{"id":"https://openalex.org/W7127126533","doi":"https://doi.org/10.1109/trustcom66490.2025.00064","title":"LLM-Driven APT Analysis and Detection Based on Provenance Graph by Threat Pattern","display_name":"LLM-Driven APT Analysis and Detection Based on Provenance Graph by Threat Pattern","publication_year":2025,"publication_date":"2025-11-14","ids":{"openalex":"https://openalex.org/W7127126533","doi":"https://doi.org/10.1109/trustcom66490.2025.00064"},"language":null,"primary_location":{"id":"doi:10.1109/trustcom66490.2025.00064","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00064","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5124083924","display_name":"Yibin Fu","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yibin Fu","raw_affiliation_strings":["National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101394549","display_name":"Zhaoyun Ding","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhaoyun Ding","raw_affiliation_strings":["National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100394022","display_name":"Sheng Zhang","orcid":"https://orcid.org/0000-0002-6581-6399"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sheng Zhang","raw_affiliation_strings":["National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067670271","display_name":"Deqi Cao","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Deqi Cao","raw_affiliation_strings":["National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5124855275","display_name":"Yi Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yi Wang","raw_affiliation_strings":["National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology,National Key Laboratory of Information Systems Engineering,Changsha,China","institution_ids":["https://openalex.org/I170215575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I170215575"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"524","last_page":"531"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.1216999962925911,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.1216999962925911,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.09030000120401382,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.08730000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5548999905586243},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5540000200271606},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5198000073432922},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4772000014781952},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.4758000075817108},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.4325999915599823},{"id":"https://openalex.org/keywords/sequential-pattern-mining","display_name":"Sequential Pattern Mining","score":0.3944999873638153},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.38339999318122864}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7682999968528748},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5548999905586243},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5540000200271606},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5198000073432922},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5099999904632568},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4772000014781952},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.4758000075817108},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.43540000915527344},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4325999915599823},{"id":"https://openalex.org/C149490388","wikidata":"https://www.wikidata.org/wiki/Q1718507","display_name":"Sequential Pattern Mining","level":2,"score":0.3944999873638153},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.38339999318122864},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.3732999861240387},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.3668000102043152},{"id":"https://openalex.org/C59656382","wikidata":"https://www.wikidata.org/wiki/Q191536","display_name":"Conjunction (astronomy)","level":2,"score":0.3662000000476837},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.36169999837875366},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3312000036239624},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3154999911785126},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.31119999289512634},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.2996000051498413},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.2996000051498413},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.26579999923706055},{"id":"https://openalex.org/C2777946921","wikidata":"https://www.wikidata.org/wiki/Q7449044","display_name":"Semantic analysis (machine learning)","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.25589999556541443},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.2500999867916107}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/trustcom66490.2025.00064","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00064","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.5363590717315674,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W2947745012","https://openalex.org/W2962703433","https://openalex.org/W2978956219","https://openalex.org/W2998038410","https://openalex.org/W3212868562","https://openalex.org/W4402288718"],"related_works":[],"abstract_inverted_index":{"We":[0,41],"propose":[1],"a":[2,67,133],"threat":[3,17,56,141],"detection":[4,130],"framework":[5,85],"that":[6,117],"enhances":[7],"provenance-based":[8],"APT":[9],"analysis":[10],"by":[11,77],"combining":[12],"event":[13],"clustering":[14],"with":[15,29,122],"LLM-driven":[16,78],"pattern":[18,120],"extraction":[19],"refinement.":[20],"Our":[21],"method":[22],"is":[23],"designed":[24],"to":[25,36,49,58,80],"work":[26],"in":[27,84,110],"conjunction":[28],"existing":[30,129],"systems":[31],"like":[32],"Kairos,":[33],"which":[34],"able":[35],"detect":[37],"anomaly":[38],"time":[39],"windows.":[40],"first":[42],"group":[43],"fine-grained":[44],"events":[45],"into":[46],"semantic":[47,82],"clusters":[48],"preserve":[50],"behavioral":[51],"context,":[52],"then":[53],"apply":[54],"structured":[55,119],"patterns":[57],"identify":[59],"suspicious":[60],"sequences.":[61],"To":[62],"improve":[63],"precision,":[64],"we":[65],"introduce":[66],"two-stage":[68],"refinement:":[69],"relaxing":[70],"matching":[71,121],"constraints":[72],"for":[73],"high":[74],"recall,":[75],"followed":[76],"filtering":[79],"assess":[81],"plausibility":[83],"of":[86,92],"MITRE":[87],"based":[88],"on":[89,96],"\"Part":[90],"Chain":[91],"Pattern\"":[93],"assumption.":[94],"Evaluated":[95],"CADETS":[97],"E3":[98,101],"and":[99,112,139],"THEIA":[100],"using":[102],"defender-observable":[103],"ground":[104],"truth,":[105],"our":[106],"approach":[107],"outperforms":[108],"Kairos":[109],"precision":[111],"F1-score.":[113],"The":[114],"results":[115],"show":[116],"integrating":[118],"contextual":[123],"language":[124],"models":[125],"can":[126],"effectively":[127],"enhance":[128],"pipelines,":[131],"offering":[132],"practical":[134],"path":[135],"toward":[136],"more":[137],"accurate":[138],"interpretable":[140],"hunting.":[142]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-02-03T00:00:00"}