{"id":"https://openalex.org/W4417438836","doi":"https://doi.org/10.1109/access.2025.3645226","title":"Enhancing Incident Response Through Effective TTPs Analysis: A Design Approach","display_name":"Enhancing Incident Response Through Effective TTPs Analysis: A Design Approach","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4417438836","doi":"https://doi.org/10.1109/access.2025.3645226"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3645226","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3645226","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3645226","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5025132321","display_name":"Tonglai Han","orcid":"https://orcid.org/0009-0006-6993-1526"},"institutions":[{"id":"https://openalex.org/I12832649","display_name":"Gachon University","ror":"https://ror.org/03ryywt80","country_code":"KR","type":"education","lineage":["https://openalex.org/I12832649"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Tae-Hyun Han","raw_affiliation_strings":["Department of Information Security, Gachon University, Seongnam, Republic of Korea"],"raw_orcid":"https://orcid.org/0009-0006-6993-1526","affiliations":[{"raw_affiliation_string":"Department of Information Security, Gachon University, Seongnam, Republic of Korea","institution_ids":["https://openalex.org/I12832649"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Sang-Yeon Hwang","orcid":"https://orcid.org/0009-0009-0429-3852"},"institutions":[{"id":"https://openalex.org/I2799970807","display_name":"Severance Hospital","ror":"https://ror.org/044kjp413","country_code":"KR","type":"healthcare","lineage":["https://openalex.org/I193775966","https://openalex.org/I2799970807","https://openalex.org/I4210160791"]},{"id":"https://openalex.org/I4210120608","display_name":"Seoil University","ror":"https://ror.org/01wf22864","country_code":"KR","type":"education","lineage":["https://openalex.org/I4210120608"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Sang-Yeon Hwang","raw_affiliation_strings":["SecuLayer Inc., Seongdong-gu, Seoul, Republic of Korea","SecuLayer Inc, Seongsuil-ro 4-gil 25, Seongdong-gu, Seoul, Republic of Korea"],"raw_orcid":"https://orcid.org/0009-0009-0429-3852","affiliations":[{"raw_affiliation_string":"SecuLayer Inc., Seongdong-gu, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I2799970807"]},{"raw_affiliation_string":"SecuLayer Inc, Seongsuil-ro 4-gil 25, Seongdong-gu, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I4210120608"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100708875","display_name":"Taejin Lee","orcid":"https://orcid.org/0000-0003-3078-3459"},"institutions":[{"id":"https://openalex.org/I12832649","display_name":"Gachon University","ror":"https://ror.org/03ryywt80","country_code":"KR","type":"education","lineage":["https://openalex.org/I12832649"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Tae-Jin Lee","raw_affiliation_strings":["Department of Smart Security, Gachon University, Seongnam, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0003-3078-3459","affiliations":[{"raw_affiliation_string":"Department of Smart Security, Gachon University, Seongnam, Republic of Korea","institution_ids":["https://openalex.org/I12832649"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.9389,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.82832258,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"13","issue":null,"first_page":"217799","last_page":"217810"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.597000002861023,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.597000002861023,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.24570000171661377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.034699998795986176,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.722599983215332},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.6722000241279602},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6430000066757202},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.5468000173568726},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.4641999900341034},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.43140000104904175}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8343999981880188},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.722599983215332},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.6722000241279602},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6430000066757202},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.5468000173568726},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5253000259399414},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.4641999900341034},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.43140000104904175},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.3517000079154968},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.34310001134872437},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.3379000127315521},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.30489999055862427},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2590999901294708},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.2581000030040741},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.25189998745918274}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2025.3645226","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3645226","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:50b6a3608985490aa2d16ff32f18b1c5","is_oa":true,"landing_page_url":"https://doaj.org/article/50b6a3608985490aa2d16ff32f18b1c5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 217799-217810 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3645226","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3645226","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2842195222","display_name":null,"funder_award_id":"2022-0-00089","funder_id":"https://openalex.org/F4320328359","funder_display_name":"Ministry of Science and ICT, South Korea"},{"id":"https://openalex.org/G3205322358","display_name":null,"funder_award_id":"2022-0-00089","funder_id":"https://openalex.org/F4320335489","funder_display_name":"Institute for Information and Communications Technology Promotion"},{"id":"https://openalex.org/G5160283255","display_name":null,"funder_award_id":"RS-2023-00235509","funder_id":"https://openalex.org/F4320328359","funder_display_name":"Ministry of Science and ICT, South Korea"}],"funders":[{"id":"https://openalex.org/F4320328359","display_name":"Ministry of Science and ICT, South Korea","ror":"https://ror.org/01wpjm123"},{"id":"https://openalex.org/F4320335489","display_name":"Institute for Information and Communications Technology Promotion","ror":"https://ror.org/01g0hqq23"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"To":[0],"effectively":[1],"defend":[2],"against":[3],"intelligent":[4],"cyberattacks,":[5],"it":[6],"is":[7],"essential":[8],"to":[9,63,80,129,142],"understand":[10],"the":[11,34,111,131,144],"attacker\u2019s":[12,35,112],"intent":[13],"and":[14,24,65,97,115],"enable":[15],"proactive":[16,42],"responses.":[17],"However,":[18],"identifying":[19,120],"patterns":[20,96],"in":[21,48,109,119],"attack":[22,53,69,95,121],"incidents":[23],"quantifying":[25],"them":[26,99],"remains":[27],"highly":[28],"challenging.":[29],"Without":[30],"this":[31,56,138],"capability,":[32],"predicting":[33,110],"next":[36,113],"action":[37,114],"becomes":[38],"difficult,":[39],"thereby":[40],"hindering":[41],"defense.":[43],"The":[44,103],"key":[45],"challenge":[46],"lies":[47],"discovering":[49],"unique":[50],"correlations":[51],"among":[52],"behaviors.":[54,84],"In":[55],"study,":[57],"we":[58,77,86,124,140],"employ":[59],"an":[60,88],"embedding":[61],"model":[62],"uncover":[64],"quantify":[66],"relationships":[67,74],"between":[68],"activities.":[70],"By":[71],"managing":[72],"these":[73],"through":[75],"clustering,":[76],"were":[78],"able":[79],"predict":[81],"subsequent":[82],"attacker":[83],"Furthermore,":[85],"propose":[87],"advanced":[89],"attack-group":[90],"identification":[91],"framework":[92],"by":[93],"detecting":[94],"integrating":[98],"with":[100],"existing":[101],"methodologies.":[102],"proposed":[104],"approach":[105],"achieved":[106],"91.73%":[107],"accuracy":[108,118],"demonstrated":[116],"93.49%":[117],"groups.":[122],"Additionally,":[123],"present":[125],"two":[126],"use":[127],"cases":[128],"illustrate":[130],"practical":[132],"applicability":[133],"of":[134],"our":[135],"methodology.":[136],"Through":[137],"research,":[139],"aim":[141],"pave":[143],"way":[145],"for":[146],"next-generation":[147],"intrusion":[148],"response":[149],"technologies.":[150]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-01-02T23:11:23.791532","created_date":"2025-12-17T00:00:00"}