{"id":"W4415841383","doi":"10.48550/arxiv.2510.15188","title":"OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs","year":2025,"lang":"","type":"preprint","venue":"ArXiv.org","topic":"Software System Performance and Reliability","field":"Computer Science","cited_by":0,"is_retracted":false,"has_abstract":true,"ca_institutions":"Concordia University","funders":"","keywords":"Anomaly detection; Spurious relationship; Robustness (evolution); Audit; Attack patterns; Subgraph isomorphism problem; Iterated function; Audit trail","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow","sts"],"consensus_categories":[],"category_scores_codex":[0.001531691,0.001040918,0.001384804,0.0005361037,0.001596418,0.000643343,0.00142927,0.00117912,0.00005896201],"category_scores_gemma":[0.0004687419,0.001058619,0.0004764182,0.001237568,0.0007401693,0.001371164,0.002672908,0.001748132,0.00005466678],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0005743653,"about_ca_system_score_gemma":0.0009016986,"about_ca_topic_candidate":true,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.009533253,"about_ca_topic_score_gemma":0.0007023856,"domain_scores_codex":[0.9931678,0.0005368654,0.001745814,0.00293561,0.0006084152,0.001005509],"domain_scores_gemma":[0.9945647,0.0007314263,0.001342588,0.002420027,0.0006324063,0.0003089054],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"observational","study_design_gemma":"observational","study_design_scores_codex":[0.0000545361,0.00005239355,0.9441169,0.0006231033,0.0002572926,0.00001499466,0.003006939,0.0004508046,0.001402504,0.00002330258,0.000009949328,0.04998729],"study_design_scores_gemma":[0.001220751,0.0002457545,0.9007001,0.003246971,0.0004499699,0.0001767967,0.001526654,0.0728742,0.01377722,0.002160902,0.001436576,0.002184113],"study_design_candidate":"observational","study_design_consensus":"observational","genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.8934363,0.002213077,0.08568759,0.0001700586,0.0170065,0.000866182,0.00005901783,0.0003903181,0.000171037],"genre_scores_gemma":[0.9885476,0.000502781,0.00944819,0.00009670866,0.001097247,0.00005457998,0.0000122081,0.00003764689,0.0002030519],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.09511136,"threshold_uncertainty_score":0.9997033,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.04361607421284627,"score_gpt":0.2695770273053696,"score_spread":0.2259609530925234,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}