TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph Article Swipe
YOU?
·
· 2023
· Open Access
·
· DOI: https://doi.org/10.48550/arxiv.2304.02838
APT detection is difficult to detect due to the long-term latency, covert and slow multistage attack patterns of Advanced Persistent Threat (APT). To tackle these issues, we propose TBDetector, a transformer-based advanced persistent threat detection method for APT attack detection. Considering that provenance graphs provide rich historical information and have the powerful attacks historic correlation ability to identify anomalous activities, TBDetector employs provenance analysis for APT detection, which summarizes long-running system execution with space efficiency and utilizes transformer with self-attention based encoder-decoder to extract long-term contextual features of system states to detect slow-acting attacks. Furthermore, we further introduce anomaly scores to investigate the anomaly of different system states, where each state is calculated with an anomaly score corresponding to its similarity score and isolation score. To evaluate the effectiveness of the proposed method, we have conducted experiments on five public datasets, i.e., streamspot, cadets, shellshock, clearscope, and wget_baseline. Experimental results and comparisons with state-of-the-art methods have exhibited better performance of our proposed method.
Related Topics
- Type
- preprint
- Language
- en
- Landing Page
- http://arxiv.org/abs/2304.02838
- https://arxiv.org/pdf/2304.02838
- OA Status
- green
- Cited By
- 4
- Related Works
- 10
- OpenAlex ID
- https://openalex.org/W4362706535
Raw OpenAlex JSON
- OpenAlex ID
-
https://openalex.org/W4362706535Canonical identifier for this work in OpenAlex
- DOI
-
https://doi.org/10.48550/arxiv.2304.02838Digital Object Identifier
- Title
-
TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance GraphWork title
- Type
-
preprintOpenAlex work type
- Language
-
enPrimary language
- Publication year
-
2023Year of publication
- Publication date
-
2023-04-06Full publication date if available
- Authors
-
Nan Wang, Xuezhi Wen, Dalin Zhang, Xibin Zhao, Jiahui Ma, Mengxia Luo, Sen Nie, Shi Wu, Jiqiang LiuList of authors in order
- Landing page
-
https://arxiv.org/abs/2304.02838Publisher landing page
- PDF URL
-
https://arxiv.org/pdf/2304.02838Direct link to full text PDF
- Open access
-
YesWhether a free full text is available
- OA status
-
greenOpen access status per OpenAlex
- OA URL
-
https://arxiv.org/pdf/2304.02838Direct OA link when available
- Concepts
-
Computer science, Covert, Anomaly detection, Encoder, Detector, Data mining, Artificial intelligence, Telecommunications, Linguistics, Operating system, PhilosophyTop concepts (fields/topics) attached by OpenAlex
- Cited by
-
4Total citation count in OpenAlex
- Citations by year (recent)
-
2025: 1, 2024: 2, 2023: 1Per-year citation counts (last 5 years)
- Related works (count)
-
10Other works algorithmically related by OpenAlex
Full payload
| id | https://openalex.org/W4362706535 |
|---|---|
| doi | https://doi.org/10.48550/arxiv.2304.02838 |
| ids.doi | https://doi.org/10.48550/arxiv.2304.02838 |
| ids.openalex | https://openalex.org/W4362706535 |
| fwci | |
| type | preprint |
| title | TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph |
| biblio.issue | |
| biblio.volume | |
| biblio.last_page | |
| biblio.first_page | |
| topics[0].id | https://openalex.org/T10400 |
| topics[0].field.id | https://openalex.org/fields/17 |
| topics[0].field.display_name | Computer Science |
| topics[0].score | 0.992900013923645 |
| topics[0].domain.id | https://openalex.org/domains/3 |
| topics[0].domain.display_name | Physical Sciences |
| topics[0].subfield.id | https://openalex.org/subfields/1705 |
