{"id":"https://openalex.org/W7117895377","doi":"https://doi.org/10.1109/milcom64451.2025.11310515","title":"GNN-Based Predictive Model for Adversarial Cyber Behavior Using the MITRE ATT&CK","display_name":"GNN-Based Predictive Model for Adversarial Cyber Behavior Using the MITRE ATT&CK","publication_year":2025,"publication_date":"2025-10-06","ids":{"openalex":"https://openalex.org/W7117895377","doi":"https://doi.org/10.1109/milcom64451.2025.11310515"},"language":null,"primary_location":{"id":"doi:10.1109/milcom64451.2025.11310515","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom64451.2025.11310515","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2025 - 2025 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5113017874","display_name":"Wooyoung Son","orcid":"https://orcid.org/0009-0007-8316-8827"},"institutions":[{"id":"https://openalex.org/I28777354","display_name":"Sejong University","ror":"https://ror.org/00aft1q37","country_code":"KR","type":"education","lineage":["https://openalex.org/I28777354"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Wooyoung Son","raw_affiliation_strings":["Sejong University,Protocol Engineering Lab.,Seoul,Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sejong University,Protocol Engineering Lab.,Seoul,Republic of Korea","institution_ids":["https://openalex.org/I28777354"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072562385","display_name":"Soonhong Kwon","orcid":"https://orcid.org/0009-0000-2729-3948"},"institutions":[{"id":"https://openalex.org/I28777354","display_name":"Sejong University","ror":"https://ror.org/00aft1q37","country_code":"KR","type":"education","lineage":["https://openalex.org/I28777354"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Soonhong Kwon","raw_affiliation_strings":["Sejong Univ.,Dept. of Computer & Information Security & Convergence Eng. for Intelligent Drone,Seoul,Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sejong Univ.,Dept. of Computer & Information Security & Convergence Eng. for Intelligent Drone,Seoul,Republic of Korea","institution_ids":["https://openalex.org/I28777354"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5022793158","display_name":"Jong-Hyouk Lee","orcid":null},"institutions":[{"id":"https://openalex.org/I28777354","display_name":"Sejong University","ror":"https://ror.org/00aft1q37","country_code":"KR","type":"education","lineage":["https://openalex.org/I28777354"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jong-Hyouk Lee","raw_affiliation_strings":["Sejong Univ.,Dept. of Computer & Information Security & Convergence Eng. for Intelligent Drone,Seoul,Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sejong Univ.,Dept. of Computer & Information Security & Convergence Eng. for Intelligent Drone,Seoul,Republic of Korea","institution_ids":["https://openalex.org/I28777354"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I28777354"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"968","last_page":"973"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.25200000405311584,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.25200000405311584,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.12359999865293503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.07909999787807465,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.7168999910354614},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.6348000168800354},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.5853999853134155},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.49639999866485596},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.4885999858379364},{"id":"https://openalex.org/keywords/recall","display_name":"Recall","score":0.4302999973297119},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.40779998898506165},{"id":"https://openalex.org/keywords/cyber-physical-system","display_name":"Cyber-physical system","score":0.4043000042438507},{"id":"https://openalex.org/keywords/cyber-threats","display_name":"Cyber threats","score":0.4004000127315521}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7168999910354614},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6722999811172485},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6549999713897705},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.6348000168800354},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.5853999853134155},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.49639999866485596},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.4885999858379364},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.4302999973297119},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.40779998898506165},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.4043000042438507},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.4004000127315521},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39169999957084656},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.36910000443458557},{"id":"https://openalex.org/C166955791","wikidata":"https://www.wikidata.org/wiki/Q629579","display_name":"Macro","level":2,"score":0.3571000099182129},{"id":"https://openalex.org/C9114305","wikidata":"https://www.wikidata.org/wiki/Q1428317","display_name":"Situational ethics","level":2,"score":0.3409999907016754},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.3154999911785126},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.3050000071525574},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.2980000078678131},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2957000136375427},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2786000072956085},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2703000009059906},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.25920000672340393},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.25850000977516174},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.25699999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/milcom64451.2025.11310515","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom64451.2025.11310515","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2025 - 2025 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":2,"referenced_works":["https://openalex.org/W2966030703","https://openalex.org/W4406214267"],"related_works":[],"abstract_inverted_index":{"Recently,":[0],"the":[1,24,40,66,127,131,137,152,162],"significance":[2],"of":[3,29],"Cyber":[4,72],"Situational":[5],"Awareness":[6],"(CSA)":[7],"has":[8,83],"grown":[9],"beyond":[10],"mere":[11],"defense":[12],"in":[13,60,94,142,146],"cyber":[14,158],"military":[15],"operations.":[16],"The":[17],"U.S.":[18],"Field":[19],"Manual":[20],"defines":[21],"CSA":[22],"as":[23,34,36],"timely":[25],"and":[26,31,56,87,107,144,160],"accurate":[27],"understanding":[28],"friendly":[30],"enemy":[32],"forces,":[33],"well":[35],"ongoing":[37],"activities":[38],"across":[39],"battlefield.":[41],"In":[42],"line":[43],"with":[44,91,120],"this,":[45],"there":[46],"is":[47,68],"a":[48,104],"growing":[49],"demand":[50],"for":[51,154,164],"capabilities":[52],"that":[53,126],"can":[54],"analyze":[55],"predict":[57],"attacker":[58],"behavior":[59],"real":[61],"time.":[62],"Reflecting":[63],"this":[64,100],"trend,":[65],"focus":[67],"shifting":[69],"from":[70],"traditional":[71],"Threat":[73,77],"Intelligence":[74],"to":[75],"Predictive":[76],"Intelligence.":[78],"However,":[79],"most":[80],"existing":[81],"research":[82],"concentrated":[84],"on":[85,113],"analyzing":[86],"visualizing":[88],"past":[89],"attacks,":[90],"limited":[92],"success":[93],"forecasting":[95],"future":[96,157],"threats.":[97,167],"To":[98],"address":[99],"gap,":[101],"we":[102,124],"propose":[103],"Tactics,":[105],"Techniques,":[106],"Procedures":[108],"(TTP)":[109],"prediction":[110],"mechanism":[111],"based":[112],"Graph":[114],"Neural":[115],"Networks":[116],"(GNNs).":[117],"Through":[118],"experimentation":[119],"various":[121],"GNN":[122],"models,":[123],"found":[125],"GraphConv":[128,135],"model":[129,139],"delivered":[130],"best":[132],"performance.":[133],"Specifically,":[134],"outperformed":[136],"GCN":[138],"by":[140],"9.51%":[141],"Recall":[143],"8.73%":[145],"Macro":[147],"F1-score.":[148],"These":[149],"results":[150],"highlight":[151],"potential":[153],"preemptively":[155],"detecting":[156],"attacks":[159],"lay":[161],"groundwork":[163],"minimizing":[165],"security":[166]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-01-01T00:00:00"}