{"id":"https://openalex.org/W3200022502","doi":"https://doi.org/10.1109/access.2021.3111420","title":"Last Line of Defense: Reliability Through Inducing Cyber Threat Hunting With Deception in SCADA Networks","display_name":"Last Line of Defense: Reliability Through Inducing Cyber Threat Hunting With Deception in SCADA Networks","publication_year":2021,"publication_date":"2021-01-01","ids":{"openalex":"https://openalex.org/W3200022502","doi":"https://doi.org/10.1109/access.2021.3111420","mag":"3200022502"},"language":"en","primary_location":{"id":"doi:10.1109/access.2021.3111420","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3111420","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09531651.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09531651.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5049562643","display_name":"Abdul Basit Ajmal","orcid":"https://orcid.org/0000-0003-4418-4959"},"institutions":[{"id":"https://openalex.org/I16076960","display_name":"COMSATS University Islamabad","ror":"https://ror.org/00nqqvk19","country_code":"PK","type":"education","lineage":["https://openalex.org/I16076960"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Abdul Basit Ajmal","raw_affiliation_strings":["Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan"],"raw_orcid":"https://orcid.org/0000-0003-4418-4959","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","institution_ids":["https://openalex.org/I16076960"]},{"raw_affiliation_string":"Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan","institution_ids":["https://openalex.org/I16076960"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101533532","display_name":"Masoom Alam","orcid":"https://orcid.org/0000-0001-8839-593X"},"institutions":[{"id":"https://openalex.org/I16076960","display_name":"COMSATS University Islamabad","ror":"https://ror.org/00nqqvk19","country_code":"PK","type":"education","lineage":["https://openalex.org/I16076960"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Masoom Alam","raw_affiliation_strings":["Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan"],"raw_orcid":"https://orcid.org/0000-0001-8839-593X","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","institution_ids":["https://openalex.org/I16076960"]},{"raw_affiliation_string":"Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan","institution_ids":["https://openalex.org/I16076960"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046225750","display_name":"Awais Abdul Khaliq","orcid":null},"institutions":[{"id":"https://openalex.org/I16076960","display_name":"COMSATS University Islamabad","ror":"https://ror.org/00nqqvk19","country_code":"PK","type":"education","lineage":["https://openalex.org/I16076960"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Awais Abdul Khaliq","raw_affiliation_strings":["Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan"],"raw_orcid":"https://orcid.org/0000-0002-3439-6256","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","institution_ids":["https://openalex.org/I16076960"]},{"raw_affiliation_string":"Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan","institution_ids":["https://openalex.org/I16076960"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064039260","display_name":"Shawal Khan","orcid":"https://orcid.org/0000-0001-5952-8502"},"institutions":[{"id":"https://openalex.org/I16076960","display_name":"COMSATS University Islamabad","ror":"https://ror.org/00nqqvk19","country_code":"PK","type":"education","lineage":["https://openalex.org/I16076960"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Shawal Khan","raw_affiliation_strings":["Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan"],"raw_orcid":"https://orcid.org/0000-0001-5952-8502","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Cyber Security Laboratory, COMSATS University Islamabad, Islamabad, Pakistan","institution_ids":["https://openalex.org/I16076960"]},{"raw_affiliation_string":"Cyber Security Lab, Department of Computer Science, COMSATS University Islamabad, Islamabad, 44500, Pakistan","institution_ids":["https://openalex.org/I16076960"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012112322","display_name":"Zakria Qadir","orcid":"https://orcid.org/0000-0002-9596-1765"},"institutions":[{"id":"https://openalex.org/I63525965","display_name":"Western Sydney University","ror":"https://ror.org/03t52dk35","country_code":"AU","type":"education","lineage":["https://openalex.org/I63525965"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Zakria Qadir","raw_affiliation_strings":["School of Computing Engineering and Mathematics, Western Sydney University, Penrith, NSW, Australia","School of Computing