{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,31]],"date-time":"2026-10-31T05:16:27Z","timestamp":1793423787157,"version":"4.5.0"},"publisher-location":"New York, NY, USA","reference-count":90,"publisher":"ACM","funder":[{"name":"NSERC-CSE Research Communities Grant"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765219","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:33:16Z","timestamp":1763854396000},"page":"261-275","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":14,"title":["OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7626-8124","authenticated-orcid":false,"given":"Ahmed","family":"Aly","sequence":"first","affiliation":[{"name":"Concordia University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6851-6351","authenticated-orcid":false,"given":"Essam","family":"Mansour","sequence":"additional","affiliation":[{"name":"Concordia University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4284-8646","authenticated-orcid":false,"given":"Amr","family":"Youssef","sequence":"additional","affiliation":[{"name":"Concordia University, Montreal, Quebec, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"AI@Meta. 2024. Llama 3 Model Card. (2024). https:\/\/github.com\/meta-llama\/llama3\/blob\/main\/MODEL_CARD.md"},{"key":"e_1_3_2_2_2_1","volume-title":"ATLAS: A Sequence-based Learning Approach for Attack Investigation. In USENIX Security Symposium.","author":"Alsaheel Abdulellah","year":"2021","unstructured":"Abdulellah Alsaheel, Yuhong Nan, Shiqing Ma, Le Yu, Gregory Walkup, Z Berkay Celik, Xiangyu Zhang, and Dongyan Xu. 2021. ATLAS: A Sequence-based Learning Approach for Attack Investigation. In USENIX Security Symposium."},{"key":"e_1_3_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2891891"},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623187"},{"key":"e_1_3_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3396390"},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463573"},{"key":"e_1_3_2_2_7_1","unstructured":"Pieter Swart Aric Hagberg Dan Schult. 2024. NetworkX: Network Analysis in Python. https:\/\/github.com\/networkx\/networkx Accessed: 2025-03-06."},{"key":"e_1_3_2_2_8_1","volume-title":"USENIX Security Symposium.","author":"Arp Daniel","year":"2022","unstructured":"Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. 2022. Dos and don'ts of machine learning in computer security. In USENIX Security Symposium."},{"key":"e_1_3_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3523261"},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/2008\/10\/P10008"},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00051"},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICISA.2014.6847442"},{"key":"e_1_3_2_2_13_1","volume-title":"APT-KGL: An Intelligent apt Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning","author":"Chen Tieming","year":"2022","unstructured":"Tieming Chen, Chengyu Dong, Mingqi Lv, Qijie Song, Haiwen Liu, Tiantian Zhu, Kang Xu, Ling Chen, Shouling Ji, and Yuan Fan. 2022. APT-KGL: An Intelligent apt Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning. IEEE Transactions on Dependable and Secure Computing (2022)."},{"key":"e_1_3_2_2_14_1","volume-title":"SoK: Knowledge is All You Need: Last Mile Delivery for Automated Provenance-based Intrusion Detection with LLMs. arXiv preprint arXiv:2503.03108","author":"Cheng Wenrui","year":"2025","unstructured":"Wenrui Cheng, Tiantian Zhu, Chunlin Xiong, Haofei Sun, Zijun Wang, Shunan Jing, Mingqi Lv, and Yan Chen. 2025. SoK: Knowledge is All You Need: Last Mile Delivery for Automated Provenance-based Intrusion Detection with LLMs. arXiv preprint arXiv:2503.03108 (2025)."},{"key":"e_1_3_2_2_15_1","volume-title":"Dawn Song, and Peng Gao.","author":"Cheng Yutong","year":"2024","unstructured":"Yutong Cheng, Osama Bajaber, Saimon Amanuel Tsegai, Dawn Song, and Peng Gao. 2024a. CTINEXUS: Leveraging Optimized LLM In-Context Learning for Constructing Cybersecurity Knowledge Graphs Under Data Scarcity. arXiv preprint arXiv:2410.21060 (2024)."},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00005"},{"key":"e_1_3_2_2_17_1","unstructured":"DARPA. 2018a. TC3 Ground Truth Report. https:\/\/drive.google.com\/file\/d\/1mrs4LWkGk-3zA7t7v8zrhm0yEDHe57QU\/view Accessed: 2025-03-06."},{"key":"e_1_3_2_2_18_1","unstructured":"DARPA. 2018b. Transparent Computing Engagement 3 (TC3) Data Release. https:\/\/github.com\/darpa-i2o\/Transparent-Computing\/blob\/master\/README-E3.md Accessed: 2025-03-06."},{"key":"e_1_3_2_2_19_1","unstructured":"DARPA. 2020a. Operationally Transparent Cyber (OpTC) Data Release. https:\/\/github.com\/FiveDirections\/OpTC-data Accessed: 2025-03-06."},{"key":"e_1_3_2_2_20_1","unstructured":"DARPA. 