{"id":"https://openalex.org/W4415223176","doi":"https://doi.org/10.1109/cns66487.2025.11194941","title":"Tagging Alerts to Adversaries: ML-Enabled Classification Using MITRE ATT&CK","display_name":"Tagging Alerts to Adversaries: ML-Enabled Classification Using MITRE ATT&CK","publication_year":2025,"publication_date":"2025-09-08","ids":{"openalex":"https://openalex.org/W4415223176","doi":"https://doi.org/10.1109/cns66487.2025.11194941"},"language":"en","primary_location":{"id":"doi:10.1109/cns66487.2025.11194941","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11194941","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048543012","display_name":"Anum Talpur","orcid":"https://orcid.org/0000-0002-6702-1514"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Anum Talpur","raw_affiliation_strings":["Universität Hamburg,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Hamburg,Germany","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005242461","display_name":"J\u00f6rg Schr\u00f6der","orcid":null},"institutions":[{"id":"https://openalex.org/I129877168","display_name":"Carl von Ossietzky Universit\u00e4t Oldenburg","ror":"https://ror.org/033n9gh91","country_code":"DE","type":"education","lineage":["https://openalex.org/I129877168"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Jannik Schr\u00f6der","raw_affiliation_strings":["Universität Oldenburg,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Oldenburg,Germany","institution_ids":["https://openalex.org/I129877168"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5118954947","display_name":"Liliana Kistenmacher","orcid":null},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Liliana Kistenmacher","raw_affiliation_strings":["Universität Hamburg,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Hamburg,Germany","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051088474","display_name":"Georg Becker","orcid":"https://orcid.org/0000-0002-9316-9125"},"institutions":[{"id":"https://openalex.org/I57150801","display_name":"Sasol (Germany)","ror":"https://ror.org/04k59vn11","country_code":"DE","type":"company","lineage":["https://openalex.org/I4210117808","https://openalex.org/I57150801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Georg Becker","raw_affiliation_strings":["DCSO GmbH,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"DCSO GmbH,Germany","institution_ids":["https://openalex.org/I57150801"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074444329","display_name":"Wolfram Wingerath","orcid":"https://orcid.org/0000-0003-3512-5789"},"institutions":[{"id":"https://openalex.org/I129877168","display_name":"Carl von Ossietzky Universit\u00e4t Oldenburg","ror":"https://ror.org/033n9gh91","country_code":"DE","type":"education","lineage":["https://openalex.org/I129877168"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Wolfram Wingerath","raw_affiliation_strings":["Universität Oldenburg,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Oldenburg,Germany","institution_ids":["https://openalex.org/I129877168"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033270363","display_name":"Mathias Fischer","orcid":"https://orcid.org/0000-0002-6254-8288"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mathias Fischer","raw_affiliation_strings":["Universität Hamburg,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universität Hamburg,Germany","institution_ids":["https://openalex.org/I159176309"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.673,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.86005237,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9314000010490417,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9314000010490417,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5864999890327454},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.47110000252723694},{"id":"https://openalex.org/keywords/prioritization","display_name":"Prioritization","score":0.44029998779296875},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.4375999867916107},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.41519999504089355},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.3711000084877014},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.31450000405311584}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8259000182151794},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5864999890327454},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.47110000252723694},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.44029998779296875},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.4375999867916107},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4196999967098236},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.41519999504089355},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.3711000084877014},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33309999108314514},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.31450000405311584},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3091000020503998},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30559998750686646},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3052000105381012},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3037000000476837},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.26910001039505005},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.2689000070095062},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.2529999911785126},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.25220000743865967}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cns66487.2025.11194941","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11194941","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W1672197616","https://openalex.org/W2012917383","https://openalex.org/W2122646361","https://openalex.org/W2146510646","https://openalex.org/W2587847678","https://openalex.org/W2774161712","https://openalex.org/W2783741806","https://openalex.org/W2800788706","https://openalex.org/W2910711617","https://openalex.org/W2982586338","https://openalex.org/W3133235094","https://openalex.org/W4283382503","https://openalex.org/W4288070321","https://openalex.org/W4289793071","https://openalex.org/W4312204616","https://openalex.org/W4323321528","https://openalex.org/W4384823681","https://openalex.org/W4394586044"],"related_works":[],"abstract_inverted_index":{"An":[0],"intrusion":[1],"detection":[2],"system":[3],"(IDS)":[4],"in":[5,13,39,71,77,154],"an":[6,10,72,96,187],"enterprise":[7,145,183],"network":[8,184],"plays":[9],"important":[11],"role":[12],"identifying":[14],"and":[15,37,49,53,59,146,151,185,216],"alerting":[16],"suspicious":[17],"activity.":[18],"The":[19],"triggered":[20],"alerts":[21,40,44,79,100,120,164],"are":[22,46,200],"generated":[23],"along":[24],"with":[25,123,193,202],"false":[26],"alarms":[27],"where":[28],"a":[29,155],"legitimate":[30],"activity":[31],"is":[32,106],"mistakenly":[33],"classified":[34],"as":[35,206],"malicious":[36],"results":[38],"fatigue.":[41],"Too":[42],"many":[43],"that":[45],"not":[47,90],"integrated":[48],"lack":[50],"related":[51],"context":[52],"correlation":[54,162],"can":[55,75,85],"burden":[56],"security":[57,67,178],"analytics":[58],"make":[60],"prioritization":[61,102],"of":[62,99,103,121,128,139,163,180,189,212],"threats":[63],"more":[64],"challenging.":[65],"For":[66],"operations":[68],"centers":[69],"(SOCs)":[70],"enterprise,":[73],"it":[74],"result":[76],"critical":[78],"being":[80,91],"overlooked":[81],"or":[82],"undetected,":[83],"which":[84],"lead":[86],"to":[87,117,158,165,191,208],"dire":[88],"attacks":[89],"identified":[92],"on":[93],"time.":[94],"Therefore,":[95],"automated":[97,195],"tagging":[98],"for":[101,144],"high-risk":[104],"events":[105],"important.":[107],"To":[108],"overcome":[109],"this":[110],"challenge,":[111],"we":[112,135],"use":[113],"machine":[114],"learning":[115,153],"(ML)":[116],"enrich":[118],"the":[119,124,129,137,140,160,176,181,210,213],"IDS":[122,222],"real-world":[125],"adversary":[126],"information":[127],"MITRE":[130,141],"ATT&CK":[131,142],"framework.":[132],"In":[133],"particular,":[134],"leverage":[136],"knowledge":[138],"matrix":[143],"apply":[147],"multi-layer":[148],"perceptron":[149],"(MLP)":[150],"transformer-based":[152],"novel":[156],"way":[157],"uncover":[159],"possible":[161],"known":[166],"adversarial":[167],"behaviors":[168],"(or":[169],"tactics).":[170],"We":[171],"evaluate":[172],"our":[173,194],"models":[174],"over":[175],"recent":[177],"logs":[179],"real":[182],"demonstrate":[186,209],"accuracy":[188],"up":[190],"95%":[192],"alert":[196],"classification.":[197],"Extensive":[198],"experiments":[199],"performed":[201],"publicly":[203],"available":[204],"datasets":[205],"well":[207],"performance":[211],"transformer":[214],"model":[215],"verify":[217],"its":[218],"effectiveness":[219],"against":[220],"different":[221],"setups.":[223]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-16T00:00:00"}