{"id":"https://openalex.org/W3190778120","doi":"https://doi.org/10.1109/access.2021.3104260","title":"Offensive Security: Towards Proactive Threat Hunting via Adversary Emulation","display_name":"Offensive Security: Towards Proactive Threat Hunting via Adversary Emulation","publication_year":2021,"publication_date":"2021-01-01","ids":{"openalex":"https://openalex.org/W3190778120","doi":"https://doi.org/10.1109/access.2021.3104260","mag":"3190778120"},"language":"en","primary_location":{"id":"doi:10.1109/access.2021.3104260","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3104260","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09511495.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09511495.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5049562643","display_name":"Abdul Basit Ajmal","orcid":"https://orcid.org/0000-0003-4418-4959"},"institutions":[{"id":"https://openalex.org/I16076960","display_name":"COMSATS University Islamabad","ror":"https://ror.org/00nqqvk19","country_code":"PK","type":"education","lineage":["https://openalex.org/I16076960"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Abdul Basit Ajmal","raw_affiliation_strings":["Department of Computer Science, COMSATS University Islamabad, Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0000-0003-4418-4959","affiliations":[{"raw_affiliation_string":"Department of Computer Science, COMSATS University Islamabad, Islamabad, Pakistan","institution_ids":["https://openalex.org/I16076960"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022535739","display_name":"Munam Ali Shah","orcid":"https://orcid.org/0000-0002-4037-3405"},"institutions":[{"id":"https://openalex.org/I16076960","display_name":"COMSATS University Islamabad","ror":"https://ror.org/00nqqvk19","country_code":"PK","type":"education","lineage":["https://openalex.org/I16076960"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Munam Ali Shah","raw_affiliation_strings":["Department of Computer Science, COMSATS University Islamabad, Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0000-0002-4037-3405","affiliations":[{"raw_affiliation_string":"Department of Computer Science, COMSATS University Islamabad, Islamabad, Pakistan","institution_ids":["https://openalex.org/I16076960"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080175512","display_name":"Carsten Maple","orcid":"https://orcid.org/0000-0002-4715-212X"},"institutions":[{"id":"https://openalex.org/I39555362","display_name":"University of Warwick","ror":"https://ror.org/01a77tt86","country_code":"GB","type":"education","lineage":["https://openalex.org/I39555362"]},{"id":"https://openalex.org/I4210128584","display_name":"The Alan Turing Institute","ror":"https://ror.org/035dkdb55","country_code":"GB","type":"facility","lineage":["https://openalex.org/I4210128584"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Carsten Maple","raw_affiliation_strings":["Secure Cyber Systems Research Group, WMG, University of Warwick, Coventry, U.K","The Alan Turing Institute, London, U.K"],"raw_orcid":"https://orcid.org/0000-0002-4715-212X","affiliations":[{"raw_affiliation_string":"Secure Cyber Systems Research Group, WMG, University of Warwick, Coventry, U.K","institution_ids":["https://openalex.org/I39555362"]},{"raw_affiliation_string":"The Alan Turing Institute, London, U.K","institution_ids":["https://openalex.org/I4210128584"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044452098","display_name":"Muhammad Nabeel Asghar","orcid":"https://orcid.org/0000-0002-9487-4344"},"institutions":[{"id":"https://openalex.org/I127670440","display_name":"Bahauddin Zakariya University","ror":"https://ror.org/05x817c41","country_code":"PK","type":"education","lineage":["https://openalex.org/I127670440"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Muhammad Nabeel Asghar","raw_affiliation_strings":["Department of Computer Science, Bahauddin Zakariya University, Multan, Pakistan"],"raw_orcid":"https://orcid.org/0000-0002-9487-4344","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Bahauddin Zakariya University, Multan, Pakistan","institution_ids":["https://openalex.org/I127670440"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5035335908","display_name":"Saif ul Islam","orcid":"https://orcid.org/0000-0002-9546-4195"},"institutions":[{"id":"https://openalex.org/I197827452","display_name":"Institute of Space