{"id":"https://openalex.org/W2990220343","doi":"https://doi.org/10.1007/s11416-019-00342-x","title":"PenQuest: a gamified attacker/defender meta model for cyber security assessment and education","display_name":"PenQuest: a gamified attacker/defender meta model for cyber security assessment and education","publication_year":2019,"publication_date":"2019-11-22","ids":{"openalex":"https://openalex.org/W2990220343","doi":"https://doi.org/10.1007/s11416-019-00342-x","mag":"2990220343"},"language":"en","primary_location":{"id":"doi:10.1007/s11416-019-00342-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-019-00342-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00342-x.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00342-x.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086413609","display_name":"Robert Luh","orcid":"https://orcid.org/0000-0001-6536-6706"},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]},{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["AT","GB"],"is_corresponding":true,"raw_author_name":"Robert Luh","raw_affiliation_strings":["De Montfort University, Leicester, UK","Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":"https://orcid.org/0000-0001-6536-6706","affiliations":[{"raw_affiliation_string":"De Montfort University, Leicester, UK","institution_ids":["https://openalex.org/I66943878"]},{"raw_affiliation_string":"Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]},{"raw_affiliation_string":"Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000560474","display_name":"Marlies Temper","orcid":null},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Marlies Temper","raw_affiliation_strings":["Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006191355","display_name":"Simon Tjoa","orcid":"https://orcid.org/0000-0003-2280-9604"},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Simon Tjoa","raw_affiliation_strings":["Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]},{"raw_affiliation_string":"Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5055367812","display_name":"Sebastian Schrittwieser","orcid":"https://orcid.org/0000-0003-2115-2022"},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Sebastian Schrittwieser","raw_affiliation_strings":["Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of IT Security Research, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]},{"raw_affiliation_string":"Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5035745103","display_name":"Helge Janicke","orcid":"https://orcid.org/0000-0002-1345-2829"},"institutions":[{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Helge Janicke","raw_affiliation_strings":["De Montfort University, Leicester, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"De Montfort University, Leicester, UK","institution_ids":["https://openalex.org/I66943878"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5086413609"],"corresponding_institution_ids":["https://openalex.org/I25485817","https://openalex.org/I66943878"],"apc_list":{"value":2990,"currency":"USD","value_usd":2990},"apc_paid":{"value":2990,"currency":"USD","value_usd":2990},"fwci":5.3769,"has_fulltext":true,"cited_by_count":42,"citation_normalized_percentile":{"value":0.9607077,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"16","issue":"1","first_page":"19","last_page":"61"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.991100013256073,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7972241640090942},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7617948651313782},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5498794913291931},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.4762185513973236},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.4590100646018982},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.4520750045776367},{"id":"https://openalex.org/keywords/plan","display_name":"Plan (archaeology)","score":0.4478529095649719},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.32713741064071655}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7972241640090942},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7617948651313782},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5498794913291931},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.4762185513973236},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.4590100646018982},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.4520750045776367},{"id":"https://openalex.org/C2776505523","wikidata":"https://www.wikidata.org/wiki/Q4785468","display_name":"Plan (archaeology)","level":2,"score":0.4478529095649719},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.32713741064071655},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s11416-019-00342-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-019-00342-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00342-x.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s11416-019-00342-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-019-00342-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00342-x.