{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T06:02:14Z","timestamp":1785477734144,"version":"3.56.0"},"publisher-location":"Cham","reference-count":25,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032338648","type":"print"},{"value":"9783032338655","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2027]]},"DOI":"10.1007\/978-3-032-33865-5_7","type":"book-chapter","created":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T05:51:05Z","timestamp":1785477065000},"page":"100-115","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Hierarchical Contrastive Learning with\u00a0Explanation-Aware Training for\u00a0Case-Based APT Recognition"],"prefix":"10.1007","author":[{"given":"Wenjie","family":"Liu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhen","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yan","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qian","family":"Tan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Huading","family":"Su","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,8,1]]},"reference":[{"issue":"1","key":"7_CR1","doi-asserted-by":"publisher","first-page":"39","DOI":"10.3233\/AIC-1994-7104","volume":"7","author":"A Aamodt","year":"1994","unstructured":"Aamodt, A., Plaza, E.: Case-based reasoning: foundational issues, methodological variations, and system approaches. AI Commun. 7(1), 39\u201359 (1994)","journal-title":"AI Commun."},{"issue":"2","key":"7_CR2","doi-asserted-by":"publisher","first-page":"1851","DOI":"10.1109\/COMST.2019.2891891","volume":"21","author":"A Alshamrani","year":"2019","unstructured":"Alshamrani, A., Myneni, S., Chowdhary, A., Huang, D.: A survey on advanced persistent threats: techniques, solutions, challenges, and research opportunities. IEEE Commun. Surv. Tutor. 21(2), 1851\u20131877 (2019)","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"7_CR3","unstructured":"Armgaan, B., Jain, E., Pandey, H., Chandran, M., Ranu, S.: Gnnxemplar: exemplars to explanations-natural language rules for global GNN interpretability. arXiv preprint arXiv:2509.18376 (2025)"},{"key":"7_CR4","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102785","volume":"120","author":"PH Barros","year":"2022","unstructured":"Barros, P.H., Chagas, E.T., Oliveira, L.B., Queiroz, F., Ramos, H.S.: Malware-smell: a zero-shot learning strategy for detecting zero-day vulnerabilities. Comput. Secur. 120, 102785 (2022)","journal-title":"Comput. Secur."},{"key":"7_CR5","doi-asserted-by":"crossref","unstructured":"Han, X., Pasquier, T., Bates, A., Mickens, J., Seltzer, M.: Unicorn: runtime provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525 (2020)","DOI":"10.14722\/ndss.2020.24046"},{"key":"7_CR6","doi-asserted-by":"crossref","unstructured":"Hoffmann, M., Malburg, L., Klein, P., Bergmann, R.: Using siamese graph neural networks for similarity-based retrieval in process-oriented case-based reasoning. In: International Conference on Case-Based Reasoning, pp. 229\u2013244. Springer (2020)","DOI":"10.1007\/978-3-030-58342-2_15"},{"key":"7_CR7","doi-asserted-by":"crossref","unstructured":"Hu, Z., Dong, Y., Wang, K., Sun, Y.: Heterogeneous graph transformer. In: Proceedings of the Web Conference 2020, pp. 2704\u20132710 (2020)","DOI":"10.1145\/3366423.3380027"},{"key":"7_CR8","first-page":"18661","volume":"33","author":"P Khosla","year":"2020","unstructured":"Khosla, P., et al.: Supervised contrastive learning. Adv. Neural. Inf. Process. Syst. 33, 18661\u201318673 (2020)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"7_CR9","unstructured":"Kipf, T.N., Welling, M.: Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)"},{"key":"7_CR10","doi-asserted-by":"crossref","unstructured":"Liu, F., et al.: Microcbr: case-based reasoning on spatio-temporal fault knowledge graph for microservices troubleshooting. In: International Conference on Case-Based Reasoning, pp. 224\u2013239. Springer (2022)","DOI":"10.1007\/978-3-031-14923-8_15"},{"key":"7_CR11","doi-asserted-by":"crossref","unstructured":"Lv, M., et al.: TREC: APT tactic\/technique recognition via few-shot provenance subgraph learning. