{"id":"https://openalex.org/W7084081031","doi":"https://doi.org/10.1109/infocom55648.2025.11044565","title":"A Principled Approach for Detecting APTs in Massive Networks via Multi-Stage Causal Analytics","display_name":"A Principled Approach for Detecting APTs in Massive Networks via Multi-Stage Causal Analytics","publication_year":2025,"publication_date":"2025-05-19","ids":{"openalex":"https://openalex.org/W7084081031","doi":"https://doi.org/10.1109/infocom55648.2025.11044565"},"language":"en","primary_location":{"id":"doi:10.1109/infocom55648.2025.11044565","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infocom55648.2025.11044565","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE INFOCOM 2025 - IEEE Conference on Computer Communications","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Jiaping Gui","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiaping Gui","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Mingjie Nie","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mingjie Nie","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jinyao Guo","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinyao Guo","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Futai Zou","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Futai Zou","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Mati Ur Rehman","orcid":null},"institutions":[{"id":"https://openalex.org/I51556381","display_name":"University of Virginia","ror":"https://ror.org/0153tk833","country_code":"US","type":"education","lineage":["https://openalex.org/I51556381"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mati Ur Rehman","raw_affiliation_strings":["University of Virginia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Virginia","institution_ids":["https://openalex.org/I51556381"]}]},{"author_position":"last","author":{"id":null,"display_name":"Wajih Ul Hassan","orcid":null},"institutions":[{"id":"https://openalex.org/I51556381","display_name":"University of Virginia","ror":"https://ror.org/0153tk833","country_code":"US","type":"education","lineage":["https://openalex.org/I51556381"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wajih Ul Hassan","raw_affiliation_strings":["University of Virginia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Virginia","institution_ids":["https://openalex.org/I51556381"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T10209","display_name":"Global Maternal and Child Health","score":0.8033999800682068,"subfield":{"id":"https://openalex.org/subfields/2735","display_name":"Pediatrics, Perinatology and Child Health"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},"topics":[{"id":"https://openalex.org/T10209","display_name":"Global Maternal and Child Health","score":0.8033999800682068,"subfield":{"id":"https://openalex.org/subfields/2735","display_name":"Pediatrics, Perinatology and Child Health"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},{"id":"https://openalex.org/T12011","display_name":"Insurance, Mortality, Demography, Risk Management","score":0.03759999945759773,"subfield":{"id":"https://openalex.org/subfields/3317","display_name":"Demography"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10290","display_name":"Pregnancy and preeclampsia studies","score":0.03720000013709068,"subfield":{"id":"https://openalex.org/subfields/2729","display_name":"Obstetrics and Gynecology"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6675000190734863},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6510000228881836},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.5956000089645386},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.4918999969959259},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.43290001153945923},{"id":"https://openalex.org/keywords/pattern-matching","display_name":"Pattern matching","score":0.3386000096797943},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.3330000042915344}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7610999941825867},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6675000190734863},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6510000228881836},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.5956000089645386},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5906000137329102},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.4918999969959259},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.43290001153945923},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4065000116825104},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3555999994277954},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.3386000096797943},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.3330000042915344},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3156999945640564},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.30000001192092896},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.2994999885559082},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.29339998960494995},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2669999897480011},{"id":"https://openalex.org/C81877898","wikidata":"https://www.wikidata.org/wiki/Q1965787","display_name":"Network monitoring","level":2,"score":0.258899986743927},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.25189998745918274}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/infocom55648.2025.11044565","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infocom55648.2025.11044565","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE INFOCOM 2025 - IEEE Conference on Computer Communications","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Detecting":[0],"Advanced":[1],"Persistent":[2],"Threats":[3],"(APTs)":[4],"in":[5],"large":[6,117],"enterprise":[7,120],"networks":[8],"with":[9,49,124,128,140],"conventional":[10],"Network":[11],"Intrusion":[12],"Detection":[13],"Systems":[14],"(NIDS)":[15],"is":[16],"challenging":[17],"due":[18],"to":[19,39,81,89,98],"the":[20,129],"stealthy,":[21],"multi-stage,":[22],"and":[23,78,143],"long-running":[24],"nature":[25],"of":[26,119],"APTs.":[27],"This":[28],"paper":[29],"introduces":[30],"Netguardian,":[31],"a":[32,36,55,116],"novel":[33],"NIDS":[34],"utilizing":[35],"comprehensive":[37],"methodology":[38],"correlate":[40],"anomalies":[41,85,105],"across":[42],"APT":[43,51,69,108,138],"stages.":[44],"By":[45],"merging":[46],"real":[47],"traffic":[48,73,122],"simulated":[50,125],"scenarios,":[52],"Netguardian":[53,63,135],"creates":[54],"detailed":[56],"training":[57],"dataset":[58,118,132],"for":[59,67],"enhanced":[60],"anomaly":[61],"detection.":[62],"implements":[64],"custom":[65],"models":[66],"each":[68],"stage,":[70],"extracting":[71],"specific":[72],"features,":[74],"such":[75],"as":[76],"periodicity":[77],"failed":[79],"connections,":[80],"identify":[82],"anomalies.":[83],"These":[84],"are":[86],"then":[87],"correlated":[88],"reconstruct":[90],"attack":[91],"paths.":[92,113],"Our":[93],"system":[94],"leverages":[95],"these":[96],"paths":[97],"assign":[99],"threat":[100],"scores":[101],"based":[102],"on":[103,115],"interconnected":[104],"matching":[106],"known":[107],"progression,":[109],"effectively":[110],"prioritizing":[111],"suspicious":[112],"Evaluation":[114],"network":[121],"merged":[123],"APTs":[126],"along":[127],"DARPA":[130],"OpTC":[131],"shows":[133],"that":[134],"detects":[136],"various":[137],"stages":[139],"high":[141],"accuracy":[142],"low":[144],"false":[145],"positives,":[146],"outperforming":[147],"state-of-the-art":[148],"(SOTA)":[149],"NIDS.":[150]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}