{"id":"https://openalex.org/W7163702427","doi":"https://doi.org/10.1109/access.2026.3700808","title":"MuCamp2: Generating Validated Cyber Campaign Variants via Constrained LLMs for Group Attribution","display_name":"MuCamp2: Generating Validated Cyber Campaign Variants via Constrained LLMs for Group Attribution","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7163702427","doi":"https://doi.org/10.1109/access.2026.3700808"},"language":"en","primary_location":{"id":"doi:10.1109/access.2026.3700808","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3700808","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3700808","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137989174","display_name":"Keunho Kim","orcid":"https://orcid.org/0009-0001-9595-8507"},"institutions":[{"id":"https://openalex.org/I28777354","display_name":"Sejong University","ror":"https://ror.org/00aft1q37","country_code":"KR","type":"education","lineage":["https://openalex.org/I28777354"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Keunho Kim","raw_affiliation_strings":["Department of Computer Science and Engineering, Sejong University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0009-0001-9595-8507","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Sejong University, Seoul, South Korea","institution_ids":["https://openalex.org/I28777354"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137988449","display_name":"Jimin Lee","orcid":null},"institutions":[{"id":"https://openalex.org/I2801036362","display_name":"Agency for Defense Development","ror":"https://ror.org/05fhe0r85","country_code":"KR","type":"government","lineage":["https://openalex.org/I1327899338","https://openalex.org/I1344042128","https://openalex.org/I2801036362","https://openalex.org/I2801339556"]},{"id":"https://openalex.org/I4210110812","display_name":"Sejong Cyber University","ror":"https://ror.org/020b78451","country_code":"KR","type":"education","lineage":["https://openalex.org/I4210110812"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jimin Lee","raw_affiliation_strings":["Agency for Defense Development, Daejeon, South Korea","Department of Cyber Defense, Sejong University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0009-0001-0095-4408","affiliations":[{"raw_affiliation_string":"Agency for Defense Development, Daejeon, South Korea","institution_ids":["https://openalex.org/I2801036362"]},{"raw_affiliation_string":"Department of Cyber Defense, Sejong University, Seoul, South Korea","institution_ids":["https://openalex.org/I4210110812"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030456600","display_name":"Insup Lee","orcid":"https://orcid.org/0000-0003-2672-1132"},"institutions":[{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Insup Lee","raw_affiliation_strings":["School of Cybersecurity, Korea University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0002-9822-9860","affiliations":[{"raw_affiliation_string":"School of Cybersecurity, Korea University, Seoul, South Korea","institution_ids":["https://openalex.org/I197347611"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137992492","display_name":"Insung Han","orcid":null},"institutions":[{"id":"https://openalex.org/I2801036362","display_name":"Agency for Defense Development","ror":"https://ror.org/05fhe0r85","country_code":"KR","type":"government","lineage":["https://openalex.org/I1327899338","https://openalex.org/I1344042128","https://openalex.org/I2801036362","https://openalex.org/I2801339556"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Insung Han","raw_affiliation_strings":["Agency for Defense Development, Daejeon, South Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Agency for Defense Development, Daejeon, South Korea","institution_ids":["https://openalex.org/I2801036362"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137969496","display_name":"Jungsik Lee","orcid":null},"institutions":[{"id":"https://openalex.org/I2801036362","display_name":"Agency for Defense Development","ror":"https://ror.org/05fhe0r85","country_code":"KR","type":"government","lineage":["https://openalex.org/I1327899338","https://openalex.org/I1344042128","https://openalex.org/I2801036362","https://openalex.org/I2801339556"]},{"id":"https://openalex.org/I4210110812","display_name":"Sejong Cyber University","ror":"https://ror.org/020b78451","country_code":"KR","type":"education","lineage":["https://openalex.org/I4210110812"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jungsik