{"id":"W4416582925","doi":"10.1109/access.2025.3636501","title":"XAPT: Explainable Anomaly-Driven Prediction of Threat Stages in APT Campaigns","year":2025,"lang":"en","type":"article","venue":"IEEE Access","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":2,"is_retracted":false,"has_abstract":true,"ca_institutions":"Toronto Metropolitan University; University of Victoria","funders":"National Institute of Biomedical Imaging and Bioengineering; National Institutes of Health","keywords":"Anomaly detection; Probabilistic logic; Bayesian probability; Classifier (UML); Anomaly (physics); Key (lock); Feature (linguistics); Attribution","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001573889,0.001161806,0.0006194999,0.001503319,0.0003927169,0.001338427,0.001687241,0.001113398,0.001760079],"category_scores_gemma":[0.009433036,0.000330617,0.0009336055,0.0007948168,0.00072985,0.001956466,0.001657346,0.002068902,0.0004528556],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0009100292,"about_ca_system_score_gemma":0.001144399,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.004376463,"about_ca_topic_score_gemma":0.005710484,"domain_scores_codex":[0.9991748,0.0002542063,0.00004729003,0.0002464294,0.0001969852,0.00008027306],"domain_scores_gemma":[0.9958096,0.002299428,0.0006527219,0.0005618401,0.0005325349,0.0001439924],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"simulation_or_modeling","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0003303905,0.000258279,0.04690944,0.0001803486,0.0002309166,0.0002576082,0.0003762877,0.6932681,0.005069127,0.02946365,0.008324224,0.2153316],"study_design_scores_gemma":[0.000006154494,0.00002218941,0.00156514,0.000006708361,0.000008599868,0.00002609913,0.00001316896,0.982084,0.0007013658,0.01512112,0.0004368908,0.000008548002],"study_design_candidate":"simulation_or_modeling","study_design_consensus":"simulation_or_modeling","genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.05094753,0.0001433235,0.9438806,0.0004669379,0.00003724466,0.00008935542,0.001083247,0.002443987,0.0009079382],"genre_scores_gemma":[0.809017,0.0001653974,0.1852195,0.0001706158,0.0001068747,0.0001690244,0.003544948,0.0001660406,0.001440784],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.004376463,"threshold_uncertainty_score":0.00870198,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.0224557025640188,"score_gpt":0.279477144344891,"score_spread":0.2570214417808722,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}