Pith. sign in

REVIEW 5 major objections 4 minor 1 cited by

KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis

T0 review · 5 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read KnowHow shows that high-level CTI knowledge can be applied directly to low-level provenance detection through gIoC matching and APT-lifecycle reasoning, yielding interpretable, low-false-positive APT alerts.

desk verdict Serious systems paper; the gIoC and semantic-lifting layers are genuinely new, but the unvalidated embedding core makes the 90% FP claim premature. read the letter →

arxiv 2509.05698 v1 pith:65MOTBUL submitted 2025-09-06 cs.CR

Yuhan Meng , Shaofei Li , Jiaping Gui , Peng Jiang , Ding Li This is my paper
classification cs.CR
keywords provenanceanalysiscyberthreatintelligenceAPTdetectiongIoCsemanticliftingattacklifecycleinterpretablealertsfalsepositivereduction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

KnowHow tries to close the semantic gap between high-level threat-intelligence reports written in natural language and the low-level system events that provenance-based detectors actually see. Its move is to compress attack descriptions into gIoC triplets—subject, verb, object: who did what to what—and to lift system identifiers (file paths, commands, IPs, system calls) into natural-language phrases so that both sides can be compared in the same embedding space. If this works, CTI knowledge can be applied automatically and online, without per-environment manual rules, and every alert can be explained by a technique label and an APT lifecycle stage. The paper reports detecting all 16 APT campaigns in five datasets with higher node-level precision and recall than the baselines, cutting node-level false positives by up to 90% relative to the best recent detectors, and remaining effective on attacks exploiting vulnerabilities absent from the CTI corpus.

What carries the argument

The load-bearing object is the gIoC (General Indicator of Compromise), a Subject-Verb-Object triplet extracted from CTI sentences, e.g., (attacker, dump, process memory). It carries the semantics of an attack description in a form that can be matched to system events. The matching mechanism is ProvQ: event semantic lifting rewrites concrete identifiers into natural-language phrases using a hand-built simplification table, then a word-vector model embeds both the lifted event and the gIoC, and cosine similarity decides whether the event 'hits' the gIoC. Hits are aggregated into technique scores, and a relaxed APT lifecycle model with three temporal levels (Initial Compromise first, Complete M

What would settle it

Run benign but attack-shaped activity—a backup daemon copying a browser's profile directory, a system scanner reading '/etc/passwd' — through ProvQ with the learned threshold and count how many gIoCs it hits; if routine benign events score above threshold at scale, the semantic matching layer alone is not selective. An even sharper check: replace the lifting table with a shuffled synonym mapping and re-measure node-level recall on the five datasets; if recall does not drop substantially, semantic lifting is not the operative mechanism the paper says it is.

Watch

Extended reading notes

Core claim

The central claim is that fuzzy, high-level attack knowledge becomes directly usable for low-level detection if it is first condensed into gIoC triplets and system events are lifted into the same kind of natural-language terms. KnowHow builds a knowledge base of technique entries, each tied to one entry in the standard attacker-technique catalog and populated with gIoCs automatically extracted from CTI reports. Its query, ProvQ, rewrites an event's file path, command line, and system call into phrases such as 'firefox login data' or 'copy', embeds both event and gIoC with a word-vector model, and treats a cosine similarity above a benign-learned threshold as a match to a technique. Matched e

Load-bearing premise

The approach assumes that hand-written rules translating file paths, commands, and IP addresses into a few natural-language words, plus a word-similarity model trained on about ten thousand sentences, are enough to make a high similarity score between an event and an attack description actually mean they match.

Editorial extensions

If this is right

  • CTI reports can be converted into runtime detection rules automatically, so adding new threat intelligence can update detector behavior without human rule-writing.
  • Alerts are explainable as 'technique X at lifecycle stage Y' and can be rendered as full APT reports with context, timeline, IoCs, and mitigation steps.
  • Detection can generalize beyond exact IoCs to variants: renamed malware, Living-off-the-Land commands, and exploits for vulnerabilities not mentioned in the CTI corpus, as long as the behavior resembles a known gIoC.
  • Lifecycle reasoning directly attacks the false-positive problem: the component analysis attributes up to 36 percentage points of node-level precision recovery to temporal and completeness constraints.
  • Query cost grows logarithmically with the number of gIoCs, so the knowledge base can keep growing without making online detection impractical.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same lifting-and-embedding query could be reused beyond OS provenance—container, cloud, or database audit streams—by extending the simplification table, rather than retraining a whole detector; this is a testable generalization the paper does not claim.
  • Because matching quality rests on a hand-written lifting table and a word-vector model trained on roughly 10,000 sentences, an obvious stress test is to inject events with unseen identifier semantics (novel file schemes, obfuscated command names) and measure recall degradation; the paper's robustness results cover unseen CVEs but not this failure mode.
  • The relaxed lifecycle only demands Initial Compromise, Establish Foothold, and one intermediate stage, so a two-stage attack or a fully novel attack whose behaviors resemble no gIoC would be missed; clipping attack graphs to two stages would quantify this boundary directly.
  • Since 69 of 84 technique-labeling errors were ambiguity rather than semantic misunderstanding, and lifecycle reasoning tolerates them, the bottleneck may lie in the reasoning constraints rather than the embedding; a sensitivity analysis around the tactic-to-stage mapping would isolate that.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper presents KnowHow, a provenance-analysis system that aims to automatically apply high-level cyber-threat-intelligence (CTI) knowledge to low-level system events. The central idea is a new intermediate representation, the gIoC (General Indicator of Compromise), an SVO triplet extracted from CTI text, stored in a knowledge base (CKD) and matched against system events after lifting system identifiers into natural-language terms. Matching uses FastText embeddings and cosine similarity, with Mean-Shift clustering for query acceleration and Grubbs' test for setting the matching threshold. Detected anomalous events are assembled into provenance graphs, mapped to APT lifecycle stages, and filtered by a temporal reasoning model. The evaluation covers five datasets (THEIA, TRACE, In-lab Arena, NewlySim, Open-World) with 16 APT campaigns, compares against five end-to-end detection baselines and three CTI-extraction baselines, and reports graph- and node-level precision/recall, efficiency, robustness to mimicry and incomplete attacks, and a component-wise ablation.

