{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T13:07:25Z","timestamp":1774530445117,"version":"3.50.1"},"reference-count":79,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372410"],"award-info":[{"award-number":["62372410"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U22B2028"],"award-info":[{"award-number":["U22B2028"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neurocomputing"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.neucom.2026.133345","type":"journal-article","created":{"date-parts":[[2026,3,16]],"date-time":"2026-03-16T15:58:45Z","timestamp":1773676725000},"page":"133345","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["UniProv: A unified pretraining framework for provenance graph representation learning"],"prefix":"10.1016","volume":"681","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-3140-9917","authenticated-orcid":false,"given":"Xuebo","family":"Qiu","sequence":"first","affiliation":[]},{"given":"Mingqi","family":"Lv","sequence":"additional","affiliation":[]},{"given":"Yimei","family":"Zhang","sequence":"additional","affiliation":[]},{"given":"Qijie","family":"Song","sequence":"additional","affiliation":[]},{"given":"Tiantian","family":"Zhu","sequence":"additional","affiliation":[]},{"given":"Tieming","family":"Chen","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.neucom.2026.133345_bib0005","series-title":"IEEE Symposium on Security and Privacy (S&P)","first-page":"2620","article-title":"Sok: history is a vast early warning system: auditing the provenance of system intrusions","author":"Inam","year":"2023"},{"key":"10.1016\/j.neucom.2026.133345_bib0010","first-page":"1","article-title":"APT-kgl: an intelligent APT detection system based on threat knowledge and heterogeneous provenance graph learning","author":"Chen","year":"2022","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.neucom.2026.133345_bib0015","series-title":"USENIX Security 21","first-page":"3005","article-title":"ATLAS: a sequence-based learning approach for attack investigation","author":"Alsaheel","year":"2021"},{"key":"10.1016\/j.neucom.2026.133345_bib0020","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103821","article-title":"A survey on graph neural networks for intrusion detection systems: methods, trends and challenges","author":"Zhong","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.neucom.2026.133345_bib0025","series-title":"IEEE Symposium on Security and Privacy (S&P)","first-page":"139","article-title":"Flash: a comprehensive approach to intrusion detection via provenance graph representation learning","author":"Rehman","year":"2024"},{"key":"10.1016\/j.neucom.2026.133345_bib0030","doi-asserted-by":"crossref","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","article-title":"Threatrace: detecting and tracing host-based threats in node level through provenance graph learning","volume":"17","author":"Wang","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.neucom.2026.133345_bib0035","series-title":"34th USENIX Security Symposium (USENIX Security 25)","first-page":"607","article-title":"TAPAS: an efficient onlineAPTdetection with task-guided process provenance graph segmentation and analysis","author":"Zhang","year":"2025"},{"key":"10.1016\/j.neucom.2026.133345_bib0040","series-title":"IEEE Symposium on Security and Privacy (S&P)","first-page":"3515","article-title":"R-caid: embedding root cause analysis within provenance-based intrusion detection","author":"Goyal","year":"2024"},{"key":"10.1016\/j.neucom.2026.133345_bib0045","series-title":"33rd USENIX Security Symposium (USENIX Security 24)","first-page":"5197","article-title":"MAGIC: detecting advanced persistent threats via masked graph representation learning","author":"Jia","year":"2024"},{"key":"10.1016\/j.neucom.2026.133345_bib0050","doi-asserted-by":"crossref","DOI":"10.1109\/TIFS.2024.3396390","article-title":"Megr-APT: a memory-efficient APT hunting system based on attack representation learning","author":"Aly","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.neucom.2026.133345_bib0055","series-title":"SecureComm","first-page":"3","article-title":"Deephunter: a graph neural network based approach for robust cyber threat hunting","author":"Wei","year":"2021"},{"key":"10.1016\/j.neucom.2026.133345_bib0060","series-title":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","first-page":"139","article-title":"Trec: APT tactic\/technique recognition via few-shot provenance subgraph learning","author":"Lv","year":"2024"},{"key":"10.1016\/j.neucom.2026.133345_bib0065","series-title":"International Conference on Learning Representations","article-title":"Multi-task self-supervised graph neural networks enable stronger task generalization","author":"Ju","year":"2023"},{"key":"10.1016\/j.neucom.2026.133345_bib0070","series-title":"International