{"id":"https://openalex.org/W7204229730","doi":"https://doi.org/10.52306/2578-3289.1233","title":"Technique-Level Normalization for Cybersecurity Intelligence: An Empirical Evaluation of ATT&CK Attribution from HIDS Alerts Using Fine-Tuned Transformers and Metadata Re-Ranking","display_name":"Technique-Level Normalization for Cybersecurity Intelligence: An Empirical Evaluation of ATT&CK Attribution from HIDS Alerts Using Fine-Tuned Transformers and Metadata Re-Ranking","publication_year":2026,"publication_date":"2026-08-01","ids":{"openalex":"https://openalex.org/W7204229730","doi":"https://doi.org/10.52306/2578-3289.1233"},"language":"en","primary_location":{"id":"doi:10.52306/2578-3289.1233","doi":"https://doi.org/10.52306/2578-3289.1233","is_oa":true,"landing_page_url":"https://doi.org/10.52306/2578-3289.1233","pdf_url":"https://vc.bridgew.edu/cgi/viewcontent.cgi?article=1233&context=ijcic","source":{"id":"https://openalex.org/S4210205197","display_name":"International Journal of Cybersecurity Intelligence and Cybercrime","issn_l":"2578-3289","issn":["2578-3289","2578-3297"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core"],"host_organization":"https://openalex.org/P4310315793","host_organization_name":"Bridgewater State University","host_organization_lineage":["https://openalex.org/P4310315793"],"host_organization_lineage_names":["Bridgewater State University"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Cybersecurity Intelligence & Cybercrime","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://vc.bridgew.edu/cgi/viewcontent.cgi?article=1233&context=ijcic","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076471652","display_name":"Emad Sherif","orcid":"https://orcid.org/0000-0002-8450-338X","observed_orcids":["https://orcid.org/0000-0002-8450-338X"]},"institutions":[{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Emad Sherif","raw_affiliation_strings":["De Montfort University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"De Montfort University","institution_ids":["https://openalex.org/I66943878"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5076471652"],"corresponding_institution_ids":["https://openalex.org/I66943878"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.62567066,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"2","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9458000063896179,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9458000063896179,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.017000000923871994,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.009800000116229057,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/mitre-att-ck","display_name":"MITRE ATT&CK","score":0.8709999918937683},{"id":"https://openalex.org/keywords/domain-adaptation","display_name":"domain adaptation","score":0.6959999799728394},{"id":"https://openalex.org/keywords/fine-tuned-transformers","display_name":"fine-tuned transformers","score":0.9309999942779541},{"id":"https://openalex.org/keywords/cybercrime-investigation","display_name":"cybercrime investigation","score":0.7009999752044678},{"id":"https://openalex.org/keywords/small-and-medium-sized-enterprises","display_name":"small and medium-sized enterprises","score":0.7839999794960022}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7792999744415283},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.5895000100135803},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5741999745368958},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5551999807357788},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5436999797821045},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5356000065803528},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.4887000024318695},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.4537999927997589},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.40630000829696655},{"id":"https://openalex.org/C2779623668","wikidata":"https://www.wikidata.org/wiki/Q7652842","display_name":"SwIPe","level":2,"score":0.4002000093460083},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.3921999931335449},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3912000060081482},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3822999894618988},{"id":"https://openalex.org/C2779628075","wikidata":"https://www.wikidata.org/wiki/Q1253258","display_name":"Downgrade","level":2,"score":0.37779998779296875},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.36559998989105225},{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.34599998593330383},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.3456999957561493},{"id":"https://openalex.org/C55166926","wikidata":"https://www.wikidata.org/wiki/Q2892946","display_name":"Oracle","level":2,"score":0.329800009727478},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.32659998536109924},{"id":"https://openalex.org/C136886441","wikidata":"https://www.wikidata.org/wiki/Q926129","display_name":"Normalization (sociology)","level":2,"score":0.31470000743865967},{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.30480000376701355},{"id":"https://openalex.org/C2781357168","wikidata":"https://www.wikidata.org/wiki/Q5276084","display_name":"Digital evidence","level":3,"score":0.30079999566078186},{"id":"https://openalex.org/C2780814629","wikidata":"https://www.wikidata.org/wiki/Q327353","display_name":"System administrator","level":2,"score":0.29919999837875366},{"id":"https://openalex.org/C170858558","wikidata":"https://www.wikidata.org/wiki/Q1394144","display_name":"Automatic summarization","level":2,"score":0.29580000042915344},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.29330000281333923},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.2888999879360199},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.2782000005245209},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.2727999985218048},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.26330000162124634},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.26269999146461487},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.2605000138282776},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.25940001010894775},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2590999901294708},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.2590000033378601},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.25780001282691956},{"id":"https://openalex.org/C2988987868","wikidata":"https://www.wikidata.org/wiki/Q32635","display_name":"Domain name","level":3,"score":0.2549999952316284},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.25060001015663147}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.52306/2578-3289.1233","doi":"https://doi.org/10.52306/2578-3289.1233","is_oa":true,"landing_page_url":"https://doi.org/10.52306/2578-3289.1233","pdf_url":"https://vc.bridgew.edu/cgi/viewcontent.cgi?article=1233&context=ijcic","source":{"id":"https://openalex.org/S4210205197","display_name":"International Journal of Cybersecurity Intelligence and Cybercrime","issn_l":"2578-3289","issn":["2578-3289","2578-3297"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core"],"host_organization":"https://openalex.org/P4310315793","host_organization_name":"Bridgewater State University","host_organization_lineage":["https://openalex.org/P4310315793"],"host_organization_lineage_names":["Bridgewater State University"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Cybersecurity Intelligence & Cybercrime","raw_type":"journal-article"},{"id":"pmh:oai:vc.bridgew.edu:ijcic-1233","doi":null,"is_oa":false,"landing_page_url":"https://vc.bridgew.edu/ijcic/vol9/iss2/5","pdf_url":null,"source":{"id":"https://openalex.org/S2764422806","display_name":"Journal of international women's studies","issn_l":"1539-8706","issn":["1539-8706"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","jufo-1","norway-1","poland-40","russia-white-list-4","vabb-shw"],"host_organization":"https://openalex.org/P4310315793","host_organization_name":"Bridgewater State University","host_organization_lineage":["https://openalex.org/P4310315793"],"host_organization_lineage_names":["Bridgewater State University"],"type":"journal"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"International Journal of Cybersecurity Intelligence & Cybercrime","raw_type":"text"},{"id":"pmh:oai:dora.dmu.ac.uk:2086/26394","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/2086/26394","pdf_url":null,"source":{"id":"https://openalex.org/S4306400394","display_name":"DMU Open Research Archive (De Montfort University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I66943878","host_organization_name":"De Montfort