{"id":"https://openalex.org/W4296991884","doi":"https://doi.org/10.3390/electronics11192992","title":"BTH: Behavior-Based Structured Threat Hunting Framework to Analyze and Detect Advanced Adversaries","display_name":"BTH: Behavior-Based Structured Threat Hunting Framework to Analyze and Detect Advanced Adversaries","publication_year":2022,"publication_date":"2022-09-21","ids":{"openalex":"https://openalex.org/W4296991884","doi":"https://doi.org/10.3390/electronics11192992"},"language":"en","primary_location":{"id":"doi:10.3390/electronics11192992","doi":"https://doi.org/10.3390/electronics11192992","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics11192992","pdf_url":"https://www.mdpi.com/2079-9292/11/19/2992/pdf?version=1663760809","source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"},"parent_works":[],"lineage":["https://openalex.org/W4296991884"],"child_works_count":0,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2079-9292/11/19/2992/pdf?version=1663760809","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5090659568","display_name":"Akashdeep Bhardwaj","orcid":"https://orcid.org/0000-0001-7361-0465","observed_orcids":["https://orcid.org/0000-0001-7361-0465"]},"institutions":[{"id":"https://openalex.org/I5847235","display_name":"University of Petroleum and Energy Studies","ror":"https://ror.org/04q2jes40","country_code":"IN","type":"education","lineage":["https://openalex.org/I5847235"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Akashdeep Bhardwaj","raw_affiliation_strings":["School of Computer Science, University of Petroleum and Energy Studies, Bidholi, Dehradun 248007, India"],"raw_orcid":"https://orcid.org/0000-0001-7361-0465","affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Petroleum and Energy Studies, Bidholi, Dehradun 248007, India","institution_ids":["https://openalex.org/I5847235"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017964817","display_name":"Keshav Kaushik","orcid":"https://orcid.org/0000-0003-3777-765X","observed_orcids":["https://orcid.org/0000-0003-3777-765X"]},"institutions":[{"id":"https://openalex.org/I5847235","display_name":"University of Petroleum and Energy Studies","ror":"https://ror.org/04q2jes40","country_code":"IN","type":"education","lineage":["https://openalex.org/I5847235"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Keshav Kaushik","raw_affiliation_strings":["School of Computer Science, University of Petroleum and Energy Studies, Bidholi, Dehradun 248007, India"],"raw_orcid":"https://orcid.org/0000-0003-3777-765X","affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Petroleum and Energy Studies, Bidholi, Dehradun 248007, India","institution_ids":["https://openalex.org/I5847235"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039100555","display_name":"Abdullah Alomari","orcid":"https://orcid.org/0000-0003-3866-3048","observed_orcids":["https://orcid.org/0000-0003-3866-3048"]},"institutions":[{"id":"https://openalex.org/I52207611","display_name":"Al Baha University","ror":"https://ror.org/0403jak37","country_code":"SA","type":"education","lineage":["https://openalex.org/I52207611"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Abdullah Alomari","raw_affiliation_strings":["Department of Computer Science, Al-Baha University, Albaha 65799, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0003-3866-3048","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Al-Baha University, Albaha 65799, Saudi Arabia","institution_ids":["https://openalex.org/I52207611"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051912609","display_name":"Amjad Alsirhani","orcid":"https://orcid.org/0000-0001-8145-2575","observed_orcids":["https://orcid.org/0000-0001-8145-2575","https://orcid.org/0000-0002-9831-1290"]},"institutions":[{"id":"https://openalex.org/I129902397","display_name":"Dalhousie University","ror":"https://ror.org/01e6qks80","country_code":"CA","type":"education","lineage":["https://openalex.org/I129902397"]},{"id":"https://openalex.org/I199702508","display_name":"Jouf University","ror":"https://ror.org/02zsyt821","country_code":"SA","type":"education","lineage":["https://openalex.org/I199702508"]}],"countries":["CA","SA"],"is_corresponding":false,"raw_author_name":"Amjad Alsirhani","raw_affiliation_strings":["College of Computer and Information Sciences, Jouf University, Sakaka 72388, Saudi Arabia","Faculty of Computer Science, Dalhousie University, Halifax, NS B3H 4R2, Canada"],"raw_orcid":"https://orcid.org/0000-0001-8145-2575","affiliations":[{"raw_affiliation_string":"College of