Lee","raw_affiliation_strings":["Agency for Defense Development, Daejeon, South Korea","Department of Cyber Defense, Sejong University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0002-0765-6809","affiliations":[{"raw_affiliation_string":"Agency for Defense Development, Daejeon, South Korea","institution_ids":["https://openalex.org/I2801036362"]},{"raw_affiliation_string":"Department of Cyber Defense, Sejong University, Seoul, South Korea","institution_ids":["https://openalex.org/I4210110812"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138003366","display_name":"Shinwoo Shim","orcid":"https://orcid.org/0000-0003-0959-9200"},"institutions":[{"id":"https://openalex.org/I4210165981","display_name":"CrystalGenomics (South Korea)","ror":"https://ror.org/05gk7hr65","country_code":"KR","type":"company","lineage":["https://openalex.org/I4210165981"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Shinwoo Shim","raw_affiliation_strings":["LIG D&A, Seongnam, South Korea"],"raw_orcid":"https://orcid.org/0000-0003-0959-9200","affiliations":[{"raw_affiliation_string":"LIG D&A, Seongnam, South Korea","institution_ids":["https://openalex.org/I4210165981"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5137926039","display_name":"Changhee Choi","orcid":"https://orcid.org/0009-0005-4302-3522"},"institutions":[{"id":"https://openalex.org/I4210110812","display_name":"Sejong Cyber University","ror":"https://ror.org/020b78451","country_code":"KR","type":"education","lineage":["https://openalex.org/I4210110812"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Changhee Choi","raw_affiliation_strings":["Department of Cyber Defense, Sejong University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0009-0005-4302-3522","affiliations":[{"raw_affiliation_string":"Department of Cyber Defense, Sejong University, Seoul, South Korea","institution_ids":["https://openalex.org/I4210110812"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2075,"currency":"USD","value_usd":2075},"apc_paid":{"value":2075,"currency":"USD","value_usd":2075},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.58050006,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":null,"first_page":"87329","last_page":"87344"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10456","display_name":"Multi-Agent Systems and Negotiation","score":0.2529999911785126,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10456","display_name":"Multi-Agent Systems and Negotiation","score":0.2529999911785126,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.07519999891519547,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11010","display_name":"Logic, Reasoning, and Knowledge","score":0.05869999900460243,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/attribution","display_name":"Attribution","score":0.5055000185966492},{"id":"https://openalex.org/keywords/group","display_name":"Group (periodic table)","score":0.4268999993801117},{"id":"https://openalex.org/keywords/electronic-mail","display_name":"Electronic mail","score":0.3377000093460083},{"id":"https://openalex.org/keywords/causality","display_name":"Causality (physics)","score":0.3018999993801117},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2754000127315521}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6037999987602234},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.5055000185966492},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5031999945640564},{"id":"https://openalex.org/C2781311116","wikidata":"https://www.wikidata.org/wiki/Q83306","display_name":"Group (periodic table)","level":2,"score":0.4268999993801117},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.3377000093460083},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.33230000734329224},{"id":"https://openalex.org/C64357122","wikidata":"https://www.wikidata.org/wiki/Q1149766","display_name":"Causality (physics)","level":2,"score":0.3018999993801117},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2754000127315521},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2750000059604645},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.27379998564720154},{"id":"https://openalex.org/C180872759","wikidata":"https://www.wikidata.org/wiki/Q874405","display_name":"Social