<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-05521004</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-08T20:45:01+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">A Grammar-Driven Approach to Model and Detect APT Attack Sequences</title>
            <author role="aut">
              <persName>
                <forename type="first">Antoine</forename>
                <surname>Rebstock</surname>
              </persName>
              <email type="md5">861f6e423c7dcbb64217d39480169527</email>
              <email type="domain">protonmail.ch</email>
              <idno type="idhal" notation="string">antoinerebstock</idno>
              <idno type="idhal" notation="numeric">1224066</idno>
              <idno type="halauthorid" notation="string">2716240-1224066</idno>
              <affiliation ref="#struct-482801"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Yann</forename>
                <surname>Busnel</surname>
              </persName>
              <email type="md5">4480a2e853bef7e22af2761cb4a4b313</email>
              <email type="domain">imt.fr</email>
              <idno type="idhal" notation="string">yann-busnel</idno>
              <idno type="idhal" notation="numeric">823</idno>
              <idno type="halauthorid" notation="string">2543327-823</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-6908-719X</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=Yet2gQkAAAAJ</idno>
              <idno type="IDREF">https://www.idref.fr/129816647</idno>
              <idno type="ARXIV">https://arxiv.org/a/busnel_y_1</idno>
              <affiliation ref="#struct-490899"/>
              <affiliation ref="#struct-1150935"/>
              <affiliation ref="#struct-302102"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Romaric</forename>
                <surname>Ludinard</surname>
              </persName>
              <email type="md5">65e0ac77be7318035b399dd9bedeb94b</email>
              <email type="domain">imt-atlantique.fr</email>
              <idno type="idhal" notation="string">rludinard</idno>
              <idno type="idhal" notation="numeric">15725</idno>
              <idno type="halauthorid" notation="string">25089-15725</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-4997-4813</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?hl=fr&amp;user=9Tn9JK8AAAAJ&amp;view_op=list_works&amp;sortby=pubdate</idno>
              <idno type="IDREF">https://www.idref.fr/12181100X</idno>
              <affiliation ref="#struct-482801"/>
              <affiliation ref="#struct-491177"/>
              <affiliation ref="#struct-1150935"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Yann</forename>
                <surname>Busnel</surname>
              </persName>
              <email type="md5">4480a2e853bef7e22af2761cb4a4b313</email>
              <email type="domain">imt.fr</email>
            </editor>
            <funder ref="#projanr-51232"/>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2026-02-20 15:40:26</date>
              <date type="whenWritten">2025-09</date>
              <date type="whenModified">2026-03-03 03:10:13</date>
              <date type="whenReleased">2026-02-22 22:36:16</date>
              <date type="whenProduced">2025-11-25</date>
              <date type="whenEndEmbargoed">2026-02-20</date>
              <ref type="file" target="https://hal.science/hal-05521004v1/document">
                <date notBefore="2026-02-20"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-05521004v1/file/multi_step_grammar-3.pdf" id="file-5521004-4725779">
                <date notBefore="2026-02-20"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="108751">
                <persName>
                  <forename>Yann</forename>
                  <surname>Busnel</surname>
                </persName>
                <email type="md5">4480a2e853bef7e22af2761cb4a4b313</email>
                <email type="domain">imt.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-05521004</idno>
            <idno type="halUri">https://hal.science/hal-05521004</idno>
            <idno type="halBibtex">rebstock:hal-05521004</idno>
            <idno type="halRefHtml">&lt;i&gt;FPS 2025: 18th International Symposium on Foundations &amp; Practice of Security&lt;/i&gt;, IMT Atlantique, Nov 2025, Brest, France</idno>
            <idno type="halRef">FPS 2025: 18th International Symposium on Foundations &amp; Practice of Security, IMT Atlantique, Nov 2025, Brest, France</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-5521004-4725779"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-RENNES1">Université de Rennes 1</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="UNIV-UBS">Université de Bretagne Sud</idno>
