{"id":"https://openalex.org/W4415222937","doi":"https://doi.org/10.1109/cns66487.2025.11195068","title":"CAPTure: Classifying APT Stages and Techniques via Graph-Enhanced Network Flow Representations","display_name":"CAPTure: Classifying APT Stages and Techniques via Graph-Enhanced Network Flow Representations","publication_year":2025,"publication_date":"2025-09-08","ids":{"openalex":"https://openalex.org/W4415222937","doi":"https://doi.org/10.1109/cns66487.2025.11195068"},"language":"en","primary_location":{"id":"doi:10.1109/cns66487.2025.11195068","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11195068","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037315126","display_name":"Mohammad Nadim","orcid":"https://orcid.org/0000-0001-8436-5178"},"institutions":[{"id":"https://openalex.org/I78715868","display_name":"University of Arkansas at Fayetteville","ror":"https://ror.org/05jbt9m15","country_code":"US","type":"education","lineage":["https://openalex.org/I78715868"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Md Taef Uddin Nadim","raw_affiliation_strings":["University of Arkansas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arkansas","institution_ids":["https://openalex.org/I78715868"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101927781","display_name":"Qinghua Li","orcid":"https://orcid.org/0000-0002-7734-6216"},"institutions":[{"id":"https://openalex.org/I78715868","display_name":"University of Arkansas at Fayetteville","ror":"https://ror.org/05jbt9m15","country_code":"US","type":"education","lineage":["https://openalex.org/I78715868"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qinghua Li","raw_affiliation_strings":["University of Arkansas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arkansas","institution_ids":["https://openalex.org/I78715868"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I78715868"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9350000023841858,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9350000023841858,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.9280999898910522,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.9024999737739563},{"id":"https://openalex.org/keywords/undersampling","display_name":"Undersampling","score":0.5486000180244446},{"id":"https://openalex.org/keywords/attack-model","display_name":"Attack model","score":0.4925000071525574},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.4489000141620636},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.40610000491142273},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.3926999866962433},{"id":"https://openalex.org/keywords/side-channel-attack","display_name":"Side channel attack","score":0.3508000075817108}],"concepts":[{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.9024999737739563},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7560999989509583},{"id":"https://openalex.org/C136536468","wikidata":"https://www.wikidata.org/wiki/Q1225894","display_name":"Undersampling","level":2,"score":0.5486000180244446},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5073000192642212},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.4925000071525574},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4814000129699707},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4555000066757202},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.4489000141620636},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.40610000491142273},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3926999866962433},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.3508000075817108},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3479999899864197},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.3411000072956085},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.33570000529289246},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.27810001373291016},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.2621000111103058},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C116409475","wikidata":"https://www.wikidata.org/wiki/Q1385056","display_name":"External Data Representation","level":2,"score":0.25200000405311584}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cns66487.2025.11195068","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11195068","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W2132022337","https://openalex.org/W2591712613","https://openalex.org/W2910711617","https://openalex.org/W2962703433","https://openalex.org/W2998038410","https://openalex.org/W3130970113","https://openalex.org/W3133235094","https://openalex.org/W4248336048","https://openalex.org/W4294238081","https://openalex.org/W4312362177","https://openalex.org/W4323321528","https://openalex.org/W4377968460","https://openalex.org/W4388481469","https://openalex.org/W4388894090","https://openalex.org/W4390446269","https://openalex.org/W4392182086","https://openalex.org/W4395020987","https://openalex.org/W4402265033","https://openalex.org/W4403937410","https://openalex.org/W4404013234","https://openalex.org/W4404452292","https://openalex.org/W4406892542","https://openalex.org/W4408383748"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"are":[4],"complex,":[5],"stealthy":[6],"attacks":[7],"that":[8,191],"involve":[9],"multiple":[10],"stages":[11,64,102,196],"and":[12,52,75,103,111,133,148,167,178,197],"many":[13,27],"attack":[14,55,72,104,114,168,182,198],"techniques":[15,199],"used":[16],"in":[17,217],"each":[18],"stage,":[19],"making":[20,219],"them":[21,34,70],"difficult":[22],"to":[23,99,115,126,144],"defend":[24],"against.":[25],"Although":[26],"solutions":[28,60],"can":[29,61,193],"detect":[30,36,100,194],"APTs,":[31],"most":[32],"of":[33,39,49,65,69,213,222],"only":[35],"the":[37,47,50,53,63,83,88,109,113,128],"existence":[38],"attack,":[40],"but":[41,67],"cannot":[42],"produce":[43],"fine-grained":[44],"classification":[45,84],"over":[46],"stage":[48,165],"APT":[51,101,164,188,195],"specific":[54],"technique":[56,73,125,169],"used.":[57],"Some":[58],"existing":[59,76],"classify":[62],"APT,":[66],"few":[68],"do":[71,78],"classification,":[74],"work":[77],"not":[79],"provide":[80,106],"interpretability":[81,107,177],"for":[82,87,108,151,163,176,181],"or":[85],"countermeasures":[86],"attack.":[89],"In":[90],"this":[91],"paper,":[92],"we":[93,120,156],"propose":[94],"a":[95,122,134,159,210],"solution":[96],"named":[97],"CAPTure,":[98],"techniques,":[105],"detection,":[110,170,218],"map":[112],"MITRE":[116],"D3FEND":[117],"countermeasures.":[118],"Specifically,":[119],"introduce":[121],"selective":[123],"undersampling":[124],"address":[127],"imbalanced":[129],"data":[130],"distribution":[131],"problem,":[132],"hybrid":[135],"graph":[136],"representation":[137],"concatenated":[138],"with":[139,201],"numerical":[140],"flow":[141],"statistics":[142],"features":[143],"capture":[145],"both":[146],"structural":[147],"quantitative":[149],"contexts":[150],"detection.":[152,224],"Leveraging":[153],"these":[154],"features,":[155],"further":[157],"design":[158],"stacked":[160],"hierarchical":[161],"classifier":[162],"detection":[166],"followed":[171],"by":[172],"feature":[173],"importance":[174],"generation":[175],"countermeasure":[179],"mapping":[180],"mitigation.":[183],"Evaluations":[184],"on":[185],"two":[186],"open-source":[187],"datasets":[189],"show":[190],"CAPTure":[192],"accurately,":[200],"higher":[202],"performance":[203],"than":[204],"baseline":[205],"schemes.":[206],"It":[207],"also":[208],"has":[209],"short":[211],"latency":[212],"below":[214],"1.25":[215],"seconds":[216],"it":[220],"capable":[221],"real-time":[223]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-16T00:00:00"}