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.550000011920929,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320311813","display_name":"\u00d6sterreichische Nationalstiftung f\u00fcr Forschung, Technologie und Entwicklung","ror":"https://ror.org/04hb33h70"},{"id":"https://openalex.org/F4320327593","display_name":"Bundesministerium f\u00fcr Digitalisierung und Wirtschaftsstandort","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2990220343.pdf","grobid_xml":"https://content.openalex.org/works/W2990220343.grobid-xml"},"referenced_works_count":52,"referenced_works":["https://openalex.org/W32063464","https://openalex.org/W61758119","https://openalex.org/W77083600","https://openalex.org/W98925779","https://openalex.org/W125969323","https://openalex.org/W1480913758","https://openalex.org/W1521415124","https://openalex.org/W1561009489","https://openalex.org/W1920444580","https://openalex.org/W1964439345","https://openalex.org/W2026736862","https://openalex.org/W2030684361","https://openalex.org/W2037621702","https://openalex.org/W2049973206","https://openalex.org/W2050764671","https://openalex.org/W2062830664","https://openalex.org/W2105013775","https://openalex.org/W2106242065","https://openalex.org/W2107726111","https://openalex.org/W2110006972","https://openalex.org/W2110667918","https://openalex.org/W2148922260","https://openalex.org/W2159675211","https://openalex.org/W2162040794","https://openalex.org/W2187022131","https://openalex.org/W2241864412","https://openalex.org/W2323000864","https://openalex.org/W2346127545","https://openalex.org/W2369295637","https://openalex.org/W2393441467","https://openalex.org/W2462449478","https://openalex.org/W2475568089","https://openalex.org/W2487152776","https://openalex.org/W2513318834","https://openalex.org/W2535186492","https://openalex.org/W2537905549","https://openalex.org/W2560532904","https://openalex.org/W2561675875","https://openalex.org/W2588184971","https://openalex.org/W2592042192","https://openalex.org/W2593732104","https://openalex.org/W2610833072","https://openalex.org/W2619779390","https://openalex.org/W2758108284","https://openalex.org/W2913459036","https://openalex.org/W2924245917","https://openalex.org/W3133897466","https://openalex.org/W3186276894","https://openalex.org/W3198888493","https://openalex.org/W4229891013","https://openalex.org/W4292542163","https://openalex.org/W4299569569"],"related_works":["https://openalex.org/W2324569364","https://openalex.org/W4239903230","https://openalex.org/W2383950765","https://openalex.org/W2126922396","https://openalex.org/W4231726099","https://openalex.org/W1591098212","https://openalex.org/W377587031","https://openalex.org/W2110889412","https://openalex.org/W3094701468","https://openalex.org/W896362041"],"abstract_inverted_index":{"Abstract":[0],"Attacks":[1],"on":[2,74],"IT":[3,184],"systems":[4],"are":[5,134],"a":[6,65,71,83,101,152,190,200],"rising":[7],"threat":[8],"against":[9],"the":[10,21,24,49,162,171,179,209],"confidentiality,":[11],"integrity,":[12],"and":[13,18,30,40,54,78,90,124,131,139,150,158,195],"availability":[14],"of":[15,27,51,100,111,155,164,181],"critical":[16],"information":[17,75,104,116,213],"infrastructures.":[19],"At":[20],"same":[22],"time,":[23],"complex":[25],"interplay":[26],"attack":[28,176],"techniques":[29],"possible":[31],"countermeasures":[32],"makes":[33],"it":[34,198],"difficult":[35],"to":[36,69,136,173,212],"appropriately":[37],"plan,":[38],"implement,":[39],"evaluate":[41,208],"an":[42,182],"organization\u2019s":[43],"defense.":[44],"More":[45],"often":[46],"than":[47],"not,":[48],"worlds":[50],"technical":[52,169],"threats":[53],"organizational":[55],"controls":[56,133],"remain":[57],"disjunct.":[58],"In":[59],"this":[60],"article,":[61],"we":[62],"introduce":[63],"PenQuest,":[64],"meta":[66],"model":[67,148],"designed":[68],"present":[70],"complete":[72],"view":[73],"system":[76],"attacks":[77],"their":[79],"mitigation":[80],"while":[81,167],"providing":[82],"tool":[84],"for":[85],"both":[86],"semantic":[87],"data":[88],"enrichment":[89],"security":[91,117,214],"education.":[92],"PenQuest":[93,188],"simulates":[94],"time-enabled":[95],"attacker/defender":[96],"behavior":[97],"as":[98,120,189],"part":[99],"dynamic,":[102],"imperfect":[103],"multi-player":[105],"game":[106,193],"that":[107],"derives":[108],"significant":[109],"parts":[110],"its":[112],"ruleset":[113],"from":[114],"established":[115],"sources":[118],"such":[119],"STIX,":[121],"CAPEC,":[122],"CVE/CWE":[123],"NIST":[125],"SP":[126],"800-53.":[127],"Attack":[128],"patterns,":[129],"vulnerabilities,":[130],"mitigating":[132],"mapped":[135],"counterpart":[137],"strategies":[138],"concrete":[140],"actions":[141],"through":[142],"practical,":[143],"data-centric":[144],"mechanisms.":[145],"The":[146],"gamified":[147],"considers":[149],"defines":[151],"wide":[153],"range":[154],"actors,":[156],"assets,":[157],"actions,":[159],"thereby":[160],"enabling":[161],"assessment":[163],"cyber":[165],"risks":[166],"giving":[168],"experts":[170],"opportunity":[172],"explore":[174],"specific":[175],"scenarios":[177],"in":[178,199],"context":[180],"abstracted":[183],"infrastructure.":[185],"We":[186],"implemented":[187],"physical":[191],"serious":[192],"prototype":[194],"successfully":[196],"tested":[197],"higher":[201],"education":[202],"environment.":[203],"Additional":[204],"expert":[205],"interviews":[206],"helped":[207],"model\u2019s":[210],"applicability":[211],"scenarios.":[215]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":2}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}