Unknown-K demixing
TGCM recovers multiple latent campaign sequences while simultaneously estimating how many campaigns are present.
TGCM research project
TGCM
Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences
TGCM addresses unknown-K disentanglement of interleaved APT technique sequences. This website provides the paper, CAPTure dataset documentation, and reproduction materials.
Interleaved intrusion view
Stream A Stream B Stream C
TGCM paper
Recovering latent APT campaigns from interleaved technique sequences
Enterprise audit logs may contain multiple APT campaigns unfolding at the same time. Their techniques become interleaved across actors, hosts, and execution stages, making it difficult to determine which techniques belong to the same underlying campaign.
TGCM formulates this setting as the Unknown-K Interleaved Sequence Demixing problem: jointly infer the number of latent campaigns and assign each observed technique to a coherent campaign sequence.
Guo-Wei Wong, Ming-Chuan Yang, Shou-De Lin, Wang-Chien Lee, and MengChang Chen.
One-step generation
A consistency-model-based generator learns a direct inverse mapping from an interleaved observation to separated campaign sequences.
Topic-guided coherence
A topic prior derived from MITRE ATT&CK narratives encourages each recovered sequence to form a coherent attack chain.
Reproduction
Paper-numbered notebooks and evaluation instructions.
The artifact covers the blind unknown-K comparison, zero-shot evaluation, DARPA robustness, CAPTure evaluation, unknown-K sensitivity, and topic-encoder sensitivity.
CAPTure dataset
Controlled CALDERA–Procmon audit data
CAPTure contains controlled adversary-emulation scenarios with high-volume Windows audit collection. It covers single-host and multi-host settings and supports event extraction, technique sequencing, mixed-intrusion analysis, and episode disentanglement.
Single-host
Twenty scenarios for each mixture level from Mix-2 through Mix-6.
Multi-host
Twenty scenarios for each mixture level, with host traces merged by recorded timestamps.
Per-setting details
Event volume, storage size, benign and malicious counts, and malicious ratios.
Dataset download
Complete CAPTure CSV archive
The complete 499-file CALDERA–Procmon snapshot is available through Google Drive and expands to approximately 822.44 GiB.
Available
Full CALDERA–Procmon CSV dataset
Complete single-host and multi-host CAPTure audit-log collection.
- Source files
- 499 CSV files
- Extracted size
- 822.44 GiB
Available
Dataset documentation
Single-host and multi-host Mix-2 through Mix-6 details corresponding to the paper appendix.
- Scenarios
- 200
- Mixture levels
- 2–6
Available
Reproduction materials
Experiment guides, environment definitions, metadata, and paper-numbered notebooks.
- Experiments
- 7 groups
- Format
- Jupyter / Python
@misc{wong2026tgcmtopicguidedconsistencymodeling,
title={TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences},
author={Guo-Wei Wong and Ming-Chuan Yang and Shou-De Lin and Wang-Chien Lee and Meng Chang Chen},
year={2026},
eprint={2606.18651},
archivePrefix={arXiv},
primaryClass={cs.CR},
url={https://arxiv.org/abs/2606.18651},
}