Conference on Learning Representations","article-title":"Automated self-supervised learning for graphs","author":"Jin","year":"2022"},{"key":"10.1016\/j.neucom.2026.133345_bib0075","author":"Sanh"},{"key":"10.1016\/j.neucom.2026.133345_bib0080","series-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","first-page":"3977","article-title":"M3p: learning universal representations via multitask multilingual multimodal pre-training","author":"Ni","year":"2021"},{"key":"10.1016\/j.neucom.2026.133345_bib0085","article-title":"Hyperbolic graph representation learning: methods, applications and challenges\u00e2\u20ac\u201da survey","author":"Chen","year":"2025","journal-title":"Neurocomputing"},{"key":"10.1016\/j.neucom.2026.133345_bib0090","series-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","first-page":"7482","article-title":"Multi-task learning using uncertainty to weigh losses for scene geometry and semantics","author":"Kendall","year":"2018"},{"key":"10.1016\/j.neucom.2026.133345_bib0095","unstructured":"Streamspot dataset, https:\/\/github.com\/sbustreamspot\/sbustreamspot-data"},{"key":"10.1016\/j.neucom.2026.133345_bib0100","unstructured":"Unicorn dataset, https:\/\/dataverse.harvard.edu\/dataverse\/unicorn-wget"},{"key":"10.1016\/j.neucom.2026.133345_bib0105","unstructured":"Transparent computing engagement 3 data release, 2017, https:\/\/github.com\/darpa-i2o\/Transparent-Computing\/blob\/master\/README-E3.md"},{"key":"10.1016\/j.neucom.2026.133345_bib0110","unstructured":"Operationally transparent cyber (optc) data release, 2020, https:\/\/github.com\/FiveDirections\/OpTC-data"},{"key":"10.1016\/j.neucom.2026.133345_bib0115","author":"Han"},{"key":"10.1016\/j.neucom.2026.133345_bib0120","series-title":"ICMLA","first-page":"1720","article-title":"Prov-gem: automated provenance analysis framework using graph embeddings","author":"Kapoor","year":"2021"},{"key":"10.1016\/j.neucom.2026.133345_bib0125","series-title":"USENIX Security 23","first-page":"4355","article-title":"PROGRAPHER: an anomaly detection system based on provenance graph embedding","author":"Yang","year":"2023"},{"key":"10.1016\/j.neucom.2026.133345_bib0130","series-title":"Network and Distributed System Security Symposium (NDSS)","article-title":"Sometimes, you aren\u2019t what you do: mimicry attacks against provenance graph host intrusion detection systems","author":"Goyal","year":"2023"},{"key":"10.1016\/j.neucom.2026.133345_bib0135","author":"Cheng"},{"key":"10.1016\/j.neucom.2026.133345_bib0140","author":"Corporation"},{"key":"10.1016\/j.neucom.2026.133345_bib0145","series-title":"International Conference on Learning Representations","article-title":"On large-batch training for deep learning: generalization gap and sharp minima","author":"Keskar","year":"2017"},{"issue":"1","key":"10.1016\/j.neucom.2026.133345_bib0150","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1162\/neco.1997.9.1.1","article-title":"Flat minima","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"10.1016\/j.neucom.2026.133345_bib0155","series-title":"International Conference on Learning Representations","article-title":"Sharpness-aware minimization for efficiently improving generalization","author":"Foret","year":"2021"},{"key":"10.1016\/j.neucom.2026.133345_bib0160","article-title":"Hessian-based analysis of large batch training and robustness to adversaries","volume":"31","author":"Yao","year":"2018","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.neucom.2026.133345_bib0165","author":"Veli\u010dkovi\u0107"},{"key":"10.1016\/j.neucom.2026.133345_bib0170","series-title":"International Conference on Machine Learning (ICML)","first-page":"12957","article-title":"Exploring correlations of self-supervised tasks for graphs","author":"Fang","year":"2024"},{"key":"10.1016\/j.neucom.2026.133345_bib0175","doi-asserted-by":"crossref","DOI":"10.1109\/TBDATA.2025.3570082","article-title":"Generative-contrastive heterogeneous graph neural network","author":"Wang","year":"2025","journal-title":"IEEE Trans. Big Data"},{"issue":"6","key":"10.1016\/j.neucom.2026.133345_bib0180","first-page":"5935","article-title":"Heterogeneous graph representation learning with relation awareness","volume":"35","author":"Yu","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.neucom.2026.133345_bib0185","series-title":"WWW","first-page":"737","article-title":"Graphmae2: a decoding-enhanced masked self-supervised Graph learner","author":"Hou","year":"2023"},{"key":"10.1016\/j.neucom.2026.133345_bib0190","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2025.130612","article-title":"Dynamic heterogeneous graph contrastive learning based on multi-prior tasks","author":"Bai","year":"2025","journal-title":"Neurocomputing"},{"key":"10.1016\/j.neucom.2026.133345_bib0195","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2025.129650","article-title":"Encoder