{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,16]],"date-time":"2026-06-16T19:53:49Z","timestamp":1781639629478,"version":"3.54.5"},"reference-count":43,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T00:00:00Z","timestamp":1772409600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T00:00:00Z","timestamp":1775692800000},"content-version":"vor","delay-in-days":38,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Sci Rep"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Advanced Persistent Threat (APT) detection based on artificial intelligence (AI) platforms has emerged as a dominant trend, has attracted increasing attention in cybersecurity. Nevertheless, two major challenges remain: (i) how to effectively extract discriminative features from complex network traffic flows, and (ii) how to address severe class imbalance caused by the rarity of APT attacks. To tackle these challenges, we propose an integrated pipeline\/framework named ET-SDG. The ET-SDG model integrates Transformer-based Feature Learning with a Conditional Generative Model for Synthesis (CGMS). Specifically, the Transformer-based feature learning component combines the ExtraTrees algorithm with a Transformer architecture to select, aggregate, and encode informative flow-level features. To mitigate data imbalance, ET-SDG incorporates CGMS, a cGAN-based synthetic data generation module designed for data augmentation of minority APT traffic. By conditioning the generation process on class labels, CGMS synthesizes representative minority-class samples, aiming to improve the robustness and generalization of the downstream detection model under class imbalance. Across the evaluated benchmarks, ET-SDG shows competitive results and provides modest improvements (approximately 1\u20134% points, depending on the dataset and metric) relative to the compared baselines.<\/jats:p>","DOI":"10.1038\/s41598-026-41317-5","type":"journal-article","created":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T13:26:21Z","timestamp":1772457981000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Advancing APT detection through transformer-driven feature learning and synthetic data generation"],"prefix":"10.1038","volume":"16","author":[{"given":"Le Tran Kim","family":"Danh","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cho Do","family":"Xuan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nhan Nguyen","family":"Van","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,3,2]]},"reference":[{"key":"41317_CR1","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1007\/s12293-025-00474-2","volume":"17","author":"VT Duc","year":"2025","unstructured":"Duc, V. T., Do Xuan, C. & Long, V. T. A novel ensemble learning-based model for APT attack detection. Memetic Comp. 17, 39. https:\/\/doi.org\/10.1007\/s12293-025-00474-2 (2025).","journal-title":"Memetic Comp."},{"issue":"1","key":"41317_CR2","first-page":"4037","volume":"13","author":"EJ Khaleefa","year":"2022","unstructured":"Khaleefa, E. J. & Abdulah, D. A. Concept and difficulties of advanced persistent threats (APT): Survey. Int. J. Nonlinear Anal. Appl. 13 (1), 4037\u20134052 (2022).","journal-title":"Int. J. Nonlinear Anal. Appl."},{"issue":"DOI: doi.org\/10","key":"41317_CR3","first-page":"190","volume":"SRC\/JAICC-204","author":"N Challa","year":"2022","unstructured":"Challa, N. Unveiling the Shadows: A Comprehensive Exploration of Advanced Persistent Threats (APTs) and Silent Intrusions in Cybersecurity. J. Artif. Intell. Cloud Comput. SRC\/JAICC-204 (DOI: doi.org\/10.47363\/JAICC\/2022 (1)), 190\u2013192 (2022).","journal-title":"J. Artif. Intell. Cloud Comput."