Computer and Information Sciences, Jouf University, Sakaka 72388, Saudi Arabia","institution_ids":["https://openalex.org/I199702508"]},{"raw_affiliation_string":"Faculty of Computer Science, Dalhousie University, Halifax, NS B3H 4R2, Canada","institution_ids":["https://openalex.org/I129902397"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113900901","display_name":"Mohammed Mujib Alshahrani","orcid":"https://orcid.org/0000-0001-6661-6623","observed_orcids":["https://orcid.org/0000-0001-6661-6623"]},"institutions":[{"id":"https://openalex.org/I4210136004","display_name":"University of Bisha","ror":"https://ror.org/040548g92","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210136004"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Mohammed Mujib Alshahrani","raw_affiliation_strings":["College of Computing and Information Technology, University of Bisha, Bisha 61361, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computing and Information Technology, University of Bisha, Bisha 61361, Saudi Arabia","institution_ids":["https://openalex.org/I4210136004"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5055981334","display_name":"Salil Bharany","orcid":"https://orcid.org/0000-0002-2282-0419","observed_orcids":["https://orcid.org/0000-0002-2282-0419"]},"institutions":[{"id":"https://openalex.org/I165682329","display_name":"Guru Nanak Dev University","ror":"https://ror.org/05ghzpa93","country_code":"IN","type":"education","lineage":["https://openalex.org/I165682329"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Salil Bharany","raw_affiliation_strings":["Department of Computer Engineering & Technology, Guru Nanak Dev University, Punjab 143005, India"],"raw_orcid":"https://orcid.org/0000-0002-2282-0419","affiliations":[{"raw_affiliation_string":"Department of Computer Engineering & Technology, Guru Nanak Dev University, Punjab 143005, India","institution_ids":["https://openalex.org/I165682329"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5055981334"],"corresponding_institution_ids":["https://openalex.org/I165682329"],"apc_list":{"value":2000,"currency":"CHF","value_usd":2094},"apc_paid":{"value":2000,"currency":"CHF","value_usd":2094},"fwci":1.8837,"has_fulltext":true,"cited_by_count":26,"citation_normalized_percentile":{"value":0.85741,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"11","issue":"19","first_page":"2992","last_page":"2992"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9750999808311462,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9750999808311462,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.01119999960064888,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.005799999926239252,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.8740000128746033},{"id":"https://openalex.org/keywords/indicators-of-compromise","display_name":"indicators of compromise","score":0.8650000095367432},{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":0.7329999804496765},{"id":"https://openalex.org/keywords/emerging-threats","display_name":"emerging threats","score":0.6200000047683716},{"id":"https://openalex.org/keywords/network-security","display_name":"network security","score":0.5830000042915344}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.778092622756958},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7535854578018188},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6911424398422241},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.6510218977928162},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.5249345898628235},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.5060965418815613},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4916744828224182},{"id":"https://openalex.org/C2776650193","wikidata":"https://www.wikidata.org/wiki/Q264661","display_name":"Obstacle","level":2,"score":0.4603751301765442},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.383966326713562},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.35767662525177},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.1323116421699524},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.10844039916992188},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.1049659252166748},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.07845032215118408},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/electronics11192992","doi":"https://doi.org/10.3390/electronics11192992","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics11192992","pdf_url":"https://www.mdpi.com/2079-9292/11/19/2992/pdf?version=1663760809","