{"id":"https://openalex.org/W4405104147","doi":"https://doi.org/10.1109/milcom61039.2024.10773782","title":"TTPatternMiner: Automated Learning and Characterization of Attack Pattern from Malicious Cyber Campaign","display_name":"TTPatternMiner: Automated Learning and Characterization of Attack Pattern from Malicious Cyber Campaign","publication_year":2024,"publication_date":"2024-10-28","ids":{"openalex":"https://openalex.org/W4405104147","doi":"https://doi.org/10.1109/milcom61039.2024.10773782"},"language":"en","primary_location":{"id":"doi:10.1109/milcom61039.2024.10773782","doi":"https://doi.org/10.1109/milcom61039.2024.10773782","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom61039.2024.10773782","pdf_url":null,"source":{"id":"https://openalex.org/S4363608114","display_name":"IEEE Military Communications Conference (MILCOM)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2024 - 2024 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5071845094","display_name":"Sharif Ullah","orcid":"https://orcid.org/0000-0001-8286-3122","observed_orcids":["https://orcid.org/0000-0001-8286-3122"]},"institutions":[{"id":"https://openalex.org/I32038505","display_name":"University of Central Arkansas","ror":"https://ror.org/029bp0k25","country_code":"US","type":"education","lineage":["https://openalex.org/I32038505"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sharif Ullah","raw_affiliation_strings":["University of Central Arkansas,Conway,AR,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Central Arkansas,Conway,AR,USA","institution_ids":["https://openalex.org/I32038505"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052787847","display_name":"Sachin S. Shetty","orcid":"https://orcid.org/0000-0002-8789-0610","observed_orcids":["https://orcid.org/0000-0002-8789-0610"]},"institutions":[{"id":"https://openalex.org/I81365321","display_name":"Old Dominion University","ror":"https://ror.org/04zjtrb98","country_code":"US","type":"education","lineage":["https://openalex.org/I81365321"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sachin Shetty","raw_affiliation_strings":["Old Dominion University,Norfolk,VA,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Old Dominion University,Norfolk,VA,USA","institution_ids":["https://openalex.org/I81365321"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112716337","display_name":"Abdul Rahman","orcid":"https://orcid.org/0009-0003-8201-3787","observed_orcids":["https://orcid.org/0009-0003-8201-3787"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abdul Rahman","raw_affiliation_strings":["AI Center of Excellence,Deloitte"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AI Center of Excellence,Deloitte","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035652325","display_name":"Amin Hass","orcid":"https://orcid.org/0009-0001-1115-8060","observed_orcids":["https://orcid.org/0009-0001-1115-8060"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Amin Hass","raw_affiliation_strings":["Accenture Cyber Lab,Arlington,VA,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Accenture Cyber Lab,Arlington,VA,USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5010643450","display_name":"Xiaoyong Yuan","orcid":"https://orcid.org/0000-0003-0782-4187","observed_orcids":["https://orcid.org/0000-0003-0782-4187"]},"institutions":[{"id":"https://openalex.org/I8078737","display_name":"Clemson University","ror":"https://ror.org/037s24f05","country_code":"US","type":"education","lineage":["https://openalex.org/I8078737"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaoyong Yuan","raw_affiliation_strings":["Clemson University,Clemson,SC,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Clemson University,Clemson,SC,USA","institution_ids":["https://openalex.org/I8078737"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6309,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.63710723,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"405","last_page":"411"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4219000041484833,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4219000041484833,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.3508000075817108,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.052400000393390656,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/threat-intelligence","display_name":"threat