},{"key":"41317_CR4","doi-asserted-by":"publisher","unstructured":"Marcos Luengo & Vi\u00f1uela Jes\u00fas-\u00c1ngel Rom\u00e1n-Gallego, Mar\u00eda-Luisa P\u00e9rez-Delgado, Miguel A. Conde, Mar\u00eda-Concepci\u00f3n Vega-Hern\u00e1ndez, Hernando Silva Varela. Detection of APTs by Machine Learning: A Performance Comparison. Expert Systems. Volume43, Issue1 January 2026. https:\/\/doi.org\/10.1111\/exsy.70181","DOI":"10.1111\/exsy.70181"},{"key":"41317_CR5","doi-asserted-by":"publisher","unstructured":"Gauhar Ali, S., Shah, M. & ElAffendi Enhancing cybersecurity incident response: AI-driven optimization for strengthened advanced persistent. threat detection. Results Eng. Volume. 25, 104078. https:\/\/doi.org\/10.1016\/j.rineng.2025.104078 (March 2025).","DOI":"10.1016\/j.rineng.2025.104078"},{"key":"41317_CR6","doi-asserted-by":"publisher","first-page":"22223","DOI":"10.1038\/s41598-024-72957-0","volume":"14","author":"CD Xuan","year":"2024","unstructured":"Xuan, C. D. & Nguyen, T. T. A novel approach for APT attack detection based on an advanced computing. Sci. Rep. 14, 22223. https:\/\/doi.org\/10.1038\/s41598-024-72957-0 (2024).","journal-title":"Sci. Rep."},{"issue":"4","key":"41317_CR7","first-page":"4135","volume":"42","author":"C Do Xuan","year":"2022","unstructured":"Do Xuan, C. & Duong, D. Optimization of APT attack detection based on a model combining ATTENTION and deep learning. J. Intell. Fuzzy Syst. 42 (4), 4135\u20134151 (2022).","journal-title":"J. Intell. Fuzzy Syst."},{"key":"41317_CR8","doi-asserted-by":"crossref","unstructured":"Do Xuan, C. & Cuong, N. H. A novel approach for APT attack detection based on feature intelligent extraction and representation learning. Plos one, 19(6), e0305618. (2024).","DOI":"10.1371\/journal.pone.0305618"},{"key":"41317_CR9","doi-asserted-by":"crossref","unstructured":"Guo, J., Tian, K., Ye, K. & Xu, C. Z. Ma-lstm: A multi-attention based lstm for complex pattern extraction. In 2020 25th International Conference on Pattern Recognition (ICPR) (pp. 3605\u20133611). IEEE. (2021), January.","DOI":"10.1109\/ICPR48806.2021.9412402"},{"key":"41317_CR10","doi-asserted-by":"publisher","first-page":"64375","DOI":"10.1109\/ACCESS.2022.3182333","volume":"10","author":"Z Wu","year":"2022","unstructured":"Wu, Z., Zhang, H., Wang, P. & Sun, Z. RTIDS: A robust transformer-based approach for intrusion detection system. IEEE Access. 10, 64375\u201364387 (2022).","journal-title":"IEEE Access."},{"issue":"1","key":"41317_CR11","first-page":"19","volume":"17","author":"J Yuan","year":"2024","unstructured":"Yuan, J. & Li, Y. An APT Attack Detection Method of a New-type Power System Based on STSA-transformer. Recent. Adv. Electr. Electron. Eng. (Formerly Recent. Pat. Electr. Electron. Engineering). 17 (1), 19\u201328 (2024).","journal-title":"Recent. Adv. Electr. Electron. Eng. (Formerly Recent. Pat. Electr. Electron. Engineering)"},{"issue":"13","key":"41317_CR12","doi-asserted-by":"publisher","first-page":"11888","DOI":"10.1109\/JIOT.2023.3244810","volume":"10","author":"A Thakkar","year":"2023","unstructured":"Thakkar, A. & Lohiya, R. Attack classification of imbalanced intrusion data for IoT network using ensemble-learning-based deep neural network. IEEE Internet Things J. 10 (13), 11888\u201311895 (2023).","journal-title":"IEEE Internet Things J."