Significance. If the central claim holds, KnowHow would be a substantial step forward: it would show that high-level, natural-language CTI knowledge can be operationalized for low-level provenance detection without per-attack manual rules, while improving precision over data-driven baselines. The evaluation is broad by the standards of the field: 16 campaigns across public and industrial datasets, multiple baseline families, an ablation against alternative CTI-extraction methods, and dedicated robustness experiments for mimicry and incomplete attacks. The paper also explicitly checks overlap between CTI knowledge and the attack techniques in the datasets, and it presents a component-wise analysis showing that each stage contributes to the final result. These strengths are real and should be credited. However, the load-bearing semantic-matching layer is not validated in isolation, several thresholds and hand-set rules are not reported or analyzed, and the headline quantitative claims are not fully verifiable from the tables. The contribution is therefore promising but not yet established to the standard needed for acceptance.

major comments (5)
  1. [Section IV-C, Fig. 2, and Section VII] The central semantic bridge is unvalidated. The paper asserts that FastText embedding of lifted event terms can relate terms such as 'read' and 'show', and that gIoCs such as (Adversary, read, etc shadow file) match events involving 'cp', but no similarity scores, nearest-neighbor examples, or threshold-sensitivity results are reported. This matters because the FastText model is trained on the same ATT&CK/CTI corpus from which the gIoCs are extracted, so end-to-end detection success does not demonstrate that embeddings generalize to lifted terms that never appear in the CTI corpus (e.g., 'firefox' from a profile path). I recommend adding an isolated evaluation of the embedding/lifting layer: report cosine-similarity distributions for known-positive and known-negative lifted term pairs, precision@k for lifted event terms against gIoC terms, and an ablation that replaces the hand-written l
  2. [Table VI, Table VII, and abstract] The abstract's '90% false-positive reduction' claim and the graph-level comparison are not verifiable from the reported tables. Tables VI and VII report only precision and recall, not the numbers of graph-level or node-level false positives, and no per-campaign counts are given. A reader cannot compute the claimed 81%/90% false-positive reductions relative to NODLINK and KAIROS. The absence of error bars or multiple runs is also notable for the ML-based baselines (AIRTAG retrains BERT; NODLINK and KAIROS have randomized components). I ask the authors to report raw FP/FN counts, per-dataset and per-campaign results, and run-to-run variability (or explain why the evaluation is deterministic).
  3. [Section IV-C and Section V-B] Several parameters that directly affect the reported results are either not stated or are hand-set without sensitivity analysis. The Grubbs' test significance level used to derive theta_q is not reported; the Mean-Shift bandwidth is not reported; and the alert-completeness rule in Section V-B (requiring 'Initial Compromise' plus 'Establish Foothold' plus one of four intermediate stages) is a manually chosen rule with no justification or sensitivity study. Since the precision improvements over baselines are the main selling point, the paper should report concrete parameter values and show that the conclusions are stable across reasonable variations of these parameters.
  4. [Section VI-D] The technique-labeling evaluation uses a generous success criterion: a labeling is correct if KnowHow matches any of up to three ground-truth techniques, and the text then says 69 of 84 mislabeled actions are 'not labeled by KnowHow as the top 3 accurate labels'. This conflates top-3 retrieval with exact labeling and makes the reported 87.0% accuracy hard to interpret. Please report top-1 and top-3 accuracy separately, and clarify whether the ground-truth annotation was performed independently of the system developers (the same red team is mentioned for Open-World and for annotating other datasets).
  5. [Section IV-B, Table II] The paper positions KnowHow as avoiding manual rules, but the event-semantic-lifting table (Table II) and the IoC-to-gIoC conversion rules are hand-written and may be incomplete for arbitrary file systems and command-line patterns. The motivating example relies on lifting a Firefox profile path to a 'browser' concept, but Table II does not show how this is produced. Please describe the rule-creation process, estimate coverage, and test sensitivity to the lifting rules, for example by removing or perturbing rows of Table II. This is not a fatal issue, but it is load-bearing for the 'automatic' claim.
minor comments (4)
  1. [Throughout] There are several typos and inconsistencies: 'uaually' (Section III-C), 'campaingn' (Section VII), 'tatics' (Section VI-D caption), 'Huawai' in the acknowledgments, and inconsistent capitalization of 'NodLink'/'NODLINK'. The tables also have formatting issues (e.g., Table VII's Open-World row is hard to read).
  2. [Section VI-A] The FastText model is said to be trained on 'over 10,000 attack-related statements extracted from 1,500 paragraphs' in ATT&CK and '80 pieces of attack descriptions'. It is not stated whether the 80 CTI reports used for training the embedding are the same 80 reports used to build CKD, or whether any held-out CTI text was used to test extraction. Please clarify the data split.
  3. [Section VI-F] The mimicry-robustness evaluation uses a newly constructed dataset (Mimic-Prov), but the construction procedure is only referenced to prior work. Since the paper notes that the prior work's dataset strips contextual information, please describe the new dataset's generation more concretely and state whether it will be released.
  4. [Section VI-B] The definition of node-level true positives ('a node is an NTP if it represents an attack step') is coarse; it does not distinguish between the attacker-controlled process/file and a benign neighbor included in the reported graph. This is inherited from NODLINK, but it makes high node-level precision numbers difficult to compare across systems. A finer-grained definition or additional case analysis would help.

