{"id":"https://openalex.org/W7083815114","doi":"https://doi.org/10.21227/8f3x-gk52","title":"\"A Fine-Grained Labeled Provenance Graph Dataset for Advanced Persistent Threat Detection\"","display_name":"\"A Fine-Grained Labeled Provenance Graph Dataset for Advanced Persistent Threat Detection\"","publication_year":2025,"publication_date":"2025-09-30","ids":{"openalex":"https://openalex.org/W7083815114","doi":"https://doi.org/10.21227/8f3x-gk52"},"language":"en","primary_location":{"id":"doi:10.21227/8f3x-gk52","is_oa":true,"landing_page_url":"https://doi.org/10.21227/8f3x-gk52","pdf_url":null,"source":{"id":"https://openalex.org/S7407051695","display_name":"IEEE DataPort","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"type":"dataset","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.21227/8f3x-gk52","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Yaqin Cao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yaqin Cao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Meng Shen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Meng Shen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Canhua Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Canhua Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Baihang Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Baihang Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Jieshuo Ni","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jieshuo Ni","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Ru Tan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ru Tan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Yuling Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yuling Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"Qixu Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qixu Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T13655","display_name":"Canadian Policy and Governance","score":0.4242999851703644,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T13655","display_name":"Canadian Policy and Governance","score":0.4242999851703644,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T13546","display_name":"Census and Population Estimation","score":0.07750000059604645,"subfield":{"id":"https://openalex.org/subfields/2613","display_name":"Statistics and Probability"},"field":{"id":"https://openalex.org/fields/26","display_name":"Mathematics"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12011","display_name":"Insurance, Mortality, Demography, Risk Management","score":0.039400000125169754,"subfield":{"id":"https://openalex.org/subfields/3317","display_name":"Demography"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.510200023651123},{"id":"https://openalex.org/keywords/annotation","display_name":"Annotation","score":0.45590001344680786},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4453999996185303},{"id":"https://openalex.org/keywords/traceability","display_name":"Traceability","score":0.43720000982284546},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.3968000113964081},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.37700000405311584}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7328000068664551},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5404000282287598},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.510200023651123},{"id":"https://openalex.org/C2776321320","wikidata":"https://www.wikidata.org/wiki/Q857525","display_name":"Annotation","level":2,"score":0.45590001344680786},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4453999996185303},{"id":"https://openalex.org/C153876917","wikidata":"https://www.wikidata.org/wiki/Q899704","display_name":"Traceability","level":2,"score":0.43720000982284546},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.3968000113964081},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.37700000405311584},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3246999979019165},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3093999922275543},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3041999936103821},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2757999897003174},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.27549999952316284},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.2655999958515167}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21227/8f3x-gk52","is_oa":true,"landing_page_url":"https://doi.org/10.21227/8f3x-gk52","pdf_url":null,"source":{"id":"https://openalex.org/S7407051695","display_name":"IEEE DataPort","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Dataset"}],"best_oa_location":{"id":"doi:10.21227/8f3x-gk52","is_oa":true,"landing_page_url":"https://doi.org/10.21227/8f3x-gk52","pdf_url":null,"source":{"id":"https://openalex.org/S7407051695","display_name":"IEEE DataPort","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.718590497970581,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"\"This":[0],"dataset":[1,67],"is":[2,109],"a":[3,75,156,167],"high-fidelity":[4],"resource":[5],"manually":[6,83],"constructed":[7],"for":[8,143,173],"the":[9,44,49,79,112,129,177],"evaluation":[10],"of":[11,27,65,78,98,179],"Provenance-based":[12],"Intrusion":[13],"Detection":[14],"Systems":[15],"(Prov-IDS).":[16],"It":[17],"comprises":[18],"two":[19,53],"main":[20],"components:":[21],"\\\"benign\\\"":[22],"logs":[23,32,93,119,144,161],"collected":[24],"during":[25],"periods":[26],"normal":[28],"system":[29,92,133,160],"usage,":[30],"and":[31,35,52,87,135,162,175],"from":[33,48],"simulated":[34,45],"replicated":[36,55],"complex":[37],"attack":[38,41,80],"scenarios.":[39,61],"The":[40,62],"portion":[42],"includes":[43],"APT-VELES,":[46],"activities":[47],"disclosed":[50],"APT-29,":[51],"other":[54],"typical":[56],"Advanced":[57],"Persistent":[58],"Threat":[59],"(APT)":[60],"core":[63],"feature":[64],"this":[66,107],"lies":[68],"in":[69],"its":[70],"fine-grained":[71],"labeling":[72],"methodology.":[73],"With":[74],"thorough":[76],"understanding":[77],"procedures,":[81],"we":[82],"audited":[84],"each":[85],"log":[86],"precisely":[88],"labeled":[89,145],"only":[90],"those":[91],"that":[94],"bore":[95],"direct":[96],"traces":[97],"attacker":[99],"operations":[100],"as":[101,146,151],"\\\"anomaly.\\\"":[102],"To":[103],"facilitate":[104],"provenance-based":[105],"analysis,":[106],"annotation":[108],"extended":[110],"to":[111,123],"provenance":[113,126,163],"graph":[114,164],"level.":[115],"In":[116],"our":[117],"experiments,":[118],"are":[120,148],"processed":[121],"entry-by-entry":[122],"systematically":[124],"construct":[125],"graphs,":[127],"where":[128],"corresponding":[130],"edges":[131],"(representing":[132],"activities)":[134],"affected":[136],"objects":[137],"(e.g.,":[138],"child":[139],"processes":[140],"or":[141],"files)":[142],"\\\"anomaly\\\"":[147],"also":[149],"annotated":[150],"such.":[152],"This":[153],"approach":[154],"establishes":[155],"clear":[157],"mapping":[158],"between":[159],"elements,":[165],"providing":[166],"ground-truth":[168],"benchmark":[169],"with":[170],"comprehensive":[171],"traceability":[172],"evaluating":[174],"studying":[176],"performance":[178],"Prov-IDS,":[180],"particularly":[181],"concerning":[182],"information":[183],"abuse.\"":[184]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2025-10-10T00:00:00"}