{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T09:09:14Z","timestamp":1784365754058,"version":"3.55.0"},"publisher-location":"Singapore","reference-count":34,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819234226","type":"print"},{"value":"9789819234233","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,7,19]],"date-time":"2026-07-19T00:00:00Z","timestamp":1784419200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,7,19]],"date-time":"2026-07-19T00:00:00Z","timestamp":1784419200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2027]]},"DOI":"10.1007\/978-981-92-3423-3_22","type":"book-chapter","created":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T08:46:37Z","timestamp":1784364397000},"page":"268-279","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Causality-Driven Cascaded Collaboration Framework for Interpretable APT Detection"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-6027-9900","authenticated-orcid":false,"given":"Yuling","family":"Huang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-6249-7152","authenticated-orcid":false,"given":"Ying","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-5240-2371","authenticated-orcid":false,"given":"Shanpeng","family":"Lv","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,7,19]]},"reference":[{"issue":"12","key":"22_CR1","doi-asserted-by":"publisher","first-page":"92","DOI":"10.1109\/MC.2020.3021548","volume":"53","author":"Q Zou","year":"2020","unstructured":"Zou, Q., Sun, X., Liu, P., Singhal, A.: An approach for detection of advanced persistent threat attacks. IEEE Comput. 53(12), 92\u201396 (2020)","journal-title":"IEEE Comput."},{"issue":"6","key":"22_CR2","doi-asserted-by":"publisher","first-page":"324","DOI":"10.1109\/MNET.2024.3389734","volume":"38","author":"Y Wang","year":"2024","unstructured":"Wang, Y., Liu, H., Li, Z., et al.: Combating advanced persistent threats: challenges and solutions. IEEE Network 38(6), 324\u2013333 (2024)","journal-title":"IEEE Network"},{"issue":"10","key":"22_CR3","doi-asserted-by":"publisher","first-page":"1910809","DOI":"10.1007\/s11704-024-40610-8","volume":"19","author":"F Xu","year":"2025","unstructured":"Xu, F., Zhao, Q., Liu, X., Wang, N., Zhang, D.: Advanced persistent threat detection via mining long-term features in provenance graphs. Front. Comp. Sci. 19(10), 1910809 (2025)","journal-title":"Front. Comp. Sci."},{"key":"22_CR4","doi-asserted-by":"publisher","first-page":"5257","DOI":"10.1109\/TIFS.2024.3396390","volume":"19","author":"A Aly","year":"2024","unstructured":"Aly, A., Iqbal, S., Youssef, A., Mansour, E.: MEGR-APT: a memory-efficient APT hunting system based on attack representation learning. IEEE Trans. Inf. Forensics Secur. 19, 5257\u20135271 (2024)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"22_CR5","doi-asserted-by":"crossref","unstructured":"Milajerdi, S.M., Eshete, B., Gjomemo, R., Venkatakrishnan, V.N.: POIROT: aligning attack behavior with kernel audit records for cyber threat hunting. Proc. ACM CCS. 1795--1812 (2019)","DOI":"10.1145\/3319535.3363217"},{"key":"22_CR6","doi-asserted-by":"crossref","unstructured":"Wei, R., Cai, L., Yu, A., Meng, D.: DeepHunter: a graph neural network-based approach for robust cyber threat hunting. In: Proceedings of SecureCommunication, pp. 3\u201324 (2021)","DOI":"10.1007\/978-3-030-90019-9_1"},{"key":"22_CR7","doi-asserted-by":"crossref","unstructured":"Qiu, X., et al.: Provenance-based intrusion detection via multi-scale graph representation learning. In: Proceedings of ICICS, pp. 531\u2013549 (2025)","DOI":"10.1007\/978-981-95-3543-9_29"},{"key":"22_CR8","doi-asserted-by":"crossref","unstructured":"Lv, Y., Qin, S., Zhu, Z., et al.: A review of provenance graph-based APT attack detection. In: Proceedings of IEEE DSC, pp. 498--505 (2022)","DOI":"10.1109\/DSC55868.2022.00075"},{"issue":"1","key":"22_CR9","first-page":"1","volume":"45","author":"J Yi-Mu","year":"2025","unstructured":"Yi-Mu, J., et al.: Survey of advanced persistent threat detection and analysis. J. Nanjing Univ. Posts Telecom. (Nat. Sci.) 45(1), 1\u201311 (2025)","journal-title":"J. Nanjing Univ. Posts Telecom. (Nat. Sci.)"