2020b. OpTC Ground Truth Report. https:\/\/drive.google.com\/file\/d\/1lX8kfrdZGJwaqSdwTlEBGwmz069lZWh-\/view Accessed: 2025-03-06."},{"key":"e_1_3_2_2_21_1","volume-title":"PentestGPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing. In USENIX Security Symposium. 847-864","author":"Deng Gelei","year":"2024","unstructured":"Gelei Deng, Yi Liu, V\u00edctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. 2024. PentestGPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing. In USENIX Security Symposium. 847-864."},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053387"},{"key":"e_1_3_2_2_23_1","volume-title":"Back-Propagating System Dependency Impact for Attack Investigation. In USENIX Security Symposium. 2461-2478","author":"Fang Pengcheng","year":"2022","unstructured":"Pengcheng Fang, Peng Gao, Changlin Liu, Erman Ayday, Kangkook Jee, Ting Wang, Yanfang Fanny Ye, Zhuotao Liu, and Xusheng Xiao. 2022. Back-Propagating System Dependency Impact for Attack Investigation. In USENIX Security Symposium. 2461-2478."},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW61312.2024.00018"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24207"},{"key":"e_1_3_2_2_26_1","unstructured":"IBM Granite Embedding Team. 2024. Granite Embedding Models. https:\/\/github.com\/ibm-granite\/granite-embedding-models\/"},{"key":"e_1_3_2_2_27_1","volume-title":"International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles. Springer, 83-99","author":"Guastalla Michael","year":"2023","unstructured":"Michael Guastalla, Yiyi Li, Arvin Hekmati, and Bhaskar Krishnamachari. 2023. Application of large language models to ddos attack detection. In International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles. Springer, 83-99."},{"key":"e_1_3_2_2_28_1","volume-title":"Inductive representation learning on large graphs. Advances in neural information processing systems","author":"Hamilton Will","year":"2017","unstructured":"Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. Advances in neural information processing systems, Vol. 30 (2017)."},{"key":"e_1_3_2_2_29_1","volume-title":"UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats. In Network and Distributed Systems Security (NDSS) Symposium.","author":"Han Xueyuan","year":"2020","unstructured":"Xueyuan Han, Thomas Pasquier, Adam Bates, James Mickens, and Margo Seltzer. 2020. UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats. In Network and Distributed Systems Security (NDSS) Symposium."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427255"},{"key":"e_1_3_2_2_33_1","volume-title":"USENIX Security Symposium. 487-504","author":"Hossain Md Nahid","year":"2017","unstructured":"Md Nahid Hossain, Sadegh M Milajerdi, Junao Wang, Birhanu Eshete, Rigel Gjomemo, R Sekar, Scott Stoller, and VN Venkatakrishnan. 2017. SLEUTH: Real-time attack scenario reconstruction from COTS audit data. In USENIX Security Symposium. 487-504."},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00064"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24401"},{"key":"e_1_3_2_2_36_1","volume-title":"One-Class Directed Heterogeneous Graph Neural Network for Intrusion Detection. In The International Conference on Innovation in Artificial Intelligence (ICIAI). 178-184","author":"Huang Zeqi","year":"2022","unstructured":"Zeqi Huang, Yonghao Gu, and Qing Zhao. 2022. One-Class Directed Heterogeneous Graph Neural Network for Intrusion Detection. In The International Conference on Innovation in Artificial Intelligence (ICIAI). 178-184."},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1002\/net.3230220105"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1137\/0404033"},{"key":"e_1_3_2_2_39_1","volume-title":"IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 307-325","author":"Inam Muhammad Adil","year":"2022","unstructured":"Muhammad Adil Inam, Yinfang Chen, Akul Goyal, Jason Liu, Jaron Mink, Noor Michael, Sneha Gaur, Adam Bates, and Wajih Ul Hassan. 2022. SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions. In IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 307-325."},{"key":"e_1_3_2_2_40_1","volume-title":"USENIX Security Symposium. 5197-5214","author":"Jia Zian","year":"2024","unstructured":"Zian Jia, Yun Xiong, Yuhong Nan, Yao Zhang, Jinjing Zhao, and Mi Wen. 2024. MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning. In USENIX Security Symposium. 5197-5214."},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA52953.2021.00273"},{"key":"e_1_3_2_2_42_1","volume-title":"Won-Yong Shin, and Sungsu Lim.","author":"Kim Hwan","year":"2022","unstructured":"Hwan Kim, Byung Suk Lee, Won-Yong Shin, and Sungsu Lim. 2022. Graph anomaly detection with graph neural networks: Current status and challenges. IEEE Access (2022)."