{"id":"https://openalex.org/W7127639022","doi":"https://doi.org/10.1145/3785520.3785522","title":"GT-FID: A Graph-Temporal Fusion Network for Host-Based Intrusion Detection from System Call Sequences","display_name":"GT-FID: A Graph-Temporal Fusion Network for Host-Based Intrusion Detection from System Call Sequences","publication_year":2025,"publication_date":"2025-11-26","ids":{"openalex":"https://openalex.org/W7127639022","doi":"https://doi.org/10.1145/3785520.3785522"},"language":null,"primary_location":{"id":"doi:10.1145/3785520.3785522","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3785520.3785522","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 10th International Conference on Cloud Computing and Internet of Things","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3785520.3785522","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5124344022","display_name":"Phuc Hao Do","orcid":null},"institutions":[{"id":"https://openalex.org/I37355250","display_name":"Saint-Petersburg State University of Telecommunications","ror":"https://ror.org/00pcyc255","country_code":"RU","type":"education","lineage":["https://openalex.org/I37355250"]}],"countries":["RU"],"is_corresponding":false,"raw_author_name":"Phuc Hao Do","raw_affiliation_strings":["Bonch-Bruevich Saint Petersburg State University of Telecommunications, Saint Petersburg, Russian Federation and Danang Architecture University, DaNang, Vietnam"],"raw_orcid":"https://orcid.org/0000-0003-0645-0021","affiliations":[{"raw_affiliation_string":"Bonch-Bruevich Saint Petersburg State University of Telecommunications, Saint Petersburg, Russian Federation and Danang Architecture University, DaNang, Vietnam","institution_ids":["https://openalex.org/I37355250"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038961438","display_name":"Tran Duc Le","orcid":"https://orcid.org/0000-0003-3735-0314"},"institutions":[{"id":"https://openalex.org/I1921588","display_name":"University of Wisconsin\u2013Stout","ror":"https://ror.org/01gb8pc70","country_code":"US","type":"education","lineage":["https://openalex.org/I1921588"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tran Duc Le","raw_affiliation_strings":["Department of Mathematics, Statistics & Computer Science, University of Wisconsin\u2013Stout, Menomonie, USA"],"raw_orcid":"https://orcid.org/0000-0003-3735-0314","affiliations":[{"raw_affiliation_string":"Department of Mathematics, Statistics & Computer Science, University of Wisconsin\u2013Stout, Menomonie, USA","institution_ids":["https://openalex.org/I1921588"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041417996","display_name":"Truong Duy Dinh","orcid":"https://orcid.org/0000-0002-9993-9792"},"institutions":[{"id":"https://openalex.org/I4210095603","display_name":"Vietnam Posts and Telecommunications Group (Vietnam)","ror":"https://ror.org/00q0e7f94","country_code":"VN","type":"company","lineage":["https://openalex.org/I4210095603"]},{"id":"https://openalex.org/I4400600977","display_name":"Posts and Telecommunications Institute of Technology","ror":"https://ror.org/0363rtq22","country_code":null,"type":"education","lineage":["https://openalex.org/I4400600977"]}],"countries":["VN"],"is_corresponding":false,"raw_author_name":"Truong Duy Dinh","raw_affiliation_strings":["Posts and Telecommunications Institute of Technology, Hanoi, Vietnam"],"raw_orcid":"https://orcid.org/0000-0002-9993-9792","affiliations":[{"raw_affiliation_string":"Posts and Telecommunications Institute of Technology, Hanoi, Vietnam","institution_ids":["https://openalex.org/I4210095603","https://openalex.org/I4400600977"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017967256","display_name":"Van Dai Pham","orcid":"https://orcid.org/0000-0003-1363-0784"},"institutions":[{"id":"https://openalex.org/I109689652","display_name":"FPT University","ror":"https://ror.org/03esj4g97","country_code":"VN","type":"education","lineage":["https://openalex.org/I109689652"]}],"countries":["VN"],"is_corresponding":false,"raw_author_name":"Van Dai Pham","raw_affiliation_strings":["FPT University, Hanoi, Vietnam"],"raw_orcid":"https://orcid.org/0000-0003-1363-0784","affiliations":[{"raw_affiliation_string":"FPT University, Hanoi, Vietnam","institution_ids":["https://openalex.org/I109689652"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5125042783","display_name":"Thi Le Quyen Nguyen","orcid":null},"institutions":[{"id":"https://openalex.org/I848706","display_name":"Sungkyunkwan University","ror":"https://ror.org/04q78tk20","country_code":"KR","type":"education","lineage":["https://openalex.org/I848706"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Thi Le Quyen Nguyen","raw_affiliation_strings":["Sungkyunkwan University, Seoul, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0003-2978-6345","affiliations":[{"raw_affiliation_string":"Sungkyunkwan