{"id":"https://openalex.org/W7127451165","doi":"https://doi.org/10.1109/tnsm.2026.3660650","title":"Dynamic Adaptive Aggregation and Feature Pyramid Network Enhanced GraphSAGE for Advanced Persistent Threat Detection in Next-Generation Communication Networks","display_name":"Dynamic Adaptive Aggregation and Feature Pyramid Network Enhanced GraphSAGE for Advanced Persistent Threat Detection in Next-Generation Communication Networks","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7127451165","doi":"https://doi.org/10.1109/tnsm.2026.3660650"},"language":null,"primary_location":{"id":"doi:10.1109/tnsm.2026.3660650","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3660650","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5011263795","display_name":"Liang Kou","orcid":"https://orcid.org/0000-0002-4625-4271"},"institutions":[{"id":"https://openalex.org/I50760025","display_name":"Hangzhou Dianzi University","ror":"https://ror.org/0576gt767","country_code":"CN","type":"education","lineage":["https://openalex.org/I50760025"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liang Kou","raw_affiliation_strings":["College of Cyberspace, Hangzhou Dianzi University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-4625-4271","affiliations":[{"raw_affiliation_string":"College of Cyberspace, Hangzhou Dianzi University, Hangzhou, China","institution_ids":["https://openalex.org/I50760025"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124888939","display_name":"Xiaochen Pan","orcid":null},"institutions":[{"id":"https://openalex.org/I50760025","display_name":"Hangzhou Dianzi University","ror":"https://ror.org/0576gt767","country_code":"CN","type":"education","lineage":["https://openalex.org/I50760025"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaochen Pan","raw_affiliation_strings":["College of Cyberspace, Hangzhou Dianzi University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0001-0483-9052","affiliations":[{"raw_affiliation_string":"College of Cyberspace, Hangzhou Dianzi University, Hangzhou, China","institution_ids":["https://openalex.org/I50760025"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124937899","display_name":"Guozhong Dong","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guozhong Dong","raw_affiliation_strings":["Department of New Networks, Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-7144-1327","affiliations":[{"raw_affiliation_string":"Department of New Networks, Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076103896","display_name":"Meiyu Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I50760025","display_name":"Hangzhou Dianzi University","ror":"https://ror.org/0576gt767","country_code":"CN","type":"education","lineage":["https://openalex.org/I50760025"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Meiyu Wang","raw_affiliation_strings":["College of Communication Engineering, Hangzhou Dianzi University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-2025-721X","affiliations":[{"raw_affiliation_string":"College of Communication Engineering, Hangzhou Dianzi University, Hangzhou, China","institution_ids":["https://openalex.org/I50760025"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100382085","display_name":"Chunyu Miao","orcid":"https://orcid.org/0000-0002-4296-2086"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chunyu Miao","raw_affiliation_strings":["Hangzhou DBAPPSecurity Company Ltd., Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hangzhou DBAPPSecurity Company Ltd., Hangzhou, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124917091","display_name":"Jilin Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I50760025","display_name":"Hangzhou Dianzi University","ror":"https://ror.org/0576gt767","country_code":"CN","type":"education","lineage":["https://openalex.org/I50760025"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jilin Zhang","raw_affiliation_strings":["College of Cyberspace, Hangzhou Dianzi University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-0241-0727","affiliations":[{"raw_affiliation_string":"College of Cyberspace, Hangzhou Dianzi University, Hangzhou, China","institution_ids":["https://openalex.org/I50760025"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5124908197","display_name":"Pingxia Duan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pingxia Duan","raw_affiliation_strings":["Hangzhou DBAPPSecurity Company Ltd., Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hangzhou DBAPPSecurity Company Ltd., Hangzhou, China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.08500871,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":null,"first_page":"2712","last_page":"2727"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.767799973487854,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.767799973487854,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11498","display_name":"Security in Wireless Sensor Networks","score":0.02590000070631504,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.02370000071823597,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adaptability","display_name":"Adaptability","score":0.7440000176429749},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7027000188827515},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5609999895095825},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.554099977016449},{"id":"https://openalex.org/keywords/pyramid","display_name":"Pyramid (geometry)","score":0.48019999265670776},{"id":"https://openalex.org/keywords/dynamic-network-analysis","display_name":"Dynamic network