{"id":"https://openalex.org/W7166664656","doi":"https://doi.org/10.7148/2026-0331","title":"Multi-expert ensemble models for cyber adversary behavior prediction","display_name":"Multi-expert ensemble models for cyber adversary behavior prediction","publication_year":2026,"publication_date":"2026-06-23","ids":{"openalex":"https://openalex.org/W7166664656","doi":"https://doi.org/10.7148/2026-0331"},"language":null,"primary_location":{"id":"doi:10.7148/2026-0331","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0331","pdf_url":"https://doi.org/10.7148/2026-0331","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.7148/2026-0331","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042989087","display_name":"Amy Sliva","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Amy Sliva","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139663739","display_name":"Michael Murray","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Michael Murray","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139706269","display_name":"Bailey Gallagher","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bailey Gallagher","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139691387","display_name":"Logan Palys","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Logan Palys","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139646416","display_name":"Stoney Trent","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Stoney Trent","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"331","last_page":"337"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4165000021457672,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4165000021457672,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.10140000283718109,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.07829999923706055,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.6205000281333923},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.5526000261306763},{"id":"https://openalex.org/keywords/automatic-summarization","display_name":"Automatic summarization","score":0.5332000255584717},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.47600001096725464},{"id":"https://openalex.org/keywords/ground-truth","display_name":"Ground truth","score":0.4049000144004822},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3953999876976013},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.3873000144958496},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"Data stream mining","score":0.3675999939441681},{"id":"https://openalex.org/keywords/training-set","display_name":"Training set","score":0.3675999939441681}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.754800021648407},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.6205000281333923},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5526000261306763},{"id":"https://openalex.org/C170858558","wikidata":"https://www.wikidata.org/wiki/Q1394144","display_name":"Automatic summarization","level":2,"score":0.5332000255584717},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.47600001096725464},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4634999930858612},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42980000376701355},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4120999872684479},{"id":"https://openalex.org/C146849305","wikidata":"https://www.wikidata.org/wiki/Q370766","display_name":"Ground truth","level":2,"score":0.4049000144004822},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3953999876976013},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.3873000144958496},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3675999939441681},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.3675999939441681},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.3562000095844269},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.3555000126361847},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3515999913215637},{"id":"https://openalex.org/C119898033","wikidata":"https://www.wikidata.org/wiki/Q3433888","display_name":"Ensemble forecasting","level":2,"score":0.33809998631477356},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.33489999175071716},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.3273000121116638},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.3082999885082245},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.29750001430511475},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.2872999906539917},{"id":"https://openalex.org/C45804977","wikidata":"https://www.wikidata.org/wiki/Q7239673","display_name":"Predictive modelling","level":2,"score":0.2599000036716461},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2574000060558319},{"id":"https://openalex.org/C104122410","wikidata":"https://www.wikidata.org/wiki/Q1416406","display_name":"Network model","level":2,"score":0.2565000057220459},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2529999911785126},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.250900000333786}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.7148/2026-0331","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0331","pdf_url":"https://doi.org/10.7148/2026-0331","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.7148/2026-0331","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0331","pdf_url":"https://doi.org/10.7148/2026-0331","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.7457692623138428,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7166664656.pdf","grobid_xml":"https://content.openalex.org/works/W7166664656.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Security":[0],"Operations":[1],"Centers":[2],"are":[3,12],"currently":[4],"inundated":[5],"with":[6],"high-volume,":[7],"heterogeneous":[8],"data":[9,50,72],"streams":[10],"that":[11,40,74],"extremely":[13],"challenging":[14],"to":[15,18,64,109],"analyze":[16],"cohesively":[17],"make":[19,65],"timely":[20],"cyber":[21],"defense":[22],"decisions.":[23],"In":[24],"this":[25],"paper,":[26],"we":[27],"present":[28],"the":[29,42,87,113,116,120],"Attack":[30],"Summarization":[31],"Model":[32],"(ASM),":[33],"a":[34,70,79,104],"novel":[35],"multi-expert":[36],"ensemble":[37],"neural":[38,46],"network":[39,49],"combines":[41],"power":[43],"of":[44,82,91,106,115,119],"graph":[45],"networks":[47,56],"for":[48,57],"flows":[51],"and":[52,89,98,102,111],"long":[53],"short-term":[54],"memory":[55],"host-based":[58],"events,":[59],"enabling":[60],"each":[61],"expert":[62],"model":[63],"accurate":[66],"predictions":[67],"based":[68],"on":[69],"single":[71],"source":[73],"can":[75],"be":[76],"combined":[77],"into":[78],"holistic":[80],"prediction":[81],"adversary":[83],"behaviors.":[84],"We":[85],"describe":[86],"collection":[88],"engineering":[90],"ground":[92],"truth":[93],"datasets":[94],"using":[95],"networking":[96],"benchmarks":[97],"live":[99],"hacking":[100],"competitions,":[101],"discuss":[103],"set":[105],"simulation":[107],"experiments":[108],"train":[110],"validate":[112],"performance":[114],"individual":[117],"components":[118],"ASM.":[121]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-07-01T00:00:00"}