Engineering and Mathematics, Western Sydney University, Locked Bag 1797, Penrith, NSW 2751, Australia"],"raw_orcid":"https://orcid.org/0000-0002-9596-1765","affiliations":[{"raw_affiliation_string":"School of Computing Engineering and Mathematics, Western Sydney University, Penrith, NSW, Australia","institution_ids":["https://openalex.org/I63525965"]},{"raw_affiliation_string":"School of Computing Engineering and Mathematics, Western Sydney University, Locked Bag 1797, Penrith, NSW 2751, Australia","institution_ids":["https://openalex.org/I63525965"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017410063","display_name":"M. A. Parvez Mahmud","orcid":"https://orcid.org/0000-0002-1905-6800"},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"M. A. Parvez Mahmud","raw_affiliation_strings":["School of Engineering, Deakin University, Geelong, VIC, Australia","School of Engineering, Deakin University, Geelong, VIC 3216, Australia"],"raw_orcid":"https://orcid.org/0000-0002-1905-6800","affiliations":[{"raw_affiliation_string":"School of Engineering, Deakin University, Geelong, VIC, Australia","institution_ids":["https://openalex.org/I149704539"]},{"raw_affiliation_string":"School of Engineering, Deakin University, Geelong, VIC 3216, Australia","institution_ids":["https://openalex.org/I149704539"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":3.144,"has_fulltext":true,"cited_by_count":34,"citation_normalized_percentile":{"value":0.92736498,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"9","issue":null,"first_page":"126789","last_page":"126800"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/scada","display_name":"SCADA","score":0.9754999876022339},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7879743576049805},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6065815091133118},{"id":"https://openalex.org/keywords/deception","display_name":"Deception","score":0.5155599117279053},{"id":"https://openalex.org/keywords/reliability","display_name":"Reliability (semiconductor)","score":0.4660402834415436},{"id":"https://openalex.org/keywords/critical-infrastructure","display_name":"Critical infrastructure","score":0.46205392479896545},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.18941298127174377}],"concepts":[{"id":"https://openalex.org/C113863187","wikidata":"https://www.wikidata.org/wiki/Q17498","display_name":"SCADA","level":2,"score":0.9754999876022339},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7879743576049805},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6065815091133118},{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.5155599117279053},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.4660402834415436},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.46205392479896545},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.18941298127174377},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C163258240","wikidata":"https://www.wikidata.org/wiki/Q25342","display_name":"Power (physics)","level":2,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/access.2021.3111420","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3111420","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09531651.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:3ef15aef24d14df688f383cefd217234","is_oa":true,"landing_page_url":"https://doaj.org/article/3ef15aef24d14df688f383cefd217234","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 9, Pp 126789-126800 (2021)","raw_type":"article"},{"id":"pmh:oai:dro.deakin.edu.au:DU:30156124","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4306401102","display_name":"Own your potential (DEAKIN)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I149704539","host_organization_name":"Deakin University","host_organization_lineage":["https://openalex.org/I149704539"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Journal Article"},{"id":"pmh:oai:figshare.com:article/20645118","is_oa":true,"landing_page_url":"https://figshare.com/articles/journal_contribution/Last_Line_of_Defense_Reliability_through_Inducing_Cyber_Threat_Hunting_with_Deception_in_SCADA_Networks/20645118","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"}],"best_oa_location":{"id":"doi:10.1109/access.2021.3111420","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3111420","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/09531651.