APT-GRAN
Intelligent Attribution of Advanced Persistent Threats in Cybersecurity through Neural Networks and Graph Modelling.
University of Alcalá
Own Research Programme
2025 call · 12 months
Ref. PIUAH25/IA-058
PI: Enrique de la Hoz
Co-PI: Laura M. Cornejo
APT-GRAN is a research project at the University of Alcalá on the attribution of cyberattacks: determining which advanced persistent threat group is behind an intrusion from its observed activity.
The starting point is a simple idea. An intrusion is naturally described as a network of related entities (tools, infrastructure, techniques, victims), and when several intrusions are analysed together some of those entities recur and connect them. Expert analysts spot these overlaps and weigh them by judgement. We investigate how to generalise that work with graph neural networks with attention mechanisms, able to learn which relationships matter and how much.
On this site we publish the project's results as they consolidate, its publications and the datasets and software we release so that experiments can be reproduced.
news
| 13 Oct 2026 | On 20 November 2026, from 10:00 to 12:00, we run the workshop “Attackers think in graphs: graph theory for cybersecurity” (in Spanish) in laboratory LE10 of the Escuela Politécnica Superior, as part of the Madrid Science and Innovation Week. Open to secondary and vocational students, university students and the general public. Booking opens on 19 October at 09:00. Information and booking. |
|---|---|
| 1 Oct 2025 | The University of Alcalá funds APT-GRAN within its Own Research Programme. Over twelve months we will investigate the attribution of advanced persistent threats with graph neural networks. |
