{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T15:57:59Z","timestamp":1783526279988,"version":"3.55.0"},"reference-count":45,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/access.2025.3639270","type":"journal-article","created":{"date-parts":[[2025,12,2]],"date-time":"2025-12-02T18:49:26Z","timestamp":1764701366000},"page":"212973-212982","source":"Crossref","is-referenced-by-count":1,"title":["Adaptive Detection of Advanced Persistent Threats (APT) With Graph Neural Networks and Rehearsal-Based Continual Learning on Wazuh EDR Telemetry"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-7418-1790","authenticated-orcid":false,"given":"Auttapon","family":"Pomsathit","sequence":"first","affiliation":[{"name":"Department of IoT and Information Engineering, School of Engineering, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, Thailand"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s44196-023-00369-5"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103821"},{"key":"ref3","article-title":"A survey of graph neural networks in real world: Imbalance, noise, privacy and OOD challenges","author":"Ju","year":"2024","journal-title":"arXiv:2403.04468"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-014-0365-y"},{"key":"ref5","article-title":"Lifelong learning for anomaly detection: New challenges, perspectives, and insights","author":"Faber","year":"2023","journal-title":"SSRN J."},{"key":"ref6","first-page":"275","article-title":"Continual learning for anomaly detection: An empirical study","volume":"153","author":"Lesort","year":"2022","journal-title":"Neural Netw."},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3605162"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.12732\/ijam.v38i5s.351"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2025.3606998"},{"key":"ref10","article-title":"Continual learning with strategic selection and forgetting for network intrusion detection","author":"Zhang","year":"2024","journal-title":"arXiv:2412.16264"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/isctis63324.2024.10698918"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/tkde.2024.3363240"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/itnec60942.2024.10732985"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3505244"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11491"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3652628.3652697"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/tts.2023.3240107"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-024-00813-3"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/access.2022.3211306"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.aiopen.2021.05.002"},{"key":"ref21","article-title":"Continual graph learning: A survey","author":"Yuan","year":"2023","journal-title":"arXiv:2301.12230"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2025.111363"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/csr57506.2023.10224974"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103960"},{"key":"ref25","article-title":"RAPID: Robust APT detection and investigation using context-aware deep learning","author":"Amaru","year":"2024","journal-title":"arXiv:2406.05362"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/s42979-023-01744-x"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.3390\/su151813820"},{"key":"ref28","article-title":"Towards continuous reuse of graph models via holistic memory diversification","author":"Qiao","year":"2024","journal-title":"arXiv:2406.07413"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645561"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i10.17049"},{"key":"ref31","article-title":"Universal graph continual learning","author":"Hoang","year":"2023","journal-title":"arXiv:2308.13982"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.54254\/2755-2721\/2025.ld24900"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3687300"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3645012"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1016\/j.bdr.2025.100555"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.30574\/wjarr.2024.23.2.2404"},{"key":"ref37","article-title":"A synergistic approach in network intrusion detection by neurosymbolic AI","author":"Bizzarri","year":"2024","journal-title":"arXiv:2406.00938"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-96-8892-0_35"},{"key":"ref39","article-title":"METANOIA: A lifelong intrusion detection and investigation system for mitigating concept drift","author":"Ying","year":"2024","journal-title":"arXiv:2501.00438"},{"key":"ref40","article-title":"CONTINUUM: Detecting APT attacks through spatial\u2013temporal graph neural networks","author":"Bahar","year":"2025","journal-title":"arXiv:2501.02981"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1117\/12.3052125"},{"key":"ref42","article-title":"Web scale graph mining for cyber threat intelligence","author":"Freitas","year":"2024","journal-title":"arXiv:2411.06239"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2024.114351"},{"key":"ref44","article-title":"SHIELD: APT detection and intelligent explanation using LLM","author":"Gandhi","year":"2025","journal-title":"arXiv:2502.02342"},{"key":"ref45","article-title":"P3GNN: A privacy-preserving provenance graph-based model for APT detection in software defined networking","author":"Nazari","year":"2024","journal-title":"arXiv:2406.12003"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10820123\/11272092.pdf?arnumber=11272092","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,23]],"date-time":"2025-12-23T06:16:01Z","timestamp":1766470561000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11272092\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":45,"URL":"https:\/\/doi.org\/10.1109\/access.2025.3639270","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}