{"id":"https://openalex.org/W4410089709","doi":"https://doi.org/10.1145/3696410.3714925","title":"STGAN: Detecting Host Threats via Fusion of Spatial-Temporal Features in Host Provenance Graphs","display_name":"STGAN: Detecting Host Threats via Fusion of Spatial-Temporal Features in Host Provenance Graphs","publication_year":2025,"publication_date":"2025-04-22","ids":{"openalex":"https://openalex.org/W4410089709","doi":"https://doi.org/10.1145/3696410.3714925"},"language":"en","primary_location":{"id":"doi:10.1145/3696410.3714925","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3696410.3714925","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714925","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Web Conference 2025","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714925","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5107589511","display_name":"Anyuan Sang","orcid":"https://orcid.org/0009-0006-3265-4078"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Anyuan Sang","raw_affiliation_strings":["Xidian University, Xian, Shaanxi, China"],"raw_orcid":"https://orcid.org/0009-0006-3265-4078","affiliations":[{"raw_affiliation_string":"Xidian University, Xian, Shaanxi, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xuezheng Fan","orcid":"https://orcid.org/0009-0003-1023-1902"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuezheng Fan","raw_affiliation_strings":["Xidian University, Xian, Shaanxi, China"],"raw_orcid":"https://orcid.org/0009-0003-1023-1902","affiliations":[{"raw_affiliation_string":"Xidian University, Xian, Shaanxi, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100637724","display_name":"Li Yang","orcid":"https://orcid.org/0000-0003-2750-7031"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Li Yang","raw_affiliation_strings":["Xidian University, Xian, Shaanxi, China and Shaanxi Key Laboratory of Network and System Security, Xian, Shaanxi, China"],"raw_orcid":"https://orcid.org/0000-0003-2750-7031","affiliations":[{"raw_affiliation_string":"Xidian University, Xian, Shaanxi, China and Shaanxi Key Laboratory of Network and System Security, Xian, Shaanxi, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053754175","display_name":"Yuchen Wang","orcid":"https://orcid.org/0000-0002-9685-6107"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuchen Wang","raw_affiliation_strings":["Xidian University, Xian, Shaanxi, China"],"raw_orcid":"https://orcid.org/0000-0002-9685-6107","affiliations":[{"raw_affiliation_string":"Xidian University, Xian, Shaanxi, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101883746","display_name":"Lu Zhou","orcid":"https://orcid.org/0000-0002-5201-5074"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lu Zhou","raw_affiliation_strings":["Xidian University, Xian, Shaanxi, China"],"raw_orcid":"https://orcid.org/0000-0002-5201-5074","affiliations":[{"raw_affiliation_string":"Xidian University, Xian, Shaanxi, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100532638","display_name":"Junbo Jia","orcid":"https://orcid.org/0009-0009-4286-4003"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junbo Jia","raw_affiliation_strings":["Xidian University, Xian, Shaanxi, China"],"raw_orcid":"https://orcid.org/0009-0009-4286-4003","affiliations":[{"raw_affiliation_string":"Xidian University, Xian, Shaanxi, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"last","author":{"id":null,"display_name":"Huipeng Yang","orcid":"https://orcid.org/0009-0004-1975-8062"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Huipeng Yang","raw_affiliation_strings":["Xidian University, Xian, Shaanxi, China"],"raw_orcid":"https://orcid.org/0009-0004-1975-8062","affiliations":[{"raw_affiliation_string":"Xidian University, Xian, Shaanxi, China","institution_ids":["https://openalex.org/I149594827"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I149594827"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1046","last_page":"1057"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9922000169754028,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9919000267982483,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.8547405004501343},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6801053881645203},{"id":"https://openalex.org/keywords/provenance","display_name":"Provenance","score":0.5328434109687805},{"id":"https://openalex.org/keywords/biology","display_name":"Biology","score":0.11748161911964417},{"id":"https://openalex.org/keywords/ecology","display_name":"Ecology","score":0.09650325775146484}],"concepts":[{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.8547405004501343},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6801053881645203},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.5328434109687805},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.11748161911964417},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.09650325775146484},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3696410.3714925","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3696410.3714925","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714925","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Web