},{"key":"22_CR10","unstructured":"Qin, T., Walker, B., Lyons, T., Yan, H., Li, H.: Learning dynamic graph embeddings with neural controlled differential equations. arXiv Preprint arXiv:2302.11354 (2023)"},{"key":"22_CR11","unstructured":"Rossi, E., Chamberlain, B., Frasca, F., Eynard, D., Monti, F., Bronstein, M.: Temporal graph networks for deep learning on dynamic graphs. arXiv Preprint arXiv:2006.10637 (2020)"},{"key":"22_CR12","unstructured":"Pareja, A., et al.: EvolveGCN: evolving graph convolutional networks for dynamic graphs. arXiv Preprint arXiv:1902.10191 (2019)"},{"key":"22_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104578","volume":"157","author":"M Suarez-Roman","year":"2025","unstructured":"Suarez-Roman, M., Tapiador, J.: Attack structure matters: causality-preserving metrics for provenance-based intrusion detection systems. Comput. Secur. 157, 104578 (2025)","journal-title":"Comput. Secur."},{"issue":"1","key":"22_CR14","doi-asserted-by":"publisher","first-page":"289","DOI":"10.1146\/annurev-statistics-040120-010930","volume":"9","author":"A Shojaie","year":"2022","unstructured":"Shojaie, A., Fox, E.B.: Granger causality: a review and recent advances. Ann. Rev. Stat. Appl. 9(1), 289\u2013319 (2022)","journal-title":"Ann. Rev. Stat. Appl."},{"key":"22_CR15","unstructured":"Lippe, P., Magliacane, S., Lowe, S., Asano, Y.M., Cohen, T., Gavves, E.: CITRIS: causal identifiability from temporal intervened sequences. arXiv Preprint arXiv:2202.03169 (2022)"},{"key":"22_CR16","unstructured":"Ahuja, K., Mahajan, D., Wang, Y., Bengio, Y.: Interventional causal representation learning. In: Proceedings of ICML. PMLR, vol. 202, pp. 372-407 (2023)"},{"key":"22_CR17","unstructured":"Longa, A., Lachi, V., Santin, G., Di Gangi, M.: Graph neural networks for temporal graphs: state of the art, open challenges, and opportunities. arXiv Preprint arXiv:2302.01018 (2023)"},{"key":"22_CR18","doi-asserted-by":"crossref","unstructured":"Della Penna, S., Natella, R., Orbinato, V., Paudice, A., Aniello, L.: CTI-HAL: a human-annotated dataset for cyber threat intelligence analysis. In: Proceedings of IEEE EuroS&PW, pp. 69\u201378 (2025)","DOI":"10.1109\/EuroSPW67616.2025.00014"},{"key":"22_CR19","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104120","volume":"148","author":"I Mouiche","year":"2025","unstructured":"Mouiche, I., Saad, S.: Entity and relation extraction for threat intelligence knowledge graphs. Comput. Secur. 148, 104120 (2025)","journal-title":"Comput. Secur."},{"key":"22_CR20","doi-asserted-by":"crossref","unstructured":"Wu, H., Yuan, Y., Mikaelyan, L., Li, Z., Ren, X.: Learning to extract structured entities using language models. In: Proceedings of EMNLP, pp. 6817\u20136834 (2024)","DOI":"10.18653\/v1\/2024.emnlp-main.388"},{"key":"22_CR21","unstructured":"Yang, F., et al.: PROGRAPHER: An anomaly detection system based on provenance graph embedding. In: Proceedings of USENIX Security, pp. 4355\u20134372 (2023)"},{"key":"22_CR22","doi-asserted-by":"crossref","unstructured":"Che Mat, N.I., Jamil, N., Yusoff, Y., Shariff, N.M., Omar, S.: A systematic literature review on advanced persistent threat behaviors and detection strategies. J. Cybersecur. 10(1) (2024)","DOI":"10.1093\/cybsec\/tyad023"},{"key":"22_CR23","doi-asserted-by":"crossref","unstructured":"Su, Y., Zhao, Y., Niu, C., Liu, R., Sun, W., Pei, D.: Robust anomaly detection for multivariate time series through stochastic recurrent neural networks. In: Proceedings of 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), Anchorage, AK, USA, pp. 2828\u20132837 (2019)","DOI":"10.1145\/3292500.3330672"},{"key":"22_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2025.127379","volume":"278","author":"J Lee","year":"2025","unstructured":"Lee, J., Lee, J., Kim, S.B.: Uncertainty-informed dynamic threshold for time series anomaly detection. Expert Syst. Appl. 278, 127379 (2025)","journal-title":"Expert Syst. Appl."