{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T05:44:34Z","timestamp":1782798274286,"version":"3.54.5"},"reference-count":45,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100005320","name":"Xidian University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100005320","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010909","name":"Young Scientists Fund","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100010909","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/infocom59046.2026.11571243","type":"proceedings-article","created":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T19:38:15Z","timestamp":1782761895000},"page":"1-10","source":"Crossref","is-referenced-by-count":0,"title":["SAGE: Self-Reflective End-to-End Framework for Automated APT Investigation in 5G Networks"],"prefix":"10.1109","author":[{"given":"Xinyu","family":"Liu","sequence":"first","affiliation":[{"name":"Beihang University,School of Cyber Science and Technology,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yu","family":"Sun","sequence":"additional","affiliation":[{"name":"Beihang University,School of Cyber Science and Technology,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gaojian","family":"Xiong","sequence":"additional","affiliation":[{"name":"Beihang University,School of Cyber Science and Technology,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jianhua","family":"Liu","sequence":"additional","affiliation":[{"name":"Beihang University,School of Cyber Science and Technology,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jian","family":"Cui","sequence":"additional","affiliation":[{"name":"Beihang University,School of Cyber Science and Technology,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jianwei","family":"Liu","sequence":"additional","affiliation":[{"name":"Beihang University,School of Cyber Science and Technology,China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"2024 global advanced persistent threat (apt) research report","year":"2024","journal-title":"360 Digital Security Group, China, Technical Report"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM55648.2025.11044489"},{"key":"ref3","first-page":"5287","article-title":"{CoreCrisis} :{Threat-Guided} and {Context-Aware} iterative learning and fuzzing of 5g core networks","volume-title":"34th USENIX Security Symposium (USENIX Security 25)","author":"Dong"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945467"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179405"},{"key":"ref6","article-title":"Transparent computing program","volume-title":"Material from the DARPA Transparent Computing Program","year":"2019"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref8","article-title":"Lost in the middle: How language models use long contexts","author":"Liu","year":"2023"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1017\/S1351324916000334"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-22915-7_40"},{"key":"ref11","article-title":"MITRE ATT&CK"},{"key":"ref12","article-title":"Orthrus: Achieving high quality of attribution in provenance-based intrusion detection systems","volume-title":"Security Symposium (USENIX Sec\u201925). USENIX","author":"Jiang"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref14","first-page":"5197","article-title":"{MAGIC}: Detecting advanced persistent threats via masked graph representation learning","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Jia"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24270"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24329"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427255"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00005"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104220"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS65363.2025.11011912"},{"key":"ref23","article-title":"From alerts to intelligence: A novel llm-aided framework for host-based intrusion detection","author":"Sun","year":"2025"},{"key":"ref24","article-title":"Sok: Knowledge is all you need: Accelerating last mile delivery for automated provenance-based intrusion detection with llms","author":"Cheng","year":"2025"},{"key":"ref25","article-title":"Loro: Real-time on-device secure inference for llms via tee-based low rank obfuscation","volume-title":"The Thirty-ninth Annual Conference on Neural Information Processing Systems","author":"Xiong"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00001"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP48485.2024.10445924"},{"key":"ref28","first-page":"3971","article-title":"Dos and don\u2019ts of machine learning in computer security","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Arp"},{"key":"ref29","first-page":"100","article-title":"Sometimes simpler is better: A comprehensive analysis of state-of-the-art provenance-based intrusion detection systems","volume":"99","author":"Bilot","year":"2025","journal-title":"representations"},{"key":"ref30","article-title":"Kag-thinker: Teaching large language models to think with human-like reasoning process","author":"Zhang","year":"2025"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-025-09422-z"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/0306-4573(88)90021-0"},{"key":"ref33","article-title":"Open5GS: Open Source Implementation for 5G Core and EPC","year":"2024"},{"key":"ref34","article-title":"free5GC: Open Source 5G Core Network","volume-title":"National Yang Ming Chiao Tung University"},{"key":"ref35","volume-title":"Cve-2024-33241","year":"2024"},{"key":"ref36","volume-title":"Cve-2023-4884","year":"2023"},{"key":"ref37","volume-title":"Cve-2022-40890","year":"2022"},{"key":"ref38","volume-title":"Cve-2022-43221","year":"2022"},{"key":"ref39","article-title":"Open5gs issue #2786: Cve-2024-41479","year":"2024"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00006"},{"key":"ref41","volume-title":"Cve-2023-50804","year":"2023"},{"key":"ref42","article-title":"srsran: Open source 4g and 5g software radio suite","year":"2025"},{"key":"ref43","article-title":"The llama 3 herd of models","author":"Grattafiori","year":"2024"},{"key":"ref44","article-title":"Openai o3-mini","year":"2024"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM55648.2025.11044565"}],"event":{"name":"IEEE INFOCOM 2026 - IEEE Conference on Computer Communications","location":"Tokyo, Japan","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["IEEE INFOCOM 2026 - IEEE Conference on Computer Communications"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11571071\/11571169\/11571243.pdf?arnumber=11571243","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T05:12:02Z","timestamp":1782796322000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11571243\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":45,"URL":"https:\/\/doi.org\/10.1109\/infocom59046.2026.11571243","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}