group","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.25270000100135803}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2026.3700808","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3700808","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:c6b6049895094de68c6c44800416fb0b","is_oa":false,"landing_page_url":"https://doaj.org/article/c6b6049895094de68c6c44800416fb0b","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 14, Pp 87329-87344 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3700808","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3700808","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6927736836","display_name":null,"funder_award_id":"UG253005TD","funder_id":"https://openalex.org/F4320323103","funder_display_name":"Agency for Defense Development"}],"funders":[{"id":"https://openalex.org/F4320323103","display_name":"Agency for Defense Development","ror":"https://ror.org/05fhe0r85"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"As":[0],"cyberattack":[1],"operators":[2],"have":[3],"progressed":[4],"to":[5,83,98,105,145,174,176,196,205,215],"advanced":[6],"persistent":[7],"threat":[8,44],"(APT)":[9],"groups,":[10],"accurate":[11],"group":[12],"attribution":[13,209],"based":[14,138],"on":[15,139,159],"tactic,":[16],"technique,":[17],"and":[18,40,149,162,180,198,252],"procedure":[19],"(TTP)":[20],"sequences":[21,31,261],"has":[22],"gained":[23],"significant":[24],"attention.":[25],"However,":[26],"publicly":[27],"available":[28,154],"campaign-level":[29,121],"TTP":[30,122],"remain":[32],"extremely":[33],"limited,":[34],"which":[35],"restricts":[36],"both":[37],"statistical":[38],"learning":[39],"generalization":[41],"for":[42,76,120,178,193,202,259],"cyber":[43],"intelligence.":[45],"Existing":[46],"augmentation":[47,123],"methods,":[48],"such":[49],"as":[50,237],"synonym":[51],"replacement":[52],"(SR),":[53],"often":[54],"produce":[55,106],"structurally":[56],"invalid":[57],"variants":[58],"because":[59],"they":[60,80],"do":[61],"not":[62,95],"consider":[63],"cross-technique":[64],"capability":[65],"chains.":[66],"Although":[67],"large":[68,108,225],"language":[69],"models":[70],"(LLMs)":[71],"offer":[72],"a":[73,107,117,134,211],"promising":[74],"alternative":[75],"generating":[77],"novel":[78],"sequences,":[79],"alone":[81],"fail":[82],"guarantee":[84],"sequence":[85],"integrity.":[86],"Therefore,":[87],"the":[88,96,103,127,140,153,160,182,253],"primary":[89],"limitation":[90],"of":[91,213,246],"current":[92],"approaches":[93],"is":[94],"inability":[97],"generate":[99],"diverse":[100],"variants,":[101],"but":[102,219],"tendency":[104],"volume":[109],"ofunusabledata.":[110],"To":[111],"this":[112],"end,":[113],"we":[114],"propose":[115],"MuCamp2,":[116],"generation-validation":[118],"architecture":[119],"that":[124,166,232],"places":[125],"LLMsoutside":[126],"trust":[128],"boundary.":[129],"MuCamp2":[130,167],"employs":[131],"deterministiccandidate-pool":[132],"constraintsand":[133],"multi-level":[135],"semantic":[136],"validation":[137,185],"adversary":[141],"emulation":[142],"planner":[143],"(AEP)":[144],"improve":[146],"structural":[147],"soundness":[148],"operational":[150,240],"consistency":[151],"under":[152],"AEP":[155,242],"mappings.":[156],"Experimental":[157],"results":[158],"Lazarus":[161,194],"MenuPass":[163,203],"datasets":[164],"demonstrate":[165],"completely":[168],"eliminates":[169],"tactic":[170],"violations":[171],"(0%":[172],"compared":[173],"26%":[175],"32%":[177],"SR)":[179],"improves":[181],"strict":[183],"AEP-based":[184,239],"(L3)":[186],"pass":[187,256],"rate":[188,257],"by":[189],"5.5":[190],"percentage":[191,200],"points":[192,201],"(10.2%":[195],"15.7%)":[197],"3.0":[199],"(7.5%":[204],"10.5%).":[206],"Furthermore,":[207],"downstream":[208],"achieves":[210],"Macro-F1":[212],"0.987":[214],"0.990,":[216],"indicating":[217],"bounded":[218],"consistent":[220],"usable-yield":[221],"gains":[222],"rather":[223,266],"than":[224,267],"per-sample":[226],"quality":[227],"differences.":[228],"We":[229],"further":[230],"note":[231],"L3":[233,255],"should":[234],"be":[235],"interpreted":[236],"an":[238],"proxy:":[241],"currently":[243],"covers":[244],"197":[245],"356":[247],"ATT&CK":[248],"v18":[249],"techniques":[250],"(55.3%),":[251],"high":[254],"observed":[258],"low-coverage":[260],"reflects":[262],"reduced":[263],"validator":[264],"discrimination":[265],"higher":[268],"intrinsic":[269],"validity.":[270]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2026-06-06T00:00:00"}