{"id":"https://openalex.org/W7134958977","doi":"https://doi.org/10.1109/icdmw69685.2025.00146","title":"Enhancing Graph-Based Advanced Persistent Threat Detection with LLM Sentence Embedding","display_name":"Enhancing Graph-Based Advanced Persistent Threat Detection with LLM Sentence Embedding","publication_year":2025,"publication_date":"2025-11-12","ids":{"openalex":"https://openalex.org/W7134958977","doi":"https://doi.org/10.1109/icdmw69685.2025.00146"},"language":null,"primary_location":{"id":"doi:10.1109/icdmw69685.2025.00146","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icdmw69685.2025.00146","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE International Conference on Data Mining Workshops (ICDMW)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5032841459","display_name":"Shota Sakamaki","orcid":null},"institutions":[{"id":"https://openalex.org/I14396692","display_name":"Tokyo University of Information Sciences","ror":"https://ror.org/044bdx604","country_code":"JP","type":"education","lineage":["https://openalex.org/I14396692"]},{"id":"https://openalex.org/I74801974","display_name":"The University of Tokyo","ror":"https://ror.org/057zh3y96","country_code":"JP","type":"education","lineage":["https://openalex.org/I74801974"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Shota Sakamaki","raw_affiliation_strings":["The University of Tokyo,Department of Electrical Engineering and Information Systems,Tokyo,Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Tokyo,Department of Electrical Engineering and Information Systems,Tokyo,Japan","institution_ids":["https://openalex.org/I14396692","https://openalex.org/I74801974"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103213189","display_name":"Hiroki Kanezashi","orcid":"https://orcid.org/0000-0002-8329-6235"},"institutions":[{"id":"https://openalex.org/I74801974","display_name":"The University of Tokyo","ror":"https://ror.org/057zh3y96","country_code":"JP","type":"education","lineage":["https://openalex.org/I74801974"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Hiroki Kanezashi","raw_affiliation_strings":["The University of Tokyo,Information Technology Center,Tokyo,Japan"],"raw_orcid":"https://orcid.org/0000-0002-8329-6235","affiliations":[{"raw_affiliation_string":"The University of Tokyo,Information Technology Center,Tokyo,Japan","institution_ids":["https://openalex.org/I74801974"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011886931","display_name":"Toyotaro Suzumura","orcid":"https://orcid.org/0000-0001-6412-8386"},"institutions":[{"id":"https://openalex.org/I74801974","display_name":"The University of Tokyo","ror":"https://ror.org/057zh3y96","country_code":"JP","type":"education","lineage":["https://openalex.org/I74801974"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Toyotaro Suzumura","raw_affiliation_strings":["Graduate School of Information Science and Technology, The University of Tokyo,Tokyo,Japan"],"raw_orcid":"https://orcid.org/0000-0001-6412-8386","affiliations":[{"raw_affiliation_string":"Graduate School of Information Science and Technology, The University of Tokyo,Tokyo,Japan","institution_ids":["https://openalex.org/I74801974"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5128693934","display_name":"Tomohiro Kudoh","orcid":null},"institutions":[{"id":"https://openalex.org/I191055192","display_name":"Tokyo Kasei University","ror":"https://ror.org/05xbyzq55","country_code":"JP","type":"education","lineage":["https://openalex.org/I191055192"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Tomohiro Kudoh","raw_affiliation_strings":["The University of Tokyo,Information Technology Center,Kashiwa,Japan"],"raw_orcid":"https://orcid.org/0000-0002-5095-0368","affiliations":[{"raw_affiliation_string":"The University of Tokyo,Information Technology Center,Kashiwa,Japan","institution_ids":["https://openalex.org/I191055192"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1238","last_page":"1243"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11147","display_name":"Misinformation and Its Impacts","score":0.2020999938249588,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11147","display_name":"Misinformation and Its Impacts","score":0.2020999938249588,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.13529999554157257,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12262","display_name":"Hate Speech and Cyberbullying