{"id":"https://openalex.org/W7125958181","doi":"https://doi.org/10.1109/commnet68224.2025.11288886","title":"Graph Neural Network Framework for Advanced Persistent Threat Detection in IIoT Environments","display_name":"Graph Neural Network Framework for Advanced Persistent Threat Detection in IIoT Environments","publication_year":2025,"publication_date":"2025-12-03","ids":{"openalex":"https://openalex.org/W7125958181","doi":"https://doi.org/10.1109/commnet68224.2025.11288886"},"language":null,"primary_location":{"id":"doi:10.1109/commnet68224.2025.11288886","is_oa":false,"landing_page_url":"https://doi.org/10.1109/commnet68224.2025.11288886","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 8th International Conference on Advanced Communication Technologies and Networking (CommNet)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120734714","display_name":"Kaouthar Merzouki","orcid":null},"institutions":[{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]},{"id":"https://openalex.org/I39481719","display_name":"Institut National de la Recherche Scientifique","ror":"https://ror.org/04td37d32","country_code":"CA","type":"education","lineage":["https://openalex.org/I39481719","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Kaouthar Merzouki","raw_affiliation_strings":["INRS-EMT, UMR INRS-UQO,Gatineau,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INRS-EMT, UMR INRS-UQO,Gatineau,Canada","institution_ids":["https://openalex.org/I33217400","https://openalex.org/I39481719"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070411533","display_name":"Youssef Hadi","orcid":"https://orcid.org/0000-0003-1810-6877"},"institutions":[{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]},{"id":"https://openalex.org/I39481719","display_name":"Institut National de la Recherche Scientifique","ror":"https://ror.org/04td37d32","country_code":"CA","type":"education","lineage":["https://openalex.org/I39481719","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Youssef Hadi","raw_affiliation_strings":["INRS-EMT, UMR INRS-UQO,Gatineau,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INRS-EMT, UMR INRS-UQO,Gatineau,Canada","institution_ids":["https://openalex.org/I33217400","https://openalex.org/I39481719"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071435618","display_name":"Hassan Elghazi","orcid":null},"institutions":[{"id":"https://openalex.org/I4210153527","display_name":"Institut National des Postes et T\u00e9l\u00e9communications","ror":"https://ror.org/052bnvt46","country_code":"MA","type":"education","lineage":["https://openalex.org/I4210153527","https://openalex.org/I4210167103"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Hassan Elghazi","raw_affiliation_strings":["Institute of Posts and Telecommunications,Rabat,Morocco,10140"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Posts and Telecommunications,Rabat,Morocco,10140","institution_ids":["https://openalex.org/I4210153527"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027414521","display_name":"Hajar Moudoud","orcid":"https://orcid.org/0000-0003-2979-0862"},"institutions":[{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Hajar Moudoud","raw_affiliation_strings":["Université du Québec en Outaouais,Département D’Informatique et D’Ingénierie,Gatineau,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Université du Québec en Outaouais,Département D’Informatique et D’Ingénierie,Gatineau,Canada","institution_ids":["https://openalex.org/I33217400"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5122147154","display_name":"Zakaria Abou El Houda","orcid":null},"institutions":[{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]},{"id":"https://openalex.org/I39481719","display_name":"Institut National de la Recherche Scientifique","ror":"https://ror.org/04td37d32","country_code":"CA","type":"education","lineage":["https://openalex.org/I39481719","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Zakaria Abou El Houda","raw_affiliation_strings":["INRS-EMT, UMR INRS-UQO,Gatineau,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INRS-EMT, UMR INRS-UQO,Gatineau,Canada","institution_ids":["https://openalex.org/I33217400","https://openalex.org/I39481719"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.61390905,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.48420000076293945,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.48420000076293945,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.16009999811649323,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.06759999692440033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5059000253677368},{"id":"https://openalex.org/keywords/industrial-internet","display_name":"Industrial