source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/electronics11192992","doi":"https://doi.org/10.3390/electronics11192992","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics11192992","pdf_url":"https://www.mdpi.com/2079-9292/11/19/2992/pdf?version=1663760809","source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4296991884.pdf","grobid_xml":"https://content.openalex.org/works/W4296991884.grobid-xml"},"referenced_works_count":30,"referenced_works":["https://openalex.org/W1966741850","https://openalex.org/W2025451090","https://openalex.org/W2756675797","https://openalex.org/W2789823311","https://openalex.org/W2886752452","https://openalex.org/W2909851051","https://openalex.org/W2942969883","https://openalex.org/W3036491774","https://openalex.org/W3049395662","https://openalex.org/W3087886930","https://openalex.org/W3099922319","https://openalex.org/W3128070938","https://openalex.org/W3174621618","https://openalex.org/W3176367300","https://openalex.org/W3179737025","https://openalex.org/W3190778120","https://openalex.org/W3198142785","https://openalex.org/W3200022502","https://openalex.org/W3203098540","https://openalex.org/W4205911522","https://openalex.org/W4210797123","https://openalex.org/W4234670385","https://openalex.org/W4280507864","https://openalex.org/W4281251447","https://openalex.org/W4283805935","https://openalex.org/W4284886432","https://openalex.org/W4286559706","https://openalex.org/W4289520325","https://openalex.org/W4291952042","https://openalex.org/W6800978559"],"related_works":["https://openalex.org/W7211941242","https://openalex.org/W4402811947","https://openalex.org/W7130684688","https://openalex.org/W4399332138","https://openalex.org/W7026988543","https://openalex.org/W166376487","https://openalex.org/W2996525578","https://openalex.org/W2735384891","https://openalex.org/W2766227136","https://openalex.org/W3010451506"],"abstract_inverted_index":{"Organizations":[0],"of":[1,45,102,151,161,176],"every":[2],"size":[3],"and":[4,16,38,72,84,116,138,144,159,168,199,203],"industry":[5],"are":[6,76,81],"facing":[7,24],"a":[8,123,148,183],"new":[9],"normal.":[10],"Adversaries":[11],"have":[12,147],"become":[13],"more":[14],"sophisticated":[15],"persistent":[17,83],"than":[18],"ever":[19],"before.":[20],"Every":[21],"network":[22],"is":[23,132],"never-ending":[25],"onslaughts.":[26],"Yet":[27],"many":[28],"organizations":[29],"continue":[30,117],"to":[31,69,118,191],"rely":[32],"on":[33,156,201],"signature-based":[34],"reactive":[35],"threat":[36,189],"detection":[37],"mitigation":[39],"solutions":[40,63],"as":[41],"the":[42,65,91,98,107,111,127,139,157,162],"primary":[43],"line":[44],"defense":[46],"against":[47,196],"new-age,":[48],"cutting-edge":[49],"attacks.":[50],"Even":[51],"conventional":[52],"attacks":[53,75,114,135,145],"can":[54,129,146,165],"bypass":[55],"such":[56],"security":[57],"solutions.":[58],"This":[59,153],"means":[60],"legacy":[61],"protection":[62],"leave":[64],"organization\u2019s":[66],"data":[67],"vulnerable":[68],"damage,":[70],"destruction,":[71],"theft.":[73],"Adversarial":[74],"like":[77,87],"ocean":[78],"waves:":[79],"they":[80],"very":[82],"keep":[85],"coming":[86],"attack":[88],"campaigns.":[89],"Sometimes":[90],"waves,":[92],"in":[93],"our":[94],"case,":[95],"attacks,":[96,108],"look":[97,119],"same,":[99],"where":[100],"indicators":[101],"compromise":[103],"(IoCs)":[104],"effectively":[105],"detect":[106],"while":[109],"sometimes,":[110],"waves":[112,137],"or":[113,136],"change":[115],"different,":[120],"especially":[121],"over":[122],"while.":[124],"If":[125],"somehow":[126],"defenders":[128],"recognize":[130],"what":[131],"making":[133],"those":[134],"conditions,":[140],"then":[141],"detecting":[142],"threats":[143,198],"longer-lasting":[149],"effect":[150],"success.":[152],"study":[154],"focuses":[155],"behavior":[158],"habits":[160],"attackers":[163],"that":[164],"provide":[166],"better":[167],"long-lasting":[169],"results":[170],"when":[171],"matching":[172],"adversarial":[173],"profiles":[174],"instead":[175],"using":[177],"just":[178],"IoCs.":[179],"The":[180],"paper":[181],"presents":[182],"unique":[184],"framework":[185],"for":[186],"behavior-based":[187],"structured":[188],"hunting":[190],"deliver":[192],"rapid,":[193],"consistent":[194],"remediation":[195],"emerging":[197],"malware":[200],"systems":[202],"networks.":[204]},"counts_by_year":[{"year":2026,"cited_by_count":7},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":4}],"updated_date":"2026-11-14T11:04:58.165337","created_date":"2022-09-25T00:00:00"}