{"id":"https://openalex.org/W7154569430","doi":"https://doi.org/10.1145/3803525.3804991","title":"From Anomaly to Attack Path: LLM-Based Network Traffic Investigation for APT Detection","display_name":"From Anomaly to Attack Path: LLM-Based Network Traffic Investigation for APT Detection","publication_year":2026,"publication_date":"2026-04-16","ids":{"openalex":"https://openalex.org/W7154569430","doi":"https://doi.org/10.1145/3803525.3804991"},"language":null,"primary_location":{"id":"doi:10.1145/3803525.3804991","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3803525.3804991","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th European Workshop on Systems Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3803525.3804991","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120354501","display_name":"Benedikt Pletzer","orcid":null},"institutions":[{"id":"https://openalex.org/I120163777","display_name":"OTH Regensburg","ror":"https://ror.org/04b9vrm74","country_code":"DE","type":"education","lineage":["https://openalex.org/I120163777"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Benedikt Pletzer","raw_affiliation_strings":["Laboratory for Safe and Secure Systems, OTH Regensburg, Regensburg, Bayern, Germany"],"raw_orcid":"https://orcid.org/0009-0005-5088-5681","affiliations":[{"raw_affiliation_string":"Laboratory for Safe and Secure Systems, OTH Regensburg, Regensburg, Bayern, Germany","institution_ids":["https://openalex.org/I120163777"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5110764231","display_name":"Juergen Mottok","orcid":"https://orcid.org/0000-0002-7727-2448"},"institutions":[{"id":"https://openalex.org/I120163777","display_name":"OTH Regensburg","ror":"https://ror.org/04b9vrm74","country_code":"DE","type":"education","lineage":["https://openalex.org/I120163777"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"J\u00fcrgen Mottok","raw_affiliation_strings":["Laboratory for Safe and Secure Systems, OTH Regensburg, Regensburg, Bayern, Germany"],"raw_orcid":"https://orcid.org/0000-0002-7727-2448","affiliations":[{"raw_affiliation_string":"Laboratory for Safe and Secure Systems, OTH Regensburg, Regensburg, Bayern, Germany","institution_ids":["https://openalex.org/I120163777"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I120163777"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"10","last_page":"16"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7538999915122986,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7538999915122986,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.03889999911189079,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.03550000116229057,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7124000191688538},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6985999941825867},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.5460000038146973},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.5105000138282776},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.461899995803833},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4410000145435333},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.36469998955726624},{"id":"https://openalex.org/keywords/limit","display_name":"Limit (mathematics)","score":0.3319000005722046}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7325999736785889},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7124000191688538},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6985999941825867},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.5460000038146973},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.535099983215332},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.5105000138282776},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.461899995803833},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4410000145435333},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.36469998955726624},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33489999175071716},{"id":"https://openalex.org/C151201525","wikidata":"https://www.wikidata.org/wiki/Q177239","display_name":"Limit (mathematics)","level":2,"score":0.3319000005722046},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.32739999890327454},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32359999418258667},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3221000134944916},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3158999979496002},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.2962000072002411},{"id":"https://openalex.org/C74256435","wikidata":"https://www.wikidata.org/wiki/Q134052","display_name":"Flood myth","level":2,"score":0.28949999809265137},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.2847000062465668},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.27889999747276306},{"id":"https://openalex.org/C29825287","wikidata":"https://www.wikidata.org/wiki/Q1427940","display_name":"Warning system","level":2,"score":0.2784000039100647},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.27410000562667847},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2662000060081482},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.25690001249313354},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.25619998574256897},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.25609999895095825},{"id":"https://openalex.org/C81877898","wikidata":"https://www.wikidata.org/wiki/Q1965787","display_name":"Network monitoring","level":2,"score":0.25049999356269836}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3803525.3804991","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3803525.3804991","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th European Workshop on Systems Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3803525.3804991","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3803525.3804991","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th European Workshop on Systems Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure","score":0.6726861596107483}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W3212213895","https://openalex.org/W4226060502","https://openalex.org/W4309395891","https://openalex.org/W4383898261","https://openalex.org/W4388886073","https://openalex.org/W4389072658","https://openalex.org/W4393063446","https://openalex.org/W4399307557","https://openalex.org/W4401752687","https://openalex.org/W4403753869","https://openalex.org/W4404731747","https://openalex.org/W4407406741","https://openalex.org/W4409261757","https://openalex.org/W4411119405","https://openalex.org/W4411160542","https://openalex.org/W4413434360","https://openalex.org/W4415318217","https://openalex.org/W4416035110","https://openalex.org/W4416284487","https://openalex.org/W4416549364","https://openalex.org/W4417261870","https://openalex.org/W7110452706"],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"pose":[4],"a":[5,40,48,86,96],"growing":[6],"challenge":[7],"to":[8,62,99],"critical":[9],"infrastructure":[10],"security.":[11],"Their":[12],"extended":[13],"timescales,":[14],"stealth,":[15],"and":[16,35,67,82,155],"multi-stage":[17],"tactics":[18],"limit":[19],"the":[20,80,101,105,109,114],"effectiveness":[21],"of":[22,42,128],"traditional":[23],"Network":[24],"Intrusion":[25],"Detection":[26],"Systems":[27],"(NIDS),":[28],"as":[29],"signature-based":[30],"methods":[31],"miss":[32],"novel":[33],"techniques":[34],"anomaly":[36,53],"detection":[37,54,131],"alone":[38],"produce":[39],"flood":[41],"low-confidence,":[43],"low-specificity":[44],"events.":[45],"We":[46,137],"propose":[47],"system":[49,115],"that":[50,113],"combines":[51],"unsupervised":[52],"with":[55],"automated,":[56],"large":[57],"language":[58,89,144],"model":[59],"(LLM)-driven":[60],"investigation":[61],"analyze":[63],"suspicious":[64],"network":[65],"flows":[66,75,120],"reconstruct":[68,100],"attack":[69,102,135],"paths":[70],"from":[71],"network-level":[72],"observations.":[73],"Flagged":[74],"are":[76,93],"examined":[77],"at":[78],"both":[79],"feature":[81],"payload":[83],"level":[84],"using":[85],"locally":[87],"hosted":[88],"model.":[90],"Investigation":[91],"results":[92],"aggregated":[94],"in":[95,146],"graph":[97],"database":[98],"progression":[103],"through":[104],"network.":[106],"Evaluation":[107],"on":[108],"CICAPT-IIoT":[110],"dataset":[111],"shows":[112],"identifies":[116],"all":[117],"labeled":[118],"malicious":[119,153],"while":[121],"uncovering":[122],"mislabeled":[123],"traffic":[124],"containing":[125],"clear":[126],"indicators":[127],"compromise,":[129],"suggesting":[130],"capability":[132],"without":[133],"prior":[134],"knowledge.":[136],"further":[138],"discuss":[139],"risks":[140],"introduced":[141],"by":[142],"deploying":[143],"models":[145],"security-critical":[147],"applications,":[148],"including":[149],"prompt":[150],"injection":[151],"via":[152],"payloads":[154],"data":[156],"poisoning":[157],"attacks.":[158]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-04-17T00:00:00"}