Technology","ror":"https://ror.org/01tmmzv45","country_code":"PK","type":"education","lineage":["https://openalex.org/I197827452"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Saif Ul Islam","raw_affiliation_strings":["Department of Computer Science, Institute of Space Technology, Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0000-0002-9546-4195","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Institute of Space Technology, Islamabad, Pakistan","institution_ids":["https://openalex.org/I197827452"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":5.1697,"has_fulltext":true,"cited_by_count":56,"citation_normalized_percentile":{"value":0.96418137,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":"9","issue":null,"first_page":"126023","last_page":"126033"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/offensive","display_name":"Offensive","score":0.8381935358047485},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.8052020072937012},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7898644208908081},{"id":"https://openalex.org/keywords/emulation","display_name":"Emulation","score":0.7003580927848816},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6136194467544556},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.12082076072692871},{"id":"https://openalex.org/keywords/operations-research","display_name":"Operations research","score":0.09119465947151184}],"concepts":[{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.8381935358047485},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.8052020072937012},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7898644208908081},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.7003580927848816},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6136194467544556},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.12082076072692871},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.09119465947151184},{"id":"https://openalex.org/C50522688","wikidata":"https://www.wikidata.org/wiki/Q189833","display_name":"Economic growth","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2021.3104260","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3104260","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09511495.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:1c434404ac244b428805761c21d119a1","is_oa":true,"landing_page_url":"https://doaj.org/article/1c434404ac244b428805761c21d119a1","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 9, Pp 126023-126033 (2021)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2021.3104260","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3104260","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09511495.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.7599999904632568,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1309768829","display_name":null,"funder_award_id":"EP/N510129/1.","funder_id":"https://openalex.org/F4320313467","funder_display_name":"Alan Turing Institute"},{"id":"https://openalex.org/G1354703012","display_name":null,"funder_award_id":"EP/R007195/1","funder_id":"https://openalex.org/F4320320279","funder_display_name":"University of Warwick"},{"id":"https://openalex.org/G1633672591","display_name":null,"funder_award_id":"N510129","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G3855435662","display_name":null,"funder_award_id":"N510129","funder_id":"https://openalex.org/F4320313467","funder_display_name":"Alan Turing Institute"},{"id":"https://openalex.org/G444630160","display_name":null,"funder_award_id":"EP/N510129/","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G4500485203","display_name":"The Alan Turing Institute","funder_award_id":"EP/N510129/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G7788615685","display_name":null,"funder_award_id":"TDF-206","funder_id":"https://openalex.org/F4320322799","funder_display_name":"Higher Education Commission, Pakistan"}],"funders":[{"id":"https://openalex.org/F4320313467","display_name":"Alan Turing Institute","ror":"https://ror.org/035dkdb55"},{"id":"https://openalex.org/F4320320279","display_name":"University of Warwick","ror":"https://ror.org/01a77tt86"},{"id":"https://openalex.org/F4320322799","display_name":"Higher Education