analysis","score":0.42010000348091125},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.40799999237060547},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.34790000319480896}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8539000153541565},{"id":"https://openalex.org/C177606310","wikidata":"https://www.wikidata.org/wiki/Q5674297","display_name":"Adaptability","level":2,"score":0.7440000176429749},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7027000188827515},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5609999895095825},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.554099977016449},{"id":"https://openalex.org/C142575187","wikidata":"https://www.wikidata.org/wiki/Q3358290","display_name":"Pyramid (geometry)","level":2,"score":0.48019999265670776},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.4722000062465668},{"id":"https://openalex.org/C13540734","wikidata":"https://www.wikidata.org/wiki/Q5318996","display_name":"Dynamic network analysis","level":2,"score":0.42010000348091125},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.40799999237060547},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3582000136375427},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.34790000319480896},{"id":"https://openalex.org/C192126672","wikidata":"https://www.wikidata.org/wiki/Q1068715","display_name":"Telecommunications network","level":2,"score":0.3319000005722046},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3276999890804291},{"id":"https://openalex.org/C82578977","wikidata":"https://www.wikidata.org/wiki/Q16773055","display_name":"Data aggregator","level":3,"score":0.3264999985694885},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3208000063896179},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.31189998984336853},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.3061000108718872},{"id":"https://openalex.org/C88796919","wikidata":"https://www.wikidata.org/wiki/Q1142907","display_name":"Backbone network","level":2,"score":0.3059000074863434},{"id":"https://openalex.org/C24590314","wikidata":"https://www.wikidata.org/wiki/Q336038","display_name":"Wireless sensor network","level":2,"score":0.2922999858856201},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2825999855995178},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2754000127315521},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.2635999917984009},{"id":"https://openalex.org/C52970973","wikidata":"https://www.wikidata.org/wiki/Q2497134","display_name":"Adaptive system","level":2,"score":0.2590000033378601}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2026.3660650","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3660650","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W1821462560","https://openalex.org/W1995875735","https://openalex.org/W2101491865","https://openalex.org/W2132022337","https://openalex.org/W2194775991","https://openalex.org/W2565639579","https://openalex.org/W2604395162","https://openalex.org/W2907492528","https://openalex.org/W2962703433","https://openalex.org/W2962907613","https://openalex.org/W2963857746","https://openalex.org/W2986944522","https://openalex.org/W2998038410","https://openalex.org/W3024560045","https://openalex.org/W3036543015","https://openalex.org/W3201829457","https://openalex.org/W3211430557","https://openalex.org/W3212868562","https://openalex.org/W4232478844","https://openalex.org/W4319342016","https://openalex.org/W4385245566","https://openalex.org/W4385565676","https://openalex.org/W4385625674","https://openalex.org/W4394002394","https://openalex.org/W4401410618","https://openalex.org/W4401540312","https://openalex.org/W4405236144","https://openalex.org/W4406237488"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"pose":[4],"severe":[5],"challenges":[6],"to":[7,13,33,75,101,105],"Next-Generation":[8],"Communication":[9],"Networks":[10],"(NGCNs)":[11],"due":[12],"their":[14],"stealthiness":[15],"and":[16,30,54,73,137,147],"NGCNs\u2019":[17],"dynamic":[18,77],"topology,":[19],"while":[20],"conventional":[21],"GNN-based":[22],"intrusion":[23],"detection":[24,47,155],"systems":[25],"suffer":[26],"from":[27],"static":[28],"aggregation":[29],"poor":[31],"adaptability":[32],"unseen":[34,69],"nodes.":[35],"To":[36],"address":[37],"these":[38],"issues,":[39],"this":[40],"paper":[41],"proposes":[42],"DAA-FPN-SAGE,":[43],"a":[44,129],"lightweight":[45],"graph-based":[46],"framework":[48,66],"integrating":[49],"Dynamic":[50],"Adaptive":[51],"Aggregation":[52],"(DAA)":[53],"Multi-Scale":[55],"Feature":[56],"Pyramid":[57],"Network":[58],"(MSFPM).":[59],"Leveraging":[60],"GraphSAGE\u2019s":[61],"inductive":[62],"learning":[63],"capability,":[64],"the":[65],"effectively":[67],"models":[68],"nodes":[70],"or":[71],"subgraphs":[72],"adapts":[74],"NGCN\u2019s":[76,91],"changes":[78],"(e.g.,":[79],"elastic":[80],"network":[81],"slicing,":[82],"online":[83],"AI":[84],"model":[85],"updates)\u2014a":[86],"key":[87],"advantage":[88],"for":[89],"handling":[90],"real-time":[92],"topological":[93],"variations.":[94],"The":[95,121],"DAA":[96],"module":[97,123],"employs":[98],"multi-hop":[99],"attention":[100],"dynamically":[102],"assign":[103],"weights":[104],"neighbors":[106],"at":[107],"different":[108],"hop":[109],"distances,":[110],"enhancing":[111],"capture":[112],"of":[113,157],"hierarchical":[114],"dependencies":[115],"in":[116],"multi-stage":[117],"APT":[118],"attack":[119,139],"chains.":[120],"MSFPM":[122],"fuses":[124],"local-global":[125],"structural":[126],"information":[127],"via":[128],"gated":[130],"feature":[131],"selection":[132],"mechanism,":[133],"resolving":[134],"dimensional":[135],"inconsistency":[136],"enriching":[138],"behavior":[140],"representation.":[141],"Extensive":[142],"experiments":[143],"on":[144],"StreamSpot,":[145],"Unicorn,":[146],"DARPA":[148],"TC#3":[149],"datasets":[150],"demonstrate":[151],"superior":[152],"performance,":[153],"meeting":[154],"requirements":[156],"large-scale":[158],"NGCNs.":[159]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2026-02-04T00:00:00"}