augmentation for multi-task graph contrastive learning","volume":"630","author":"Wang","year":"2025","journal-title":"Neurocomputing"},{"key":"10.1016\/j.neucom.2026.133345_bib0200","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2025.130109","article-title":"Multi-view graph anomaly detection via subgraph anomaly augmentation","volume":"637","author":"Lin","year":"2025","journal-title":"Neurocomputing"},{"issue":"3","key":"10.1016\/j.neucom.2026.133345_bib0205","first-page":"4","article-title":"Deep graph infomax","volume":"2","author":"Velickovic","year":"2019","journal-title":"Int. Conf. Learn. Represent. (ICLR) (poster)"},{"key":"10.1016\/j.neucom.2026.133345_bib0210","author":"Hjelm"},{"key":"10.1016\/j.neucom.2026.133345_bib0215","first-page":"5812","article-title":"Graph contrastive learning with augmentations","volume":"33","author":"You","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.neucom.2026.133345_bib0220","article-title":"Local augmentation and debiasing for graph contrastive learning","author":"Gao","year":"2025","journal-title":"Neurocomputing"},{"issue":"2","key":"10.1016\/j.neucom.2026.133345_bib0225","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1137\/0201010","article-title":"Depth-first search and linear graph algorithms","volume":"1","author":"Tarjan","year":"1972","journal-title":"SIAM J. Comput."},{"key":"10.1016\/j.neucom.2026.133345_bib0230","series-title":"USENIX Security 22","first-page":"2461","article-title":"Back-Propagating system dependency impact for attack investigation","author":"Fang","year":"2022"},{"key":"10.1016\/j.neucom.2026.133345_bib0235","author":"Jing"},{"key":"10.1016\/j.neucom.2026.133345_bib0240","series-title":"International Conference on Machine Learning (ICML)","first-page":"3015","article-title":"Whitening for self-supervised representation learning","author":"Ermolov","year":"2021"},{"key":"10.1016\/j.neucom.2026.133345_bib0245","series-title":"CIKM","first-page":"3122","article-title":"Anemone: graph anomaly detection with multi-scale contrastive learning","author":"Jin","year":"2021"},{"issue":"6","key":"10.1016\/j.neucom.2026.133345_bib0250","doi-asserted-by":"crossref","first-page":"2378","DOI":"10.1109\/TNNLS.2021.3068344","article-title":"Anomaly detection on attributed networks via contrastive self-supervised learning","volume":"33","author":"Liu","year":"2021","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"issue":"7","key":"10.1016\/j.neucom.2026.133345_bib0255","first-page":"7068","article-title":"Kg-mtl: knowledge graph enhanced multi-task learning for molecular interaction","volume":"35","author":"Ma","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.neucom.2026.133345_bib0260","series-title":"SoCC","first-page":"405","article-title":"Practical whole-system provenance capture","author":"Pasquier","year":"2017"},{"key":"10.1016\/j.neucom.2026.133345_bib0265","series-title":"SACMAT","first-page":"27","article-title":"Analyzing the usefulness of the Darpa optc dataset in cyber threat detection research","author":"Anjum","year":"2021"},{"key":"10.1016\/j.neucom.2026.133345_bib0270","series-title":"USENIX Security 22","first-page":"3971","article-title":"DOS and don\u2019ts of machine learning in computer security","author":"Arp","year":"2022"},{"issue":"2","key":"10.1016\/j.neucom.2026.133345_bib0275","doi-asserted-by":"crossref","first-page":"1883","DOI":"10.4249\/scholarpedia.1883","article-title":"K-nearest neighbor","volume":"4","author":"Peterson","year":"2009","journal-title":"Scholarpedia"},{"issue":"3","key":"10.1016\/j.neucom.2026.133345_bib0280","doi-asserted-by":"crossref","first-page":"535","DOI":"10.1109\/TBDATA.2019.2921572","article-title":"Billion-scale similarity search with gpus","volume":"7","author":"Johnson","year":"2019","journal-title":"IEEE Trans. on Big Data"},{"key":"10.1016\/j.neucom.2026.133345_bib0285","series-title":"Exploring Network Structure, Dynamics, and Function Using Networkx","author":"Hagberg","year":"2008"},{"key":"10.1016\/j.neucom.2026.133345_bib0290","author":"Wang"},{"key":"10.1016\/j.neucom.2026.133345_bib0295","article-title":"Pytorch: an imperative style, high-performance deep learning library","volume":"32","author":"Paszke","year":"2019","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.neucom.2026.133345_bib0300","series-title":"AISTATS","first-page":"249","article-title":"Understanding the difficulty of training deep feedforward neural networks","author":"Glorot","year":"2010"},{"issue":"1","key":"10.1016\/j.neucom.2026.133345_bib0305","first-page":"1929","article-title":"Dropout: a simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"JMLR"},{"key":"10.1016\/j.neucom.2026.133345_bib0310","series-title":"AAAI","first-page":"3438","article-title":"Measuring and relieving the over-smoothing problem for graph neural networks from the topological view","volume":"vol. 34","author":"Chen","year":"2020"},{"key":"10.1016\/j.neucom.2026.133345_bib0315","author":"Wei"},{"issue":"6","key":"10.1016\/j.neucom.2026.133345_bib0320","doi-asserted-by":"crossref","first-page":"3947","DOI":"10.1007\/s10462-019-09784-7","article-title":"A survey of regularization strategies for deep models","volume":"53","author":"Moradi","year":"2020","journal-title":"Artif. Intell. Rev."