{"id":"https://openalex.org/W4411551619","doi":"https://doi.org/10.1109/cscwd64889.2025.11033299","title":"DygLM: Detecting Lateral Movement Threat via Continuous-time Dynamic Graph Learning","display_name":"DygLM: Detecting Lateral Movement Threat via Continuous-time Dynamic Graph Learning","publication_year":2025,"publication_date":"2025-05-05","ids":{"openalex":"https://openalex.org/W4411551619","doi":"https://doi.org/10.1109/cscwd64889.2025.11033299"},"language":"en","primary_location":{"id":"doi:10.1109/cscwd64889.2025.11033299","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cscwd64889.2025.11033299","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 28th International Conference on Computer Supported Cooperative Work in Design (CSCWD)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100442484","display_name":"Renjie Li","orcid":"https://orcid.org/0000-0002-0860-4760"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Renjie Li","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100359912","display_name":"Zhou Zhou","orcid":"https://orcid.org/0000-0001-6924-5848"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhou Zhou","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037991940","display_name":"Guo Jiang","orcid":"https://orcid.org/0000-0002-0083-7738"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiang Guo","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100638558","display_name":"Zhongyi Zhang","orcid":"https://orcid.org/0000-0002-8758-1949"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhongyi Zhang","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100713362","display_name":"Qingyun Liu","orcid":"https://orcid.org/0000-0003-4815-3463"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qingyun Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2575","last_page":"2580"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10429","display_name":"EEG and Brain-Computer Interfaces","score":0.9110000133514404,"subfield":{"id":"https://openalex.org/subfields/2805","display_name":"Cognitive Neuroscience"},"field":{"id":"https://openalex.org/fields/28","display_name":"Neuroscience"},"domain":{"id":"https://openalex.org/domains/1","display_name":"Life Sciences"}},"topics":[{"id":"https://openalex.org/T10429","display_name":"EEG and Brain-Computer Interfaces","score":0.9110000133514404,"subfield":{"id":"https://openalex.org/subfields/2805","display_name":"Cognitive Neuroscience"},"field":{"id":"https://openalex.org/fields/28","display_name":"Neuroscience"},"domain":{"id":"https://openalex.org/domains/1","display_name":"Life Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7238069772720337},{"id":"https://openalex.org/keywords/movement","display_name":"Movement (music)","score":0.4894358217716217},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4521321654319763},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4032563269138336},{"id":"https://openalex.org/keywords/computer-vision","display_name":"Computer vision","score":0.3265947699546814},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.24243170022964478}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7238069772720337},{"id":"https://openalex.org/C2780226923","wikidata":"https://www.wikidata.org/wiki/Q929848","display_name":"Movement (music)","level":2,"score":0.4894358217716217},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4521321654319763},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4032563269138336},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.3265947699546814},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.24243170022964478},{"id":"https://openalex.org/C107038049","wikidata":"https://www.wikidata.org/wiki/Q35986","display_name":"Aesthetics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cscwd64889.2025.11033299","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cscwd64889.2025.11033299","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 28th International Conference on Computer Supported Cooperative Work in Design (CSCWD)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":14,"referenced_works":["https://openalex.org/W2962703433","https://openalex.org/W2967841957","https://openalex.org/W2986944522","https://openalex.org/W3015650867","https://openalex.org/W3109841242","https://openalex.org/W3195954353","https://openalex.org/W3210361503","https://openalex.org/W3212868562","https://openalex.org/W4225697716","https://openalex.org/W4282963615","https://openalex.org/W4288057803","https://openalex.org/W4290877727","https://openalex.org/W4402263645","https://openalex.org/W4402264131"],"related_works":["https://openalex.org/W2772917594","https://openalex.org/W2036807459","https://openalex.org/W2058170566","https://openalex.org/W2755342338","https://openalex.org/W2166024367","https://openalex.org/W3116076068","https://openalex.org/W2229312674","https://openalex.org/W2951359407","https://openalex.org/W2079911747","https://openalex.org/W1969923398"],"abstract_inverted_index":{"In":[0,84],"an":[1,7,9,118],"advanced":[2],"persistent":[3],"threat":[4],"(APT)":[5],"targeting":[6],"enterprise,":[8],"adversary":[10],"attempts":[11],"to":[12,72,122,132,146],"move":[13],"through":[14],"the":[15,53,57,88,91,110,123,133,139,166,172,178,190],"network":[16,125],"environment":[17],"starting":[18],"from":[19,80],"their":[20],"initial":[21],"point,":[22],"which":[23,36,154],"is":[24,155],"known":[25],"as":[26,39,109,149,151],"Lateral":[27],"Movement":[28],"(LM).":[29],"Detecting":[30],"LM":[31,107,196],"typically":[32],"uses":[33],"authentication":[34,135],"logs,":[35],"are":[37],"modeled":[38],"dynamic":[40],"graphs":[41],"with":[42,105],"temporal":[43,152],"properties.":[44],"Most":[45],"prior":[46],"research":[47],"focuses":[48],"on":[49,100,184],"discrete":[50],"snapshots,":[51],"neglecting":[52],"evolving":[54,124],"nature":[55],"of":[56,90,174,192],"enterprise":[58],"network.":[59],"Recently,":[60],"some":[61],"researchers":[62],"have":[63],"proposed":[64],"continuous-time":[65,101,134],"graph":[66,102],"approaches.":[67],"However,":[68],"they":[69],"often":[70],"fail":[71],"fully":[73],"incorporate":[74],"security":[75],"domain":[76],"knowledge,":[77],"and":[78,143,200],"suffer":[79],"detection":[81,111,167],"target":[82,168],"bias.":[83],"this":[85],"paper,":[86],"given":[87],"limitations":[89],"above":[92],"approaches,":[93],"we":[94,137,188],"propose":[95],"DygLM,":[96],"a":[97,129],"framework":[98],"based":[99],"representation":[103],"learning":[104,116,159],"suspicious":[106],"events":[108,176],"target.":[112],"It":[113],"enables":[114],"self-supervised":[115],"in":[117,177,194,197],"attack-free":[119],"manner,":[120],"adapting":[121],"environment.":[126],"By":[127],"applying":[128],"well-designed":[130],"encoder":[131],"events,":[136],"encode":[138],"node-associated":[140],"neighbors,":[141],"edges,":[142],"time":[144],"intervals":[145],"obtain":[147],"topological":[148],"well":[150],"representation,":[153],"further":[156],"enhanced":[157],"by":[158,170],"long-term":[160],"correlations":[161],"using":[162],"Transformer.":[163],"We":[164],"address":[165],"bias":[169],"scoring":[171],"likelihood":[173],"malicious":[175],"evaluation":[179],"phase.":[180],"Through":[181],"extensive":[182],"experiments":[183],"two":[185],"large":[186],"datasets,":[187],"demonstrate":[189],"effectiveness":[191],"DygLM":[193],"detecting":[195],"both":[198],"transductive":[199],"inductive":[201],"settings.":[202]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}