{"id":"W4416549364","doi":"10.1145/3719027.3765219","title":"OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs","year":2025,"lang":"","type":"article","venue":"","topic":"Software System Performance and Reliability","field":"Computer Science","cited_by":3,"is_retracted":false,"has_abstract":true,"ca_institutions":"Concordia University","funders":"","keywords":"Anomaly detection; Spurious relationship; Robustness (evolution); Audit; Attack patterns; Subgraph isomorphism problem; Iterated function; Audit trail","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow"],"consensus_categories":[],"category_scores_codex":[0.0009411337,0.0004679287,0.0006409736,0.0003896875,0.001251359,0.0007307,0.0005766979,0.0004228858,0.0000803951],"category_scores_gemma":[0.0002121313,0.0004312185,0.0001916937,0.001508034,0.0004906202,0.001600178,0.000595441,0.0004677619,0.0000196886],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0002776771,"about_ca_system_score_gemma":0.0004319669,"about_ca_topic_candidate":true,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.007710767,"about_ca_topic_score_gemma":0.0009932983,"domain_scores_codex":[0.9964057,0.000250944,0.0009908668,0.001349405,0.0003564918,0.0006465467],"domain_scores_gemma":[0.9976092,0.0004599422,0.0003926643,0.001037193,0.0003343009,0.0001666798],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"observational","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.00006132774,0.00005962008,0.636849,0.0003403565,0.0002022591,0.000008262599,0.00235329,0.0001479011,0.003347118,0.0005642505,0.00005922374,0.3560074],"study_design_scores_gemma":[0.00235795,0.0004558023,0.2490201,0.001769725,0.0003722353,0.0002152255,0.004744702,0.685126,0.04129776,0.01001571,0.002669325,0.001955492],"study_design_candidate":"observational","study_design_consensus":null,"genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.6890268,0.001564206,0.3008456,0.0001902892,0.007220076,0.0003346475,0.000006978333,0.0002153862,0.0005959843],"genre_scores_gemma":[0.9806381,0.0001324565,0.01837437,0.0001253899,0.0003278852,0.00001054131,0.000001219924,0.00001462189,0.0003753364],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.6849781,"threshold_uncertainty_score":0.999814,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01481537045661702,"score_gpt":0.2487262669473818,"score_spread":0.2339108964907647,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}