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.7300000190734863,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320322799","display_name":"Higher Education Commission, Pakistan","ror":"https://ror.org/038y3sz68"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3200022502.pdf","grobid_xml":"https://content.openalex.org/works/W3200022502.grobid-xml"},"referenced_works_count":41,"referenced_works":["https://openalex.org/W77083600","https://openalex.org/W2060479059","https://openalex.org/W2471609648","https://openalex.org/W2510535264","https://openalex.org/W2606501539","https://openalex.org/W2768199379","https://openalex.org/W2771524937","https://openalex.org/W2794376943","https://openalex.org/W2794813101","https://openalex.org/W2806115626","https://openalex.org/W2809594661","https://openalex.org/W2811432357","https://openalex.org/W2883094363","https://openalex.org/W2887324343","https://openalex.org/W2898658204","https://openalex.org/W2902271075","https://openalex.org/W2904712365","https://openalex.org/W2906723160","https://openalex.org/W2908909566","https://openalex.org/W2909062875","https://openalex.org/W2948891839","https://openalex.org/W2951062106","https://openalex.org/W2963082174","https://openalex.org/W2968067965","https://openalex.org/W2987085812","https://openalex.org/W2996591841","https://openalex.org/W3013525724","https://openalex.org/W3015989286","https://openalex.org/W3019616306","https://openalex.org/W3020448654","https://openalex.org/W3024669438","https://openalex.org/W3118272856","https://openalex.org/W3144951269","https://openalex.org/W3190778120","https://openalex.org/W6603173816","https://openalex.org/W6736480050","https://openalex.org/W6740849953","https://openalex.org/W6763420696","https://openalex.org/W6775702627","https://openalex.org/W6787840763","https://openalex.org/W6792682378"],"related_works":["https://openalex.org/W2265199518","https://openalex.org/W2215365983","https://openalex.org/W2617272381","https://openalex.org/W2060595276","https://openalex.org/W2995370509","https://openalex.org/W2184855233","https://openalex.org/W2198908836","https://openalex.org/W2060479059","https://openalex.org/W2494895348","https://openalex.org/W4229698505"],"abstract_inverted_index":{"There":[0],"exists":[1],"a":[2,70,84,100,163,190],"gap":[3,101],"between":[4],"existing":[5],"security":[6,30,53,73,91,212],"mechanisms":[7,31],"and":[8,16,21,26,50,130,140,167,186,201,211,224],"their":[9],"ability":[10],"to":[11,24,39,69],"detect":[12,25],"advancing":[13],"threats.":[14,175],"Antivirus":[15],"EDR":[17],"(End":[18],"Point":[19],"Detection":[20],"Response)":[22],"aim":[23],"prevent":[27],"threats;":[28],"such":[29,107],"are":[32,158],"reactive.":[33],"This":[34],"approach":[35,169,199,210,232],"did":[36],"not":[37,93],"prove":[38],"be":[40],"effective":[41],"in":[42,102,125,151],"protecting":[43],"against":[44],"stealthy":[45],"attacks.":[46],"SCADA":[47,60,80,90,138,153,192,215],"(Supervisory":[48],"Control":[49],"Data":[51],"Acquisition)":[52],"is":[54,61,81,111],"crucial":[55],"for":[56,66,74,170,214,219],"any":[57],"country.":[58],"However,":[59],"always":[62],"an":[63],"easy":[64],"target":[65],"adversaries":[67],"due":[68],"lack":[71],"of":[72,114,148,180],"heterogeneous":[75,220],"devices.":[76,221],"An":[77],"attack":[78],"on":[79,89,136,173,189],"mainly":[82],"considered":[83,94],"national-level":[85],"threat.":[86],"Recent":[87],"research":[88],"has":[92,98,133,233],"\"unknown":[95],"threats,\"":[96],"which":[97],"left":[99],"security.":[103],"The":[104,222],"proactive":[105],"approach,":[106,181],"as":[108],"threat":[109,123,165,230,237],"hunting,":[110],"the":[112,115,146,152,178,203,207,228,236],"need":[113],"hour.":[116],"In":[117],"this":[118],"research,":[119],"we":[120,161,182],"investigated":[121],"that":[122,197,227],"hunting":[124,231],"conjunction":[126],"with":[127,216],"cyber":[128],"deception":[129],"kill":[131],"chain":[132],"countervailing":[134],"effects":[135],"detecting":[137],"threats":[139],"mitigating":[141],"them.":[142],"We":[143,194],"have":[144,195],"used":[145],"concept":[147],"\"decoy":[149],"farm\"":[150],"network,":[154],"where":[155],"all":[156],"attacks":[157,188],"engaged.":[159],"Moreover,":[160],"present":[162],"novel":[164],"detection":[166,238],"prevention":[168],"SCADA,":[171],"focusing":[172],"unknown":[174],"To":[176],"test":[177],"effectiveness":[179],"emulated":[183],"several":[184],"Linux":[185],"Windows-based":[187],"simulated":[191],"network.":[193],"concluded":[196],"our":[198],"detects":[200],"prevents":[202],"attacker":[204],"before":[205],"using":[206],"current":[208],"reactive":[209],"mechanism":[213],"enhanced":[217],"protection":[218],"results":[223],"experiments":[225],"show":[226],"proposed":[229],"significantly":[234],"improved":[235],"ability.":[239]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":10},{"year":2022,"cited_by_count":7},{"year":2021,"cited_by_count":1}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}