{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,14]],"date-time":"2026-04-14T19:55:30Z","timestamp":1776196530507,"version":"3.50.1"},"reference-count":43,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372313"],"award-info":[{"award-number":["62372313"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62002248"],"award-info":[{"award-number":["62002248"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100013290","name":"National Key Research and Development Program of China Stem Cell and Translational Research","doi-asserted-by":"publisher","award":["020YFB1805405"],"award-info":[{"award-number":["020YFB1805405"]}],"id":[{"id":"10.13039\/501100013290","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100013290","name":"National Key Research and Development Program of China Stem Cell and Translational Research","doi-asserted-by":"publisher","award":["2019QY0 800"],"award-info":[{"award-number":["2019QY0 800"]}],"id":[{"id":"10.13039\/501100013290","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1016\/j.comnet.2026.112235","type":"journal-article","created":{"date-parts":[[2026,3,22]],"date-time":"2026-03-22T23:04:05Z","timestamp":1774220645000},"page":"112235","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["DYNAMO: An adaptive spatio-Temporal attention method for provenance graph-based APT detection"],"prefix":"10.1016","volume":"281","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-9495-1794","authenticated-orcid":false,"given":"Ye","family":"Wang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0491-8305","authenticated-orcid":false,"given":"Changzhi","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9028-0533","authenticated-orcid":false,"given":"Dongqing","family":"Jia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-0168-1775","authenticated-orcid":false,"given":"Ming","family":"Kang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0566-2495","authenticated-orcid":false,"given":"Wen","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"issue":"2","key":"10.1016\/j.comnet.2026.112235_bib0001","doi-asserted-by":"crossref","first-page":"1851","DOI":"10.1109\/COMST.2019.2891891","article-title":"A survey on advanced persistent threats: techniques, solutions, challenges, and research opportunities","volume":"21","author":"Alshamrani","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"7","key":"10.1016\/j.comnet.2026.112235_bib0002","doi-asserted-by":"crossref","DOI":"10.1145\/3539605","article-title":"Provenance-based intrusion detection systems: a survey","volume":"55","author":"Zipperle","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.comnet.2026.112235_bib0003","series-title":"9Th USENIX Workshop on the Theory and Practice of Provenance (TaPP 2017)","article-title":"Applying provenance in APT monitoring and analysis: practical challenges for scalable, efficient and trustworthy distributed provenance","author":"Jenkinson","year":"2017"},{"key":"10.1016\/j.comnet.2026.112235_bib0004","doi-asserted-by":"crossref","first-page":"26","DOI":"10.1016\/j.future.2016.02.005","article-title":"Unifying intrusion detection and forensic analysis via provenance awareness","volume":"61","author":"Xie","year":"2016","journal-title":"Future Generat. Comput. Syst."},{"key":"10.1016\/j.comnet.2026.112235_bib0005","series-title":"2023 26Th International Conference on Computer Supported Cooperative Work in Design (CSCWD)","first-page":"1014","article-title":"GHunter: A fast subgraph matching method for threat hunting","author":"Cheng","year":"2023"},{"issue":"5","key":"10.1016\/j.comnet.2026.112235_bib0006","article-title":"Congraph: advanced persistent threat detection method based on provenance graph combined with process context in cyber-Physical system environment","volume":"13","author":"Li","year":"2024","journal-title":"Electronics (Basel)"},{"key":"10.1016\/j.comnet.2026.112235_bib0007","series-title":"IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2022, Wuhan, China, December 9, 2022","first-page":"747","article-title":"Deepro: provenance-based APT campaigns detection via GNN","author":"Yan","year":"2022"},{"key":"10.1016\/j.comnet.2026.112235_bib0008","series-title":"IEEE Global Communications Conference, GLOBECOM 2022, Rio De Janeiro, Brazil, December 4, 2022","first-page":"897","article-title":"A graph learning approach with audit records for advanced attack investigation","author":"Liu","year":"2022"},{"key":"10.1016\/j.comnet.2026.112235_bib0009","series-title":"2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19, 2019","first-page":"1137","article-title":"HOLMES: Real-Time APT detection through correlation of suspicious information flows","author":"Milajerdi","year":"2019"},{"key":"10.1016\/j.comnet.2026.112235_bib0010","series-title":"2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, May 18, 2020","first-page":"1139","article-title":"Combating dependence explosion in forensic