Circularity Check

0 steps flagged · score 2.0 of 10

No derivation-from-fit circularity; only minor non-load-bearing self-citations.

full rationale

KnowHow's derivation chain is: CTI text -> gIoC/ATIE construction -> event semantic lifting -> FastText cosine matching -> benign-calibrated threshold -> lifecycle reasoning -> alerts. No step reduces to its own input by construction. The matching threshold is set by Grubbs' Test on benign data only, not on attack labels; gIoCs are not fitted to the evaluation datasets' ground truth; and the claimed generalization to unseen attacks is supported by external evidence (DARPA E3, red-team Open-World ground truth, and CVEs dated after the CTI corpus). The FastText embedding is trained on the same ATT&CK/CTI corpus used to build gIoCs, but that is a shared semantic representation rather than a fit of the prediction target: no attack label or detection outcome is used to estimate the embedding or the threshold, so the end-to-end detection is not equivalent to its inputs by construction. Self-citations (e.g., NODLINK for the online graph-construction component and the In-lab Arena dataset, and [21] for industrial motivation) are present but not load-bearing for the central semantic-matching claim; the core evaluation is against external ground truth. The paper also explicitly acknowledges limits (fully novel attacks, limited CTI coverage), which is consistent with a knowledge-driven system rather than evidence of circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the completeness of hand-built lifting rules, a small FastText training corpus, and several dataset-derived thresholds; these are the inputs the reader must buy before accepting the evaluation. No physical entities are introduced; gIoC is a data structure rather than a postulated entity.

free parameters (4)
  • Query threshold θ_q = Not reported; set via one-sided Grubbs' Test per dataset on benign data
    Section IV-C Threshold Setting; controls whether an event is flagged as matching an ATIE. If the Grubbs' alpha or dataset changes, detection changes. No sensitivity analysis provided.
  • Grubbs' Test significance level = Not stated
    Used both in threshold setting and in one-to-limited stage-label merging (Sections IV-C, V-C). This hidden alpha effectively tunes false-positive tolerance.
  • Alert completeness rule = Require Initial Compromise + Establish Foothold + at least one of {Escalate Privilege, Internal Reconnaissance, Move Lat
    Section V-B Raising Alerts. Hand-crafted lifecycle completeness threshold; no ablation on varying the required stages.
  • Mean-Shift bandwidth = Not stated
    Section IV-C Query Acceleration uses Mean-Shift clustering; bandwidth determines cluster granularity and can affect whether the nearest gIoC cluster contains the true match.
assumptions (5)
  • standard math Grubbs' Test is applicable to the similarity scores from benign data (approximate normality, no heavy-tailed clusters).
    Section IV-C applies one-sided Grubbs' Test to set θ_q without reporting a normality check or significance level.
  • domain assumption The relaxed APT lifecycle and the tactic-to-stage mapping in Table III correctly model real APT attack ordering.
    Section V-B relies on this ordering to prune false positives; if real attacks violate the ordering, true attacks would be discarded.
  • domain assumption The kernel and auditing framework are trusted and the attacker is remote or via user-executed payload.
    Section II threat model; kernel-level attacks are out of scope and would break detection.
  • ad hoc to paper The hand-written semantic-lifting rules in Table II are complete for the evaluated file systems and commands.
    Section IV-C; unmatched paths/commands degrade to generic terms like 'file' or 'unknown network', making matching dependent on the table's coverage.
  • ad hoc to paper FastText trained on roughly 10,000 attack-related statements captures the synonymy needed to equate lifted events with gIoC terms.
    Section IV-C states FastText makes 'run' and 'execute' close; the model is trained on ATT&CK descriptions and 80 CTI reports, the same source as gIoCs, and its generalization is not measured.

how reviews work

0 comments
Cite this review

Pith. "Pith review of KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis." pith.science (2026). https://pith.science/paper/65MOTBUL

@misc{pith2026250905698,
  author       = {Pith},
  title        = {Pith review of: KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/65MOTBUL}},
  note         = {Machine review of arXiv:2509.05698}
}
read the original abstract

High-level natural language knowledge in CTI reports, such as the ATT&CK framework, is beneficial to counter APT attacks. However, how to automatically apply the high-level knowledge in CTI reports in realistic attack detection systems, such as provenance analysis systems, is still an open problem. The challenge stems from the semantic gap between the knowledge and the low-level security logs: while the knowledge in CTI reports is written in natural language, attack detection systems can only process low-level system events like file accesses or network IP manipulations. Manual approaches can be labor-intensive and error-prone. In this paper, we propose KnowHow, a CTI-knowledge-driven online provenance analysis approach that can automatically apply high-level attack knowledge from CTI reports written in natural languages to detect low-level system events. The core of KnowHow is a novel attack knowledge representation, gIoC, that represents the subject, object, and actions of attacks. By lifting system identifiers, such as file paths, in system events to natural language terms, KnowHow can match system events to gIoC and further match them to techniques described in natural languages. Finally, based on the techniques matched to system events, KnowHow reasons about the temporal logic of attack steps and detects potential APT attacks in system events. Our evaluation shows that KnowHow can accurately detect all 16 APT campaigns in the open-source and industrial datasets, while existing approaches all introduce large numbers of false positives. Meanwhile, our evaluation also shows that KnowHow reduces at most 90% of node-level false positives while having a higher node-level recall and is robust against several unknown attacks and mimicry attacks.

Figures

Figures reproduced from arXiv: 2509.05698 by the authors.

