{"id":"https://openalex.org/W7225177751","doi":"https://doi.org/10.3390/engproc2026158013","title":"A Behavioral Detection and Monitoring Framework for Ransomware Using Splunk SIEM and MITRE ATT&CK: The Hive Case Study","display_name":"A Behavioral Detection and Monitoring Framework for Ransomware Using Splunk SIEM and MITRE ATT&CK: The Hive Case Study","publication_year":2026,"publication_date":"2026-11-02","ids":{"openalex":"https://openalex.org/W7225177751","doi":"https://doi.org/10.3390/engproc2026158013"},"language":"en","primary_location":{"id":"doi:10.3390/engproc2026158013","doi":"https://doi.org/10.3390/engproc2026158013","is_oa":true,"landing_page_url":"https://doi.org/10.3390/engproc2026158013","pdf_url":null,"source":{"id":"https://openalex.org/S7407114148","display_name":"Jornadas de Ingenier\u00eda El\u00e9ctrica y Electr\u00f3nica (JIEE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"JIEE 2026","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.3390/engproc2026158013","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114372668","display_name":"Jefferson Ac\u00e1n","orcid":"https://orcid.org/0009-0008-8375-687X","observed_orcids":["https://orcid.org/0009-0008-8375-687X"]},"institutions":[{"id":"https://openalex.org/I70764802","display_name":"National Polytechnic School","ror":"https://ror.org/01gb99w41","country_code":"EC","type":"education","lineage":["https://openalex.org/I70764802"]}],"countries":["EC"],"is_corresponding":true,"raw_author_name":"Jefferson Ac\u00e1n","raw_affiliation_strings":["Departamento de Electr\u00f3nica, Telecomunicaciones y Redes de Informaci\u00f3n (DETRI), Escuela Polit\u00e9cnica Nacional, Quito 170525, Ecuador"],"raw_orcid":"https://orcid.org/0009-0008-8375-687X","affiliations":[{"raw_affiliation_string":"Departamento de Electr\u00f3nica, Telecomunicaciones y Redes de Informaci\u00f3n (DETRI), Escuela Polit\u00e9cnica Nacional, Quito 170525, Ecuador","institution_ids":["https://openalex.org/I70764802"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075213159","display_name":"Soraya Sinche","orcid":"https://orcid.org/0000-0001-5308-2255","observed_orcids":["https://orcid.org/0000-0001-5308-2255"]},"institutions":[{"id":"https://openalex.org/I70764802","display_name":"National Polytechnic School","ror":"https://ror.org/01gb99w41","country_code":"EC","type":"education","lineage":["https://openalex.org/I70764802"]}],"countries":["EC"],"is_corresponding":false,"raw_author_name":"Soraya Sinche","raw_affiliation_strings":["Departamento de Electr\u00f3nica, Telecomunicaciones y Redes de Informaci\u00f3n (DETRI), Escuela Polit\u00e9cnica Nacional, Quito 170525, Ecuador"],"raw_orcid":"https://orcid.org/0000-0001-5308-2255","affiliations":[{"raw_affiliation_string":"Departamento de Electr\u00f3nica, Telecomunicaciones y Redes de Informaci\u00f3n (DETRI), Escuela Polit\u00e9cnica Nacional, Quito 170525, Ecuador","institution_ids":["https://openalex.org/I70764802"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5034413683","display_name":"Pablo Hidalgo Lascano","orcid":"https://orcid.org/0000-0002-0994-3342","observed_orcids":["https://orcid.org/0000-0002-0994-3342"]},"institutions":[{"id":"https://openalex.org/I70764802","display_name":"National Polytechnic School","ror":"https://ror.org/01gb99w41","country_code":"EC","type":"education","lineage":["https://openalex.org/I70764802"]}],"countries":["EC"],"is_corresponding":false,"raw_author_name":"Pablo Hidalgo","raw_affiliation_strings":["Departamento de Electr\u00f3nica, Telecomunicaciones y Redes de Informaci\u00f3n (DETRI), Escuela Polit\u00e9cnica Nacional, Quito 170525, Ecuador"],"raw_orcid":"https://orcid.org/0000-0002-0994-3342","affiliations":[{"raw_affiliation_string":"Departamento de Electr\u00f3nica, Telecomunicaciones y Redes de Informaci\u00f3n (DETRI), Escuela Polit\u00e9cnica Nacional, Quito 170525, Ecuador","institution_ids":["https://openalex.org/I70764802"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5114372668"],"corresponding_institution_ids":["https://openalex.org/I70764802"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"13","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6327999830245972,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6327999830245972,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3379000127315521,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.018799999728798866,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware-detection","display_name":"ransomware detection","score":0.9850000143051147},{"id":"https://openalex.org/keywords/mitre-att-ck","display_name":"MITRE ATT&CK","score":0.9980000257492065},{"id":"https://openalex.org/keywords/behavioral-detection","display_name":"behavioral detection","score":0.6869999766349792},{"id":"https://openalex.org/keywords/security-event-monitoring","display_name":"security event monitoring","score":0.6940000057220459},{"id":"https://openalex.org/keywords/defense-evasion","display_name":"defense evasion","score":0.6970000267028809},{"id":"https://openalex.org/keywords/cyber-resilience","display_name":"cyber resilience","score":0.4410000145435333},{"id":"https://openalex.org/keywords/real-time-dashboard","display_name":"real-time