions":[{"id":"https://openalex.org/I168635309","display_name":"University of Calgary","ror":"https://ror.org/03yjb2x39","country_code":"CA","type":"education","lineage":["https://openalex.org/I168635309"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Rubina Akter","raw_affiliation_strings":["University of Calgary"],"raw_orcid":"https://orcid.org/0000-0003-3619-1534","affiliations":[{"raw_affiliation_string":"University of Calgary","institution_ids":["https://openalex.org/I168635309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102945288","display_name":"Hadis Karimipour","orcid":"https://orcid.org/0000-0001-7948-4033"},"institutions":[{"id":"https://openalex.org/I168635309","display_name":"University of Calgary","ror":"https://ror.org/03yjb2x39","country_code":"CA","type":"education","lineage":["https://openalex.org/I168635309"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Hadis Karimipour","raw_affiliation_strings":["University of Calgary"],"raw_orcid":"https://orcid.org/0000-0001-7948-4033","affiliations":[{"raw_affiliation_string":"University of Calgary","institution_ids":["https://openalex.org/I168635309"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5073867210","display_name":"Fattane Zarrinkalam","orcid":"https://orcid.org/0000-0002-2102-9190"},"institutions":[{"id":"https://openalex.org/I79817857","display_name":"University of Guelph","ror":"https://ror.org/01r7awg59","country_code":"CA","type":"education","lineage":["https://openalex.org/I79817857"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Fattane Zarrinkalam","raw_affiliation_strings":["University of Guelph"],"raw_orcid":"https://orcid.org/0000-0002-2102-9190","affiliations":[{"raw_affiliation_string":"University of Guelph","institution_ids":["https://openalex.org/I79817857"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.83111064,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":null,"first_page":"110052","last_page":"110068"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.43549999594688416,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.43549999594688416,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.08429999649524689,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.07810000330209732,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.3653999865055084},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.28690001368522644},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.24150000512599945},{"id":"https://openalex.org/keywords/semantic-similarity","display_name":"Semantic similarity","score":0.23319999873638153}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8216999769210815},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6365000009536743},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.5605000257492065},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.3653999865055084},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.28690001368522644},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.27090001106262207},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.24150000512599945},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.23569999635219574},{"id":"https://openalex.org/C130318100","wikidata":"https://www.wikidata.org/wiki/Q2268914","display_name":"Semantic similarity","level":2,"score":0.23319999873638153},{"id":"https://openalex.org/C197914299","wikidata":"https://www.wikidata.org/wiki/Q18650","display_name":"Semantic memory","level":3,"score":0.2160000056028366}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2026.3709714","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3709714","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:3f8e9293f810411a9e1efe27a76574d6","is_oa":false,"landing_page_url":"https://doaj.org/article/3f8e9293f810411a9e1efe27a76574d6","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 14, Pp 110052-110068 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3709714","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3709714","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"increasingly":[4],"employ":[5],"“Living-off-the-Land”":[6],"techniques,":[7],"rendering":[8],"traditional":[9],"signature-based":[10],"detection":[11],"ineffective.":[12],"While":[13],"query-based":[14],"threat":[15],"hunting":[16],"using":[17,199],"system":[18],"provenance":[19],"graphs":[20],"provides":[21],"essential":[22],"behavioral":[23,186],"context,":[24,78],"existing":[25,137,221],"approaches,":[26,140],"specifically":[27],"Graph":[28,107],"Neural":[29],"Network":[30,109],"(GNN)":[31],"based":[32],"methods,":[33],"can":[34],"suffer":[35],"from":[36,204],"a":[37,88,97,104,116,122,175,241],"critical":[38],"vulnerability":[39],"to":[40,61,68,147,154,220],"structural":[41,118,160],"mimicry,":[42],"where":[43],"benign":[44,159],"administrative":[45],"tasks":[46],"topologically":[47],"resemble":[48],"malicious":[49],"campaigns.":[50],"Large":[51],"Language":[52],"Models":[53],"(LLMs)":[54],"offer":[55],"the":[56,158,168,205,226,233],"deep":[57],"semantic":[58,189,234],"reasoning":[59],"required":[60],"resolve":[62],"this":[63,84,94],"ambiguity,":[64],"but":[65],"applying":[66],"them":[67],"raw":[69],"enterprise":[70],"logs":[71],"is":[72,130,172],"constrained":[73,183],"by":[74,136,174],"prohibitive":[75],"latency,":[76],"limited":[77],"and":[79,150,182,208,216,245],"data":[80,227],"privacy":[81],"constraints.":[82],"In":[83],"paper,":[85],"we":[86,239],"propose":[87],"novel":[89],"neuro-symbolic":[90],"framework":[91,212],"that":[92],"bridges":[93],"gap":[95],"via":[96],"highly":[98,243],"efficient":[99,246],"two-stage":[100],"cascade":[101],"architecture.":[102],"First,":[103],"self-supervised":[105],"contrastive":[106,230],"Isomorphism":[108],"with":[110,232],"Edge":[111],"features":[112],"(GINE)":[113],"acts":[114],"as":[115,218],"high-recall":[117],"filter.":[119],"Trained":[120],"on":[121],"curated":[123,164,201],"dataset":[124],"of":[125,157,229,236],"just":[126],"24,000":[127],"subgraphs,":[128],"which":[129],"much":[131],"smaller":[132],"than":[133],"those":[134],"used":[135],"supervised":[138],"learning-based":[139],"our":[141,163,200,211],"encoder":[142],"learns":[143],"robust":[144],"representations":[145],"resilient":[146],"graph":[148],"noise":[149],"successfully":[151],"eliminates":[152],"87%":[153],"over":[155],"99%":[156],"mimics":[161],"in":[162],"test":[165,202],"sets.":[166],"Second,":[167],"reduced":[169],"candidate":[170],"set":[171],"processed":[173],"localized":[176,237],"LLM":[177],"utilizing":[178],"deterministic":[179],"artifact":[180],"matching":[181,187],"Chain-of-Thought":[184],"(CoT)":[185],"for":[188],"reasoning.":[190],"Evaluated":[191],"across":[192],"diverse":[193],"operating":[194],"systems":[195],"(Windows,":[196],"Linux,":[197],"FreeBSD)":[198],"sets":[203],"DARPA":[206],"TC3":[207],"OpTC":[209],"datasets,":[210],"achieves":[213],"superior":[214],"precision":[215],"F1-scores":[217],"compared":[219],"baseline":[222],"systems.":[223],"By":[224],"combining":[225],"efficiency":[228],"GNNs":[231],"depth":[235],"LLMs,":[238],"provide":[240],"scalable,":[242],"accurate,":[244],"threat-hunting":[247],"solution.":[248]},"counts_by_year":[],"updated_date":"2026-07-26T07:53:14.480251","created_date":"2026-07-03T00:00:00"}