},{"issue":"2","key":"41317_CR13","doi-asserted-by":"publisher","first-page":"12","DOI":"10.58346\/JOWUA.2023.I2.002","volume":"14","author":"SQ Mohammed","year":"2023","unstructured":"Mohammed, S. Q. & Hussein, M. A. E. Reducing False Negative Intrusions Rates of Ensemble Machine Learning Model based on Imbalanced Multiclass Datasets. J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl. 14 (2), 12\u201330 (2023).","journal-title":"J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl."},{"key":"41317_CR14","doi-asserted-by":"crossref","unstructured":"Torres, R., Solis, M. A., Mart\u23a8nez, V. & Salas, R. A Nested-Cascade Machine Learning Based Model for Intrusion Detection Systems. In 2023 IEEE CHILEAN Conference on Electrical, Electronics Engineering, Information and Communication Technologies (CHILECON) (pp. 1\u20136). IEEE. (2023), December.","DOI":"10.1109\/CHILECON60335.2023.10418750"},{"key":"41317_CR15","doi-asserted-by":"crossref","unstructured":"Ullah, I. & Mahmoud, Q. H. A framework for anomaly detection in IoT networks using conditional generative adversarial networks.\u00a0IEEE 165907\u2013165931 (Access,\u00a09, 2021).","DOI":"10.1109\/ACCESS.2021.3132127"},{"key":"41317_CR16","doi-asserted-by":"crossref","unstructured":"Woldesellasse, H. & Tesfamariam, S. Data augmentation using conditional generative adversarial network (cGAN): applications for sewer condition classification and testing using different machine learning techniques. J. Hydroinformatics, jh2024135. (2024).","DOI":"10.2166\/hydro.2024.135"},{"issue":"20","key":"41317_CR17","doi-asserted-by":"publisher","first-page":"4221","DOI":"10.3390\/app9204221","volume":"9","author":"J Lee","year":"2019","unstructured":"Lee, J. & Park, K. AE-CGAN model based high performance network intrusion detection system. Appl. Sci. 9 (20), 4221 (2019).","journal-title":"Appl. Sci."},{"key":"41317_CR18","doi-asserted-by":"crossref","unstructured":"Saheed, K. & Henna, S. Deep Reinforcement Learning for Advanced Persistent Threat Detection in Wireless Networks. In 2023 31st Irish Conference on Artificial Intelligence and Cognitive Science (AICS) (pp. 1\u20136). IEEE. (2023), December.","DOI":"10.1109\/AICS60730.2023.10470498"},{"key":"41317_CR19","doi-asserted-by":"crossref","unstructured":"Lin, X. et al. Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification. In Proceedings of the ACM Web Conference 2022 (pp. 633\u2013642). (2022), April.","DOI":"10.1145\/3485447.3512217"},{"key":"41317_CR20","doi-asserted-by":"crossref","unstructured":"Zhao, G. et al. Research on data imbalance in intrusion detection using CGAN. Plos one, 18(10), e0291750. (2023).","DOI":"10.1371\/journal.pone.0291750"},{"key":"41317_CR21","doi-asserted-by":"crossref","unstructured":"Xuan, C., Do, Dau, H. & Xuan Duong, Duc, and A Multi-layer Approach for Advanced Persistent Threat Detection Using Machine Learning Based on Network Traffic. 1 Jan. : 11311\u201311329. (2021).","DOI":"10.3233\/JIFS-202465"},{"issue":"3","key":"41317_CR22","doi-asserted-by":"publisher","first-page":"3459","DOI":"10.3233\/JIFS-221055","volume":"44","author":"HC Nguyen","year":"2022","unstructured":"Nguyen, H. C., Xuan, C. D., Nguyen, L. T. & Nguyen, H. D. A new framework for APT attack detection based on network traffic. J. Intell. Fuzzy Systems: Appl. Eng. Technol. 44 (3), 3459\u20133474. https:\/\/doi.org\/10.3233\/JIFS-221055 (2022).","journal-title":"J. Intell. Fuzzy Systems: Appl. Eng. Technol."