{"id":"https://openalex.org/W7156185659","doi":"https://doi.org/10.1145/3774904.3792201","title":"HyperDetector: Advanced Persistent Threat Detection via Hypergraph Neural Networks with Enhanced Global Perception","display_name":"HyperDetector: Advanced Persistent Threat Detection via Hypergraph Neural Networks with Enhanced Global Perception","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W7156185659","doi":"https://doi.org/10.1145/3774904.3792201"},"language":null,"primary_location":{"id":"doi:10.1145/3774904.3792201","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3774904.3792201","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Web Conference 2026","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3774904.3792201","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5078973865","display_name":"Ziyue Wu","orcid":"https://orcid.org/0000-0002-6033-4585"},"institutions":[{"id":"https://openalex.org/I21193070","display_name":"Beijing Jiaotong University","ror":"https://ror.org/01yj56c84","country_code":"CN","type":"education","lineage":["https://openalex.org/I21193070"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ziyue Wu","raw_affiliation_strings":["School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0005-7755-097X","affiliations":[{"raw_affiliation_string":"School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China","institution_ids":["https://openalex.org/I21193070"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100332791","display_name":"Nan Wang","orcid":"https://orcid.org/0000-0003-2297-0000"},"institutions":[{"id":"https://openalex.org/I21193070","display_name":"Beijing Jiaotong University","ror":"https://ror.org/01yj56c84","country_code":"CN","type":"education","lineage":["https://openalex.org/I21193070"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Nan Wang","raw_affiliation_strings":["School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-2297-0000","affiliations":[{"raw_affiliation_string":"School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China","institution_ids":["https://openalex.org/I21193070"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070828650","display_name":"Jiqiang Liu","orcid":"https://orcid.org/0000-0003-1147-4327"},"institutions":[{"id":"https://openalex.org/I21193070","display_name":"Beijing Jiaotong University","ror":"https://ror.org/01yj56c84","country_code":"CN","type":"education","lineage":["https://openalex.org/I21193070"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiqiang Liu","raw_affiliation_strings":["School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-1147-4327","affiliations":[{"raw_affiliation_string":"School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China","institution_ids":["https://openalex.org/I21193070"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102996491","display_name":"Hairong Dong","orcid":"https://orcid.org/0000-0003-4369-3401"},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hairong Dong","raw_affiliation_strings":["School of Electronic and Information Engineering, TONGJI University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-7255-2950","affiliations":[{"raw_affiliation_string":"School of Electronic and Information Engineering, TONGJI University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100773043","display_name":"Xibin Zhao","orcid":"https://orcid.org/0000-0002-6168-7016"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xibin Zhao","raw_affiliation_strings":["School of Software, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-6168-7016","affiliations":[{"raw_affiliation_string":"School of Software, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2673","last_page":"2682"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.37599998712539673,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.37599998712539673,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.1120000034570694,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.08889999985694885,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/hypergraph","display_name":"Hypergraph","score":0.8166999816894531},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.4876999855041504},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.42879998683929443},{"id":"https://openalex.org/keywords/perception","display_name":"Perception","score":0.4287000000476837},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4212000072002411},{"id":"https://openalex.org/keywords/binary-number","display_name":"Binary