| Paper Abstract and Keywords |
| Presentation |
2026-07-14 14:15
Improving the Stability of Graph-based APT Detection with LLM Sentence Embeddings Shota Sakamaki, Hiroki Kanezashi, Toyotaro Suzumura, Tomohiro Kudoh (UTokyo) ISEC2026-41 SITE2026-37 BioX2026-64 HWS2026-37 ICSS2026-56 EMM2026-48 |
| Abstract |
(in Japanese) |
(See Japanese page) |
| (in English) |
Advanced Persistent Threat (APT) attacks threaten modern information systems through stealthy,multi-stage activities that closely resemble benign behavior.Provenance-based intrusion detection systems are a promising approach for detecting such attacks by representing audit logs as graphs.However,many existing graph-based methods rely on shallow categorical features and fail to exploit the semantic information contained in raw log messages.In this paper,we propose a graph-based APT detection method that incorporates Large Language Model (LLM)-generated log representations into provenance graph learning.Our method replaces conventional categorical edge features with sentence embeddings derived from raw audit logs,allowing the model to capture fine-grained behavioral context.We evaluate the proposed method on the Unicorn Wget and DARPA TC E3 datasets.The results show that LLM-based semantic edge features improve detection performance for stealthy attacks and enhance result stability,while also revealing remaining challenges in heterogeneous environments. |
| Keyword |
(in Japanese) |
(See Japanese page) |
| (in English) |
APT detection / provenance graph / graph neural network / LLM sentence embedding / anomaly detection / / / |
| Reference Info. |
IEICE Tech. Rep., vol. 126, no. 111, ICSS2026-56, pp. 190-197, July 2026. |
| Paper # |
ICSS2026-56 |
| Date of Issue |
2026-07-06 (ISEC, SITE, BioX, HWS, ICSS, EMM) |
| ISSN |
Online edition: ISSN 2432-6380 |
Copyright and reproduction |
All rights are reserved and no part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from the publisher. Notwithstanding, instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. (License No.: 10GA0019/12GB0052/13GB0056/17GB0034/18GB0034) |
| Download PDF |
ISEC2026-41 SITE2026-37 BioX2026-64 HWS2026-37 ICSS2026-56 EMM2026-48 |
| Conference Information |
| Committee |
BioX HWS ISEC SITE ICSS EMM IPSJ-CSEC IPSJ-SPT |
| Conference Date |
2026-07-13 - 2026-07-15 |
| Place (in Japanese) |
(See Japanese page) |
| Place (in English) |
Sapporo Convention Center |
| Topics (in Japanese) |
(See Japanese page) |
| Topics (in English) |
|
| Paper Information |
| Registration To |
ICSS |
| Conference Code |
2026-07-BioX-HWS-ISEC-SITE-ICSS-EMM-CSEC-SPT-SEC |
| Language |
Japanese |
| Title (in Japanese) |
(See Japanese page) |
| Sub Title (in Japanese) |
(See Japanese page) |
| Title (in English) |
Improving the Stability of Graph-based APT Detection with LLM Sentence Embeddings |
| Sub Title (in English) |
|
| Keyword(1) |
APT detection |
| Keyword(2) |
provenance graph |
| Keyword(3) |
graph neural network |
| Keyword(4) |
LLM sentence embedding |
| Keyword(5) |
anomaly detection |
| Keyword(6) |
|
| Keyword(7) |
|
| Keyword(8) |
|
| 1st Author's Name |
Shota Sakamaki |
| 1st Author's Affiliation |
The University of Tokyo (UTokyo) |
| 2nd Author's Name |
Hiroki Kanezashi |
| 2nd Author's Affiliation |
The University of Tokyo (UTokyo) |
| 3rd Author's Name |
Toyotaro Suzumura |
| 3rd Author's Affiliation |
The University of Tokyo (UTokyo) |
| 4th Author's Name |
Tomohiro Kudoh |
| 4th Author's Affiliation |
The University of Tokyo (UTokyo) |
| 5th Author's Name |
|
| 5th Author's Affiliation |
() |
| 6th Author's Name |
|
| 6th Author's Affiliation |
() |
| 7th Author's Name |
|
| 7th Author's Affiliation |
() |
| 8th Author's Name |
|
| 8th Author's Affiliation |
() |
| 9th Author's Name |
|
| 9th Author's Affiliation |
() |
| 10th Author's Name |
|
| 10th Author's Affiliation |
() |
| 11th Author's Name |
|
| 11th Author's Affiliation |
() |
| 12th Author's Name |
|
| 12th Author's Affiliation |
() |
| 13th Author's Name |
|
| 13th Author's Affiliation |
() |
| 14th Author's Name |
|
| 14th Author's Affiliation |
() |
| 15th Author's Name |
|
| 15th Author's Affiliation |
() |
| 16th Author's Name |
|
| 16th Author's Affiliation |
() |
| 17th Author's Name |
|
| 17th Author's Affiliation |
() |
| 18th Author's Name |
|
| 18th Author's Affiliation |
() |
| 19th Author's Name |
|
| 19th Author's Affiliation |
() |
| 20th Author's Name |
|
| 20th Author's Affiliation |
() |
| 21st Author's Name |
|
| 21st Author's Affiliation |
() |
| 22nd Author's Name |
|
| 22nd Author's Affiliation |
() |
| 23rd Author's Name |
|
| 23rd Author's Affiliation |
() |
| 24th Author's Name |
|
| 24th Author's Affiliation |
() |
| 25th Author's Name |
|
| 25th Author's Affiliation |
() |
| 26th Author's Name |
/ / |
| 26th Author's Affiliation |
()
() |
| 27th Author's Name |
/ / |
| 27th Author's Affiliation |
()
() |
| 28th Author's Name |
/ / |
| 28th Author's Affiliation |
()
() |
| 29th Author's Name |
/ / |
| 29th Author's Affiliation |
()
() |
| 30th Author's Name |
/ / |
| 30th Author's Affiliation |
()
() |
| 31st Author's Name |
/ / |
| 31st Author's Affiliation |
()
() |
| 32nd Author's Name |
/ / |
| 32nd Author's Affiliation |
()
() |
| 33rd Author's Name |
/ / |
| 33rd Author's Affiliation |
()
() |
| 34th Author's Name |
/ / |
| 34th Author's Affiliation |
()
() |
| 35th Author's Name |
/ / |
| 35th Author's Affiliation |
()
() |
| 36th Author's Name |
/ / |
| 36th Author's Affiliation |
()
() |
| Speaker |
Author-1 |
| Date Time |
2026-07-14 14:15:00 |
| Presentation Time |
25 minutes |
| Registration for |
ICSS |
| Paper # |
ISEC2026-41, SITE2026-37, BioX2026-64, HWS2026-37, ICSS2026-56, EMM2026-48 |
| Volume (vol) |
vol.126 |
| Number (no) |
no.107(ISEC), no.108(SITE), no.109(BioX), no.110(HWS), no.111(ICSS), no.112(EMM) |
| Page |
pp.190-197 |
| #Pages |
8 |
| Date of Issue |
2026-07-06 (ISEC, SITE, BioX, HWS, ICSS, EMM) |