| topics[0].subfield.display_name | Computer Networks and Communications |
| topics[0].display_name | Network Security and Intrusion Detection |
| topics[1].id | https://openalex.org/T10734 |
| topics[1].field.id | https://openalex.org/fields/17 |
| topics[1].field.display_name | Computer Science |
| topics[1].score | 0.9797000288963318 |
| topics[1].domain.id | https://openalex.org/domains/3 |
| topics[1].domain.display_name | Physical Sciences |
| topics[1].subfield.id | https://openalex.org/subfields/1710 |
| topics[1].subfield.display_name | Information Systems |
| topics[1].display_name | Information and Cyber Security |
| topics[2].id | https://openalex.org/T10064 |
| topics[2].field.id | https://openalex.org/fields/31 |
| topics[2].field.display_name | Physics and Astronomy |
| topics[2].score | 0.9761000275611877 |
| topics[2].domain.id | https://openalex.org/domains/3 |
| topics[2].domain.display_name | Physical Sciences |
| topics[2].subfield.id | https://openalex.org/subfields/3109 |
| topics[2].subfield.display_name | Statistical and Nonlinear Physics |
| topics[2].display_name | Complex Network Analysis Techniques |
| is_xpac | False |
| apc_list | |
| apc_paid | |
| concepts[0].id | https://openalex.org/C41008148 |
| concepts[0].level | 0 |
| concepts[0].score | 0.6752649545669556 |
| concepts[0].wikidata | https://www.wikidata.org/wiki/Q21198 |
| concepts[0].display_name | Computer science |
| concepts[1].id | https://openalex.org/C2779338814 |
| concepts[1].level | 2 |
| concepts[1].score | 0.641284167766571 |
| concepts[1].wikidata | https://www.wikidata.org/wiki/Q5179285 |
| concepts[1].display_name | Covert |
| concepts[2].id | https://openalex.org/C739882 |
| concepts[2].level | 2 |
| concepts[2].score | 0.54914790391922 |
| concepts[2].wikidata | https://www.wikidata.org/wiki/Q3560506 |
| concepts[2].display_name | Anomaly detection |
| concepts[3].id | https://openalex.org/C118505674 |
| concepts[3].level | 2 |
| concepts[3].score | 0.513603925704956 |
| concepts[3].wikidata | https://www.wikidata.org/wiki/Q42586063 |
| concepts[3].display_name | Encoder |
| concepts[4].id | https://openalex.org/C94915269 |
| concepts[4].level | 2 |
| concepts[4].score | 0.41874611377716064 |
| concepts[4].wikidata | https://www.wikidata.org/wiki/Q1834857 |
| concepts[4].display_name | Detector |
| concepts[5].id | https://openalex.org/C124101348 |
| concepts[5].level | 1 |
| concepts[5].score | 0.41866418719291687 |
| concepts[5].wikidata | https://www.wikidata.org/wiki/Q172491 |
| concepts[5].display_name | Data mining |
| concepts[6].id | https://openalex.org/C154945302 |
| concepts[6].level | 1 |
| concepts[6].score | 0.3603188991546631 |
| concepts[6].wikidata | https://www.wikidata.org/wiki/Q11660 |
| concepts[6].display_name | Artificial intelligence |
| concepts[7].id | https://openalex.org/C76155785 |
| concepts[7].level | 1 |
| concepts[7].score | 0.0782105028629303 |
| concepts[7].wikidata | https://www.wikidata.org/wiki/Q418 |
| concepts[7].display_name | Telecommunications |
| concepts[8].id | https://openalex.org/C41895202 |
| concepts[8].level | 1 |
| concepts[8].score | 0.0 |
| concepts[8].wikidata | https://www.wikidata.org/wiki/Q8162 |
| concepts[8].display_name | Linguistics |
| concepts[9].id | https://openalex.org/C111919701 |
| concepts[9].level | 1 |
| concepts[9].score | 0.0 |
| concepts[9].wikidata | https://www.wikidata.org/wiki/Q9135 |
| concepts[9].display_name | Operating system |
| concepts[10].id | https://openalex.org/C138885662 |
| concepts[10].level | 0 |
| concepts[10].score | 0.0 |
| concepts[10].wikidata | https://www.wikidata.org/wiki/Q5891 |
| concepts[10].display_name | Philosophy |
| keywords[0].id | https://openalex.org/keywords/computer-science |
| keywords[0].score | 0.6752649545669556 |
| keywords[0].display_name | Computer science |