intelligence","score":0.6890000104904175},{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.8980000019073486},{"id":"https://openalex.org/keywords/threat-propagation","display_name":"threat propagation","score":0.5849999785423279}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6902227401733398},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5995774269104004},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.4162684381008148}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/milcom61039.2024.10773782","doi":"https://doi.org/10.1109/milcom61039.2024.10773782","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom61039.2024.10773782","pdf_url":null,"source":{"id":"https://openalex.org/S4363608114","display_name":"IEEE Military Communications Conference (MILCOM)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2024 - 2024 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W581956982","https://openalex.org/W2027979924","https://openalex.org/W2144211451","https://openalex.org/W2147880316","https://openalex.org/W2153579005","https://openalex.org/W2250539671","https://openalex.org/W2251771443","https://openalex.org/W2296283641","https://openalex.org/W2520488855","https://openalex.org/W2524168323","https://openalex.org/W2538865281","https://openalex.org/W2771963642","https://openalex.org/W2837911466","https://openalex.org/W2900914892","https://openalex.org/W2914662937","https://openalex.org/W2970509139","https://openalex.org/W3022088706","https://openalex.org/W3048012689","https://openalex.org/W3176367300","https://openalex.org/W3211888892","https://openalex.org/W4286375281","https://openalex.org/W4300819682"],"related_works":["https://openalex.org/W4387298166","https://openalex.org/W3214329506","https://openalex.org/W4287806267","https://openalex.org/W4324031781","https://openalex.org/W2900845928","https://openalex.org/W7154628470","https://openalex.org/W4405468677","https://openalex.org/W4413950197","https://openalex.org/W4411551348","https://openalex.org/W4296991331"],"abstract_inverted_index":{"With":[0],"the":[1,14,39,170],"development":[2],"of":[3,16,27,41,71,133],"advanced":[4],"persistent":[5],"threats":[6],"(APT),":[7],"sophisticated":[8],"attacks":[9],"happen":[10],"frequently":[11],"nowadays":[12],"in":[13,169],"form":[15],"cyber":[17,190],"threat":[18,56,64,84,121,134,149,166,191],"campaigns.":[19,192],"Threat":[20],"reports":[21,160],"that":[22],"offer":[23],"a":[24,68,95,144,178],"comprehensive":[25],"analysis":[26],"malicious":[28],"operations":[29],"have":[30],"emerged":[31],"as":[32,177],"essential":[33],"resources":[34],"for":[35,82,99,182],"analyzing":[36],"and":[37,51,126,185],"understanding":[38],"dynamics":[40],"these":[42],"attacks.":[43],"However,":[44],"it":[45],"is":[46,116],"non-trivial":[47],"to":[48,104,111,118,143,148],"automatically":[49],"extract":[50],"identify":[52],"attack":[53,72,91,139,187],"patterns":[54,188],"from":[55,161,189],"reports.":[57],"The":[58,151,172],"existing":[59],"research":[60],"mainly":[61],"explores":[62],"rule-based":[63],"entity":[65],"extraction,":[66],"ignoring":[67],"critical":[69],"aspect":[70],"behavior":[73],"analysis.":[74,101],"This":[75],"paper":[76],"presents":[77],"TTPatternMiner,":[78],"an":[79],"innovative":[80],"tool":[81,153],"operationalizing":[83],"intelligence":[85],"data":[86],"through":[87],"identifying":[88],"unique":[89,138],"adversarial":[90],"patterns,":[92],"thus":[93],"developing":[94],"valuable":[96],"knowledge":[97],"base":[98],"security":[100],"In":[102],"contrast":[103],"low-level":[105],"indicators,":[106],"which":[107,128],"are":[108,129],"very":[109],"unlikely":[110],"be":[112],"used":[113],"repetitively,":[114],"TTPatternMiner":[115,136,176],"designed":[117],"employ":[119],"robust":[120],"characterization.":[122],"Along":[123],"with":[124,157],"technique":[125],"tactic,":[127],"more":[130,145],"standardized":[131],"attributes":[132],"execution,":[135],"extracts":[137],"pattern":[140],"entities":[141],"corresponding":[142],"granular":[146],"context":[147],"propagation.":[150],"proposed":[152],"has":[154],"been":[155],"evaluated":[156],"real-world":[158],"incident":[159],"various":[162],"sources":[163],"involving":[164],"multiple":[165],"campaigns":[167],"happened":[168],"wild.":[171],"evaluation":[173],"result":[174],"indicates":[175],"novel,":[179],"effective":[180],"framework":[181],"revealing":[183],"standard":[184],"non-standard":[186]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2024-12-07T00:00:00"}