{"id":"https://openalex.org/W7140141393","doi":"https://doi.org/10.48550/arxiv.2603.19658","title":"ProHunter: A Comprehensive APT Hunting System Based on Whole-System Provenance","display_name":"ProHunter: A Comprehensive APT Hunting System Based on Whole-System Provenance","publication_year":2026,"publication_date":"2026-03-20","ids":{"openalex":"https://openalex.org/W7140141393","doi":"https://doi.org/10.48550/arxiv.2603.19658"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.19658","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.19658","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.19658","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5130371803","display_name":"Xuebo Qiu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qiu, Xuebo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130405104","display_name":"Mingqi Lv","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lv, Mingqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129588125","display_name":"Yimei Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Yimei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130336632","display_name":"Tiantian Zhu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhu, Tiantian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5130341438","display_name":"Tieming Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Tieming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.10580000281333923,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.10580000281333923,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.09369999915361404,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.09130000323057175,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/provenance","display_name":"Provenance","score":0.6514000296592712},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.44020000100135803},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.39100000262260437},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.3871000111103058},{"id":"https://openalex.org/keywords/semantic-web","display_name":"Semantic Web","score":0.34139999747276306},{"id":"https://openalex.org/keywords/segmentation","display_name":"Segmentation","score":0.3181000053882599},{"id":"https://openalex.org/keywords/semantic-search","display_name":"Semantic search","score":0.30559998750686646}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7193999886512756},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.6514000296592712},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.44020000100135803},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.40639999508857727},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4059999883174896},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.39100000262260437},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3871000111103058},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.34139999747276306},{"id":"https://openalex.org/C89600930","wikidata":"https://www.wikidata.org/wiki/Q1423946","display_name":"Segmentation","level":2,"score":0.3181000053882599},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3179999887943268},{"id":"https://openalex.org/C166423231","wikidata":"https://www.wikidata.org/wiki/Q1891170","display_name":"Semantic search","level":3,"score":0.30559998750686646},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.3034999966621399},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.30239999294281006},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.290800005197525},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2736000120639801},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C75165309","wikidata":"https://www.wikidata.org/wiki/Q2258979","display_name":"Search engine indexing","level":2,"score":0.2653000056743622},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.26159998774528503},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.26089999079704285},{"id":"https://openalex.org/C52146309","wikidata":"https://www.wikidata.org/wiki/Q7431116","display_name":"Schema (genetic algorithms)","level":2,"score":0.2581999897956848}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.19658","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.19658","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.19658","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.19658","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/1","display_name":"No poverty","score":0.4907987117767334}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"remain":[4],"difficult":[5],"to":[6,9,67,83,105,176],"detect":[7],"due":[8,66,82,104],"their":[10,84,106],"stealthy":[11],"nature":[12],"and":[13,41,63,90,101,120,149,184,192,206,219,234],"long-term":[14,143],"persistence.":[15],"To":[16,110,130,154],"tackle":[17],"this":[18,114],"challenge,":[19],"provenance-based":[20,122],"threat":[21,160,227],"hunting":[22,124,228],"has":[23],"gained":[24],"traction":[25],"as":[26,36],"a":[27,37,127,136,158],"proactive":[28],"defense":[29],"mechanism.":[30],"This":[31],"technique":[32],"models":[33],"audit":[34],"logs":[35],"whole-system":[38],"provenance":[39,71,80,102,144,173,185],"graph":[40,161,190],"searches":[42],"for":[43],"subgraphs":[44],"that":[45,140,223],"match":[46],"APT":[47,77,123,156,212],"patterns":[48,171],"recorded":[49],"in":[50,230],"Cyber":[51],"Threat":[52],"Intelligence":[53],"(CTI)":[54],"reports.":[55],"However,":[56],"several":[57],"limitations":[58],"persist:":[59],"1)":[60],"significant":[61],"memory":[62],"time":[64],"overhead":[65],"the":[68,178,197],"extremely":[69],"large":[70],"graphs;":[72],"2)":[73],"imprecise":[74],"segmentation":[75],"of":[76,94,199,232],"activities":[78],"from":[79,172,214],"graphs":[81,100,103,145,183],"intricate":[85],"entanglement":[86],"with":[87,126],"benign":[88],"operations;":[89],"3)":[91],"poor":[92],"alignment":[93],"attack":[95,170,201],"representations":[96],"between":[97,181],"CTI-derived":[98,182],"query":[99],"substantial":[107],"semantic":[108,147,179],"gaps.":[109],"address":[111],"these":[112],"limitations,":[113],"paper":[115],"presents":[116],"ProHunter,":[117],"an":[118],"efficient":[119],"accurate":[121],"system":[125,132],"platform-independent":[128],"design.":[129],"minimize":[131],"overhead,":[133],"ProHunter":[134,187,224],"creates":[135],"compact":[137],"data":[138],"structure":[139],"efficiently":[141],"stores":[142],"using":[146],"abstraction":[148],"bit-level":[150],"hierarchical":[151],"encoding":[152],"strategies.":[153],"segment":[155],"behaviors,":[157],"heuristic-driven":[159],"sampling":[162],"algorithm":[163],"is":[164,238],"designed,":[165],"which":[166],"can":[167],"extract":[168],"precise":[169],"graphs.":[174],"Furthermore,":[175],"bridge":[177],"gaps":[180],"graphs,":[186],"proposes":[188],"adaptive":[189],"representation":[191],"feature":[193],"enhancement":[194],"methods,":[195],"enabling":[196],"extraction":[198],"consistent":[200],"semantics":[202],"at":[203,240],"both":[204],"localized":[205],"globalized":[207],"levels.Extensive":[208],"evaluations":[209],"on":[210],"real-world":[211],"campaigns":[213],"DARPA":[215],"TC":[216],"E3,":[217],"E5":[218],"OpTC":[220],"datasets":[221],"demonstrate":[222],"outperforms":[225],"state-of-the-art":[226],"systems":[229],"terms":[231],"efficiency":[233],"accuracy.":[235],"Our":[236],"code":[237],"available":[239],"https://github.com/xueboQiu/ProHunter.":[241]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-03-24T00:00:00"}