Detection","score":0.10589999705553055,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sentence","display_name":"Sentence","score":0.38199999928474426},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.3292999863624573},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.2953999936580658},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.26969999074935913},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.26010000705718994}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6294000148773193},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.531499981880188},{"id":"https://openalex.org/C2777530160","wikidata":"https://www.wikidata.org/wiki/Q41796","display_name":"Sentence","level":2,"score":0.38199999928474426},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.36550000309944153},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.3292999863624573},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.2953999936580658},{"id":"https://openalex.org/C28490314","wikidata":"https://www.wikidata.org/wiki/Q189436","display_name":"Speech recognition","level":1,"score":0.2888999879360199},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.26969999074935913},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26010000705718994},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.24879999458789825}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icdmw69685.2025.00146","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icdmw69685.2025.00146","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE International Conference on Data Mining Workshops (ICDMW)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4758479164","display_name":null,"funder_award_id":"25K21210","funder_id":"https://openalex.org/F4320320212","funder_display_name":"Japan Society for the Promotion of Science London"}],"funders":[{"id":"https://openalex.org/F4320320212","display_name":"Japan Society for the Promotion of Science London","ror":"https://ror.org/02m7axw05"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W2747669027","https://openalex.org/W2978956219","https://openalex.org/W3006711782","https://openalex.org/W3015650867","https://openalex.org/W3199174176","https://openalex.org/W4205965165","https://openalex.org/W4290876361","https://openalex.org/W4385605314","https://openalex.org/W4398160651","https://openalex.org/W4402265033"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threat":[2],"(APT)":[3],"attacks":[4],"represent":[5],"a":[6,19,33,49,59,80,158,167],"sophisticated":[7],"and":[8,138,151,170],"growing":[9],"danger":[10],"to":[11,35,64,105,145,185],"modern":[12],"information":[13,40],"systems.":[14],"While":[15],"provenance":[16],"graphs":[17],"are":[18],"promising":[20],"tool":[21],"for":[22],"detecting":[23],"these":[24],"complex":[25,191],"threats,":[26],"their":[27],"effectiveness":[28],"is":[29],"often":[30],"limited":[31],"by":[32,57,87],"failure":[34],"harness":[36],"the":[37,74,101,113,119,126,146,177,187],"rich":[38],"semantic":[39,67,181],"contained":[41],"within":[42],"raw":[43],"system":[44,70],"logs.":[45],"This":[46],"paper":[47],"proposes":[48],"novel":[50],"detection":[51,172,188],"framework":[52],"that":[53],"addresses":[54],"this":[55],"gap":[56],"leveraging":[58],"Large":[60],"Language":[61],"Model":[62],"(LLM)":[63],"embed":[65],"deep":[66],"meaning":[68],"from":[69,183],"logs":[71],"directly":[72],"into":[73],"graph's":[75,102],"features.":[76],"Our":[77],"approach":[78],"enhances":[79],"state-of-the-art":[81],"Graph":[82],"Neural":[83],"Network":[84],"(GNN)-based":[85],"method":[86,156],"replacing":[88],"its":[89],"simple":[90],"embedding":[91,97],"technique":[92],"with":[93],"an":[94,133,139],"LLM-based":[95],"sentence":[96],"method,":[98],"specifically":[99],"enriching":[100],"edge":[103],"features":[104],"capture":[106],"deeper":[107],"contextual":[108],"information.":[109],"Experimental":[110],"results":[111],"on":[112],"challenging":[114],"Unicorn":[115],"Wget":[116],"dataset":[117],"demonstrate":[118],"superiority":[120],"of":[121,135,141,163,179,189],"our":[122,155],"method.":[123],"It":[124],"surpassed":[125],"baseline":[127],"in":[128],"all":[129],"evaluation":[130],"metrics,":[131],"achieving":[132],"F1-Score":[134,150],"96.12":[136],"%":[137,149],"AUC":[140],"98.52":[142],"%,":[143,165],"compared":[144],"baseline's":[147],"94.36":[148],"97.39%":[152],"AUC.":[153],"Furthermore,":[154],"achieved":[157],"lower":[159],"false":[160],"positive":[161],"rate":[162],"6.68":[164],"indicating":[166],"more":[168],"precise":[169],"reliable":[171],"capability.":[173],"These":[174],"findings":[175],"highlight":[176],"value":[178],"integrating":[180],"embeddings":[182],"LLMs":[184],"improve":[186],"stealthy,":[190],"cyberattacks.":[192]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-03-12T00:00:00"}