| keywords[1].id | https://openalex.org/keywords/covert |
| keywords[1].score | 0.641284167766571 |
| keywords[1].display_name | Covert |
| keywords[2].id | https://openalex.org/keywords/anomaly-detection |
| keywords[2].score | 0.54914790391922 |
| keywords[2].display_name | Anomaly detection |
| keywords[3].id | https://openalex.org/keywords/encoder |
| keywords[3].score | 0.513603925704956 |
| keywords[3].display_name | Encoder |
| keywords[4].id | https://openalex.org/keywords/detector |
| keywords[4].score | 0.41874611377716064 |
| keywords[4].display_name | Detector |
| keywords[5].id | https://openalex.org/keywords/data-mining |
| keywords[5].score | 0.41866418719291687 |
| keywords[5].display_name | Data mining |
| keywords[6].id | https://openalex.org/keywords/artificial-intelligence |
| keywords[6].score | 0.3603188991546631 |
| keywords[6].display_name | Artificial intelligence |
| keywords[7].id | https://openalex.org/keywords/telecommunications |
| keywords[7].score | 0.0782105028629303 |
| keywords[7].display_name | Telecommunications |
| language | en |
| locations[0].id | pmh:oai:arXiv.org:2304.02838 |
| locations[0].is_oa | True |
| locations[0].source.id | https://openalex.org/S4306400194 |
| locations[0].source.issn | |
| locations[0].source.type | repository |
| locations[0].source.is_oa | True |
| locations[0].source.issn_l | |
| locations[0].source.is_core | False |
| locations[0].source.is_in_doaj | False |
| locations[0].source.display_name | arXiv (Cornell University) |
| locations[0].source.host_organization | https://openalex.org/I205783295 |
| locations[0].source.host_organization_name | Cornell University |
| locations[0].source.host_organization_lineage | https://openalex.org/I205783295 |
| locations[0].license | |
| locations[0].pdf_url | https://arxiv.org/pdf/2304.02838 |
| locations[0].version | submittedVersion |
| locations[0].raw_type | text |
| locations[0].license_id | |
| locations[0].is_accepted | False |
| locations[0].is_published | False |
| locations[0].raw_source_name | |
| locations[0].landing_page_url | http://arxiv.org/abs/2304.02838 |
| locations[1].id | doi:10.48550/arxiv.2304.02838 |
| locations[1].is_oa | True |
| locations[1].source.id | https://openalex.org/S4306400194 |
| locations[1].source.issn | |
| locations[1].source.type | repository |
| locations[1].source.is_oa | True |
| locations[1].source.issn_l | |
| locations[1].source.is_core | False |
| locations[1].source.is_in_doaj | False |
| locations[1].source.display_name | arXiv (Cornell University) |
| locations[1].source.host_organization | https://openalex.org/I205783295 |
| locations[1].source.host_organization_name | Cornell University |
| locations[1].source.host_organization_lineage | https://openalex.org/I205783295 |
| locations[1].license | |
| locations[1].pdf_url | |
| locations[1].version | |
| locations[1].raw_type | article |
| locations[1].license_id | |
| locations[1].is_accepted | False |
| locations[1].is_published | |
| locations[1].raw_source_name | |
| locations[1].landing_page_url | https://doi.org/10.48550/arxiv.2304.02838 |
| indexed_in | arxiv, datacite |
| authorships[0].author.id | https://openalex.org/A5100332693 |
| authorships[0].author.orcid | https://orcid.org/0000-0001-5256-4551 |
| authorships[0].author.display_name | Nan Wang |
| authorships[0].author_position | first |
| authorships[0].raw_author_name | Wang, Nan |
| authorships[0].is_corresponding | False |
| authorships[1].author.id | https://openalex.org/A5110369052 |
| authorships[1].author.orcid | |
| authorships[1].author.display_name | Xuezhi Wen |
| authorships[1].author_position | middle |
| authorships[1].raw_author_name | Wen, Xuezhi |
| authorships[1].is_corresponding | False |
| authorships[2].author.id | https://openalex.org/A5001804455 |