University","host_organization_lineage":["https://openalex.org/I66943878"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"}],"best_oa_location":{"id":"doi:10.52306/2578-3289.1233","doi":"https://doi.org/10.52306/2578-3289.1233","is_oa":true,"landing_page_url":"https://doi.org/10.52306/2578-3289.1233","pdf_url":"https://vc.bridgew.edu/cgi/viewcontent.cgi?article=1233&context=ijcic","source":{"id":"https://openalex.org/S4210205197","display_name":"International Journal of Cybersecurity Intelligence and Cybercrime","issn_l":"2578-3289","issn":["2578-3289","2578-3297"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core"],"host_organization":"https://openalex.org/P4310315793","host_organization_name":"Bridgewater State University","host_organization_lineage":["https://openalex.org/P4310315793"],"host_organization_lineage_names":["Bridgewater State University"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Cybersecurity Intelligence & Cybercrime","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204229730.pdf","grobid_xml":"https://content.openalex.org/works/W7204229730.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7131110511","https://openalex.org/W4211223944","https://openalex.org/W7202148739","https://openalex.org/W4415223176","https://openalex.org/W7154016164","https://openalex.org/W4318148355","https://openalex.org/W7213921794","https://openalex.org/W7165958420","https://openalex.org/W7165567802","https://openalex.org/W4416226700"],"abstract_inverted_index":{"Cybercrime":[0],"investigations":[1],"increasingly":[2],"depend":[3],"on":[4],"the":[5,30,75,145,159],"ability":[6],"to":[7,60,68,137,152],"interpret":[8],"large":[9],"volumes":[10],"of":[11,33,156,179,185],"automated":[12,56],"security":[13,19,66],"events.":[14],"For":[15],"organizations":[16],"without":[17],"dedicated":[18],"operations":[20],"centres,":[21],"a":[22,41,92,96,101,105,112,139,176,182,193,202,220],"situation":[23],"common":[24],"among":[25],"small":[26],"and":[27,48,83,100,126,175,207,217],"medium":[28],"enterprises,":[29],"manual":[31],"translation":[32],"raw":[34],"alerts":[35,110,121],"into":[36],"structured":[37],"threat":[38],"intelligence":[39],"represents":[40],"critical":[42],"bottleneck":[43,63],"that":[44],"slows":[45],"investigative":[46],"triage":[47],"limits":[49],"cross-case":[50],"comparability.":[51],"This":[52],"paper":[53],"evaluates":[54],"an":[55,131],"enrichment":[57],"pipeline":[58,90],"designed":[59],"address":[61],"this":[62],"by":[64],"mapping":[65],"events":[67,129],"standardised":[69],"adversary":[70,124],"behaviour":[71],"labels":[72],"drawn":[73],"from":[74,111,130],"MITRE":[76],"ATT&CK":[77],"framework,":[78],"supporting":[79],"both":[80],"operational":[81,142],"response":[82],"cybercrime":[84],"investigation":[85],"workflows.":[86],"We":[87],"compare":[88],"three":[89],"configurations,":[91],"general-purpose":[93,146],"encoder":[94],"model,":[95],"cybersecurity":[97],"domain-adapted":[98],"variant,":[99],"hybrid":[102,168],"system":[103,169],"incorporating":[104],"metadata-aware":[106],"re-ranker,":[107],"across":[108,225],"1,566":[109],"controlled":[113],"nine-stage":[114],"adversarial":[115],"experiment":[116],"with":[117,213],"471":[118],"ground-truth":[119],"labelled":[120],"spanning":[122],"12":[123],"techniques,":[125],"8,465":[127],"Windows":[128],"external":[132],"dataset.":[133],"Domain":[134],"adaptation":[135],"proves":[136],"be":[138],"prerequisite":[140],"for":[141,164],"viability":[143],"where":[144],"model":[147,161],"assigns":[148],"meaningful":[149],"similarity":[150],"scores":[151],"fewer":[153],"than":[154],"1%":[155],"alerts,":[157],"while":[158],"fine-tuned":[160],"does":[162],"so":[163],"all":[165,226],"1,566.":[166],"The":[167,198],"achieves":[170],"88.54%":[171],"micro":[172],"Top-1":[173],"accuracy":[174],"class-balanced":[177],"macro-F1":[178],"0.244":[180],"against":[181],"majority-class":[183],"predictor":[184],"0.182,":[186],"confirming":[187],"genuine":[188],"multi-class":[189],"benefit":[190],"beyond":[191],"what":[192],"trivial":[194],"always-predict":[195],"strategy":[196],"provides.":[197],"metadata":[199],"re-ranker":[200],"resolves":[201],"specific":[203],"ambiguity":[204],"between":[205],"valid-accounts":[206],"account-removal":[208],"predictions,":[209],"correcting":[210],"400":[211],"misattributions":[212],"zero":[214],"adverse":[215],"effects":[216],"98.3%":[218],"precision,":[219],"statistically":[221],"significant":[222],"improvement":[223],"stable":[224],"tested":[227],"parameter":[228],"settings.":[229]},"counts_by_year":[],"updated_date":"2026-09-11T09:22:31.653822","created_date":"2026-08-27T00:00:00"}