{"id":"https://openalex.org/W4404130408","doi":"https://doi.org/10.1145/3689933.3690836","title":"P3GNN: A Privacy-Preserving Provenance Graph-Based Model for Autonomous APT Detection in Software Defined Networking","display_name":"P3GNN: A Privacy-Preserving Provenance Graph-Based Model for Autonomous APT Detection in Software Defined Networking","publication_year":2023,"publication_date":"2023-11-06","ids":{"openalex":"https://openalex.org/W4404130408","doi":"https://doi.org/10.1145/3689933.3690836"},"language":"en","primary_location":{"id":"doi:10.1145/3689933.3690836","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3689933.3690836","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Workshop on Autonomous Cybersecurity","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5099282306","display_name":"Hedyeh Nazari","orcid":null},"institutions":[{"id":"https://openalex.org/I79817857","display_name":"University of Guelph","ror":"https://ror.org/01r7awg59","country_code":"CA","type":"education","lineage":["https://openalex.org/I79817857"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Hedyeh Nazari","raw_affiliation_strings":["Cyber Science Lab, Canada Cyber Foundry, University of Guelph, Guelph, Canada"],"raw_orcid":"https://orcid.org/0009-0007-9168-2498","affiliations":[{"raw_affiliation_string":"Cyber Science Lab, Canada Cyber Foundry, University of Guelph, Guelph, Canada","institution_ids":["https://openalex.org/I79817857"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087870144","display_name":"Abbas Yazdinejad","orcid":"https://orcid.org/0000-0002-8669-9777"},"institutions":[{"id":"https://openalex.org/I79817857","display_name":"University of Guelph","ror":"https://ror.org/01r7awg59","country_code":"CA","type":"education","lineage":["https://openalex.org/I79817857"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Abbas Yazdinejad","raw_affiliation_strings":["Cyber Science Lab, Canada Cyber Foundry, University of Guelph, Guelph, Canada"],"raw_orcid":"https://orcid.org/0000-0002-8669-9777","affiliations":[{"raw_affiliation_string":"Cyber Science Lab, Canada Cyber Foundry, University of Guelph, Guelph, Canada","institution_ids":["https://openalex.org/I79817857"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038019914","display_name":"Ali Dehghantanha","orcid":"https://orcid.org/0000-0002-9294-7554"},"institutions":[{"id":"https://openalex.org/I79817857","display_name":"University of Guelph","ror":"https://ror.org/01r7awg59","country_code":"CA","type":"education","lineage":["https://openalex.org/I79817857"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Ali Dehghantanha","raw_affiliation_strings":["Cyber Science Lab, Canada Cyber Foundry, University of Guelph, Guelph, Canada"],"raw_orcid":"https://orcid.org/0000-0002-9294-7554","affiliations":[{"raw_affiliation_string":"Cyber Science Lab, Canada Cyber Foundry, University of Guelph, Guelph, Canada","institution_ids":["https://openalex.org/I79817857"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073867210","display_name":"Fattane Zarrinkalam","orcid":"https://orcid.org/0000-0002-2102-9190"},"institutions":[{"id":"https://openalex.org/I79817857","display_name":"University of Guelph","ror":"https://ror.org/01r7awg59","country_code":"CA","type":"education","lineage":["https://openalex.org/I79817857"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Fattane Zarrinkalam","raw_affiliation_strings":["Department of Engineering, University of Guelph, Guelph, Canada"],"raw_orcid":"https://orcid.org/0000-0002-2102-9190","affiliations":[{"raw_affiliation_string":"Department of Engineering, University of Guelph, Guelph, Canada","institution_ids":["https://openalex.org/I79817857"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5041541232","display_name":"Gautam Srivastava","orcid":"https://orcid.org/0000-0001-9851-4103"},"institutions":[{"id":"https://openalex.org/I48890080","display_name":"Brandon University","ror":"https://ror.org/02qp25a50","country_code":"CA","type":"education","lineage":["https://openalex.org/I48890080"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Gautam Srivastava","raw_affiliation_strings":["Department of Math and Computer Science, Brandon University, Brandon, Canada"],"raw_orcid":"https://orcid.org/0000-0001-9851-4103","affiliations":[{"raw_affiliation_string":"Department of Math and Computer Science, Brandon