| authorships[2].author.orcid | https://orcid.org/0000-0003-0346-7020 |
| authorships[2].author.display_name | Dalin Zhang |
| authorships[2].author_position | middle |
| authorships[2].raw_author_name | Zhang, Dalin |
| authorships[2].is_corresponding | False |
| authorships[3].author.id | https://openalex.org/A5100773043 |
| authorships[3].author.orcid | https://orcid.org/0000-0002-6168-7016 |
| authorships[3].author.display_name | Xibin Zhao |
| authorships[3].author_position | middle |
| authorships[3].raw_author_name | Zhao, Xibin |
| authorships[3].is_corresponding | False |
| authorships[4].author.id | https://openalex.org/A5102481651 |
| authorships[4].author.orcid | |
| authorships[4].author.display_name | Jiahui Ma |
| authorships[4].author_position | middle |
| authorships[4].raw_author_name | Ma, Jiahui |
| authorships[4].is_corresponding | False |
| authorships[5].author.id | https://openalex.org/A5032949445 |
| authorships[5].author.orcid | https://orcid.org/0000-0003-2413-1251 |
| authorships[5].author.display_name | Mengxia Luo |
| authorships[5].author_position | middle |
| authorships[5].raw_author_name | Luo, Mengxia |
| authorships[5].is_corresponding | False |
| authorships[6].author.id | https://openalex.org/A5109305232 |
| authorships[6].author.orcid | |
| authorships[6].author.display_name | Sen Nie |
| authorships[6].author_position | middle |
| authorships[6].raw_author_name | Nie, Sen |
| authorships[6].is_corresponding | False |
| authorships[7].author.id | https://openalex.org/A5112725533 |
| authorships[7].author.orcid | |
| authorships[7].author.display_name | Shi Wu |
| authorships[7].author_position | middle |
| authorships[7].raw_author_name | Wu, Shi |
| authorships[7].is_corresponding | False |
| authorships[8].author.id | https://openalex.org/A5108529463 |
| authorships[8].author.orcid | |
| authorships[8].author.display_name | Jiqiang Liu |
| authorships[8].author_position | last |
| authorships[8].raw_author_name | Liu, Jiqiang |
| authorships[8].is_corresponding | False |
| has_content.pdf | False |
| has_content.grobid_xml | False |
| is_paratext | False |
| open_access.is_oa | True |
| open_access.oa_url | https://arxiv.org/pdf/2304.02838 |
| open_access.oa_status | green |
| open_access.any_repository_has_fulltext | False |
| created_date | 2025-10-10T00:00:00 |
| display_name | TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph |
| has_fulltext | False |
| is_retracted | False |
| updated_date | 2025-11-06T06:51:31.235846 |
| primary_topic.id | https://openalex.org/T10400 |
| primary_topic.field.id | https://openalex.org/fields/17 |
| primary_topic.field.display_name | Computer Science |
| primary_topic.score | 0.992900013923645 |
| primary_topic.domain.id | https://openalex.org/domains/3 |
| primary_topic.domain.display_name | Physical Sciences |
| primary_topic.subfield.id | https://openalex.org/subfields/1705 |
| primary_topic.subfield.display_name | Computer Networks and Communications |
| primary_topic.display_name | Network Security and Intrusion Detection |
| related_works | https://openalex.org/W2523525694, https://openalex.org/W2998642566, https://openalex.org/W2392682561, https://openalex.org/W57793151, https://openalex.org/W2804882289, https://openalex.org/W2727423897, https://openalex.org/W2497612952, https://openalex.org/W4247948804, https://openalex.org/W2392053643, https://openalex.org/W2595182909 |
| cited_by_count | 4 |
| counts_by_year[0].year | 2025 |
| counts_by_year[0].cited_by_count | 1 |
| counts_by_year[1].year | 2024 |
| counts_by_year[1].cited_by_count | 2 |
| counts_by_year[2].year | 2023 |
| counts_by_year[2].cited_by_count | 1 |
| locations_count | 2 |
| best_oa_location.id | pmh:oai:arXiv.org:2304.02838 |
| best_oa_location.is_oa | True |