},{"key":"e_1_3_2_2_43_1","volume-title":"Variational graph auto-encoders. arXiv preprint arXiv:1611.07308","author":"Kipf Thomas N","year":"2016","unstructured":"Thomas N Kipf and Max Welling. 2016. Variational graph auto-encoders. arXiv preprint arXiv:1611.07308 (2016)."},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3664646.3664770"},{"key":"e_1_3_2_2_45_1","volume-title":"DoLLM: How Large Language Models Understanding Network Flow Data to Detect Carpet Bombing DDoS. arXiv preprint arXiv:2405.07638","author":"Li Qingyang","year":"2024","unstructured":"Qingyang Li, Yihang Zhang, Zhidong Jia, Yannan Hu, Lei Zhang, Jianrong Zhang, Yongming Xu, Yong Cui, Zongming Guo, and Xinggong Zhang. 2024c. DoLLM: How Large Language Models Understanding Network Flow Data to Detect Carpet Bombing DDoS. arXiv preprint arXiv:2405.07638 (2024)."},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23204"},{"key":"e_1_3_2_2_47_1","first-page":"793","volume-title":"KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection. In 33rd USENIX Security Symposium (USENIX Security 24)","author":"Li Yuexin","year":"2024","unstructured":"Yuexin Li, Chengyu Huang, Shumin Deng, Mei Lin Lock, Tri Cao, Nay Oo, Hoon Wei Lim, and Bryan Hooi. 2024b. KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection. In 33rd USENIX Security Symposium (USENIX Security 24). 793-810."},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241491"},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363224"},{"key":"e_1_3_2_2_50_1","unstructured":"Jerry Liu. 2022. LlamaIndex. https:\/\/github.com\/jerryjliu\/llama_index"},{"key":"e_1_3_2_2_51_1","first-page":"1","article-title":"Pygod: A python library for graph outlier detection","volume":"25","author":"Liu Kay","year":"2024","unstructured":"Kay Liu, Yingtong Dou, Xueying Ding, Xiyang Hu, Ruitong Zhang, Hao Peng, Lichao Sun, and S Yu Philip. 2024. Pygod: A python library for graph outlier detection. Journal of Machine Learning Research, Vol. 25, 141 (2024), 1-9.","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_2_2_52_1","first-page":"27021","article-title":"Bond: Benchmarking unsupervised outlier node detection on static attributed graphs","volume":"35","author":"Liu Kay","year":"2022","unstructured":"Kay Liu, Yingtong Dou, Yue Zhao, Xueying Ding, Xiyang Hu, Ruitong Zhang, Kaize Ding, Canyu Chen, Hao Peng, Kai Shu, et al., 2022a. Bond: Benchmarking unsupervised outlier node detection on static attributed graphs. Advances in Neural Information Processing Systems, Vol. 35 (2022), 27021-27035.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3068344"},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3564625.3567997"},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2024.112031"},{"key":"e_1_3_2_2_56_1","volume-title":"IEEE International Conference on Data Science in Cyberspace (DSC). IEEE, 498-505","author":"Lv Yang","year":"2022","unstructured":"Yang Lv, Shaona Qin, Zifeng Zhu, Zhuocheng Yu, Shudong Li, and Weihong Han. 2022. A Review of Provenance Graph based apt Attack Detection: Applications and Developments. In IEEE International Conference on Data Science in Cyberspace (DSC). IEEE, 498-505."},{"key":"e_1_3_2_2_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"e_1_3_2_2_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"e_1_3_2_2_60_1","first-page":"1199","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Mukherjee Kunal","year":"2023","unstructured":"Kunal Mukherjee, Joshua Wiedemeier, Tianhao Wang, James Wei, Feng Chen, Muhyun Kim, Murat Kantarcioglu, and Kangkook Jee. 2023. Evading Provenance-BasedML detectors with adversarial system actions. In 32nd USENIX Security Symposium (USENIX Security 23). 1199-1216."},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-35314-7_2"},{"key":"e_1_3_2_2_62_1","first-page":"883","volume-title":"Fuzzing BusyBox: Leveraging LLM and Crash Reuse for Embedded Bug Unearthing. In 33rd USENIX Security Symposium (USENIX Security 24)","author":"Oliinyk Yaroslav","year":"2024","unstructured":"Yaroslav Oliinyk, Michael Scott, Ryan Tsang, Chongzhou Fang, Houman Homayoun, et al., 2024. Fuzzing BusyBox: Leveraging LLM and Crash Reuse for Embedded Bug Unearthing. In 33rd USENIX Security Symposium (USENIX Security 24). 883-900."},{"key":"e_1_3_2_2_63_1","unstructured":"Ontotext. 2025. GraphDB. https:\/\/www.ontotext.com\/products\/graphdb\/ Accessed: 2025-03-06."},{"key":"e_1_3_2_2_64_1","volume-title":"https:\/\/openai.com\/index\/gpt-4o-mini-advancing-cost-efficient-intelligence\/. Accessed","author":"AI.","year":"2025","unstructured":"OpenAI. 2024a. GPT-4o-mini. https:\/\/openai.com\/index\/gpt-4o-mini-advancing-cost-efficient-intelligence\/. Accessed April 2025."