{"id":"W4416549364","doi":"10.1145/3719027.3765219","title":"OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs","year":2025,"lang":"","type":"article","venue":"","topic":"Software System Performance and Reliability","field":"Computer Science","cited_by":3,"is_retracted":false,"has_abstract":true,"ca_institutions":"Concordia University","funders":"","keywords":"Anomaly detection; Spurious relationship; Robustness (evolution); Audit; Attack patterns; Subgraph isomorphism problem; Iterated function; Audit trail","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001185296,0.001977329,0.0005387979,0.003798593,0.0003832642,0.00114573,0.001644381,0.001090129,0.001497142],"category_scores_gemma":[0.009769039,0.0003626654,0.0009822629,0.001618845,0.0006220514,0.002646521,0.001675431,0.001131827,0.001430162],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0007971784,"about_ca_system_score_gemma":0.001067107,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.01039765,"about_ca_topic_score_gemma":0.01764746,"domain_scores_codex":[0.9986205,0.0002880323,0.0001119198,0.000426089,0.0004632592,0.000090229],"domain_scores_gemma":[0.9946233,0.002061516,0.0008729626,0.001451368,0.0008110785,0.0001796352],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"not_applicable","study_design_scores_codex":[0.0008015098,0.0004735718,0.03506898,0.001040275,0.0003156378,0.001512108,0.001392929,0.1083315,0.01964028,0.005336427,0.07328904,0.7527978],"study_design_scores_gemma":[0.00003237168,0.0001130486,0.004863827,0.00005339993,0.00005417609,0.0003957087,0.000299089,0.9558734,0.01301387,0.008974504,0.01627379,0.00005281784],"study_design_candidate":"not_applicable","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"methods","genre_scores_codex":[0.1793368,0.001925042,0.5569074,0.001479459,0.000338093,0.0008284378,0.02596898,0.2267363,0.006479449],"genre_scores_gemma":[0.5114553,0.0007156279,0.4219268,0.0004731909,0.0001324107,0.000376227,0.05752315,0.002715083,0.00468231],"genre_candidate":"methods","genre_consensus":"methods","teacher_disagreement_score":0.01039765,"threshold_uncertainty_score":0.02067423,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01481537045661702,"score_gpt":0.2487262669473818,"score_spread":0.2339108964907647,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}