            <idno type="stamp" n="INSA-RENNES">Institut National des Sciences Appliquées de Rennes</idno>
            <idno type="stamp" n="IRISA">Irisa</idno>
            <idno type="stamp" n="IRISA_SET">IRISA_SET</idno>
            <idno type="stamp" n="CENTRALESUPELEC">Ecole CentraleSupélec</idno>
            <idno type="stamp" n="UR1-HAL">Publications labos UR1 dans HAL-Rennes 1</idno>
            <idno type="stamp" n="UR1-MATH-STIC">UR1 - publications Maths-STIC</idno>
            <idno type="stamp" n="UR1-UFR-ISTIC">UFR ISTIC Informatique et électronique</idno>
            <idno type="stamp" n="IMTA_SRCD">IMT Atlantique - Département systèmes réseaux, cybersécurité &amp; droit du numérique </idno>
            <idno type="stamp" n="TEST-UR-CSS">TEST Université de Rennes CSS</idno>
            <idno type="stamp" n="IRISA_IMTA">IRISA - IMT Atlantique</idno>
            <idno type="stamp" n="UNIV-RENNES">Université de Rennes</idno>
            <idno type="stamp" n="IMT-ATLANTIQUE" corresp="INSTITUT-MINES-TELECOM">IMT-ATLANTIQUE</idno>
            <idno type="stamp" n="INSA-GROUPE">Groupe INSA</idno>
            <idno type="stamp" n="INSTITUTS-TELECOM">composantes instituts telecom </idno>
            <idno type="stamp" n="ANR">ANR</idno>
            <idno type="stamp" n="UR1-MATH-NUM">Pôle UnivRennes - Mathématiques - Numérique </idno>
            <idno type="stamp" n="CYBERSCHOOL">CyberSchool - Ecole universitaire de recherche en Cybersécurité</idno>
            <idno type="stamp" n="IRISA-SOTERN-IMTA">Equipe SOTERN</idno>
            <idno type="stamp" n="INSTITUT-MINES-TELECOM">Institut Mines Telecom</idno>
            <idno type="stamp" n="ANR-IA-20" corresp="ANR-IA">ANR-IA-20</idno>
            <idno type="stamp" n="ANR-IA">ANR-IA</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">A Grammar-Driven Approach to Model and Detect APT Attack Sequences</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Antoine</forename>
                    <surname>Rebstock</surname>
                  </persName>
                  <email type="md5">861f6e423c7dcbb64217d39480169527</email>
                  <email type="domain">protonmail.ch</email>
                  <idno type="idhal" notation="string">antoinerebstock</idno>
                  <idno type="idhal" notation="numeric">1224066</idno>
                  <idno type="halauthorid" notation="string">2716240-1224066</idno>
                  <affiliation ref="#struct-482801"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Yann</forename>
                    <surname>Busnel</surname>
                  </persName>
                  <email type="md5">4480a2e853bef7e22af2761cb4a4b313</email>
                  <email type="domain">imt.fr</email>
                  <idno type="idhal" notation="string">yann-busnel</idno>
                  <idno type="idhal" notation="numeric">823</idno>
                  <idno type="halauthorid" notation="string">2543327-823</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-6908-719X</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=Yet2gQkAAAAJ</idno>
                  <idno type="IDREF">https://www.idref.fr/129816647</idno>
                  <idno type="ARXIV">https://arxiv.org/a/busnel_y_1</idno>
                  <affiliation ref="#struct-490899"/>
                  <affiliation ref="#struct-1150935"/>
                  <affiliation ref="#struct-302102"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Romaric</forename>
                    <surname>Ludinard</surname>
                  </persName>
                  <email type="md5">65e0ac77be7318035b399dd9bedeb94b</email>
                  <email type="domain">imt-atlantique.fr</email>
                  <idno type="idhal" notation="string">rludinard</idno>
                  <idno type="idhal" notation="numeric">15725</idno>
                  <idno type="halauthorid" notation="string">25089-15725</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-4997-4813</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?hl=fr&amp;user=9Tn9JK8AAAAJ&amp;view_op=list_works&amp;sortby=pubdate</idno>
                  <idno type="IDREF">https://www.idref.fr/12181100X</idno>
                  <affiliation ref="#struct-482801"/>
                  <affiliation ref="#struct-491177"/>
                  <affiliation ref="#struct-1150935"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>FPS 2025: 18th International Symposium on Foundations &amp; Practice of Security</title>