},{"key":"e_1_3_2_2_65_1","volume-title":"text-embedding-3-large. https:\/\/platform.openai.com\/docs\/guides\/embeddings\/embedding-models. Accessed","author":"AI.","year":"2025","unstructured":"OpenAI. 2024b. text-embedding-3-large. https:\/\/platform.openai.com\/docs\/guides\/embeddings\/embedding-models. Accessed April 2025."},{"key":"e_1_3_2_2_66_1","unstructured":"Adam Paszke Sam Gross Francisco Massa Adam Lerer James Bradbury and et al. 2019. PyTorch: An Imperative Style High-Performance Deep Learning Library. In Advances in Neural Information Processing Systems. Curran Associates Inc."},{"key":"e_1_3_2_2_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179420"},{"key":"e_1_3_2_2_68_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991122"},{"key":"e_1_3_2_2_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIPRO60963.2024.10569238"},{"key":"e_1_3_2_2_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"e_1_3_2_2_71_1","unstructured":"David Wood Richard Cyganiak and Markus Lanthaler. 2014. RDF 1.1 concepts and abstract syntax. (2014)."},{"key":"e_1_3_2_2_72_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93417-4_38"},{"key":"e_1_3_2_2_73_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00210"},{"key":"e_1_3_2_2_74_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833671"},{"key":"e_1_3_2_2_75_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230822"},{"key":"e_1_3_2_2_76_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"e_1_3_2_2_77_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"e_1_3_2_2_78_1","volume-title":"One-class graph neural networks for anomaly detection in attributed networks. Neural computing and applications","author":"Wang Xuhong","year":"2021","unstructured":"Xuhong Wang, Baihong Jin, Ying Du, Ping Cui, Yingshui Tan, and Yupu Yang. 2021. One-class graph neural networks for anomaly detection in attributed networks. Neural computing and applications, Vol. 33 (2021), 12073-12085."},{"key":"e_1_3_2_2_79_1","volume-title":"Quoc V. Le, and Denny Zhou.","author":"Wei Jason","year":"2022","unstructured":"Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed H. Chi, Quoc V. Le, and Denny Zhou. 2022. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. In Advances in Neural Information Processing Systems (NeurIPS). https:\/\/papers.nips.cc\/paper_files\/paper\/2022\/hash\/9d5609613524ecf4f15af0f7b31abca4-Abstract-Conference.html"},{"key":"e_1_3_2_2_80_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833632"},{"key":"e_1_3_2_2_81_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-05936-0_35"},{"key":"e_1_3_2_2_82_1","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom56396.2022.00106"},{"key":"e_1_3_2_2_83_1","volume-title":"USENIX Security Symposium. 4355-4372","author":"Yang Fan","year":"2023","unstructured":"Fan Yang, Jiacen Xu, Chunlin Xiong, Zhou Li, and Kehuan Zhang. 2023. PROGRAPHER: An Anomaly Detection System based on Provenance Graph Embedding. In USENIX Security Symposium. 4355-4372."},{"key":"e_1_3_2_2_84_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.07.061"},{"key":"e_1_3_2_2_85_1","volume-title":"AttackSeqBench: Benchmarking Large Language Models' Understanding of Sequential Patterns in Cyber Attacks. arXiv preprint arXiv:2503.03170","author":"Yong Javier","year":"2025","unstructured":"Javier Yong, Haokai Ma, Yunshan Ma, Anis Yusof, Zhenkai Liang, and Ee-Chien Chang. 2025. AttackSeqBench: Benchmarking Large Language Models' Understanding of Sequential Patterns in Cyber Attacks. arXiv preprint arXiv:2503.03170 (2025)."},{"key":"e_1_3_2_2_86_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"},{"key":"e_1_3_2_2_87_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"e_1_3_2_2_88_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104220"},{"key":"e_1_3_2_2_89_1","volume-title":"Advances in Neural Information Processing Systems","volume":"36","author":"Zheng Lianmin","year":"2024","unstructured":"Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al., 2024. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_2_90_1","volume-title":"Provenance-based Intrusion Detection Systems: A Survey. ACM Computing Surveys (CSUR)","author":"Zipperle Michael","year":"2022","unstructured":"Michael Zipperle, Florian Gottwalt, Elizabeth Chang, and Tharam Dillon. 2022. Provenance-based Intrusion Detection Systems: A Survey. ACM Computing Surveys (CSUR) (2022)."}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765219","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:15:54Z","timestamp":1766441754000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765219"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":90,"alternative-id":["10.1145\/3719027.3765219","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765219","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}