FlagThis

Abstract

In enterprise environments, multiple Advanced Persistent Threat (APT) campaigns may execute concurrently, producing audit logs in which techniques from different adversaries are temporally interleaved. This setting gives rise to the Unknown-K Interleaved Sequence Demixing (UKISD) problem, where the goal is to recover latent campaigns from a mixed technique sequence while jointly inferring the number of campaigns and technique-level assignments. Existing approaches, including statistical pattern mining and provenance-based analysis, typically assume single-campaign settings or rely on rigid heuristics, limiting their effectiveness under realistic conditions such as overlapping campaigns, shared techniques, and variable execution lengths.