},{"key":"41317_CR23","doi-asserted-by":"crossref","unstructured":"Cuong, N. H., Xuan, D., Long, C., Dat, V. T. & Anh, T. Q. N. D., A Novel Approach for APT Detection Based on Ensemble Learning Model. Stat. Anal. Data Mining: ASA Data Sci. J., 18(1), e70005. (2025).","DOI":"10.1002\/sam.70005"},{"key":"41317_CR24","doi-asserted-by":"publisher","first-page":"152","DOI":"10.1007\/s10207-025-01053-9","volume":"24","author":"NT Tung","year":"2025","unstructured":"Tung, N. T., Xuan, D., Long, V. T. & C. & Ensemble learning-based adaptive and adversarial techniques for APT attack detection. Int. J. Inf. Secur. 24, 152. https:\/\/doi.org\/10.1007\/s10207-025-01053-9 (2025).","journal-title":"Int. J. Inf. Secur."},{"key":"41317_CR25","doi-asserted-by":"publisher","unstructured":"Lu, W. et al. XAPT: Explainable Anomaly-Driven Prediction of Threat Stages in APT Campaigns, in IEEE Access, vol. 13, pp. 199737\u2013199756, (2025). https:\/\/doi.org\/10.1109\/ACCESS.2025.3636501","DOI":"10.1109\/ACCESS.2025.3636501"},{"key":"41317_CR26","doi-asserted-by":"publisher","first-page":"16715","DOI":"10.1007\/s00521-025-11338-8","volume":"37","author":"SS Karim","year":"2025","unstructured":"Karim, S. S. et al. SLF-ADM: Securing Linux frontiers: Advanced persistent threat (APT) detection using machine learning. Neural Comput. Applic. 37, 16715\u201316734. https:\/\/doi.org\/10.1007\/s00521-025-11338-8 (2025).","journal-title":"Neural Comput. Applic"},{"key":"41317_CR27","doi-asserted-by":"publisher","first-page":"3349","DOI":"10.3390\/electronics12153349","volume":"12","author":"G Xiang","year":"2023","unstructured":"Xiang, G., Shi, C. & Zhang, Y. An APT Event Extraction Method Based on BERT-BiGRU-CRF for APT Attack Detection. Electronics 12, 3349. https:\/\/doi.org\/10.3390\/electronics12153349 (2023).","journal-title":"Electronics"},{"key":"41317_CR28","doi-asserted-by":"publisher","first-page":"284","DOI":"10.1007\/s40747-025-01898-6","volume":"11","author":"W Zhang","year":"2025","unstructured":"Zhang, W. & Hong, H. Enhanced APT detection with the improved KAN algorithm: capturing interdependencies for better accuracy. Complex. Intell. Syst. 11, 284. https:\/\/doi.org\/10.1007\/s40747-025-01898-6 (2025).","journal-title":"Complex. Intell. Syst."},{"key":"41317_CR29","doi-asserted-by":"publisher","first-page":"1443","DOI":"10.1007\/s11227-025-07902-7","volume":"81","author":"H Liu","year":"2025","unstructured":"Liu, H. et al. Gs-Ocsvm: an APT attack detection method based on provenance graph. J. Supercomput. 81, 1443. https:\/\/doi.org\/10.1007\/s11227-025-07902-7 (2025).","journal-title":"J. Supercomput"},{"key":"41317_CR30","doi-asserted-by":"crossref","unstructured":"Benabderrahmane, S. Talal Rahwan. From one attack domain to another: Contrastive transfer learning with siamese networks for APT detection. Knowledge-Based Syst. Volume 332, 15 January 2026, 114877 .","DOI":"10.1016\/j.knosys.2025.114877"},{"key":"41317_CR31","first-page":"188","volume":"9","author":"SA Khanday","year":"2024","unstructured":"Khanday, S. A., Fatima, H. & Rakesh, N. A Novel Data Preprocessing Model for Lightweight Sensory IoT Intrusion Detection. Int. J. Math. Eng. Manag Sci. 9, 188\u2013204 (2024).","journal-title":"Int. J. Math. Eng. Manag Sci."},{"issue":"8","key":"41317_CR32","doi-asserted-by":"publisher","first-page":"2742","DOI":"10.3906\/elk-2104-183","volume":"29","author":"D Baby","year":"2021","unstructured":"Baby, D., Devaraj, S. J. & Hemanth, J. Leukocyte classification based on feature selection using extra trees classifier: Atransfer learning approach. Turkish J. Electr. Eng. Comput. Sci. 29 (8), 2742\u20132757 (2021).","journal-title":"Turkish J. Electr. Eng. Comput. Sci."},{"key":"41317_CR33","unstructured":"Waswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A., \u2026 Polosukhin,I. (2017, December). Attention is all you need. In NIPS."