                  <date type="start">2025-11-25</date>
                  <date type="end">2025-11-27</date>
                  <settlement>Brest</settlement>
                  <country key="FR">France</country>
                </meeting>
                <respStmt>
                  <resp>conferenceOrganizer</resp>
                  <name>IMT Atlantique</name>
                </respStmt>
                <imprint/>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info.info-ds">Computer Science [cs]/Data Structures and Algorithms [cs.DS]</classCode>
              <classCode scheme="halDomain" n="info.info-dc">Computer Science [cs]/Distributed, Parallel, and Cluster Computing [cs.DC]</classCode>
              <classCode scheme="halDomain" n="info.info-it">Computer Science [cs]/Information Theory [cs.IT]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>This paper introduces a grammar-driven approach to model and detect sequences of Advanced Persistent Threat (APT) attacks. APTs are characterized by their complexity and multi-step nature, making them challenging to detect with traditional systems. The proposed method employs interpretable rules to capture malicious behaviors and aligns semantically with the MITRE ATT&amp;amp;CK framework. This approach enables the detection of plausible attack scenarios even in the presence of incomplete or noisy data. We evaluate it using a public large CTF dataset which provides realistic and diverse attack scenarios. Experiments illustrate the effectiveness of the method in reconstructing plausible attack progressions, even with incomplete data. The main contribution of this study is an open-source implementation in Rust, ensuring reproducibility and extensibility. We also propose future enhancements to better model contextual dependencies between tactics in APT attack sequences. In a nutshell, this grammatical approach offers a robust method for detecting sophisticated threats, bridging the gap between low-level observations and high-level strategic reasoning.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="department" xml:id="struct-482801" status="VALID">
          <orgName>Département Systèmes Réseaux, Cybersécurité et Droit du numérique</orgName>
          <orgName type="acronym">IMT Atlantique - SRCD</orgName>
          <date type="start">2017-01-02</date>
          <desc>
            <address>
              <addrLine>IMT Atlantique - Campus de Rennes - 2 rue de la Châtaigneraie - CS 17607 - 35576 CESSON SEVIGNE CEDEX</addrLine>
              <country key="FR"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-481355" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-490899" status="VALID">
          <idno type="IdRef">026386909</idno>
          <idno type="ISNI">0000 0001 2298 7270</idno>
          <idno type="RNSR">200012163A</idno>
          <idno type="ROR">https://ror.org/00myn0z94</idno>
          <orgName>Institut de Recherche en Informatique et Systèmes Aléatoires</orgName>
          <orgName type="acronym">IRISA</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Avenue du général LeclercCampus de Beaulieu 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.irisa.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-105160" type="direct"/>
            <relation active="#struct-117606" type="direct"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="direct"/>
            <relation active="#struct-247362" type="direct"/>
            <relation active="#struct-300009" type="direct"/>
            <relation active="#struct-411575" type="direct"/>
            <relation name="UMR6074" active="#struct-441569" type="direct"/>
            <relation active="#struct-481355" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="researchteam" xml:id="struct-1150935" status="VALID">
          <orgName>Self-prOtecting The futurE inteRNet</orgName>
          <orgName type="acronym">SOTERN</orgName>
          <date type="start">2023-01-01</date>
          <desc>
            <address>
              <addrLine>IRISAIMT Atlantique2 Rue de la ChâtaigneraieCS 1760735576 Cesson-Sévigné</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.irisa.fr/node/957</ref>
          </desc>
          <listRelation>
            <relation active="#struct-481355" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation active="#struct-491177" type="direct"/>
            <relation active="#struct-490899" type="indirect"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-302102" status="VALID">