dashboard","score":0.6949999928474426}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7595999836921692},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.5738999843597412},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.5196999907493591},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5141000151634216},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4690000116825104},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.4627000093460083},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.4293999969959259},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.41440001130104065},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3711000084877014},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.34279999136924744},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.3398999869823456},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.3312000036239624},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.32429999113082886},{"id":"https://openalex.org/C2780505938","wikidata":"https://www.wikidata.org/wiki/Q17093282","display_name":"Unavailability","level":2,"score":0.2971999943256378},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.2948000133037567},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.29170000553131104},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.28290000557899475},{"id":"https://openalex.org/C172367668","wikidata":"https://www.wikidata.org/wiki/Q6504956","display_name":"Data visualization","level":3,"score":0.27709999680519104},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.2768999934196472},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.27469998598098755},{"id":"https://openalex.org/C8797682","wikidata":"https://www.wikidata.org/wiki/Q2115","display_name":"XML","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.260699987411499},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.25929999351501465},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.25850000977516174},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.25619998574256897},{"id":"https://openalex.org/C14669888","wikidata":"https://www.wikidata.org/wiki/Q4014850","display_name":"Creative visualization","level":3,"score":0.2551000118255615},{"id":"https://openalex.org/C170858558","wikidata":"https://www.wikidata.org/wiki/Q1394144","display_name":"Automatic summarization","level":2,"score":0.2551000118255615}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/engproc2026158013","doi":"https://doi.org/10.3390/engproc2026158013","is_oa":true,"landing_page_url":"https://doi.org/10.3390/engproc2026158013","pdf_url":null,"source":{"id":"https://openalex.org/S7407114148","display_name":"Jornadas de Ingenier\u00eda El\u00e9ctrica y Electr\u00f3nica (JIEE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"JIEE 2026","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.3390/engproc2026158013","doi":"https://doi.org/10.3390/engproc2026158013","is_oa":true,"landing_page_url":"https://doi.org/10.3390/engproc2026158013","pdf_url":null,"source":{"id":"https://openalex.org/S7407114148","display_name":"Jornadas de Ingenier\u00eda El\u00e9ctrica y Electr\u00f3nica (JIEE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"JIEE 2026","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":1,"referenced_works":["https://openalex.org/W2784113120"],"related_works":["https://openalex.org/W7213951792","https://openalex.org/W7018898574","https://openalex.org/W4404731208","https://openalex.org/W7128398813","https://openalex.org/W7135400645","https://openalex.org/W7165654035","https://openalex.org/W7212122665","https://openalex.org/W7198786292","https://openalex.org/W4405088842","https://openalex.org/W3129101061"],"abstract_inverted_index":{"The":[0,74],"persistent":[1],"escalation":[2],"of":[3,15,36,79,100,106,119,147],"ransomware-related":[4],"incidents":[5],"constitutes":[6],"a":[7,24,60,70],"critical":[8],"existential":[9],"threat":[10],"to":[11],"the":[12,29,42,53,57,65,77,101,104,148,157,161],"security":[13,38],"infrastructure":[14],"contemporary":[16],"digital":[17],"organizations.":[18],"This":[19],"study":[20],"proposes":[21],"and":[22,33,47,82,125,139],"validates":[23],"comprehensive":[25],"analytical":[26],"model":[27],"for":[28,63,116],"proactive":[30],"detection,":[31],"visualization,":[32],"taxonomic":[34],"categorization":[35],"adversarial":[37],"events.":[39],"By":[40],"integrating":[41],"Splunk":[43],"Enterprise":[44],"Security":[45],"Information":[46],"Event":[48],"Management":[49],"(SIEM)":[50],"platform":[51],"with":[52],"MITRE":[54],"ATT&CK":[55],"framework,":[56],"research":[58],"establishes":[59],"robust":[61],"methodology":[62],"monitoring":[64],"Hive":[66],"ransomware":[67],"variant":[68],"as":[69],"primary":[71],"case":[72],"study.":[73],"process":[75],"encompasses":[76],"ingestion":[78],"heterogeneous":[80],"telemetry":[81,150],"historical":[83],"forensic":[84],"records,":[85],"which":[86],"are":[87],"then":[88],"normalized":[89],"through":[90],"structured":[91],"Search":[92],"Processing":[93],"Language":[94],"(SPL)":[95],"algorithms.":[96],"A":[97],"central":[98],"component":[99],"framework":[102],"is":[103],"deployment":[105],"dynamic":[107],"dashboards":[108],"based":[109],"on":[110,135],"Splunk\u2019s":[111],"Simple":[112],"XML":[113],"schema,":[114],"allowing":[115],"real-time":[117],"visualization":[118],"Command-and-Control":[120],"spikes,":[121],"resource":[122],"consumption":[123],"anomalies,":[124],"unauthorized":[126],"administrative":[127],"activities.":[128],"Findings":[129],"demonstrate":[130],"that":[131,152],"focusing":[132],"detection":[133,158],"efforts":[134],"\u201cDefense":[136],"Evasion\u201d":[137],"(T1562)":[138],"\u201cImpact\u201d":[140],"(T1490)":[141],"significantly":[142,155],"enhances":[143],"cyber-resilience.":[144],"Quantitative":[145],"analysis":[146],"generated":[149],"confirms":[151],"behavioral":[153],"mapping":[154],"reduces":[156],"window":[159],"during":[160],"pre-encryption":[162],"phase.":[163]},"counts_by_year":[],"updated_date":"2026-11-05T12:25:35.769452","created_date":"2026-11-04T00:00:00"}