{"id":"https://openalex.org/W4408353041","doi":"https://doi.org/10.1109/icassp49660.2025.10890506","title":"RAS-GNN: Reconstructing APT Attack Scenario Using Graph Neural Network","display_name":"RAS-GNN: Reconstructing APT Attack Scenario Using Graph Neural Network","publication_year":2025,"publication_date":"2025-03-12","ids":{"openalex":"https://openalex.org/W4408353041","doi":"https://doi.org/10.1109/icassp49660.2025.10890506"},"language":"en","primary_location":{"id":"doi:10.1109/icassp49660.2025.10890506","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icassp49660.2025.10890506","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5115593935","display_name":"Zhicheng Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhicheng Huang","raw_affiliation_strings":["Peking University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100338658","display_name":"Ping Wang","orcid":"https://orcid.org/0000-0002-4716-5457"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ping Wang","raw_affiliation_strings":["Peking University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University","institution_ids":["https://openalex.org/I20231570"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I20231570"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"5"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9456999897956848,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9456999897956848,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7153840065002441},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.506381630897522},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3029244840145111}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7153840065002441},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.506381630897522},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3029244840145111}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icassp49660.2025.10890506","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icassp49660.2025.10890506","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320337504","display_name":"Research and Development","ror":"https://ror.org/027s68j25"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":17,"referenced_works":["https://openalex.org/W2560810941","https://openalex.org/W2962703433","https://openalex.org/W2964732194","https://openalex.org/W2978956219","https://openalex.org/W2998038410","https://openalex.org/W3005127313","https://openalex.org/W3008508243","https://openalex.org/W3016038045","https://openalex.org/W3158906645","https://openalex.org/W3211430557","https://openalex.org/W3214329506","https://openalex.org/W4210803071","https://openalex.org/W4328028676","https://openalex.org/W4392173849","https://openalex.org/W4392173855","https://openalex.org/W6743841043","https://openalex.org/W6793953445"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"As":[0],"a":[1,30,99,172],"kind":[2],"of":[3,33,43,59,75,85,121,164],"multi-step":[4],"attack,":[5],"the":[6,41,57,64,110,119,132],"APT":[7,23,47,60,65,111,142,146,151,157],"attack":[8,66,86,112,122,147,152,178],"is":[9,51],"long-term,":[10],"highly":[11],"hidden,":[12],"and":[13,20,36,62,70,80,124,130,144,162],"usually":[14],"exploits":[15],"novel":[16],"vulnerabilities.":[17],"To":[18],"detect":[19,141,156],"respond":[21],"to":[22,28,39,55,108,140],"attacks,":[24],"security":[25],"analysts":[26],"need":[27],"analyze":[29],"large":[31],"number":[32],"system":[34],"logs":[35],"network":[37,102],"traffic":[38],"determine":[40],"sequence":[42,58],"activities":[44],"executed":[45],"by":[46],"attacks.":[48],"Provenance":[49],"graph":[50,90,100],"an":[52,105],"effective":[53],"approach":[54],"determining":[56],"attacks":[61,143,158],"reconstructing":[63],"scenario":[67,179],"for":[68],"detection":[69,84],"defense.":[71],"However,":[72],"its":[73],"weakness":[74],"relying":[76],"on":[77,149],"prior":[78,115],"knowledge":[79],"difficulty":[81],"in":[82,91,127],"fine-grained":[83],"behavior":[87],"hinder":[88],"provenance":[89,128],"practice.":[92],"In":[93],"this":[94],"paper,":[95],"we":[96],"propose":[97],"RAS-GNN,":[98],"neural":[101],"framework":[103],"with":[104,159],"attention":[106],"mechanism":[107],"reconstruct":[109,145],"scenario,":[113],"without":[114],"knowledge.":[116],"We":[117,136],"embed":[118],"attributes":[120],"nodes":[123],"their":[125],"edges":[126],"graph,":[129],"use":[131],"state":[133],"transition":[134],"information.":[135],"evaluated":[137],"RAS-GNN\u2019s":[138],"ability":[139,175],"scenarios":[148],"10":[150],"scenarios.":[153],"RAS-GNN":[154],"can":[155],"precision,":[160],"recall,":[161],"F1-score":[163],"95.32%,":[165],"99.12%,":[166],"97.09%,":[167],"respectively.":[168],"Moreover,":[169],"it":[170],"has":[171],"higher":[173],"reconstruction":[174,180],"than":[176],"other":[177],"methods.":[181]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}