},{"key":"41317_CR34","unstructured":"Mirza, M. & Osindero, S. Conditional generative adversarial nets. arXiv preprint arXiv :14111784. (2014)."},{"issue":"20","key":"41317_CR35","doi-asserted-by":"publisher","first-page":"13251","DOI":"10.1007\/s00521-021-05952-5","volume":"33","author":"C Do Xuan","year":"2021","unstructured":"Do Xuan, C. & Dao, M. H. A novel approach for APT attack detection based on combined deep learning model. Neural Comput. Appl. 33 (20), 13251\u201313264 (2021).","journal-title":"Neural Comput. Appl."},{"key":"41317_CR36","doi-asserted-by":"crossref","unstructured":"Dai, W., Li, X., Ji, W. & He, S. Network Intrusion Detection Method Based on CNN, BiLSTM, and Attention Mechanism (IEEE Access, 2024).","DOI":"10.1109\/ACCESS.2024.3384528"},{"issue":"4","key":"41317_CR37","doi-asserted-by":"publisher","first-page":"229","DOI":"10.2478\/jaiscr-2023-0017","volume":"13","author":"M Huang","year":"2023","unstructured":"Huang, M., Li, T., Li, B., Zhang, N. & Huang, H. Fast attack detection method for imbalanced data in industrial cyber-physical systems. J. Artif. Intell. Soft Comput. Res. 13 (4), 229\u2013245 (2023).","journal-title":"J. Artif. Intell. Soft Comput. Res."},{"key":"41317_CR38","unstructured":"Malware Capture Facility Project. September (2021). https:\/\/www.stratosphereips.org\/datasets-malware. (Accessed."},{"key":"41317_CR39","unstructured":"Department of Information and Communications Soc Trang Province. https:\/\/sotttt.soctrang.gov.vn\/Default.aspx?sname=sotttt&sid=1229&pageid=27530. (Accessed 8 September 2021)."},{"key":"41317_CR40","doi-asserted-by":"crossref","unstructured":"Lo, W. W., Layeghy, S., Sarhan, M., Gallagher, M. & Portmann, M. E GraphSAGE: A graph neural network based intrusion detection system for IoT, in Proc. IEEE\/IFIP Netw. Oper. Manage. Symp., Budapest, Hungary, Apr. pp. 1\u20139. (2022).","DOI":"10.1109\/NOMS54207.2022.9789878"},{"key":"41317_CR41","doi-asserted-by":"crossref","unstructured":"Caville, E., Lo, W. W., Layeghy, S. & Portmann, M. Dec., Anomal-E: A self supervised network intrusion detection system based on graph neural networks. Knowl. -Based Syst., 258, (2022). Art. 11.","DOI":"10.1016\/j.knosys.2022.110030"},{"key":"41317_CR42","unstructured":"Chang, L. & Branco, P. Graph-based solutions with residuals for intrusion detection: The modified E-GraphSAGE and E-ResGAT algorithms, (2021). arXiv:2111.13597."},{"key":"41317_CR43","unstructured":"Qinghua Mao, X. et al. FeCoGraph: Label-Aware Federated Graph Contrastive Learning for Few-Shot Network Intrusion."}],"container-title":["Scientific Reports"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-41317-5","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-41317-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-41317-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,16]],"date-time":"2026-06-16T19:10:44Z","timestamp":1781637044000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-41317-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,2]]},"references-count":43,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["41317"],"URL":"https:\/\/doi.org\/10.1038\/s41598-026-41317-5","relation":{},"ISSN":["2045-2322"],"issn-type":[{"value":"2045-2322","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,2]]},"assertion":[{"value":"1 November 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 February 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 March 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"11772"}}