University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I848706"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.67112376,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"7","last_page":"14"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8973000049591064,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8973000049591064,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.017000000923871994,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.01640000008046627,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7297000288963318},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.46799999475479126},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.4650000035762787},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.41130000352859497},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.4020000100135803},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.3955000042915344},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.36469998955726624}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7297000288963318},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7224000096321106},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5740000009536743},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4853000044822693},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.46799999475479126},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.4650000035762787},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4196000099182129},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.41130000352859497},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.4020000100135803},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.3955000042915344},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.36469998955726624},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3504999876022339},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3208000063896179},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.3111000061035156},{"id":"https://openalex.org/C158525013","wikidata":"https://www.wikidata.org/wiki/Q2593739","display_name":"Fusion","level":2,"score":0.2897999882698059},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2637999951839447},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2563999891281128},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.2556000053882599}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3785520.3785522","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3785520.3785522","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 10th International Conference on Cloud Computing and Internet of Things","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3785520.3785522","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3785520.3785522","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 10th International Conference on Cloud Computing and Internet of Things","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W1109422923","https://openalex.org/W1975539049","https://openalex.org/W2167240430","https://openalex.org/W2952078967","https://openalex.org/W3014407644","https://openalex.org/W3136767761","https://openalex.org/W4388675532","https://openalex.org/W4391481650","https://openalex.org/W4391944556","https://openalex.org/W4401370664","https://openalex.org/W4401410618","https://openalex.org/W4401751871","https://openalex.org/W4401888689","https://openalex.org/W4404030095","https://openalex.org/W4404031313","https://openalex.org/W4407788042","https://openalex.org/W4409156599","https://openalex.org/W4411358762"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"pose":[4],"a":[5,45,54,65,87,93,119,131],"significant":[6],"challenge":[7],"to":[8,20,60],"cybersecurity,":[9],"as":[10],"their":[11],"sophisticated":[12],"strategies":[13],"often":[14],"evade":[15],"traditional":[16],"detectors":[17],"that":[18,70,112],"fail":[19],"capture":[21],"complex":[22,127],"temporal":[23,114],"and":[24,92,105,115,122],"structural":[25,72,116],"patterns":[26],"in":[27],"system":[28],"call":[29,77],"sequences.":[30],"To":[31],"address":[32],"this":[33],"gap,":[34],"we":[35],"propose":[36],"the":[37,81],"Graph-Temporal":[38],"Fusion":[39],"Network":[40,68],"for":[41,125,134],"Intrusion":[42],"Detection":[43],"(GT-FID),":[44],"novel":[46],"dual-branch":[47],"deep":[48],"learning":[49],"architecture.":[50],"GT-FID":[51,85],"synergistically":[52],"integrates":[53],"Long":[55],"Short-Term":[56],"Memory":[57],"(LSTM)":[58],"network":[59],"model":[61],"time-ordered":[62],"dependencies":[63],"with":[64],"Graph":[66],"Neural":[67],"(GNN)":[69],"analyzes":[71],"relationships":[73],"within":[74],"dynamically":[75],"constructed":[76],"graphs.":[78],"Evaluated":[79],"on":[80],"public":[82],"ADFA-LD":[83],"dataset,":[84],"achieves":[86],"test":[88],"accuracy":[89],"of":[90,96],"0.9622":[91],"Macro-Averaged":[94],"F1-Score":[95],"0.95,":[97],"significantly":[98],"outperforming":[99],"strong":[100],"baselines":[101],"including":[102],"GRU":[103],"(0.9462)":[104],"Transformer":[106],"(0.9563)":[107],"models.":[108],"These":[109],"results":[110],"demonstrate":[111],"fusing":[113],"features":[117],"provides":[118],"more":[120],"robust":[121],"effective":[123],"representation":[124],"detecting":[126],"attack":[128],"patterns,":[129],"establishing":[130],"promising":[132],"direction":[133],"future":[135],"host-based":[136],"intrusion":[137],"detection":[138],"systems.":[139]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-02-06T00:00:00"}