{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T00:26:49Z","timestamp":1784852809094,"version":"3.55.0"},"reference-count":59,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/100000070","name":"National Institute of Biomedical Imaging and Bioengineering of the National Institutes of Health","doi-asserted-by":"publisher","award":["1R15EB036778-01"],"award-info":[{"award-number":["1R15EB036778-01"]}],"id":[{"id":"10.13039\/100000070","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/access.2025.3636501","type":"journal-article","created":{"date-parts":[[2025,11,24]],"date-time":"2025-11-24T19:01:12Z","timestamp":1764010872000},"page":"199737-199756","source":"Crossref","is-referenced-by-count":3,"title":["XAPT: Explainable Anomaly-Driven Prediction of Threat Stages in APT Campaigns"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4150-8674","authenticated-orcid":false,"given":"Wei","family":"Lu","sequence":"first","affiliation":[{"name":"Department of Computer Science, Keene State College, Keene, NH, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2987-8047","authenticated-orcid":false,"given":"Issa","family":"Traor\u00e9","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2484-4649","authenticated-orcid":false,"given":"Isaac","family":"Woungang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Toronto Metropolitan University, Toronto, ON, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-9450-7782","authenticated-orcid":false,"given":"Eric","family":"Brown","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Dartmouth College, Hanover, NH, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marcelo","family":"Luiz Brocardo","sequence":"additional","affiliation":[{"name":"Santa Catarina State University (UDESC), Florianópolis, Santa Catarina, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7232-8529","authenticated-orcid":false,"given":"Qiaoyan","family":"Yu","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of New Hampshire, Durham, NH, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ornella","family":"Lucresse Soh","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"issue":"6","key":"ref1","first-page":"20","article-title":"What APT is (and what it isn\u2019t)","volume":"12","author":"Bejtlich","year":"2010","journal-title":"Inf. Secur."},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-012-1275-x"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ICIS.2016.7550947"},{"key":"ref4","first-page":"4593","article-title":"SHAP-based explanation methods: A review for NLP interpretability","volume-title":"Proc. 29th Int. Conf. Comput. Linguistics","author":"Mosca"},{"key":"ref5","first-page":"1","article-title":"A unified approach to interpreting model predictions","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Lundberg"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1038\/s41551-018-0304-0"},{"issue":"1","key":"ref7","first-page":"80","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume":"1","author":"Hutchins","year":"2011","journal-title":"Leading Issues Inf. Warfare Secur. Res."},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/cybersecurity.2012.16"},{"key":"ref9","volume-title":"APT1\u2014Exposing One of China\u2019s Cyber Espionage Units","year":"2013"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/msp.2012.90"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-44885-4_5"},{"key":"ref12","volume-title":"Advanced Persistent Threat Hacking: The Art and Science of Hacking Any Organization","author":"Wrightson","year":"2014"},{"key":"ref13","volume-title":"Lions at the Watering Hole\u2014The \u2018VOHO\u2019 Affair","author":"Gragido","year":"2012"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/uic-atc.2013.80"},{"key":"ref15","first-page":"842","article-title":"A Markov multi-phase transferable belief model: An application for predicting data exfiltration APTs","volume-title":"Proc. 16th Int. Conf. Inf. Fusion","author":"Ioannou"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/sose.2014.53"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-015-1604-8"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1117\/12.2263543"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.08.095"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-021-05952-5"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.3390\/app12136816"},{"key":"ref22","article-title":"ProAPT: Projection of APT threats with deep reinforcement learning","author":"Dehghan","year":"2022","journal-title":"arXiv:2209.07215"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2022.108548"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/PST58708.2023.10320192"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2019.00026"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.06.055"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.32604\/cmc.2021.014223"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.13052\/jwe1540-9589.2019"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/4916953"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2015.2458581"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3170011"},{"issue":"3","key":"ref32","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly detection: A survey","volume":"41","author":"Varun","year":"2009","journal-title":"ACM Comput. Surv."},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-16237-4_9"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59621-7_8"},{"key":"ref35","article-title":"A semi real dataset of Meta-Alerts for APT attack detection","author":"Tork","year":"2020","journal-title":"IEEE Dataport"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.2478\/bsrj-2021-0015"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.3390\/app11219899"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/9396141"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-00296-0_5"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-9868.2005.00503.x"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.17487\/RFC9110"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355567"},{"key":"ref43","doi-asserted-by":"crossref","DOI":"10.17487\/RFC9293","volume-title":"Transmission Control Protocol (TCP)","author":"Eddy","year":"2022"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3646547.3688409"},{"key":"ref45","first-page":"1","article-title":"Spoki: Unveiling a new wave of scanners through a reactive network telescope","volume-title":"Proc. USENIX Secur.","author":"Hiesgen"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3424214"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/dsn.2016.48"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3588771"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.3390\/sym15061205"},{"key":"ref50","first-page":"559","article-title":"ShadowMove: A stealthy lateral movement strategy","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Secur.)","author":"Niakanlahiji"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyad023"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.3390\/computers14070245"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/eIT60633.2024.10609886"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3716815.3729016"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-024-10890-4"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/csnet64211.2024.10851720"},{"key":"ref57","article-title":"CONTINUUM: Detecting APT attacks through spatial\u2013temporal graph neural networks","author":"Bahar","year":"2025","journal-title":"arXiv:2501.02981"},{"key":"ref58","article-title":"Preliminary investigation into uncertainty-aware attack stage classification","author":"Gaudenzi","year":"2025","journal-title":"arXiv:2508.00368"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-025-05219-x"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10820123\/11265744.pdf?arnumber=11265744","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,3]],"date-time":"2025-12-03T18:43:51Z","timestamp":1764787431000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11265744\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":59,"URL":"https:\/\/doi.org\/10.1109\/access.2025.3636501","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}