},{"key":"10.1016\/j.neucom.2026.133345_bib0325","author":"Kipf"},{"key":"10.1016\/j.neucom.2026.133345_bib0330","author":"Xu"},{"key":"10.1016\/j.neucom.2026.133345_bib0335","series-title":"Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","first-page":"1035","article-title":"Fast memory-efficient anomaly detection in streaming heterogeneous graphs","author":"Manzoor","year":"2016"},{"key":"10.1016\/j.neucom.2026.133345_bib0340","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2024.125877","article-title":"A dynamic provenance graph-based detector for advanced persistent threats","volume":"265","author":"Wang","year":"2025","journal-title":"Expert Syst. Appl."},{"key":"10.1016\/j.neucom.2026.133345_bib0345","series-title":"ACM Conference on Computer and Communications Security (CCS)","first-page":"2247","article-title":"Provg-searcher: a graph representation learning approach for efficient provenance graph search","author":"Altinisik","year":"2023"},{"key":"10.1016\/j.neucom.2026.133345_bib0350","series-title":"Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","first-page":"135","article-title":"Metapath2vec: scalable representation learning for heterogeneous networks","author":"Dong","year":"2017"},{"key":"10.1016\/j.neucom.2026.133345_bib0355","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2025.131251","article-title":"Multi-objective adaptive nesterov-like acceleration algorithm for multi-task deep learning","author":"Meng","year":"2025","journal-title":"Neurocomputing"},{"key":"10.1016\/j.neucom.2026.133345_bib0360","series-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","first-page":"11114","article-title":"Continual self-supervised learning: towards universal multi-modal medical data representation learning","author":"Ye","year":"2024"},{"key":"10.1016\/j.neucom.2026.133345_bib0365","author":"Zhou"},{"key":"10.1016\/j.neucom.2026.133345_bib0370","series-title":"International Conference on Learning Representations (ICLR)","article-title":"C-clip: multimodal continual learning for vision-language model","author":"Liu","year":"2025"},{"key":"10.1016\/j.neucom.2026.133345_bib0375","series-title":"Network and Distributed System Security Symposium (NDSS)","article-title":"You are what you do: hunting stealthy malware via data provenance analysis","author":"Wang","year":"2020"},{"key":"10.1016\/j.neucom.2026.133345_bib0380","series-title":"ACM Conference on Computer and Communications Security (CCS)","first-page":"1795","article-title":"Poirot: aligning attack behavior with kernel audit records for cyber threat hunting","author":"Milajerdi","year":"2019"},{"key":"10.1016\/j.neucom.2026.133345_bib0385","doi-asserted-by":"crossref","DOI":"10.1109\/TPAMI.2024.3415112","article-title":"A survey on self-supervised learning: algorithms, applications, and future trends","author":"Gui","year":"2024","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"10.1016\/j.neucom.2026.133345_bib0390","series-title":"Proceedings of the IEEE International Conference on Computer Vision (ICCV)","first-page":"2051","article-title":"Multi-task self-supervised visual learning","author":"Doersch","year":"2017"},{"issue":"1","key":"10.1016\/j.neucom.2026.133345_bib0395","doi-asserted-by":"crossref","DOI":"10.1155\/2024\/6964759","article-title":"Httpsmell: a deep learning approach on malicious Http traffic detection via data augmentation and label refactoring","volume":"2024","author":"Chen","year":"2024","journal-title":"Secur. Commun. Netw."}],"container-title":["Neurocomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226007423?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226007423?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T12:31:16Z","timestamp":1774528276000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0925231226007423"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":79,"alternative-id":["S0925231226007423"],"URL":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133345","relation":{},"ISSN":["0925-2312"],"issn-type":[{"value":"0925-2312","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"UniProv: A unified pretraining framework for provenance graph representation learning","name":"articletitle","label":"Article Title"},{"value":"Neurocomputing","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133345","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"133345"}}