Figure 1
Figure 1. A comparison of various CTI-knowledge driven methods with the detection results using the extracted knowledge on [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The calculation process of S(e.y, t). can calculate their cosine similarity. To this end, we leverage FastText [24] to embed the lifted event entries and fields in gIoCs into numerical vectors. We chose FastText due to its ability to preserve semantics and be efficient. First, embedding vectors of FastText can preserve the semantics of words. For example, FastText ensures the distances between “run” and “execute” to… view at source ↗
Figure 3
Figure 3. It consists of four steps: 1 Detecting Anomalous Events: Given a stream of system events, KNOWHOW first matches each incoming event e with CKD to identify anoma￾lous events. It detects anomalies by querying a system event in CKD using P rovQ, determining whether it corresponds to an attack technique documented in CKD. If an event matches at least one technique, it is classified as anomalous. 2 Constructing Provenanc… view at source ↗
Figures from the paper (7 more)
Figure 3
Figure 3. Figure 3: The workflow of KNOWHOW. Given an event stream, KNOWHOW first queries CKD to detect anomalous events by labeling attack techniques associated with them. Each event may correspond to multiple techniques. Next, KNOWHOW constructs the provenance graph, with a zoomed-in vi…
Figure 4
Figure 4. Figure 4: Stages are grouped into three levels based on the [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Structured prompt used to guide the LLM in generating [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Validation prompt used to verify the factual support. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 8
Figure 8. Figure 8: Working throughput among different frameworks. [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 7
Figure 7. Figure 7: Top 10 frequent techniques in our experiments. [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 9
Figure 9. Figure 9: Detection result of the APT campaingn using CVE [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. The Procedural Semantics Gap in Structured CTI: A Measurement-Driven STIX Analysis for APT Emulation

    cs.CR 2025-12 conditional novelty 6.0 of 10

    Structured CTI standards like ATT&CK describe adversary actions but lack the ordering, preconditions, and environmental details needed for direct multi-stage emulation, and a translation method can bridge this gap whe...

Reference graph

Works this paper leans on

96 extracted references · 71 canonical work pages · cited by 1 Pith paper

  1. [1]

    ThreatMiner,

    “ThreatMiner,” 2024, accessed on April 25, 2024. [Online]. Available: https://threatminer.org/

    2024

  2. [2]

    Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI,

    M. T. Alam, D. Bhusal, Y . Park, and N. Rastogi, “Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI,” inProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, ser. RAID ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 92–108. [Online]. Available: https://doi.org/...

    arXiv 2023

  3. [3]

    Lazagne,

    AlessandroZ, “Lazagne,” 2017, accessed on July 25, 2025. [Online]. Available: https://github.com/AlessandroZ/LaZagne/

    2017

  4. [4]

    ATLAS: A Sequence-based Learning Approach for Attack Investigation,

    A. Alsaheel, Y . Nan, S. Ma, L. Yu, G. Walkup, Z. B. Celik, X. Zhang, and D. Xu, “ATLAS: A Sequence-based Learning Approach for Attack Investigation,” in30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Aug. 2021, pp. 3005–3022. [Online]. Available: https://www.usenix.org/conference/usenixsecurity21/present ation/alsaheel

    2021

  5. [5]

    SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS,

    “SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS,” ANSSI, 2021, accessed on April 25,

    2021

  6. [6]

    ProvTalk: Towards Interpretable Multi-level Provenance Analysis in Networking Functions Virtualization (NFV)

    H. Z. Azadeh Tabiban, Y . J. Lingyu Wang, and M. Z. Makan Pourzandi, “ProvTalk: Towards Interpretable Multi-level Provenance Analysis in Networking Functions Virtualization (NFV).” inNDSS, 2022

    2022

  7. [7]

    Representation learning: A review and new perspectives,

    Y . Bengio, A. Courville, and P. Vincent, “Representation learning: A review and new perspectives,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 35, no. 8, pp. 1798–1828, 2013

    2013

  8. [8]

    Multidimensional binary search trees used for associative searching,

    J. L. Bentley, “Multidimensional binary search trees used for associative searching,”Commun. ACM, vol. 18, no. 9, p. 509–517, Sep. 1975. [Online]. Available: https://doi.org/10.1145/361002.361007

    arXiv 1975

Show all 96 references
  1. [9]

    BLACKENERGY & QUEDAGH,

    Bermejo, “BLACKENERGY & QUEDAGH,” 2020, accessed on April 25, 2024. [Online]. Available: https://blog-assets.f-secure.com/wp-con tent/uploads/2019/10/15163408/BlackEnergy Quedagh.pdf/

    2020

  2. [10]

    Fast nonparametric clustering with gaussian blurring mean-shift,

    M. A. Carreira-Perpi ˜n´an, “Fast nonparametric clustering with gaussian blurring mean-shift,” inProceedings of the 23rd International Conference on Machine Learning, ser. ICML ’06. New York, NY , USA: Association for Computing Machinery, 2006, p. 153–160. [Online]. Available:...

