{"id":"W4411204262","doi":"10.1109/isdfs65363.2025.11011912","title":"APT-LLM: Embedding-Based Anomaly Detection of Cyber Advanced Persistent Threats Using Large Language Models","year":2025,"lang":"en","type":"article","venue":"","topic":"Information and Cyber Security","field":"Computer Science","cited_by":19,"is_retracted":false,"has_abstract":true,"ca_institutions":"Université de Montréal; Université du Québec à Montréal","funders":"","keywords":"Computer science; Anomaly detection; Embedding; Anomaly (physics); Natural language processing; Artificial intelligence; Physics","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0001753871,0.00009894458,0.0001295058,0.0001561636,0.0001128994,0.00005967817,0.0002737078,0.00005436795,0.00002617179],"category_scores_gemma":[0.000008522539,0.00009038351,0.0001195499,0.0003331017,0.00001625887,0.0006216966,0.00009860837,0.00007279563,0.000007157471],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.00007033604,"about_ca_system_score_gemma":0.00007223247,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.00007837787,"about_ca_topic_score_gemma":0.0001063962,"domain_scores_codex":[0.999209,0.0000280746,0.0002257959,0.0001716296,0.0001760587,0.000189458],"domain_scores_gemma":[0.9993932,0.00002163065,0.00008275811,0.0003482936,0.0001165821,0.0000375589],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"theoretical_or_conceptual","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.000144648,0.0009410408,0.0005271375,0.0004042755,0.0001903287,0.00001429349,0.02139927,0.3037316,0.04259289,0.5169013,0.0002219771,0.1129312],"study_design_scores_gemma":[0.0005000835,0.00003199873,0.00009003423,0.00002607988,0.000008665127,0.000001606446,0.000463301,0.9621166,0.03602502,0.0004957191,0.000144886,0.00009600729],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.1894831,0.000110359,0.7881569,0.00007682827,0.0001642455,0.0001174767,0.000002564261,0.0001098701,0.02177872],"genre_scores_gemma":[0.9815583,0.000001832443,0.01736477,0.0005378351,0.000006273649,0.000004793205,0.000002230978,0.000003062152,0.0005208757],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.7920752,"threshold_uncertainty_score":0.3685732,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01478359222374085,"score_gpt":0.2756461668821293,"score_spread":0.2608625746583884,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}