| best_oa_location.source.id | https://openalex.org/S4306400194 |
| best_oa_location.source.issn | |
| best_oa_location.source.type | repository |
| best_oa_location.source.is_oa | True |
| best_oa_location.source.issn_l | |
| best_oa_location.source.is_core | False |
| best_oa_location.source.is_in_doaj | False |
| best_oa_location.source.display_name | arXiv (Cornell University) |
| best_oa_location.source.host_organization | https://openalex.org/I205783295 |
| best_oa_location.source.host_organization_name | Cornell University |
| best_oa_location.source.host_organization_lineage | https://openalex.org/I205783295 |
| best_oa_location.license | |
| best_oa_location.pdf_url | https://arxiv.org/pdf/2304.02838 |
| best_oa_location.version | submittedVersion |
| best_oa_location.raw_type | text |
| best_oa_location.license_id | |
| best_oa_location.is_accepted | False |
| best_oa_location.is_published | False |
| best_oa_location.raw_source_name | |
| best_oa_location.landing_page_url | http://arxiv.org/abs/2304.02838 |
| primary_location.id | pmh:oai:arXiv.org:2304.02838 |
| primary_location.is_oa | True |
| primary_location.source.id | https://openalex.org/S4306400194 |
| primary_location.source.issn | |
| primary_location.source.type | repository |
| primary_location.source.is_oa | True |
| primary_location.source.issn_l | |
| primary_location.source.is_core | False |
| primary_location.source.is_in_doaj | False |
| primary_location.source.display_name | arXiv (Cornell University) |
| primary_location.source.host_organization | https://openalex.org/I205783295 |
| primary_location.source.host_organization_name | Cornell University |
| primary_location.source.host_organization_lineage | https://openalex.org/I205783295 |
| primary_location.license | |
| primary_location.pdf_url | https://arxiv.org/pdf/2304.02838 |
| primary_location.version | submittedVersion |
| primary_location.raw_type | text |
| primary_location.license_id | |
| primary_location.is_accepted | False |
| primary_location.is_published | False |
| primary_location.raw_source_name | |
| primary_location.landing_page_url | http://arxiv.org/abs/2304.02838 |
| publication_date | 2023-04-06 |
| publication_year | 2023 |
| referenced_works_count | 0 |
| abstract_inverted_index.a | 29 |
| abstract_inverted_index.To | 22, 125 |
| abstract_inverted_index.an | 114 |
| abstract_inverted_index.is | 2, 111 |
| abstract_inverted_index.of | 17, 87, 104, 129, 159 |
| abstract_inverted_index.on | 137 |
| abstract_inverted_index.to | 4, 7, 56, 82, 90, 100, 118 |
| abstract_inverted_index.we | 26, 95, 133 |
| abstract_inverted_index.APT | 0, 37, 65 |
| abstract_inverted_index.and | 12, 48, 75, 122, 146, 150 |
| abstract_inverted_index.due | 6 |
| abstract_inverted_index.for | 36, 64 |
| abstract_inverted_index.its | 119 |
| abstract_inverted_index.our | 160 |
| abstract_inverted_index.the | 8, 50, 102, 127, 130 |
| abstract_inverted_index.each | 109 |
| abstract_inverted_index.five | 138 |
| abstract_inverted_index.have | 49, 134, 155 |
| abstract_inverted_index.rich | 45 |
| abstract_inverted_index.slow | 13 |
| abstract_inverted_index.that | 41 |
| abstract_inverted_index.with | 72, 78, 113, 152 |
| abstract_inverted_index.based | 80 |
| abstract_inverted_index.i.e., | 141 |
| abstract_inverted_index.score | 116, 121 |
| abstract_inverted_index.space | 73 |
| abstract_inverted_index.state | 110 |
| abstract_inverted_index.these | 24 |
| abstract_inverted_index.where | 108 |
| abstract_inverted_index.which | 67 |
| abstract_inverted_index.(APT). | 21 |
| abstract_inverted_index.Threat | 20 |
| abstract_inverted_index.attack | 15, 38 |
| abstract_inverted_index.better | 157 |
| abstract_inverted_index.covert | 11 |
| abstract_inverted_index.detect | 5, 91 |
| abstract_inverted_index.graphs | 43 |