Internet","score":0.5031999945640564},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.48980000615119934},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.44449999928474426},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.436599999666214},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.42750000953674316},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.41530001163482666}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7825999855995178},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5331000089645386},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5059000253677368},{"id":"https://openalex.org/C202839342","wikidata":"https://www.wikidata.org/wiki/Q60740481","display_name":"Industrial Internet","level":3,"score":0.5031999945640564},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.48980000615119934},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.44449999928474426},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.44179999828338623},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.436599999666214},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.42750000953674316},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.41530001163482666},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.34049999713897705},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3296999931335449},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.32109999656677246},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3165000081062317},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.31619998812675476},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.29840001463890076},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2957000136375427},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.27730000019073486},{"id":"https://openalex.org/C193415008","wikidata":"https://www.wikidata.org/wiki/Q639681","display_name":"Network architecture","level":2,"score":0.2603999972343445},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.25060001015663147}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/commnet68224.2025.11288886","is_oa":false,"landing_page_url":"https://doi.org/10.1109/commnet68224.2025.11288886","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 8th International Conference on Advanced Communication Technologies and Networking (CommNet)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.6457534432411194,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0,80,106],"increasing":[1],"reliance":[2],"of":[3,10,149,165],"industrial":[4],"infrastructures":[5],"on":[6,55],"the":[7,70,147,162],"Industrial":[8],"Internet":[9],"Things":[11],"(IIoT)":[12],"has":[13],"made":[14],"them":[15],"more":[16],"vulnerable":[17],"to":[18,116,156],"complex":[19],"cyberattacks,":[20],"especially":[21],"Advanced":[22],"Persistent":[23],"Threats":[24],"(APTs).":[25],"To":[26],"recognize":[27],"and":[28,42,62,87,92,102,113,123,136],"analyze":[29],"these":[30],"multi-stage":[31],"incursions,":[32],"we":[33],"require":[34],"computational":[35],"models":[36,82],"that":[37,128],"can":[38],"capture":[39],"both":[40],"structural":[41],"temporal":[43],"connections":[44],"in":[45,65,94,140],"IIoT":[46,66,158],"network":[47,85],"architectures.":[48],"This":[49,144],"paper":[50,145],"presents":[51],"a":[52,95],"framework":[53],"based":[54],"Graph":[56],"Neural":[57],"Networks":[58],"(GNNs)":[59],"for":[60,99],"detecting":[61],"classifying":[63],"APTs":[64],"settings.":[67],"We":[68],"use":[69],"CICAPT-IIoT2024":[71],"dataset,":[72],"which":[73],"provides":[74],"realistic":[75],"multi-phase":[76],"APT":[77],"attack":[78,118],"scenarios.":[79],"approach":[81],"system":[83],"components,":[84],"communications,":[86],"process":[88],"interactions":[89],"as":[90,152],"nodes":[91],"edges":[93],"dynamic":[96],"graph,":[97],"allowing":[98],"relational":[100],"learning":[101,134,151],"context-aware":[103],"feature":[104],"extraction.":[105],"GNN":[107],"architecture":[108],"leverages":[109],"graph":[110],"connectivity":[111],"patterns":[112],"message-passing":[114],"techniques":[115,135],"identify":[117],"phases":[119],"with":[120],"greater":[121],"accuracy":[122],"robustness.":[124],"Experimental":[125],"results":[126],"show":[127],"this":[129],"method":[130],"outperforms":[131],"traditional":[132],"deep":[133],"ensemble":[137],"methods,":[138],"particularly":[139],"early-stage":[141],"anomaly":[142],"detection.":[143],"highlights":[146],"potential":[148],"graph-based":[150],"an":[153],"effective":[154],"way":[155],"enhance":[157],"infrastructure":[159],"security":[160],"against":[161],"changing":[163],"behaviors":[164],"advanced":[166],"persistent":[167],"threats.":[168]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-01-29T00:00:00"}