{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T20:04:11Z","timestamp":1784923451023,"version":"3.55.0"},"reference-count":37,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/access.2026.3709714","type":"journal-article","created":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T19:45:43Z","timestamp":1783021543000},"page":"110052-110068","source":"Crossref","is-referenced-by-count":0,"title":["APT-CGSV: APT Detection via Contrastive GNNs and Semantic Validation"],"prefix":"10.1109","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-5486-9870","authenticated-orcid":false,"given":"Ali","family":"Shoukat","sequence":"first","affiliation":[{"name":"University of Calgary","place":["Calgary, AB, Canada"],"department":["Department of Electrical and Software Engineering"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3619-1534","authenticated-orcid":false,"given":"Rubina","family":"Akter","sequence":"additional","affiliation":[{"name":"University of Calgary","place":["Calgary, AB, Canada"],"department":["Department of Electrical and Software Engineering"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7948-4033","authenticated-orcid":false,"given":"Hadis","family":"Karimipour","sequence":"additional","affiliation":[{"name":"University of Calgary","place":["Calgary, AB, Canada"],"department":["Department of Electrical and Software Engineering"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2102-9190","authenticated-orcid":false,"given":"Fattane","family":"Zarrinkalam","sequence":"additional","affiliation":[{"name":"University of Guelph","place":["Guelph, ON, Canada"],"department":["Department of Computer Engineering"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3700749"},{"key":"ref2","volume-title":"M-Trends 2023","year":"2023"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/1047915.1047918"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"ref5","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2016.23350","article-title":"ProTracer: Towards practical provenance tracing by alternating between logging and tainting","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Ma"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref7","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2025.111744","article-title":"RAPID: Robust APT detection and investigation using context-aware deep learning","volume":"273","author":"Amaru","year":"2025","journal-title":"Comput. Netw."},{"key":"ref8","article-title":"LogShield: A transformer-based APT detection system leveraging self-attention","author":"Afnan","year":"2023","journal-title":"arXiv:2311.05733"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-90019-9_1"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243829"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3396390"},{"key":"ref13","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2023.24207","article-title":"Sometimes, you aren\u2019t what you do: Mimicry attacks against provenance graph host intrusion detection systems","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Goyal"},{"key":"ref14","first-page":"24824","article-title":"Chain-of-thought prompting elicits reasoning in large language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"35","author":"Wei"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363224"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/tkde.2024.3469578"},{"key":"ref17","first-page":"1597","article-title":"A simple framework for contrastive learning of visual representations","volume-title":"Proc. 37th Int. Conf. Mach. Learn. (ICML)","volume":"119","author":"Chen"},{"key":"ref18","first-page":"5812","article-title":"Graph contrastive learning with augmentations","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"33","author":"You"},{"key":"ref19","volume-title":"Transparent Computing Engagement 3 Data Release","year":"2018"},{"key":"ref20","volume-title":"Operationally Transparent Cyber (OpTC) Data Release"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463573"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE51399.2021.00024"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623187"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690221"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref26","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2020.24167","article-title":"You are what you do: Hunting stealthy malware via data provenance analysis","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS)","author":"Wang"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-25538-0_3"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC-DSS-SmartCity-DependSys60770.2023.00045"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP63326.2025.00057"},{"key":"ref32","article-title":"SHIELD: APT detection and intelligent explanation using LLM","author":"Atulbhai Gandhi","year":"2025","journal-title":"arXiv:2502.02342"},{"key":"ref33","article-title":"HuntGPT: Integrating machine learning-based anomaly detection and explainable AI with large language models (LLMs)","author":"Ali","year":"2023","journal-title":"arXiv:2309.16021"},{"key":"ref34","article-title":"LLM-driven provenance forensics for threat investigation and detection","author":"Mukherjee","year":"2025","journal-title":"arXiv:2508.21323"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1613"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3209280.3229085"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.14778\/3594512.3594514"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/11323511\/11593839.pdf?arnumber=11593839","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T19:08:13Z","timestamp":1784920093000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11593839\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":37,"URL":"https:\/\/doi.org\/10.1109\/access.2026.3709714","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}