          <idno type="IdRef">192427156</idno>
          <idno type="ISNI">000000012202567X</idno>
          <idno type="ROR">https://ror.org/025vp2923</idno>
          <idno type="Wikidata">Q27962533</idno>
          <orgName>Institut Mines-Télécom [Paris]</orgName>
          <orgName type="acronym">IMT</orgName>
          <date type="start">2012-03-01</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey, 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt.fr/</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-491177" status="VALID">
          <orgName>RÉSEAUX, TÉLÉCOMMUNICATION ET SERVICES</orgName>
          <orgName type="acronym">IRISA-D2</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.irisa.fr/departements/reseaux-telecommunication-services</ref>
          </desc>
          <listRelation>
            <relation active="#struct-490899" type="direct"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
            <relation active="#struct-481355" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-481355" status="VALID">
          <idno type="IdRef">202743233</idno>
          <idno type="ROR">https://ror.org/030hj3061</idno>
          <orgName>IMT Atlantique</orgName>
          <orgName type="acronym">IMT Atlantique</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Campus Brest : Technopôle Brest-Iroise CS 8381829238 BREST Cedex 3 -Campus Nantes : 4, rue Alfred Kastler- La chantrerie 44300 NANTES -Campus Rennes :  2 Rue de la Châtaigneraie, 35510 CESSON SEVIGNE</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt-atlantique.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-105160" status="VALID">
          <idno type="IdRef">26693823X</idno>
          <idno type="ROR">https://ror.org/015m7wh34</idno>
          <orgName>Université de Rennes</orgName>
          <orgName type="acronym">UR</orgName>
          <desc>
            <address>
              <addrLine>Campus de Beaulieu, 263 avenue Général Leclerc, CS 74205, 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-rennes.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-117606" status="VALID">
          <idno type="ROR">https://ror.org/04xaa4j22</idno>
          <orgName>Institut National des Sciences Appliquées - Rennes</orgName>
          <orgName type="acronym">INSA Rennes</orgName>
          <desc>
            <address>
              <addrLine>20, avenue des Buttes de Coësmes - CS 70839 - 35708 Rennes cedex 7</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.insa-rennes.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301232" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-301232" status="VALID">
          <idno type="IdRef">162105150</idno>
          <orgName>Institut National des Sciences Appliquées</orgName>
          <orgName type="acronym">INSA</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-172265" status="VALID">
          <idno type="IdRef">05017746X</idno>
          <idno type="ISNI">0000000121680285</idno>
          <idno type="ROR">https://ror.org/04ed7fw48</idno>
          <orgName>Université de Bretagne Sud</orgName>
          <orgName type="acronym">UBS</orgName>
          <date type="start">1995-02-07</date>
          <desc>
            <address>
              <addrLine>BP 92116 - 56321 Lorient cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-ubs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-247362" status="VALID">
          <idno type="ROR">https://ror.org/03rxtdc22</idno>
          <orgName>École normale supérieure - Rennes</orgName>
          <orgName type="acronym">ENS Rennes</orgName>
          <desc>
            <address>
              <addrLine>Campus de Ker Lann - avenue Robert Schuman - 35170 Bruz</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ens-rennes.fr</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-411575" status="VALID">
          <idno type="IdRef">184443237</idno>
          <idno type="ROR">https://ror.org/019tcpt25</idno>
          <orgName>CentraleSupélec</orgName>
          <desc>
            <address>
              <addrLine>3, rue Joliot Curie,Plateau de Moulon,91192 GIF-SUR-YVETTE Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.centralesupelec.fr</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="anrProject" xml:id="projanr-51232" status="VALID">
          <idno type="anr">ANR-20-THIA-0019</idno>
          <orgName>AI@IMT</orgName>
          <desc>AI@IMT pour une IA responsable dans la société et dans l'industrie</desc>
          <date type="start">2020</date>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>