{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T08:18:12Z","timestamp":1783153092718,"version":"3.54.6"},"publisher-location":"New York, NY, USA","reference-count":40,"publisher":"ACM","funder":[{"name":"National Natural Science Foundation of China","award":["62202042, 6212780016, 624B2027"],"award-info":[{"award-number":["62202042, 6212780016, 624B2027"]}]},{"name":"State Key Laboratory of Internet Architecture, Tsinghua University","award":["HLW2025MS03"],"award-info":[{"award-number":["HLW2025MS03"]}]},{"name":"Guangdong Science and Technology Programme","award":["2024B0101030002"],"award-info":[{"award-number":["2024B0101030002"]}]},{"name":"Ministry of Industry and Information Technology of China","award":["Not applicable"],"award-info":[{"award-number":["Not applicable"]}]},{"name":"National Key Research and Development Program of China","award":["2023YFB3307500"],"award-info":[{"award-number":["2023YFB3307500"]}]},{"name":"Science and Technology Innovation Project of Hunan Province","award":["2023RC4014"],"award-info":[{"award-number":["2023RC4014"]}]},{"name":"Open Project of the Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Qilu University of Technology (Shandong Academy of Sciences)","award":["2024PY029"],"award-info":[{"award-number":["2024PY029"]}]},{"name":"Fundamental Research Funds for the Central Universities, Jilin University","award":["Not applicable"],"award-info":[{"award-number":["Not applicable"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,13]]},"DOI":"10.1145\/3774904.3792201","type":"proceedings-article","created":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T13:28:36Z","timestamp":1777296516000},"page":"2673-2682","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["HyperDetector: Advanced Persistent Threat Detection via Hypergraph Neural Networks with Enhanced Global Perception"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-7755-097X","authenticated-orcid":false,"given":"Ziyue","family":"Wu","sequence":"first","affiliation":[{"name":"School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2297-0000","authenticated-orcid":false,"given":"Nan","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1147-4327","authenticated-orcid":false,"given":"Jiqiang","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7255-2950","authenticated-orcid":false,"given":"Hairong","family":"Dong","sequence":"additional","affiliation":[{"name":"School of Electronic and Information Engineering, TONGJI University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6168-7016","authenticated-orcid":false,"given":"Xibin","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Software, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/357830.357849"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3580305.3599504"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00005"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICNC64010.2025.10993920"},{"key":"e_1_3_2_1_7_1","first-page":"1199","volume-title":"Evading Provenance-Based ML Detectors with Adversarial System Actions. In 32nd USENIX Security Symposium (USENIX Security '23)","author":"European Union Agency for Cybersecurity.","year":"2023","unstructured":"European Union Agency for Cybersecurity. 2023. Evading Provenance-Based ML Detectors with Adversarial System Actions. In 32nd USENIX Security Symposium (USENIX Security '23). USENIX Association, Anaheim, CA, USA, 1199-1216. https:\/\/www.usenix.org\/system\/files\/usenixsecurity23-mukherjee.pdf"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33013558"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.2824\/0710888"},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of the 34th International Conference on Machine Learning (ICML 2017)","volume":"1272","author":"Gilmer Justin","year":"2017","unstructured":"Justin Gilmer, Samuel S Schoenholz, Patrick F Riley, Oriol Vinyals, and George E Dahl. 2017. Neural Message Passing for Quantum Chemistry. In Proceedings of the 34th International Conference on Machine Learning (ICML 2017) (Proceedings of Machine Learning Research, Vol. 70). PMLR, Sydney, Australia, 1263-1272. https:\/\/proceedings.mlr.press\/v70\/gilmer17a.html"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-04534-4_5"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"e_1_3_2_1_14_1","first-page":"487","volume-title":"26th USENIX Security Symposium (USENIX Security 17)","author":"Hossain Md Nahid","year":"2017","unstructured":"Md Nahid Hossain, Sadegh M Milajerdi, Junao Wang, Birhanu Eshete, Rigel Gjomemo, R Sekar, Scott Stoller, and VN Venkatakrishnan. 2017. : Real-time attack scenario reconstruction from audit data. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, Canada, 487-504."