    2006

  3. [11]

    Teamtnt with new campaign aka

    O. Caspi, “Teamtnt with new campaign aka ”chimaera”,” 2021, accessed on July 25, 2025. [Online]. Available: https://levelblue.com/bl ogs/labs-research/teamtnt-with-new-campaign-aka-chimaera/

    2021

  4. [12]

    ROCKET KIT TEN: A CAMPAIGN WITH 9 LIVES,

    “ROCKET KIT TEN: A CAMPAIGN WITH 9 LIVES,” CHECK POINT, 2015, accessed on April 25, 2024. [Online]. Available: https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-r eport.pdf/

    2015

  5. [13]

    Kairos: Practical Intrusion Detection and Investigation using Whole- system Provenance,

    Z. Cheng, Q. Lv, J. Liang, Y . Wang, D. Sun, T. Pasquier, and X. Han, “Kairos: Practical Intrusion Detection and Investigation using Whole- system Provenance,” 2023

    2023

  6. [14]

    GRUBBS: Stata module to perform Grubbs’ test for outliers,

    N. Couderc, “GRUBBS: Stata module to perform Grubbs’ test for outliers,” 2007

    2007

  7. [15]

    ADV ANCED PERSISTENT THREAT (APT),

    “ADV ANCED PERSISTENT THREAT (APT),” CrowdStrike, 2023, accessed on April 25, 2024. [Online]. Available: https://www.crowdstr ike.com/cybersecurity-101/advanced-persistent-threat-apt/

    2023

  8. [16]

    A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES,

    “A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES,” Cyberreason Nocturnus, 2020, accessed on April 25, 2024. [Online]. Available: https://www.cybereason.com/blog/a-bazar-of-trick s-following-team9s-development-cycles/

    2020

  9. [17]

    DARPA Transparent Computing Engagement #3,

    “DARPA Transparent Computing Engagement #3,” DARPA, 2018, accessed on December 19, 2023. [Online]. Available: https://github.c om/darpa-i2o/Transparent-Computing/

    2018

  10. [18]

    Transparent computing engagement 3 data release,

    DARPA, “Transparent computing engagement 3 data release,” 2018, accessd on March 5, 2023. [Online]. Available: https://drive.google.c om/drive/folders/1QlbUFWAGq3Hpl8wVdzOdIoZLFxkII4EK/

    2018

  11. [19]

    Lifecycle of the Advanced Persistent Threat,

    “Lifecycle of the Advanced Persistent Threat,” DELL SecureWorks, accessed on April 25, 2024. [Online]. Available: https://docs.media.bit pipe.com/io 10x/io 105022/item 550605/Lifecycle of the Advanced Persistent Threat%5B1%5D.pdf/

    2024

  12. [20]

    AIRTAG: Towards Automated Attack Investigation by Unsupervised Learning with Log Texts,

    H. Ding, J. Zhai, Y . Nan, and S. Ma, “AIRTAG: Towards Automated Attack Investigation by Unsupervised Learning with Log Texts,” in32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, Aug. 2023, pp. 373–390. [Online]. Available: https://www.usen...

    2023

  13. [21]

    Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools,

    F. Dong, S. Li, P. Jiang, D. Li, H. Wang, L. Huang, X. Xiao, J. Chen, X. Luo, Y . Guo, and X. Chen, “Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communicat...

    2023

  14. [22]

    Elasticsearch,

    Elasticsearch, “Elasticsearch,”software, version

  15. [23]

    New osx/keydnap malware is hungry for credentials,

    ESET, “New osx/keydnap malware is hungry for credentials,” 2016, accessed on July 25, 2025. [Online]. Available: https://www.welivese curity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/

    2016

  16. [24]

    FastText. ,

    “FastText. ,” Facebook., 2017, accessed on October 1, 2023. [Online]. Available: https://fasttext.cc/

    2017

  17. [25]

    Back-Propagating system dependency impact for attack investigation,

    P. Fang, P. Gao, C. Liu, E. Ayday, K. Jee, T. Wang, Y . F. Ye, Z. Liu, and X. Xiao, “Back-Propagating system dependency impact for attack investigation,” in31st USENIX Security Symposium (USENIX Security 22). Boston, MA: USENIX Association, Aug. 2022, pp. 2461–2478. [Online]. ...

    2022

  18. [26]

    APT37(reaper): The overlooked north korean actor,

    “APT37(reaper): The overlooked north korean actor,” FireEye, 2021, accessed on April 25, 2024. [Online]. Available: https://services.googl e.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf

    2021

  19. [27]

    Apt42: Crooked charms, cons, and compromises,

    “Apt42: Crooked charms, cons, and compromises,” FireEye, 2022, accessed on April 25, 2024. [Online]. Available: https://www.mandiant .com/resources/reports/apt42-spear-phishing-and-surveillance/

    2022

  20. [28]

    An algorithm for finding best matches in logarithmic expected time,

    J. H. Friedman, J. L. Bentley, and R. A. Finkel, “An algorithm for finding best matches in logarithmic expected time,”ACM Trans. Math. Softw., vol. 3, no. 3, p. 209–226, Sep. 1977. [Online]. Available: https://doi.org/10.1145/355744.355745

    1977

  21. [29]

    Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence,

    P. Gao, F. Shao, X. Liu, X. Xiao, Z. Qin, F. Xu, P. Mittal, S. R. Kulkarni, and D. Song, “Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence,” in2021 IEEE 37th International Conference on Data Engineering (ICDE), 2021, pp. 193–204

    2021

  22. [30]

    Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems,

    A. Goyal, X. Han, G. Wang, and A. Bates, “Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems,” in30th Network and Distributed System Security Symposium, 2023

    2023

  23. [31]

    R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection,

    A. Goyal, G. Wang, and A. Bates, “R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection,” in2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 3515–3532

    2024

  24. [32]

    Project TajMahal – a sophisticated new APT framework,

    “Project TajMahal – a sophisticated new APT framework,” GReAT, 2019, accessed on April 25, 2024. [Online]. Available: https: //securelist.com/project-tajmahal/90240/

    2019

  25. [33]

    What are advanced persistent threats?

