{"id":"https://openalex.org/W7204121897","doi":"https://doi.org/10.3390/electronics15173792","title":"Integrating Cyber Threat Intelligence into Email Gateway Architectures for Phishing and Ransomware Detection and Prevention","display_name":"Integrating Cyber Threat Intelligence into Email Gateway Architectures for Phishing and Ransomware Detection and Prevention","publication_year":2026,"publication_date":"2026-08-24","ids":{"openalex":"https://openalex.org/W7204121897","doi":"https://doi.org/10.3390/electronics15173792"},"language":"en","primary_location":{"id":"doi:10.3390/electronics15173792","doi":"https://doi.org/10.3390/electronics15173792","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics15173792","pdf_url":null,"source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/electronics15173792","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5063083883","display_name":"Mustafa Kara","orcid":"https://orcid.org/0000-0002-7093-0153","observed_orcids":["https://orcid.org/0000-0002-7093-0153"]},"institutions":[{"id":"https://openalex.org/I4210098942","display_name":"Milli Savunma \u00dcniversitesi","ror":"https://ror.org/010t24d82","country_code":"TR","type":"education","lineage":["https://openalex.org/I4210098942"]},{"id":"https://openalex.org/I99312532","display_name":"Turkish Air Force Academy","ror":"https://ror.org/01psaa030","country_code":"TR","type":"education","lineage":["https://openalex.org/I99312532"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Mustafa Kara","raw_affiliation_strings":["Department of Computer Engineering, Turkish Air Force Academy, National Defence University, Istanbul 34149, T\u00fcrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Turkish Air Force Academy, National Defence University, Istanbul 34149, T\u00fcrkiye","institution_ids":["https://openalex.org/I4210098942","https://openalex.org/I99312532"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147987223","display_name":"Hasan Burus","orcid":"https://orcid.org/0009-0003-5842-0681","observed_orcids":["https://orcid.org/0009-0003-5842-0681"]},"institutions":[{"id":"https://openalex.org/I4210098942","display_name":"Milli Savunma \u00dcniversitesi","ror":"https://ror.org/010t24d82","country_code":"TR","type":"education","lineage":["https://openalex.org/I4210098942"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Hasan Burus","raw_affiliation_strings":["Department of Computer Engineering, Atat\u00fcrk Strategic Studies and Graduate Institute, National Defence University, Istanbul 34334, T\u00fcrkiye"],"raw_orcid":"https://orcid.org/0009-0003-5842-0681","affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Atat\u00fcrk Strategic Studies and Graduate Institute, National Defence University, Istanbul 34334, T\u00fcrkiye","institution_ids":["https://openalex.org/I4210098942"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042132655","display_name":"Hasan H\u00fcseyin Bal\u0131k","orcid":"https://orcid.org/0000-0003-3022-100X","observed_orcids":["https://orcid.org/0000-0003-3022-100X"]},"institutions":[{"id":"https://openalex.org/I4387153143","display_name":"Atlas \u00dcniversitesi","ror":"https://ror.org/02jqzm779","country_code":"TR","type":"education","lineage":["https://openalex.org/I4387153143"]}],"countries":["TR"],"is_corresponding":true,"raw_author_name":"Hasan H\u00fcseyin Bal\u0131k","raw_affiliation_strings":["Department of Engineering and Natural Sciences, Istanbul Atlas University, Istanbul 34408, T\u00fcrkiye"],"raw_orcid":"https://orcid.org/0000-0003-3022-100X","affiliations":[{"raw_affiliation_string":"Department of Engineering and Natural Sciences, Istanbul Atlas University, Istanbul 34408, T\u00fcrkiye","institution_ids":["https://openalex.org/I4387153143"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5042132655"],"corresponding_institution_ids":["https://openalex.org/I4387153143"],"apc_list":{"value":2400,"currency":"CHF","value_usd":2896},"apc_paid":{"value":2400,"currency":"CHF","value_usd":2896},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"15","issue":"17","first_page":"3792","last_page":"3792"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.0010999999940395355,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cyber-threat-intelligence","display_name":"cyber threat intelligence","score":0.9589999914169312},{"id":"https://openalex.org/keywords/email-gateway","display_name":"email gateway","score":0.8379999995231628},{"id":"https://openalex.org/keywords/phishing-detection","display_name":"phishing detection","score":0.9919999837875366},{"id":"https://openalex.org/keywords/ransomware-detection","display_name":"ransomware detection","score":0.9950000047683716},{"id":"https://openalex.org/keywords/decision-threshold","display_name":"decision threshold","score":0.6880000233650208},{"id":"https://openalex.org/keywords/email-security","display_name":"email security","score":0.6430000066757202},{"id":"https://openalex.org/keywords/false-positive-reduction","display_name":"false positive reduction","score":0.6620000004768372}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.8720999956130981},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.8277000188827515},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7039999961853027},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.586899995803833},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.5532000064849854},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.4023999869823456},{"id":"https://openalex.org/C2777710495","wikidata":"https://www.wikidata.org/wiki/Q5527195","display_name":"Gateway (web