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.00025"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104194"},{"key":"e_1_3_2_1_17_1","first-page":"5197","volume-title":"Proceedings of the 33rd USENIX Security Symposium (USENIX Security '24)","author":"Jia Zian","year":"2024","unstructured":"Zian Jia, Yun Xiong, Yuhong Nan, Yao Zhang, Jinjing Zhao, and Mi Wen. 2024. MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning. In Proceedings of the 33rd USENIX Security Symposium (USENIX Security '24). USENIX Association, Philadelphia, PA, USA, 5197-5214. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/jia-zian"},{"key":"e_1_3_2_1_18_1","unstructured":"Rapid7 Labs. 2024. 2024 Attack Intelligence Report. Rapid7 Research Report. https:\/\/www.rapid7.com\/research\/report\/2024-attack-intelligence-report\/ Retrieved 2025-08-01 from Accessed: 2025-08-01."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3564625.3567997"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSC55868.2022.00075"},{"key":"e_1_3_2_1_21_1","unstructured":"Dan McWhorter. 2013. APT1: Exposing one of China's cyber espionage units. Technical Report. Mandiant. https:\/\/www.fireeye.com\/content\/dam\/fireeye-www\/services\/pdfs\/mandiant-apt1-report.pdf Retrieved 2025-08-01 from"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"e_1_3_2_1_24_1","unstructured":"MITRE Corporation. 2023. APT Groups and Operations. https:\/\/attack.mitre.org\/groups\/ Accessed: 2025-08-01."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243776"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.232"},{"key":"e_1_3_2_1_28_1","first-page":"800","article-title":"Guide to Intrusion Detection and Prevention Systems (IDPS)","author":"Scarfone Karen","year":"2007","unstructured":"Karen Scarfone and Peter Mell. 2007. Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94. National Institute of Standards and Technology (NIST). https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-94\/final","journal-title":"NIST Special Publication"},{"key":"e_1_3_2_1_29_1","volume-title":"Breach Report","author":"Security IBM","year":"2023","unstructured":"IBM Security. 2023. Cost of a Data Breach Report 2023. https:\/\/www.ibm.com\/reports\/data-breach Retrieved 2025-08-01 from Research by Ponemon Institute."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.3390\/app15115872"},{"key":"e_1_3_2_1_31_1","volume-title":"We're All in This Together: A Year in Review of Zero-Days Exploited In-the-Wild","author":"Semrau Maddie","year":"2023","unstructured":"Stone, Maddie and Semrau, Jared and Sadowski, James. 2024. We're All in This Together: A Year in Review of Zero-Days Exploited In-the-Wild in 2023. Technical Report. Google LLC. https:\/\/storage.googleapis.com\/gweb-uniblog-publish-prod\/documents\/Year_in_Review_of_ZeroDays.pdf Accessed: 2026-01-24."},{"key":"e_1_3_2_1_32_1","first-page":"5179","volume-title":"Proceedings of the 33rd USENIX Security Symposium (USENIX Security '24)","author":"Uetz Rafael","year":"2024","unstructured":"Rafael Uetz, Marco Herzog, Louis Hackl\u00e4nder, Simon Schwarz, and Martin Henze. 2024. You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks. In Proceedings of the 33rd USENIX Security Symposium (USENIX Security '24). USENIX Association, Philadelphia, PA, 5179-5196. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/uetz"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"e_1_3_2_1_35_1","first-page":"5998","article-title":"Attention Is All You Need","volume":"30","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention Is All You Need. In Advances in Neural Information Processing Systems, Vol. 30. 5998-6008. https:\/\/proceedings.neurips.cc\/paper\/2017\/file\/3f5ee243547dee91fbd053c1c4a845aa-Paper.pdf","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.2307\/2346830"},{"key":"e_1_3_2_1_38_1","first-page":"4355","volume-title":"32nd USENIX Security Symposium (USENIX Security '23)","author":"Yang Fan","year":"2023","unstructured":"Fan Yang, Jiacen Xu, Chunlin Xiong, Zhou Li, and Kehuan Zhang. 2023. PROGRAPHER: An Anomaly Detection System based on Provenance Graph Embedding. In 32nd USENIX Security Symposium (USENIX Security '23). USENIX Association, Anaheim, CA, 4355-4372. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/yang-fan"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833669"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.3390\/app13231262910.3390\/app132312629"}],"event":{"name":"WWW '26: The ACM Web Conference 2026","location":"Dubai United Arab Emirates","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2026"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3774904.3792201","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T07:41:45Z","timestamp":1783150905000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3774904.3792201"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":40,"alternative-id":["10.1145\/3774904.3792201","10.1145\/3774904"],"URL":"https:\/\/doi.org\/10.1145\/3774904.3792201","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}