    A. F. Gregg Lindemulder, “What are advanced persistent threats?” 2024, accessed on April 25, 2024. [Online]. Available: https: //www.ibm.com/topics/advanced-persistent-threats/

    2024

  26. [34]

    Tactical Provenance Analysis for Endpoint Detection and Response Systems,

    W. U. Hassan, A. Bates, and D. Marino, “Tactical Provenance Analysis for Endpoint Detection and Response Systems,” in2020 IEEE Sympo- sium on Security and Privacy (SP), 2020, pp. 1172–1189

    2020

  27. [35]

    Nodoze: Combatting threat alert fatigue with automated provenance triage,

    W. U. Hassan, S. Guo, D. Li, Z. Chen, K. Jee, Z. Li, and A. Bates, “Nodoze: Combatting threat alert fatigue with automated provenance triage,” inNetwork and Distributed Systems Security Symposium, 2019

    2019

  28. [36]

    This is why we can’t cache nice things: Lightning-fast threat hunting using suspicion-based hierarchical storage,

    W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, D. Wang, Z. Chen, Z. Li, J. Rhee, J. Gui, and A. Bates, “This is why we can’t cache nice things: Lightning-fast threat hunting using suspicion-based hierarchical storage,” inAnnual Computer Security Applications Conference, ser. ACSA...

    2020

  29. [37]

    TTPDrill: Automatic and Accurate Extraction of Threat Actions from Unstructured Text of CTI Sources,

    G. Husari, E. Al-Shaer, M. Ahmed, B. Chu, and X. Niu, “TTPDrill: Automatic and Accurate Extraction of Threat Actions from Unstructured Text of CTI Sources,” inProceedings of the 33rd Annual Computer Security Applications Conference, ser. ACSAC ’17. New York, NY , USA: Associat...

    2017

  30. [38]

    MAGIC: Detecting advanced persistent threats via masked graph representation learning,

    Z. Jia, Y . Xiong, Y . Nan, Y . Zhang, J. Zhao, and M. Wen, “MAGIC: Detecting advanced persistent threats via masked graph representation learning,” in33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 5197–5214. [Online]....

    2024

  31. [39]

    Sharing cyber threat intelligence: Does it really help?

    B. Jin, E. Kim, H. Lee, E. Bertino, D. Kim, and H. Kim, “Sharing cyber threat intelligence: Does it really help?” inNDSS, 2024

    2024

  32. [40]

    Cyberwar in Ukraine leads to all-time-high levels of DDoS attacks,

    “Cyberwar in Ukraine leads to all-time-high levels of DDoS attacks,” Kaspersky, 2022, accessed on April 25, 2022. [Online]. Available: https://www.kaspersky.com/about/press-releases/2022 cyberwar-in-ukr aine-leads-to-all-time-high-levels-of-ddos-attacks/

    2022

  33. [41]

    Virus.MSWord.Aos,

    “Virus.MSWord.Aos,” Kaspersky, 2024, accessed on January 1, 2025. [Online]. Available: https://threats.kaspersky.com/en/threat/Virus.MSWo rd.Aos/

    2024

  34. [42]

    An integrated cyber security risk management framework and risk predication for the critical infras- tructure protection,

    H. I. Kure, S. Islam, and H. Mouratidis, “An integrated cyber security risk management framework and risk predication for the critical infras- tructure protection,”Neural Computing and Applications, vol. 34, no. 18, pp. 15 241–15 271, 2022

    2022

  35. [43]

    NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation

    S. Li, F. Dong, X. Xiao, H. Wang, F. Shao, J. Chen, Y . Guo, X. Chen, and D. Li, “NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation.” inNDSS, 2024

    2024

  36. [44]

    AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports,

    Z. Li, J. Zeng, Y . Chen, and Z. Liang, “AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports,” inComputer Security – ESORICS 2022: 27th European Symposium on Research in Computer Security, Copenhagen, Denmark, September 26–30, 2022, Proceedin...

    2022 doi

  37. [45]

    TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning,

    M. Lv, H. Gao, X. Qiu, T. Chen, T. Zhu, J. Chen, and S. Ji, “TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’24. New York, NY , USA: Assoc...

    2024

  38. [46]

    MANDIANT Threat Intelligence,

    “MANDIANT Threat Intelligence,” Mandiant, accessed on April 30,

  39. [47]

    This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits,

    “This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits,” Mandiant, 2020, accessed on December 19, 2023. [Online]. Available: https://www.mandiant.com/resources/blog/apt41-i nitiates-global-intrusion-campaign-using-multiple-exploits/

    2020

  40. [48]

    Available: https://www.mandiant.com/advantage/threa t-intelligence/

    [Online]. Available: https://www.mandiant.com/advantage/threa t-intelligence/

  41. [49]

    Unc3524: Eye spy on your email,

    “Unc3524: Eye spy on your email,” Mandiant, 2022, accessed on December 19, 2023. [Online]. Available: https://www.mandiant.com/r esources/blog/unc3524-eye-spy-email/

    2022

  42. [50]

    APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION,

    “APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION,” Mandiant, 2022, accessed on May 19, 2024. [Online]. Available: https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-ope ration.pdf/

    2022

  43. [51]

    Cyber Security & Threat Intelligence Webinars,

    “Cyber Security & Threat Intelligence Webinars,” Mandiant, 2023, accessed on April 25, 2024. [Online]. Available: https://www.mandiant .com/resources/webinars/

    2023

  44. [52]

    Apt43: North korean group uses cybercrime to fund espionage operations,

    “Apt43: North korean group uses cybercrime to fund espionage operations,” Mandiant, 2023, accessed on April 25, 2024. [Online]. Available: https://services.google.com/fh/files/misc/apt43-report-en.pdf

    2023

  45. [53]

    ETW events in the common language runtime,

    “ETW events in the common language runtime,” Microsoft, 2017, accessed on October 1, 2023. [Online]. Available: https://msdn.microso ft.com/en-us/library/ff357719(v=vs.110).aspx/

