{"id":"https://openalex.org/W7150879351","doi":"https://doi.org/10.48550/arxiv.2604.03104","title":"AlertStar: Path-Aware Alert Prediction on Hyper-Relational Knowledge Graphs","display_name":"AlertStar: Path-Aware Alert Prediction on Hyper-Relational Knowledge Graphs","publication_year":2026,"publication_date":"2026-04-03","ids":{"openalex":"https://openalex.org/W7150879351","doi":"https://doi.org/10.48550/arxiv.2604.03104"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.03104","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.03104","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.03104","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5070256974","display_name":"Zahra Makki Nayeri","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nayeri, Zahra Makki","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133054527","display_name":"Mohsen Rezvani","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rezvani, Mohsen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.6805999875068665,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.6805999875068665,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.09920000284910202,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.03620000183582306,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/tree-traversal","display_name":"Tree traversal","score":0.6004999876022339},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.5831000208854675},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5220999717712402},{"id":"https://openalex.org/keywords/knowledge-graph","display_name":"Knowledge graph","score":0.4359999895095825},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.415800005197525},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.39320001006126404},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.35260000824928284},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3499000072479248}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7560999989509583},{"id":"https://openalex.org/C140745168","wikidata":"https://www.wikidata.org/wiki/Q1210082","display_name":"Tree traversal","level":2,"score":0.6004999876022339},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.5831000208854675},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5220999717712402},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.4359999895095825},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.41999998688697815},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.415800005197525},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.39320001006126404},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.38679999113082886},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.35260000824928284},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3499000072479248},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3386000096797943},{"id":"https://openalex.org/C30542707","wikidata":"https://www.wikidata.org/wiki/Q1603203","display_name":"Commonsense knowledge","level":3,"score":0.3264999985694885},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.3212999999523163},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.2994000017642975},{"id":"https://openalex.org/C178005623","wikidata":"https://www.wikidata.org/wiki/Q308859","display_name":"Anonymity","level":2,"score":0.28369998931884766},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2833000123500824},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.27889999747276306},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2775000035762787},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.27459999918937683},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.26600000262260437},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2632000148296356},{"id":"https://openalex.org/C2777026412","wikidata":"https://www.wikidata.org/wiki/Q2684591","display_name":"Statement (logic)","level":2,"score":0.25040000677108765}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.03104","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.03104","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.03104","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.03104","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7045902609825134,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cyber-attacks":[0],"continue":[1],"to":[2,120,182],"grow":[3],"in":[4,155],"scale":[5],"and":[6,64,68,76,86,138,150,160,164,194,210,218,224,234],"sophistication,":[7],"yet":[8],"existing":[9],"network":[10,31,52],"intrusion":[11],"detection":[12],"approaches":[13],"lack":[14],"the":[15,73,121,170,201,208],"semantic":[16],"depth":[17],"required":[18],"for":[19,241],"path":[20,127,152,162,239],"reasoning":[21,199],"over":[22,200],"attacker-victim":[23],"interactions.":[24],"We":[25,104],"address":[26],"this":[27,101],"by":[28],"first":[29],"modelling":[30],"alerts":[32],"as":[33,42,54,82],"a":[34,43,55,141],"knowledge":[35,45,174,203],"graph,":[36],"then":[37],"formulating":[38],"hyper-relational":[39,44,122,242],"alert":[40,53,202,243],"prediction":[41],"graph":[46,175],"completion":[47],"(HR-KGC)":[48],"problem,":[49],"representing":[50],"each":[51],"qualified":[56],"statement":[57],"(h,":[58,95],"r,":[59,96],"t,":[60],"Q),":[61],"where":[62],"h":[63],"t":[65],"are":[66],"source":[67],"destination":[69],"IPs,":[70],"r":[71],"denotes":[72],"attack":[74,87],"type,":[75],"Q":[77],"encodes":[78],"flow-level":[79],"metadata":[80],"such":[81],"timestamps,":[83],"ports,":[84],"protocols,":[85],"intensity,":[88],"going":[89],"beyond":[90],"standard":[91],"KGC":[92],"binary":[93],"triples":[94],"t)":[97],"that":[98,227],"would":[99],"discard":[100],"contextual":[102],"richness.":[103],"introduce":[105],"five":[106],"models":[107],"across":[108,213],"three":[109,214],"contributions:":[110],"first,":[111],"Hyper-relational":[112],"Neural":[113,117],"Bellman-Ford":[114,118],"(HR-NBFNet)":[115],"extends":[116,179],"Networks":[119],"setting":[123],"with":[124],"qualifier-aware":[125,180],"multi-hop":[126],"reasoning,":[128],"while":[129],"its":[130,165],"multi-task":[131,166],"variant":[132],"MT-HR-NBFNet":[133],"jointly":[134],"predicts":[135],"tail,":[136],"relation,":[137],"qualifier-value":[139],"within":[140],"single":[142],"traversal":[143],"pass;":[144],"second,":[145],"AlertStar":[146,217],"fuses":[147],"qualifier":[148,229],"context":[149],"structural":[151],"information":[153],"entirely":[154],"embedding":[156],"space":[157],"via":[158],"cross-attention":[159],"learned":[161],"composition,":[163],"extension":[167],"MT-AlertStar":[168,219],"eliminates":[169],"overhead":[171],"of":[172],"full":[173],"propagation;":[176],"third,":[177],"HR-NBFNet-CQ":[178],"representations":[181],"answer":[183],"complex":[184],"first-order":[185],"logic":[186],"queries,":[187],"including":[188],"one-hop,":[189],"two-hop":[190],"chain,":[191],"two-anchor":[192],"intersection,":[193],"union,":[195],"enabling":[196],"multi-condition":[197],"threat":[198],"graph.":[204],"Evaluated":[205],"inductively":[206],"on":[207],"Warden":[209],"UNSW-NB15":[211],"benchmarks":[212],"qualifier-density":[215],"regimes,":[216],"achieve":[220],"superior":[221],"MR,":[222],"MRR,":[223],"Hits@k,":[225],"demonstrating":[226],"local":[228],"fusion":[230],"is":[231],"both":[232],"sufficient":[233],"more":[235],"efficient":[236],"than":[237],"global":[238],"propagation":[240],"prediction.":[244]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-04-07T00:00:00"}