Conference 2025","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3696410.3714925","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3696410.3714925","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3696410.3714925","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Web Conference 2025","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2536353722","display_name":null,"funder_award_id":"62302362","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8401798305","display_name":null,"funder_award_id":"62472337","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G842030476","display_name":null,"funder_award_id":"2023YFB3106900","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4410089709.pdf","grobid_xml":"https://content.openalex.org/works/W4410089709.grobid-xml"},"referenced_works_count":26,"referenced_works":["https://openalex.org/W2284900416","https://openalex.org/W2295598076","https://openalex.org/W2350778671","https://openalex.org/W2747669027","https://openalex.org/W2756203131","https://openalex.org/W2790557990","https://openalex.org/W2962703433","https://openalex.org/W2965341826","https://openalex.org/W2978956219","https://openalex.org/W3012562343","https://openalex.org/W3015650867","https://openalex.org/W3099203541","https://openalex.org/W3103720336","https://openalex.org/W3170140111","https://openalex.org/W3212868562","https://openalex.org/W4288057803","https://openalex.org/W4308338538","https://openalex.org/W4311165940","https://openalex.org/W4319663646","https://openalex.org/W4324007191","https://openalex.org/W4382239616","https://openalex.org/W4385565420","https://openalex.org/W4388858881","https://openalex.org/W4402265033","https://openalex.org/W4402288718","https://openalex.org/W4402955702"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2354627941","https://openalex.org/W2347483153","https://openalex.org/W2353379336","https://openalex.org/W2379683085","https://openalex.org/W2363868702","https://openalex.org/W2374448931","https://openalex.org/W2376723740"],"abstract_inverted_index":{"As":[0],"the":[1,67,165],"complexity":[2],"and":[3,13,48,69,102,113,126,172,177],"frequency":[4],"of":[5,72,158],"cyberattacks,":[6],"such":[7],"as":[8],"Advanced":[9],"Persistent":[10],"Threats":[11],"(APTs)":[12],"ransomware,":[14],"continue":[15],"to":[16,65,105,109,164],"escalate,":[17],"traditional":[18],"anomaly":[19,135],"detection":[20,55,79,159],"methods":[21,56],"have":[22,36],"proven":[23],"inadequate":[24],"in":[25,41,77,156],"addressing":[26],"these":[27],"sophisticated,":[28],"multi-faceted":[29],"threats.":[30],"Recently,":[31],"Host":[32],"Provenance":[33],"Graphs":[34],"(HPGs)":[35],"played":[37],"a":[38,88,117,129],"crucial":[39],"role":[40],"analyzing":[42],"system-level":[43],"interactions,":[44],"detecting":[45],"anomalous":[46],"behaviors,":[47],"tracing":[49],"attack":[50],"chains.":[51],"However,":[52],"existing":[53],"provenance-based":[54],"primarily":[57],"rely":[58],"on":[59,140],"single-dimensional":[60],"feature":[61,119],"analysis,":[62],"which":[63],"fails":[64],"capture":[66],"dynamic":[68,106],"multi-dimensional":[70],"patterns":[71],"modern":[73],"APT":[74],"attacks,":[75],"resulting":[76],"insufficient":[78],"performance.":[80,160],"To":[81],"overcome":[82],"this":[83],"limitation,":[84],"we":[85,146,162],"introduce":[86],"STGAN,":[87],"model":[89],"that":[90,148],"integrates":[91],"spatial-temporal":[92],"graphs":[93,108],"into":[94],"host":[95],"provenance":[96,107,143],"graph":[97,144],"modeling.":[98],"STGAN":[99],"applies":[100],"temporal":[101],"spatial":[103],"encoding":[104],"extract":[110],"temporal,":[111],"spatial,":[112],"semantic":[114],"features,":[115],"constructing":[116],"comprehensive":[118],"representation.":[120],"This":[121],"representation":[122],"is":[123],"further":[124,175],"fused":[125],"enhanced":[127],"using":[128],"multi-head":[130],"self-attention":[131],"mechanism,":[132],"followed":[133],"by":[134,168],"detection.":[136],"Through":[137],"extensive":[138],"evaluations":[139],"three":[141],"widely-used":[142],"datasets,":[145],"demonstrate":[147],"our":[149,170],"approach":[150],"consistently":[151],"outperforms":[152],"current":[153],"state-of-the-art":[154],"techniques":[155],"terms":[157],"Additionally,":[161],"contribute":[163],"research":[166],"community":[167],"releasing":[169],"datasets":[171],"code,":[173],"facilitating":[174],"exploration":[176],"validation.":[178]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}