{"id":"https://openalex.org/W7091373197","doi":"https://doi.org/10.1109/cns66487.2025.11194953","title":"Anticipating the Evolution of APT Variants Using Generative AI and Reinforcement Learning","display_name":"Anticipating the Evolution of APT Variants Using Generative AI and Reinforcement Learning","publication_year":2025,"publication_date":"2025-09-08","ids":{"openalex":"https://openalex.org/W7091373197","doi":"https://doi.org/10.1109/cns66487.2025.11194953"},"language":"en","primary_location":{"id":"doi:10.1109/cns66487.2025.11194953","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11194953","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Osama Iskandarani","orcid":null},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Osama Iskandarani","raw_affiliation_strings":["Concordia University,Montr&#x00E9;al,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montr&#x00E9;al,Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Boubakr Nour","orcid":null},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Boubakr Nour","raw_affiliation_strings":["Ericsson Security Research,Montr&#x00E9;al,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ericsson Security Research,Montr&#x00E9;al,Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Makan Pourzandi","orcid":null},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Makan Pourzandi","raw_affiliation_strings":["Ericsson Security Research,Montr&#x00E9;al,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ericsson Security Research,Montr&#x00E9;al,Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Mourad Debbabi","orcid":null},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["Concordia University,Montr&#x00E9;al,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montr&#x00E9;al,Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"last","author":{"id":null,"display_name":"Chadi Assi","orcid":null},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Chadi Assi","raw_affiliation_strings":["Concordia University,Montr&#x00E9;al,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montr&#x00E9;al,Canada","institution_ids":["https://openalex.org/I60158472"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4999000132083893,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4999000132083893,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.10379999876022339,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.09950000047683716,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.8141999840736389},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6606000065803528},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6560999751091003},{"id":"https://openalex.org/keywords/discriminator","display_name":"Discriminator","score":0.6348999738693237},{"id":"https://openalex.org/keywords/generative-grammar","display_name":"Generative grammar","score":0.5415999889373779},{"id":"https://openalex.org/keywords/generator","display_name":"Generator (circuit theory)","score":0.531499981880188}],"concepts":[{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.8141999840736389},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7454000115394592},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6606000065803528},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6560999751091003},{"id":"https://openalex.org/C2779803651","wikidata":"https://www.wikidata.org/wiki/Q5282088","display_name":"Discriminator","level":3,"score":0.6348999738693237},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.5415999889373779},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5325000286102295},{"id":"https://openalex.org/C2780992000","wikidata":"https://www.wikidata.org/wiki/Q17016113","display_name":"Generator (circuit theory)","level":3,"score":0.531499981880188},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5034000277519226},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.5012000203132629},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4311000108718872},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.4043999910354614},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.35530000925064087},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3100000023841858},{"id":"https://openalex.org/C2988773926","wikidata":"https://www.wikidata.org/wiki/Q25104379","display_name":"Generative adversarial network","level":3,"score":0.2847999930381775}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cns66487.2025.11194953","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11194953","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Reduced inequalities","id":"https://metadata.un.org/sdg/10","score":0.6551680564880371}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W2963241486","https://openalex.org/W2964268978","https://openalex.org/W4221077261","https://openalex.org/W4281398200","https://openalex.org/W4385819961","https://openalex.org/W4393034384","https://openalex.org/W4399666416","https://openalex.org/W4402957761","https://openalex.org/W4408519585","https://openalex.org/W4411446663"],"related_works":[],"abstract_inverted_index":{"The":[0,49,144,161,216],"cyber":[1],"threat":[2,12,183],"landscape":[3],"is":[4,105,163],"witnessing":[5],"a":[6,137,141,167,172,177,188,194],"diverse":[7],"and":[8,33,41,100,118,140,192,212,239],"widespread":[9],"evolution":[10,50],"in":[11,29],"actors'":[13],"strategies,":[14],"especially":[15],"at":[16],"the":[17,42,85,110,120,147,152,156],"level":[18],"of":[19,45,51,123,134,190,226],"Advanced":[20],"Persistent":[21],"Threats":[22],"(APTs).":[23],"Current":[24],"solutions":[25],"often":[26],"fall":[27],"behind":[28],"detecting":[30],"these":[31],"new":[32],"sophisticated":[34],"attacks":[35],"due":[36],"to":[37,115],"their":[38],"stealthy":[39],"nature":[40],"evolving":[43],"use":[44],"variant":[46,90,149],"attack":[47,59],"methods.":[48],"APT":[52,81,199,228],"variants":[53,82,225],"causes":[54],"challenges":[55],"by":[56,83,166],"introducing":[57],"inconsiderate":[58],"patterns,":[60],"for":[61],"which":[62,132],"most":[63,157],"security":[64,121],"defense":[65],"systems":[66],"are":[67],"not":[68],"prepared.":[69],"In":[70],"this":[71],"paper,":[72],"we":[73,186],"introduce":[74],"APTMORPH,":[75],"an":[76,128,213],"automated":[77],"solution":[78],"that":[79,92,220],"generates":[80,146],"anticipating":[84],"next":[86],"<tex":[87],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[88],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">$n$</tex>":[89],"techniques":[91,150,159],"can":[93,222],"occur":[94],"using":[95,107,171,197],"Generative":[96],"Adversarial":[97,129],"Network":[98],"(GAN)":[99],"Reinforcement":[101,173],"Learning":[102,130,174],"(RL).":[103],"APTMORPH":[104,126,221],"trained":[106],"APTs":[108,214],"from":[109,203],"MITRE":[111,204],"ATT&CK":[112],"knowledge":[113],"base":[114],"learn,":[116],"augment,":[117],"evaluate":[119],"context":[122],"anticipated":[124],"techniques.":[125],"integrates":[127],"Loop,":[131],"consists":[133],"two":[135],"modules:":[136],"Technique":[138,142],"Generator":[139],"Discriminator.":[143],"generator":[145],"possible":[148],"while":[151],"discriminator":[153],"ensures":[154],"only":[155],"relevant":[158,224],"remain.":[160],"process":[162],"also":[164],"supported":[165],"Security":[168],"Context":[169],"Evaluator":[170],"Loop":[175],"via":[176],"Monte-Carlo":[178],"rollouts":[179],"method.":[180],"Assisted":[181],"with":[182,230,242],"hunting":[184],"practitioners,":[185],"built":[187],"Proof":[189],"Concept":[191],"conducted":[193],"rigorous":[195],"evaluation":[196],"global":[198],"campaigns,":[200],"public":[201,206,243],"campaigns":[202,229],"ATT&CK,":[205],"Cyber":[207],"Threat":[208],"Intelligence":[209],"(CTI)":[210],"reports,":[211],"dataset.":[215],"obtained":[217],"results":[218],"confirm":[219],"generate":[223],"real-world":[227],"\u224890%":[231],"technique":[232],"similarity":[233,241],"ratio,":[234,238],"\u224883%":[235],"common":[236],"tactic":[237],"\u224880%":[240],"CTI.":[244],"APTMORPH'S":[245],"Demo:":[246],"https://youtu.be/pObO4uJv3XY":[247]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-16T00:00:00"}