number","score":0.3352000117301941},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3325999975204468}],"concepts":[{"id":"https://openalex.org/C2781221856","wikidata":"https://www.wikidata.org/wiki/Q840247","display_name":"Hypergraph","level":2,"score":0.8166999816894531},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7257999777793884},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.4876999855041504},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.47769999504089355},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.42879998683929443},{"id":"https://openalex.org/C26760741","wikidata":"https://www.wikidata.org/wiki/Q160402","display_name":"Perception","level":2,"score":0.4287000000476837},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4212000072002411},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38359999656677246},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.3352000117301941},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3325999975204468},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3269999921321869},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.31949999928474426},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.30880001187324524},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.30320000648498535},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29179999232292175},{"id":"https://openalex.org/C72634772","wikidata":"https://www.wikidata.org/wiki/Q386824","display_name":"Data integration","level":2,"score":0.29159998893737793},{"id":"https://openalex.org/C5655090","wikidata":"https://www.wikidata.org/wiki/Q192588","display_name":"Relational database","level":2,"score":0.2863999903202057},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.26429998874664307},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2623000144958496},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.25380000472068787}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3774904.3792201","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3774904.3792201","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Web Conference 2026","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3774904.3792201","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3774904.3792201","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Web Conference 2026","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.6122666001319885,"id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W23257820","https://openalex.org/W1977556410","https://openalex.org/W2122646361","https://openalex.org/W2150847526","https://openalex.org/W2156204309","https://openalex.org/W2747669027","https://openalex.org/W2885157095","https://openalex.org/W2892880750","https://openalex.org/W2947745012","https://openalex.org/W2962703433","https://openalex.org/W2978956219","https://openalex.org/W2998038410","https://openalex.org/W3015650867","https://openalex.org/W3106298483","https://openalex.org/W3212868562","https://openalex.org/W4288057803","https://openalex.org/W4311165940","https://openalex.org/W4312968719","https://openalex.org/W4385565420","https://openalex.org/W4402265033","https://openalex.org/W4402288718","https://openalex.org/W4404278858","https://openalex.org/W4410341709","https://openalex.org/W4410641042"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"represent":[4,55],"sophisticated":[5],"cyberattacks":[6],"that":[7,118,128,173],"evade":[8],"detection":[9],"through":[10],"stealthy,":[11],"multistage":[12],"operations,":[13,68],"posing":[14],"severe":[15],"risks":[16],"to":[17,24,27,54,196],"critical":[18,205],"infrastructure":[19],"and":[20,69,161,183,192,199],"organizational":[21],"security.":[22],"Due":[23],"their":[25],"ability":[26],"effectively":[28,136],"capture":[29,74],"contextual":[30],"information":[31],"of":[32,59,148,155],"attack":[33,79,139,163],"behaviors,":[34],"provenance":[35,51,101],"graphs":[36,52],"have":[37],"emerged":[38],"as":[39],"a":[40,88],"promising":[41],"approach":[42],"for":[43,92,100,181],"APT":[44,60,93,120,185],"detection.":[45,94,186],"However,":[46],"traditional":[47],"binary":[48],"edges":[49],"in":[50,66,110,203],"fail":[53],"the":[56,75,114,142,145],"collaborative":[57,159],"nature":[58],"attacks,":[61],"where":[62,103],"multiple":[63,107,169],"entities":[64,108],"coordinate":[65],"single":[67],"local":[70],"graph":[71],"structures":[72,117],"cannot":[73],"long-range":[76],"dependencies":[77],"across":[78,132,168],"stages.":[80],"To":[81],"address":[82],"these":[83,149],"challenges,":[84],"we":[85,96,123,188],"propose":[86],"HyperDetector,":[87],"novel":[89],"hypergraph-based":[90],"method":[91],"First,":[95],"introduce":[97],"hypergraph":[98,134],"representation":[99],"data,":[102],"hyperedges":[104],"naturally":[105],"connect":[106],"involved":[109],"system":[111],"events,":[112],"preserving":[113],"higher-order":[115],"relational":[116],"characterize":[119],"behaviors.":[121],"Second,":[122],"employ":[124],"block":[125],"self-attention":[126],"mechanisms":[127],"enable":[129],"global":[130],"reasoning":[131],"distant":[133],"regions,":[135],"linking":[137],"dispersed":[138],"indicators":[140],"throughout":[141],"system.":[143],"Through":[144],"synergistic":[146],"integration":[147],"approaches,":[150],"HyperDetector":[151,174],"achieves":[152],"comprehensive":[153],"understanding":[154],"both":[156],"localized":[157],"multi-entity":[158],"behaviors":[160],"system-wide":[162],"propagation":[164],"patterns.":[165],"Extensive":[166],"evaluations":[167],"prominent":[170],"datasets":[171,193],"demonstrate":[172],"outperforms":[175],"state-of-the-art":[176],"methods,":[177],"showcasing":[178],"its":[179],"effectiveness":[180],"robust":[182],"holistic":[184],"Additionally,":[187],"make":[189],"our":[190],"code":[191],"publicly":[194],"available":[195],"facilitate":[197],"reproducibility":[198],"foster":[200],"further":[201],"research":[202],"this":[204],"area.":[206]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-04-28T00:00:00"}