Commission, Pakistan","ror":"https://ror.org/038y3sz68"},{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3190778120.pdf","grobid_xml":"https://content.openalex.org/works/W3190778120.grobid-xml"},"referenced_works_count":31,"referenced_works":["https://openalex.org/W2022724444","https://openalex.org/W2149612134","https://openalex.org/W2342922302","https://openalex.org/W2421957586","https://openalex.org/W2529831505","https://openalex.org/W2894598513","https://openalex.org/W2901447795","https://openalex.org/W2902330413","https://openalex.org/W2905542721","https://openalex.org/W2921968294","https://openalex.org/W2946581864","https://openalex.org/W2949433879","https://openalex.org/W2952002252","https://openalex.org/W2957781801","https://openalex.org/W2958282219","https://openalex.org/W2980729693","https://openalex.org/W2983902239","https://openalex.org/W2995373098","https://openalex.org/W2997755431","https://openalex.org/W3011113812","https://openalex.org/W3011422375","https://openalex.org/W3021130993","https://openalex.org/W3048012689","https://openalex.org/W3091373649","https://openalex.org/W3095634855","https://openalex.org/W3171213563","https://openalex.org/W6765704459","https://openalex.org/W6768835969","https://openalex.org/W6770480005","https://openalex.org/W6784830904","https://openalex.org/W6797766548"],"related_works":["https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2994202640","https://openalex.org/W272387213","https://openalex.org/W1994406184","https://openalex.org/W4308285224","https://openalex.org/W4387985143","https://openalex.org/W4362599004","https://openalex.org/W2808242528","https://openalex.org/W1567638270"],"abstract_inverted_index":{"Attackers":[0],"increasingly":[1],"seek":[2],"to":[3,79,111,116,218,226],"compromise":[4],"organizations":[5,225],"and":[6,33,43,49,56,90,113,142,191,231],"their":[7,126,233],"critical":[8],"data":[9],"with":[10,93],"advanced":[11,228],"stealthy":[12,67],"methods,":[13],"often":[14],"utilising":[15],"legitimate":[16],"tools.":[17],"In":[18,129],"the":[19,77,173,182,201,206,220],"main,":[20],"organisations":[21,110],"employ":[22],"reactive":[23],"approaches":[24,83],"for":[25,125,138,224,235],"cyber":[26],"security,":[27,147],"focused":[28],"on":[29,159,195],"rectifying":[30],"immediate":[31],"incidents":[32],"preventing":[34],"repeat":[35],"attacks,":[36,119],"through":[37,145],"protections":[38],"such":[39,84,102],"as":[40,74,85,103],"vulnerability":[41],"assessment":[42],"penetration":[44],"testing":[45],"(VAPT)":[46],"security":[47],"information":[48],"event":[50],"management":[51],"(SIEM),":[52],"firewalls,":[53],"anti-spam/anti-malware":[54],"solutions":[55],"system":[57,60],"patches.":[58],"Such":[59],"have":[61,71,87,96,122],"weaknesses":[62],"in":[63],"addressing":[64],"modern":[65,66],"attacks.":[68],"Proactive":[69],"approaches,":[70],"been":[72,98,123],"seen":[73],"part":[75],"of":[76,163,205],"solution":[78],"this":[80,130],"problem.":[81],"However,":[82],"VAPT":[86],"limited":[88],"scope":[89],"only":[91],"works":[92],"threats":[94],"that":[95,181],"already":[97],"discovered.":[99],"Promising":[100],"methods":[101],"threat":[104,149,174,186,202],"hunting":[105,150,175,187,196],"are":[106],"gaining":[107],"momentum,":[108],"enabling":[109],"identify":[112],"rapidly":[114],"respond":[115],"any":[117],"potential":[118],"though":[120],"they":[121],"criticised":[124],"significant":[127],"cost.":[128],"paper,":[131],"we":[132],"present":[133],"a":[134,160],"novel":[135,161],"hybrid":[136],"model":[137,171],"uncovering":[139],"tactics,":[140],"techniques,":[141],"procedures":[143],"(TTPs)":[144],"offensive":[146,221],"specifically":[148],"via":[151,188],"adversary":[152,165,189],"emulation.":[153],"The":[154,177,212],"proposed":[155,183,207,213],"technique":[156],"is":[157],"based":[158],"approach":[162,184,208,214],"inducing":[164],"emulation":[166,190],"(mapping":[167],"each":[168],"respective":[169],"phase)":[170],"inside":[172],"approach.":[176],"experimental":[178],"results":[179],"show":[180],"uses":[185],"has":[192],"countervailing":[193],"effects":[194],"advance":[197],"level":[198],"threats.":[199],"Moreover,":[200],"detection":[203],"ability":[204,234],"utilizes":[209],"minimum":[210],"resources.":[211],"can":[215],"be":[216],"used":[217],"develop":[219],"security-aware":[222],"environment":[223],"uncover":[227],"attack":[229,236],"mechanisms":[230],"test":[232],"detection.":[237]},"counts_by_year":[{"year":2026,"cited_by_count":7},{"year":2025,"cited_by_count":12},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":13},{"year":2022,"cited_by_count":10},{"year":2021,"cited_by_count":4}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}