    2017

  46. [54]

    Targeted attack lifecycle,

    “Targeted attack lifecycle,” Mandiant, 2023, accessed on April 25,

    2023

  47. [55]

    Available: https://www.mandiant.com/resources/insight s/targeted-attack-lifecycle/

    [Online]. Available: https://www.mandiant.com/resources/insight s/targeted-attack-lifecycle/

  48. [56]

    HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows,

    S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V . Venkatakr- ishnan, “HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows,” in2019 IEEE Symposium on Security and Privacy (SP), 2019, pp. 1137–1152

    2019

  49. [57]

    Efficient estimation of word representations in vector space,

    T. Mikolov, K. Chen, G. Corrado, and J. Dean, “Efficient estimation of word representations in vector space,”Computer Science, 2013

    2013

  50. [58]

    POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting,

    S. M. Milajerdi, B. Eshete, R. Gjomemo, and V . Venkatakrishnan, “POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’19. New York, NY , USA: As...

    2019

  51. [59]

    Structured threat information expression,

    “Structured threat information expression,” The MITRE Corporation,

  52. [60]

    MITRE ATT&CK,

    “MITRE ATT&CK,” The MITRE Corporation, 2023, accessed on October 10, 2023. [Online]. Available: https://attack.mitre.org/

    2023

  53. [61]

    MITRE ATT&CK Tactic,

    “MITRE ATT&CK Tactic,” The MITRE Corporation, 2023, accessed on October 10, 2023. [Online]. Available: https://attack.mitre.org/tacti cs/enterprise/

    2023

  54. [62]

    CVE-2024-28085 Detail,

    “CVE-2024-28085 Detail,” NATIONAL VULNERABILITY DATABASE, 2024, accessd on May 3, 2024. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2024-28085/

    2024

  55. [63]

    Available: https://stixproject.github.io/

    [Online]. Available: https://stixproject.github.io/

  56. [64]

    NICKEL targeting government organizations across Latin America and Europe,

    “NICKEL targeting government organizations across Latin America and Europe,” MSTIC, 2021, accessed on April 25, 2024. [Online]. Available: https://www.microsoft.com/security/blog/2021/12/06/nickel-t argeting-government-organizations-across-latin-america-and-europe/

    2021

  57. [65]

    CVE-2023-22809 Detail,

    “CVE-2023-22809 Detail,” NATIONAL VULNERABILITY DATABASE, 2023, accessd on March 3, 2024. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2023-22809/

    2023

  58. [66]

    A Topological Approach to Hierarchical Segmentation using Mean Shift,

    S. Paris and F. Durand, “A Topological Approach to Hierarchical Segmentation using Mean Shift,” in2007 IEEE Conference on Computer Vision and Pattern Recognition, 2007, pp. 1–8

    2007

  59. [67]

    National vulnerability database,

    “National vulnerability database,” NIST, 2024. [Online]. Available: https://nvd.nist.gov/

    2024

  60. [68]

    Simulated-data,

    Nodlink, “Simulated-data,” 2024, accessed on April 30, 2024. [Online]. Available: https://github.com/Nodlink/Simulated-Data/

    2024

  61. [69]

    ioc-parser,

    “ioc-parser,” PaloAlto, 2014, accessed on May 10, 2024. [Online]. Available: https://github.com/PaloAltoNetworks/ioc-parser/

    2014

  62. [70]

    The linux audit framework

    “The linux audit framework.” Redhat., accessed on October 1, 2023. [Online]. Available: https://github.com/linux-audit/

    2023

  63. [71]

    Pymupdf: Python bindings for mupdf,

    PyMuPDF, “Pymupdf: Python bindings for mupdf,” 2021, accessed on January 1, 2025. [Online]. Available: https://pypi.org/project/PyMuPDF/

    2021

  64. [72]

    What Are the Attackers Doing Now? Automating Cyberthreat Intelligence Extraction from Text on Pace with the Changing Threat Landscape: A Survey,

    M. R. Rahman, R. M. Hezaveh, and L. Williams, “What Are the Attackers Doing Now? Automating Cyberthreat Intelligence Extraction from Text on Pace with the Changing Threat Landscape: A Survey,” ACM Comput. Surv., vol. 55, no. 12, Mar. 2023. [Online]. Available: https://doi.org/...

    2023 doi

  65. [73]

    Atomic red team,

    RedCanary, “Atomic red team,” 2021, accessd on March 5, 2023. [Online]. Available: https://github.com/redcanaryco/atomic-red-team/

    2021

  66. [74]

    Extractor: Extracting attack behavior from threat reports,

    K. Satvat, R. Gjomemo, and V . Venkatakrishnan, “Extractor: Extracting attack behavior from threat reports,” in2021 IEEE European Symposium on Security and Privacy (EuroS&P), 2021, pp. 598–615

    2021

  67. [75]

    Machine actionable indicators of compromise,

    D. Rhoades, “Machine actionable indicators of compromise,” in2014 International Carnahan Conference on Security Technology (ICCST). IEEE, 2014, pp. 1–5

    2014

  68. [76]

    Apt41 world tour 2021 on a tight schedule,

    N. Rostovcev, “Apt41 world tour 2021 on a tight schedule,” 2022, accessed on July 25, 2025. [Online]. Available: https: //www.group-ib.com/blog/apt41-world-tour-2021/

    2021

  69. [77]

    Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia,

    Rusu, “Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia,” 2020, accessed on April 25, 2024. [Online]. Available: https://www.bitdefender.com/blog/labs/iranian-cha fer-apt-targeted-air-transportation-and-government-in-kuwait-and-sau di-arabia/

    2020

  70. [78]