},{"key":"22_CR25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-27752-1","volume-title":"New Introduction to Multiple Time Series Analysis","author":"H L\u00fctkepohl","year":"2005","unstructured":"L\u00fctkepohl, H.: New Introduction to Multiple Time Series Analysis. Springer, Berlin (2005)"},{"key":"22_CR26","doi-asserted-by":"crossref","unstructured":"Runge, J., Nowack, P., Kretschmer, M., Flaxman, S., Sejdinovic, D.: Detecting and quantifying causal associations in large nonlinear time series datasets. Sci. Adv. 5(11), eaau4996 (2019)","DOI":"10.1126\/sciadv.aau4996"},{"key":"22_CR27","unstructured":"Veli\u010dkovi\u0107, P., Cucurull, G., Casanova, A., Romero, A., Li\u00f2, P., Bengio, Y.: Graph attention networks. In: Proceedings of ICLR (2018)"},{"issue":"43","key":"22_CR28","first-page":"1","volume":"24","author":"VP Dwivedi","year":"2023","unstructured":"Dwivedi, V.P., Joshi, C.K., Laurent, T., Bengio, Y., Bresson, X.: Benchmarking graph neural networks. J. Mach. Learn. Res. 24(43), 1\u201348 (2023)","journal-title":"J. Mach. Learn. Res."},{"key":"22_CR29","unstructured":"Li, Y., Tarlow, D., Brockschmidt, M., Zemel, R.: Gated graph sequence neural networks. arXiv Preprint arXiv:1511.05493 (2015)"},{"key":"22_CR30","doi-asserted-by":"publisher","first-page":"100","DOI":"10.1016\/j.cose.2014.05.011","volume":"45","author":"S Garcia","year":"2014","unstructured":"Garcia, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Comput. Secur. 45, 100\u2013123 (2014)","journal-title":"Comput. Secur."},{"key":"22_CR31","doi-asserted-by":"crossref","unstructured":"Huang, S., et al.: Temporal Graph Benchmark for Machine Learning on Temporal Graphs. In: Proceedings of NeurIPS Datasets and Benchmarks Track (2023)","DOI":"10.52202\/075280-0099"},{"key":"22_CR32","unstructured":"Xu, D., Ruan, C., Korpeoglu, E., Kumar, S., Achan, K.: Inductive representation learning on temporal graphs. arXiv Preprint arXiv:2002.07962 (2020)"},{"key":"22_CR33","unstructured":"Ennadir, S., et al.: Expressivity of representation learning on continuous-time dynamic graphs: an information-flow centric review. arXiv Preprint arXiv:2412.03783 (2024)"},{"key":"22_CR34","doi-asserted-by":"crossref","unstructured":"Sommer, R., Paxson, V.: Outside the closed world: on using machine learning for network intrusion detection. In: Proceedings of IEEE S&P (2010)","DOI":"10.1109\/SP.2010.25"}],"container-title":["Lecture Notes in Computer Science","Advanced Intelligent Computing Technology and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-92-3423-3_22","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T08:46:40Z","timestamp":1784364400000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-92-3423-3_22"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,19]]},"ISBN":["9789819234226","9789819234233"],"references-count":34,"URL":"https:\/\/doi.org\/10.1007\/978-981-92-3423-3_22","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,19]]},"assertion":[{"value":"19 July 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICIC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Intelligent Computing","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Toronto","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Canada","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22 July 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 July 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"icic2026a","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.ic-icc.cn\/2026\/index.htm","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}