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 139\u2013152 (2024)","DOI":"10.1145\/3658644.3690221"},{"key":"7_CR12","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.: Holmes: real-time apt detection through correlation of suspicious information flows. In: 2019 IEEE Symposium on Security and Privacy (SP), pp. 1137\u20131152. IEEE (2019)","DOI":"10.1109\/SP.2019.00026"},{"key":"7_CR13","unstructured":"Red Canary: Atomic red team. GitHub repository (2025). https:\/\/github.com\/redcanaryco\/atomic-red-team. Accessed 16 Mar 2025"},{"key":"7_CR14","doi-asserted-by":"crossref","unstructured":"Schoenborn, J.M., Althoff, K.D.: A multi-agent case-based reasoning intrusion detection system prototype. In: International Conference on Case-Based Reasoning, pp. 359\u2013374. Springer (2023)","DOI":"10.1007\/978-3-031-40177-0_23"},{"key":"7_CR15","unstructured":"The Kellect Team: Kellect4APT dataset (2025). https:\/\/www.kellect.org\/#\/kellect-4-aptdataset. Accessed 16 Mar 2025"},{"key":"7_CR16","unstructured":"The MITRE Corporation: ATT&CK matrix for enterprise (2025). https:\/\/attack.mitre.org\/. Accessed 16 Mar 2025"},{"key":"7_CR17","unstructured":"Veli\u010dkovi\u0107, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., Bengio, Y.: Graph attention networks. arXiv preprint arXiv:1710.10903 (2017)"},{"key":"7_CR18","doi-asserted-by":"crossref","unstructured":"Wang, H., Hardy, J., Kandah, F.: Case-based reasoning with diffusion model for ransomware detection. In: International Conference on Case-Based Reasoning, pp. 469\u2013483. Springer (2025)","DOI":"10.1007\/978-3-031-96559-3_31"},{"key":"7_CR19","doi-asserted-by":"crossref","unstructured":"Wang, Q., et al.: You are what you do: hunting stealthy malware via data provenance analysis. In: NDSS (2020)","DOI":"10.14722\/ndss.2020.24167"},{"key":"7_CR20","doi-asserted-by":"publisher","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","volume":"17","author":"S Wang","year":"2022","unstructured":"Wang, S., et al.: Threatrace: detecting and tracing host-based threats in node level through provenance graph learning. IEEE Trans. Inf. Forensics Secur. 17, 3972\u20133987 (2022)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"7_CR21","doi-asserted-by":"crossref","unstructured":"Wang, X., et al.: Heterogeneous graph attention network. In: The World Wide Web Conference, pp. 2022\u20132032 (2019)","DOI":"10.1145\/3308558.3313562"},{"key":"7_CR22","doi-asserted-by":"publisher","unstructured":"Wu, C., Sun, J., Chen, J., Alazab, M., Liu, Y., Xiang, Y.: $${\\sf TCG}$$-$${\\sf IDS}$$: robust network intrusion detection via temporal contrastive graph learning. IEEE Trans. Inf. Forensics Secur. 20, 1475\u20131486 (2025). https:\/\/doi.org\/10.1109\/TIFS.2025.3530702","DOI":"10.1109\/TIFS.2025.3530702"},{"key":"7_CR23","unstructured":"Ying, Z., Bourgeois, D., You, J., Zitnik, M., Leskovec, J.: Gnnexplainer: generating explanations for graph neural networks. Adv. Neural. Inf. Process. Syst. 32 (2019)"},{"key":"7_CR24","doi-asserted-by":"publisher","first-page":"3312","DOI":"10.1109\/TIFS.2021.3076288","volume":"16","author":"T Zhu","year":"2021","unstructured":"Zhu, T., et al.: General, efficient, and real-time data compaction strategy for apt forensic analysis. IEEE Trans. Inf. Forensics Secur. 16, 3312\u20133325 (2021)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"7","key":"7_CR25","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3539605","volume":"55","author":"M Zipperle","year":"2022","unstructured":"Zipperle, M., Gottwalt, F., Chang, E., Dillon, T.: Provenance-based intrusion detection systems: a survey. ACM Comput. Surv. 55(7), 1\u201336 (2022)","journal-title":"ACM Comput. Surv."}],"container-title":["Lecture Notes in Computer Science","Case-Based Reasoning Research and Development"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-33865-5_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T05:51:10Z","timestamp":1785477070000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-33865-5_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,1]]},"ISBN":["9783032338648","9783032338655"],"references-count":25,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-33865-5_7","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,1]]},"assertion":[{"value":"1 August 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"During the preparation of this work, the authors used ChatGPT in order to improve language readability, grammar, and spelling. After using this tool\/service, the authors reviewed and edited the content as needed and take full responsibility for the publication\u2019s content.","order":1,"name":"Ethics","label":"Declaration on Generative AI","group":{"name":"EthicsHeading","label":"Ethics"}},{"value":"ICCBR","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Case-Based Reasoning","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Bremen","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Germany","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"13 August 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 August 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"34","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"iccbr2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/2026.iccbr.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}