| abstract_inverted_index.method | 35 |
| abstract_inverted_index.public | 139 |
| abstract_inverted_index.score. | 124 |
| abstract_inverted_index.scores | 99 |
| abstract_inverted_index.states | 89 |
| abstract_inverted_index.system | 70, 88, 106 |
| abstract_inverted_index.tackle | 23 |
| abstract_inverted_index.threat | 33 |
| abstract_inverted_index.ability | 55 |
| abstract_inverted_index.anomaly | 98, 103, 115 |
| abstract_inverted_index.attacks | 52 |
| abstract_inverted_index.cadets, | 143 |
| abstract_inverted_index.employs | 61 |
| abstract_inverted_index.extract | 83 |
| abstract_inverted_index.further | 96 |
| abstract_inverted_index.issues, | 25 |
| abstract_inverted_index.method, | 132 |
| abstract_inverted_index.method. | 162 |
| abstract_inverted_index.methods | 154 |
| abstract_inverted_index.propose | 27 |
| abstract_inverted_index.provide | 44 |
| abstract_inverted_index.results | 149 |
| abstract_inverted_index.states, | 107 |
| abstract_inverted_index.Advanced | 18 |
| abstract_inverted_index.advanced | 31 |
| abstract_inverted_index.analysis | 63 |
| abstract_inverted_index.attacks. | 93 |
| abstract_inverted_index.evaluate | 126 |
| abstract_inverted_index.features | 86 |
| abstract_inverted_index.historic | 53 |
| abstract_inverted_index.identify | 57 |
| abstract_inverted_index.latency, | 10 |
| abstract_inverted_index.patterns | 16 |
| abstract_inverted_index.powerful | 51 |
| abstract_inverted_index.proposed | 131, 161 |
| abstract_inverted_index.utilizes | 76 |
| abstract_inverted_index.anomalous | 58 |
| abstract_inverted_index.conducted | 135 |
| abstract_inverted_index.datasets, | 140 |
| abstract_inverted_index.detection | 1, 34 |
| abstract_inverted_index.different | 105 |
| abstract_inverted_index.difficult | 3 |
| abstract_inverted_index.execution | 71 |
| abstract_inverted_index.exhibited | 156 |
| abstract_inverted_index.introduce | 97 |
| abstract_inverted_index.isolation | 123 |
| abstract_inverted_index.long-term | 9, 84 |
| abstract_inverted_index.Persistent | 19 |
| abstract_inverted_index.TBDetector | 60 |
| abstract_inverted_index.calculated | 112 |
| abstract_inverted_index.contextual | 85 |
| abstract_inverted_index.detection, | 66 |
| abstract_inverted_index.detection. | 39 |
| abstract_inverted_index.efficiency | 74 |
| abstract_inverted_index.historical | 46 |
| abstract_inverted_index.multistage | 14 |
| abstract_inverted_index.persistent | 32 |
| abstract_inverted_index.provenance | 42, 62 |
| abstract_inverted_index.similarity | 120 |
| abstract_inverted_index.summarizes | 68 |
| abstract_inverted_index.Considering | 40 |
| abstract_inverted_index.TBDetector, | 28 |
| abstract_inverted_index.activities, | 59 |
| abstract_inverted_index.clearscope, | 145 |
| abstract_inverted_index.comparisons | 151 |
| abstract_inverted_index.correlation | 54 |
| abstract_inverted_index.experiments | 136 |
| abstract_inverted_index.information | 47 |
| abstract_inverted_index.investigate | 101 |
| abstract_inverted_index.performance | 158 |
| abstract_inverted_index.shellshock, | 144 |
| abstract_inverted_index.slow-acting | 92 |
| abstract_inverted_index.streamspot, | 142 |
| abstract_inverted_index.transformer | 77 |
| abstract_inverted_index.Experimental | 148 |
| abstract_inverted_index.Furthermore, | 94 |
| abstract_inverted_index.long-running | 69 |
| abstract_inverted_index.corresponding | 117 |
| abstract_inverted_index.effectiveness | 128 |
| abstract_inverted_index.self-attention | 79 |
| abstract_inverted_index.wget_baseline. | 147 |
| abstract_inverted_index.encoder-decoder | 81 |
| abstract_inverted_index.state-of-the-art | 153 |
| abstract_inverted_index.transformer-based | 30 |
| cited_by_percentile_year | |
| countries_distinct_count | 0 |
| institutions_distinct_count | 9 |
| citation_normalized_percentile |