analysis using alternative tag propagation semantics","author":"Hossain","year":"2020"},{"key":"10.1016\/j.comnet.2026.112235_bib0011","series-title":"2024 IEEE Symposium on Security and Privacy (SP)","first-page":"3552","article-title":"Flash: a comprehensive approach to intrusion detection via provenance graph representation learning","author":"Ur Rehman","year":"2024"},{"key":"10.1016\/j.comnet.2026.112235_bib0012","series-title":"33Rd USENIX Security Symposium (USENIX Security 24)","first-page":"5197","article-title":"MAGIC: Detecting advanced persistent threats via masked graph representation learning","author":"Jia","year":"2024"},{"key":"10.1016\/j.comnet.2026.112235_bib0013","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104159","article-title":"Provenance-based APT campaigns detection via masked graph representation learning","volume":"148","author":"Ren","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.comnet.2026.112235_bib0014","series-title":"Proceedings of the 30Th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2024, Barcelona, Spain, August 25, 2024","first-page":"4290","article-title":"Towards adaptive neighborhood for advancing temporal interaction graph modeling","author":"Zhang","year":"2024"},{"key":"10.1016\/j.comnet.2026.112235_bib0015","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2024.125877","article-title":"A dynamic provenance graph-based detector for advanced persistent threats","volume":"265","author":"Wang","year":"2025","journal-title":"Expert Syst. Appl."},{"key":"10.1016\/j.comnet.2026.112235_bib0016","series-title":"8Th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26, 2020","article-title":"Inductive representation learning on temporal graphs","author":"Xu","year":"2020"},{"key":"10.1016\/j.comnet.2026.112235_bib0017","first-page":"5363","article-title":"EvolveGCN: evolving graph convolutional networks for dynamic graphs","author":"Pareja","year":"2020"},{"key":"10.1016\/j.comnet.2026.112235_bib0018","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2019.06.024","article-title":"Dyngraph2vec: capturing network dynamics using dynamic graph representation learning","volume":"187","author":"Goyal","year":"2020","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.comnet.2026.112235_bib0019","series-title":"Proceedings of the 28Th ACM SIGKDD Conference on Knowledge Discovery and Data Mining","first-page":"2358","article-title":"ROLAND: Graph learning framework for dynamic graphs","author":"You","year":"2022"},{"key":"10.1016\/j.comnet.2026.112235_bib0020","series-title":"Proceedings of the 13Th International Conference on Web Search and Data Mining","first-page":"519","article-title":"DySAT: deep neural representation learning on dynamic graphs via self-Attention networks","author":"Sankar","year":"2020"},{"key":"10.1016\/j.comnet.2026.112235_bib0021","series-title":"Proceedings of the Web Conference 2021","first-page":"693","article-title":"TEDIC: Neural modeling of behavioral patterns in dynamic social interaction networks","author":"Wang","year":"2021"},{"key":"10.1016\/j.comnet.2026.112235_bib0022","series-title":"Proceedings of the 2021 International Conference on Management of Data","first-page":"2628","article-title":"APAN: Asynchronous propagation attention network for real-time temporal graph embedding","author":"Wang","year":"2021"},{"key":"10.1016\/j.comnet.2026.112235_bib0023","series-title":"Proceedings of the 29Th ACM International Conference on Information & Knowledge Management","first-page":"145","article-title":"Continuous-Time dynamic graph learning via neural interaction processes","author":"Chang","year":"2020"},{"key":"10.1016\/j.comnet.2026.112235_bib0024","series-title":"Advances in Neural Information Processing Systems","first-page":"67686","article-title":"Towards better dynamic graph learning: new architecture and unified library","volume":"36","author":"Yu","year":"2023"},{"key":"10.1016\/j.comnet.2026.112235_bib0025","series-title":"7Th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6, 2019","article-title":"Dyrep: learning representations over dynamic graphs","author":"Trivedi","year":"2019"},{"key":"10.1016\/j.comnet.2026.112235_bib0026","series-title":"International Conference on Machine Learning (ICML)","article-title":"Temporal graph networks for deep learning on dynamic graphs","author":"Rossi","year":"2020"},{"key":"10.1016\/j.comnet.2026.112235_bib0027","series-title":"Proceedings of the ACM Web Conference 2023","first-page":"478","article-title":"TIGER: Temporal interaction graph embedding with restarts","author":"Zhang","year":"2023"},{"key":"10.1016\/j.comnet.2026.112235_bib0028","series-title":"Security in Computing and Communications","first-page":"438","article-title":"Technical aspects of cyber kill chain","author":"Yadav","year":"2015"},{"issue":"1","key":"10.1016\/j.comnet.2026.112235_bib0029","doi-asserted-by":"crossref","first-page":"551","DOI":"10.1109\/TDSC.2020.2971484","article-title":"Conan: a practical real-Time APT detection system with high accuracy and efficiency","volume":"19","author":"Xiong","year":"2022","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.comnet.2026.112235_bib0030","series-title":"Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security","first-page":"1795","article-title":"POIROT: Aligning attack behavior with kernel audit records for cyber threat hunting","author":"Milajerdi","year":"2019"},{"key":"10.1016\/j.comnet.2026.112235_bib0031","series-title":"Proceedings of the 22Nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","first-page":"1035","article-title":"Fast memory-efficient anomaly detection in streaming heterogeneous graphs","author":"Manzoor","year":"2016"},{"key":"10.1016\/j.comnet.2026.112235_bib0032","series-title":"27Th Annual Network and Distributed System Security Symposium, NDSS 2020, San Diego, California, USA, February 23, 2020","article-title":"Unicorn: runtime provenance-Based detector for advanced persistent threats","author":"Han","year":"2020"},{"key":"10.1016\/j.comnet.2026.112235_bib0033","series-title":"30Th USENIX Security Symposium (USENIX Security 21)","first-page":"3005","article-title":"ATLAS: A sequence-based learning approach for attack investigation","author":"Alsaheel","year":"2021"},{"key":"10.1016\/j.comnet.2026.112235_bib0034","series-title":"2022 IEEE Symposium on Security and Privacy (SP)","first-page":"489","article-title":"SHADEWATCHER: Recommendation-guided cyber threat analysis using system audit records","author":"Zengy","year":"2022"},{"key":"10.1016\/j.comnet.2026.112235_bib0035","doi-asserted-by":"crossref","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","article-title":"THREATRACE: Detecting and tracing host-Based threats in node level through provenance graph learning","volume":"17","author":"Wang","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2026.112235_bib0036","series-title":"32Nd USENIX Security Symposium (USENIX Security 23)","first-page":"4355","article-title":"PROGRAPHER: An anomaly detection system based on provenance graph embedding","author":"Yang","year":"2023"},{"key":"10.1016\/j.comnet.2026.112235_bib0037","series-title":"2024 IEEE Symposium on Security and Privacy (SP)","first-page":"3533","article-title":"Kairos: practical intrusion detection and investigation using whole-system provenance","author":"Cheng","year":"2024"},{"key":"10.1016\/j.comnet.2026.112235_bib0038","series-title":"Proceedings of the ACM on Web Conference 2025","first-page":"1046","article-title":"STGAN: Detecting host threats via fusion of spatial-Temporal features in host provenance graphs","author":"Sang","year":"2025"},{"key":"10.1016\/j.comnet.2026.112235_bib0039","first-page":"139","article-title":"One-Class SVMs for document classification","volume":"2","author":"Manevitz","year":"2001","journal-title":"J. Mach. Learn. Res."},{"key":"10.1016\/j.comnet.2026.112235_bib0040","series-title":"2008 Eighth IEEE International Conference on Data Mining","first-page":"413","article-title":"Isolation forest","author":"Liu","year":"2008"},{"key":"10.1016\/j.comnet.2026.112235_bib0041","doi-asserted-by":"crossref","first-page":"13","DOI":"10.70470\/ESTIDAMAA\/2025\/002","article-title":"Federated learning for smart and sustainable forest fire detection in green internet of things","volume":"2025","author":"Ali","year":"2025","journal-title":"ESTIDAMAA"},{"key":"10.1016\/j.comnet.2026.112235_bib0042","series-title":"30Th Annual Network and Distributed System Security Symposium, NDSS 2023, San Diego, California, USA, February 27, - March 3, 2023","article-title":"Sometimes, you Aren\u2019t what you do: mimicry attacks against provenance graph host intrusion detection systems","author":"Goyal","year":"2023"},{"key":"10.1016\/j.comnet.2026.112235_bib0043","series-title":"27Th Annual Network and Distributed System Security Symposium, NDSS 2020, San Diego, California, USA, February 23, 2020","article-title":"You are what you do: hunting stealthy malware via data provenance analysis","author":"Wang","year":"2020"}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626002471?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626002471?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,4,14]],"date-time":"2026-04-14T19:01:49Z","timestamp":1776193309000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128626002471"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":43,"alternative-id":["S1389128626002471"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112235","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2026,5]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"DYNAMO: An adaptive spatio-Temporal attention method for provenance graph-based APT detection","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112235","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"112235"}}