University, Brandon, Canada","institution_ids":["https://openalex.org/I48890080"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.2654,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":{"value":0.94023781,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"34","last_page":"44"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7466616034507751},{"id":"https://openalex.org/keywords/provenance","display_name":"Provenance","score":0.5741415619850159},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5123428106307983},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.47280779480934143},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.2817607820034027},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.14191082119941711}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7466616034507751},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.5741415619850159},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5123428106307983},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.47280779480934143},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2817607820034027},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.14191082119941711},{"id":"https://openalex.org/C5900021","wikidata":"https://www.wikidata.org/wiki/Q163082","display_name":"Petrology","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3689933.3690836","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3689933.3690836","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Workshop on Autonomous Cybersecurity","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W1905251226","https://openalex.org/W2067453331","https://openalex.org/W2118372007","https://openalex.org/W2121318675","https://openalex.org/W2284900416","https://openalex.org/W2747669027","https://openalex.org/W2767094836","https://openalex.org/W2767952447","https://openalex.org/W2795220486","https://openalex.org/W2831766186","https://openalex.org/W2889379876","https://openalex.org/W2910711617","https://openalex.org/W2962703433","https://openalex.org/W2978956219","https://openalex.org/W2999645065","https://openalex.org/W3004629779","https://openalex.org/W3081876271","https://openalex.org/W3099203541","https://openalex.org/W3135578542","https://openalex.org/W3172594102","https://openalex.org/W3196544260","https://openalex.org/W4220692398","https://openalex.org/W4220980801","https://openalex.org/W4232172926","https://openalex.org/W4312968719","https://openalex.org/W4385589237","https://openalex.org/W4390570833","https://openalex.org/W4400076000"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2354627941","https://openalex.org/W2347483153","https://openalex.org/W2353379336","https://openalex.org/W2379683085","https://openalex.org/W2363868702","https://openalex.org/W2374448931","https://openalex.org/W2376723740"],"abstract_inverted_index":{"Software":[0],"Defined":[1],"Networking":[2],"(SDN)":[3],"has":[4,16],"brought":[5],"significant":[6],"advancements":[7],"in":[8,38,62,89,136],"network":[9],"management":[10],"and":[11,26,85,121,199],"programmability.":[12],"However,":[13],"this":[14],"evolution":[15],"also":[17],"heightened":[18],"vulnerability":[19],"to":[20,35,53,147,173],"Advanced":[21],"Persistent":[22],"Threats":[23],"(APTs),":[24],"sophisticated":[25],"stealthy":[27],"cyberattacks":[28],"that":[29,73],"current":[30],"detection":[31,88],"methods":[32],"often":[33],"fail":[34],"counter,":[36],"especially":[37],"the":[39,48,110,130,152,166,186],"face":[40],"of":[41,50,103,112,133,142,162,197,205],"zero-day":[42,176],"exploits.":[43],"A":[44],"prevalent":[45],"issue":[46],"is":[47,109],"inadequacy":[49],"existing":[51],"strategies":[52],"detect":[54,149],"novel":[55,71],"threats":[56],"while":[57],"addressing":[58],"data":[59,119,134],"privacy":[60,135],"concerns":[61],"collaborative":[63,125],"learning":[64,138,169,179],"scenarios.":[65],"This":[66,127],"paper":[67],"presents":[68],"P3GNN,":[69],"a":[70,159,200],"model":[72],"synergizes":[74],"Federated":[75],"Learning":[76],"(FL)":[77],"with":[78,114],"Graph":[79],"Convolutional":[80],"Networks":[81],"(GCN)":[82],"for":[83],"autonomous":[84],"effective":[86],"APT":[87],"SDN":[90],"environments.":[91],"P3GNN":[92,143],"autonomously":[93,148],"analyzes":[94],"operational":[95,181],"patterns":[96],"within":[97,155],"provenance":[98,156],"graphs,":[99,157],"identifying":[100],"deviations":[101],"indicative":[102],"security":[104],"breaches.":[105],"Its":[106],"core":[107],"feature":[108],"integration":[111],"FL":[113],"homomorphic":[115],"encryption,":[116],"which":[117],"fortifies":[118],"confidentiality":[120],"gradient":[122],"integrity":[123],"during":[124],"learning.":[126],"approach":[128],"addresses":[129],"critical":[131],"challenge":[132],"shared":[137],"contexts.":[139],"Key":[140],"innovations":[141],"include":[144],"its":[145],"ability":[146],"anomalies":[150],"at":[151],"node":[153],"level":[154],"offering":[158],"detailed":[160],"view":[161],"attack":[163],"trajectories.":[164],"Furthermore,":[165],"model's":[167],"unsupervised":[168],"capability":[170],"enables":[171],"it":[172],"independently":[174],"identify":[175],"attacks":[177],"by":[178],"standard":[180],"patterns.":[182],"Empirical":[183],"evaluations":[184],"using":[185],"DARPA":[187],"TCE3":[188],"dataset":[189],"demonstrate":[190],"P3GNN's":[191],"exceptional":[192],"performance,":[193],"achieving":[194],"an":[195],"accuracy":[196],"0.93":[198],"low":[201],"false":[202],"positive":[203],"rate":[204],"0.06.":[206]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":5}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2024-11-08T00:00:00"}