    Darkwatchman: A new evolution in fileless techniques,

    S. Smith, “Darkwatchman: A new evolution in fileless techniques,” 2021, accessed on April 25, 2024. [Online]. Available: https: //www.prevailion.com/darkwatchman-new-fileless-techniques/

    2021

  71. [79]

    scikit-learn,

    “scikit-learn,” scikit-learn, 2023, accessed on December 19, 2023. [Online]. Available: https://scikit-learn.org/stable/index.html/

    2023

  72. [80]

    Executable installers are vulnerable ˆWEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege,

    “Executable installers are vulnerable ˆWEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege,” SECLIST, 2015, accessed on December 19, 2023. [Online]. Available: https: //seclists.org/fulldisclosure/2015/Dec/34/

    2015

  73. [81]

    The baffling berserk bear: A decade’s activity targeting critical infrastructure,

    Slowok, “The baffling berserk bear: A decade’s activity targeting critical infrastructure,” 2021, accessed on April 25, 2024. [Online]. Available: https://vblocalhost.com/uploads/VB2021-Slowik.pdf/

    2021

  74. [82]

    [Online]

    “Sysdig.” Sysdig., 2013, ccessed on October 1, 2023. [Online]. Available: https://sysdig.com

    2013

  75. [83]

    Survey of the state of security 2022,

    “Survey of the state of security 2022,” Splunk Inc., 2022, accessed on April 13, 2022. [Online]. Available: https://www.splunk.com/zh cn/pd fs/resources/e-book/state-of-security-2022.pdf/

    2022

  76. [84]

    Stanford CoreNLP,

    “Stanford CoreNLP,” Stanford NLP Group, accessed on October 10,

  77. [85]

    AppleJeus: Analysis of North Korea’s Cryptocurrency Malware,

    “AppleJeus: Analysis of North Korea’s Cryptocurrency Malware,” USCERT, 2021, accessed on April 25, 2024. [Online]. Available: https://us-cert.cisa.gov/ncas/alerts/aa21-048a/

    2021

  78. [86]

    3 Advanced Persistent Threat (APT) Examples You Should Know About,

    “3 Advanced Persistent Threat (APT) Examples You Should Know About,” Swiss Cyber Institute, 2024, accessed on April 25, 2024. [Online]. Available: https://swisscyberinstitute.com/blog/guide-of-adv anced-persistent-threat-apt/

    2024

  79. [87]

    Infobert: Improving robustness of language models from an information theoretic perspective,

    B. Wang, S. Wang, Y . Cheng, Z. Gan, R. Jia, B. Li, and J. J. Liu, “Infobert: Improving robustness of language models from an information theoretic perspective,” inInternational Conference on Learning Representations (ICLR 2021), March 2021. [Online]. Available: https://www.mi...

    2021

  80. [88]

    Flash: A comprehensive approach to intrusion detection via provenance graph representation learning,

    M. Ur Rehman, H. Ahmadi, and W. Ul Hassan, “Flash: A comprehensive approach to intrusion detection via provenance graph representation learning,” in2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 3552–3570

    2024

  81. [89]

    Malware Analysis Report (MAR) - 10135536-B,

    “Malware Analysis Report (MAR) - 10135536-B,” USCERT, 2017, accessed on April 25, 2024. [Online]. Available: https://www.us-cert. gov/sites/default/files/publications/MAR-10135536-B WHITE.PDF/

    2017

  82. [90]

    SHADEW ATCHER: Recommendation-guided Cyber Threat Analysis using System Audit Records,

    J. Zeng, X. Wang, J. Liu, Y . Chen, Z. Liang, T.-S. Chua, and Z. L. Chua, “SHADEW ATCHER: Recommendation-guided Cyber Threat Analysis using System Audit Records,” in2022 IEEE Symposium on Security and Privacy (SP), 2022, pp. 489–506

    2022

  83. [91]

    Where 2 worlds collide Bringing Mimikatz et al to UNIX,

    T. Wadhwa-Brown, “Where 2 worlds collide Bringing Mimikatz et al to UNIX,” 2018, accessed on April 25, 2024. [Online]. Available: https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2 -worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf/

    2018

  84. [93]

    You are what you do: Hunting stealthy malware via data provenance analysis

    Q. Wang, W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, J. Rhee, Z. Chen, W. Cheng, C. A. Gunteret al., “You are what you do: Hunting stealthy malware via data provenance analysis.” inNDSS, 2020

    2020

  85. [94]

    DEPCOMM: Graph Summarization on System Audit Logs for Attack Investigation,

    Z. Xu, P. Fang, C. Liu, X. Xiao, Y . Wen, and D. Meng, “DEPCOMM: Graph Summarization on System Audit Logs for Attack Investigation,” in2022 IEEE Symposium on Security and Privacy (SP), 2022, pp. 540– 557

    2022

  86. [96]

    APTSHIELD: A Stable, Efficient and Real-Time APT Detection System for Linux Hosts,

    T. Zhu, J. Yu, C. Xiong, W. Cheng, Q. Yuan, J. Ying, T. Chen, J. Zhang, M. Lv, Y . Chen, T. Wang, and Y . Fan, “APTSHIELD: A Stable, Efficient and Real-Time APT Detection System for Linux Hosts,”IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, pp. 5247–5264, 2023

    2023

  87. [2023]

    Available: https://stanfordnlp.github.io/CoreNLP/

    [Online]. Available: https://stanfordnlp.github.io/CoreNLP/

  88. [2024]

    Available: https://www.cert.ssi.gouv.fr/uploads/CERTF R-2021-CTI-005.pdf/

    [Online]. Available: https://www.cert.ssi.gouv.fr/uploads/CERTF R-2021-CTI-005.pdf/

    2021

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.