page)","level":2,"score":0.38999998569488525},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3603000044822693},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.30660000443458557},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2842000126838684},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.28369998931884766},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.2800000011920929},{"id":"https://openalex.org/C91262260","wikidata":"https://www.wikidata.org/wiki/Q528074","display_name":"End user","level":2,"score":0.27390000224113464},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2644999921321869},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.26190000772476196},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.25999999046325684},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.25870001316070557},{"id":"https://openalex.org/C22111027","wikidata":"https://www.wikidata.org/wiki/Q1070427","display_name":"Internet security","level":4,"score":0.25049999356269836},{"id":"https://openalex.org/C184297639","wikidata":"https://www.wikidata.org/wiki/Q177765","display_name":"Biometrics","level":2,"score":0.2502000033855438}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/electronics15173792","doi":"https://doi.org/10.3390/electronics15173792","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics15173792","pdf_url":null,"source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/electronics15173792","doi":"https://doi.org/10.3390/electronics15173792","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics15173792","pdf_url":null,"source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W2732916693","https://openalex.org/W2760313715","https://openalex.org/W2890718808","https://openalex.org/W2964522977","https://openalex.org/W3009492331","https://openalex.org/W3022088706","https://openalex.org/W3184796286","https://openalex.org/W4328098510","https://openalex.org/W4380633986","https://openalex.org/W4381137026","https://openalex.org/W4383065673","https://openalex.org/W4385336663","https://openalex.org/W4386387815","https://openalex.org/W4388535678","https://openalex.org/W4390933099","https://openalex.org/W4391333914","https://openalex.org/W4392667162","https://openalex.org/W4393169106","https://openalex.org/W4396760408","https://openalex.org/W4402901778","https://openalex.org/W4408288399","https://openalex.org/W4410918024","https://openalex.org/W4411847755","https://openalex.org/W4412193049","https://openalex.org/W4413355124","https://openalex.org/W4413862555","https://openalex.org/W4416399136","https://openalex.org/W7083579051"],"related_works":["https://openalex.org/W7164397217","https://openalex.org/W7221039694","https://openalex.org/W7217859589","https://openalex.org/W7023854255","https://openalex.org/W7154319690","https://openalex.org/W7131382222","https://openalex.org/W7161794681","https://openalex.org/W6968619852","https://openalex.org/W4412698023","https://openalex.org/W3026297283"],"abstract_inverted_index":{"Email":[0],"remains":[1],"a":[2,98,127],"major":[3],"Initial":[4,215],"Access":[5,216],"vector":[6],"for":[7,175],"phishing":[8,160],"and":[9,40,52,74,80,95,117,156,181,188,226],"ransomware":[10,154,182],"attacks,":[11],"requiring":[12],"security":[13,134],"mechanisms":[14],"that":[15,104],"can":[16],"combine":[17],"multiple":[18],"sources":[19],"of":[20,65,77,82,170,222],"threat":[21,112],"evidence":[22],"before":[23],"malicious":[24],"content":[25],"reaches":[26],"end":[27],"users.":[28],"Modern":[29],"commercial":[30,128,177],"email":[31,38,101],"gateways":[32],"already":[33],"incorporate":[34],"antivirus,":[35],"reputation-based":[36],"filtering,":[37],"authentication,":[39],"vendor-provided":[41],"threat-intelligence":[42],"mechanisms.":[43],"However,":[44],"their":[45],"correlation":[46,85,228],"logic,":[47],"scoring":[48],"criteria,":[49],"decision":[50,115],"thresholds,":[51,116],"automated":[53,118],"response":[54,119],"workflows":[55],"are":[56],"often":[57],"proprietary":[58],"or":[59],"insufficiently":[60],"documented.":[61],"Moreover,":[62],"transparent":[63,99],"evaluations":[64],"the":[66,131,176,192,202,205,209,214,219,230],"incremental":[67],"benefit":[68,221],"provided":[69],"by":[70],"external":[71,106,223],"CTI":[72,224],"enrichment":[73,225],"unified":[75,227],"Indicator":[76,81],"Compromise":[78],"(IoC)":[79],"Attack":[83],"(IoA)":[84],"remain":[86],"limited.":[87],"To":[88],"address":[89],"this":[90,92],"gap,":[91],"study":[93],"presents":[94],"experimentally":[96],"evaluates":[97],"CTI-supported":[100,163,206],"gateway":[102],"workflow":[103],"integrates":[105],"intelligence":[107],"feeds,":[108],"IoC/IoA":[109],"correlation,":[110],"contextual":[111],"scoring,":[113],"predefined":[114],"actions.":[120],"The":[121,142,162],"proposed":[122],"configuration":[123,164],"was":[124],"compared":[125,172],"with":[126,173],"baseline":[129],"using":[130],"same":[132],"vendor-native":[133],"controls":[135],"in":[136],"an":[137,166],"isolated":[138],"VMware":[139],"ESXi-based":[140],"environment.":[141],"evaluation":[143],"included":[144],"1000":[145],"emails":[146,152,158],"comprising":[147],"500":[148],"benign":[149],"emails,":[150],"200":[151],"containing":[153,159],"attachments,":[155],"300":[157],"URLs.":[161],"achieved":[165],"overall":[167],"detection":[168,184],"rate":[169,195],"98.8%,":[171],"64.2%":[174],"baseline.":[178],"Phishing":[179],"URL":[180],"attachment":[183],"rates":[185],"reached":[186],"99.3%":[187],"98.0%,":[189],"respectively,":[190],"while":[191],"false":[193],"positive":[194],"decreased":[196],"from":[197],"4.5%":[198],"to":[199],"1.2%.":[200],"In":[201],"evaluated":[203],"scenarios,":[204],"architecture":[207],"interrupted":[208],"modeled":[210],"attack":[211],"chain":[212],"at":[213],"stage,":[217],"demonstrating":[218],"measurable":[220],"beyond":[229],"gateway\u2019s":[231],"native":[232],"controls.":[233]},"counts_by_year":[],"updated_date":"2026-11-06T12:05:46.655746","created_date":"2026-08-25T00:00:00"}