{"id":"https://openalex.org/W4415222556","doi":"https://doi.org/10.1109/cns66487.2025.11194951","title":"Real-Time Detection of Multi-Stage Attacks Using Kill Chain State Machines","display_name":"Real-Time Detection of Multi-Stage Attacks Using Kill Chain State Machines","publication_year":2025,"publication_date":"2025-09-08","ids":{"openalex":"https://openalex.org/W4415222556","doi":"https://doi.org/10.1109/cns66487.2025.11194951"},"language":"en","primary_location":{"id":"doi:10.1109/cns66487.2025.11194951","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11194951","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118954947","display_name":"Liliana Kistenmacher","orcid":null},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Liliana Kistenmacher","raw_affiliation_strings":["University of Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Hamburg","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048543012","display_name":"Anum Talpur","orcid":"https://orcid.org/0000-0002-6702-1514"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Anum Talpur","raw_affiliation_strings":["University of Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Hamburg","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033270363","display_name":"Mathias Fischer","orcid":"https://orcid.org/0000-0002-6254-8288"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mathias Fischer","raw_affiliation_strings":["University of Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Hamburg","institution_ids":["https://openalex.org/I159176309"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I159176309"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.34310543,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9796000123023987,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7486000061035156},{"id":"https://openalex.org/keywords/cyber-threats","display_name":"Cyber threats","score":0.5006999969482422},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4805000126361847},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.43470001220703125},{"id":"https://openalex.org/keywords/intrusion-prevention-system","display_name":"Intrusion prevention system","score":0.3736000061035156},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.3578999936580658},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.34459999203681946},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.34049999713897705}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7703999876976013},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7486000061035156},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7060999870300293},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.5006999969482422},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4805000126361847},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.43470001220703125},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.3736000061035156},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.3578999936580658},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.34459999203681946},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.34049999713897705},{"id":"https://openalex.org/C132943942","wikidata":"https://www.wikidata.org/wiki/Q2562511","display_name":"Footprint","level":2,"score":0.33730000257492065},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.31630000472068787},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3052999973297119},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.2985000014305115},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.2883000075817108},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2662999927997589},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.25519999861717224},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.250900000333786}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cns66487.2025.11194951","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns66487.2025.11194951","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":26,"referenced_works":["https://openalex.org/W2045041532","https://openalex.org/W2152449272","https://openalex.org/W2404532944","https://openalex.org/W2789828921","https://openalex.org/W2810737462","https://openalex.org/W2946170942","https://openalex.org/W2947745012","https://openalex.org/W2953684237","https://openalex.org/W2962703433","https://openalex.org/W2998038410","https://openalex.org/W3005127313","https://openalex.org/W3104803508","https://openalex.org/W3110881363","https://openalex.org/W3133235094","https://openalex.org/W3188912055","https://openalex.org/W3210911509","https://openalex.org/W3211484264","https://openalex.org/W4210803071","https://openalex.org/W4309346044","https://openalex.org/W4310762541","https://openalex.org/W4388571717","https://openalex.org/W4388894090","https://openalex.org/W4391754923","https://openalex.org/W4400106009","https://openalex.org/W4408124979","https://openalex.org/W4408750016"],"related_works":[],"abstract_inverted_index":{"Cyber":[0],"threats":[1],"present":[2,27],"an":[3,28,54],"ongoing":[4],"challenge":[5],"for":[6],"organisations":[7,34],"worldwide.":[8],"Attackers":[9],"range":[10],"from":[11],"cybercriminals":[12],"to":[13,22,44,72,88],"state-funded":[14],"groups":[15],"that":[16,50,98,115,133],"have":[17],"a":[18,39,95,142],"specialised":[19],"skill":[20],"set":[21],"execute":[23],"complex":[24],"attacks":[25,46,105,138],"and":[26,101,146],"Advanced":[29],"Persistent":[30],"Threat":[31],"(APT).":[32],"Therefore,":[33],"use":[35],"security":[36],"monitoring":[37],"as":[38,85],"second":[40],"line":[41],"of":[42,56,104,123],"defence":[43],"detect":[45,136],"based":[47],"on":[48],"signatures":[49],"raise":[51],"alarms":[52],"when":[53],"Indicator":[55],"Compromise":[57],"(IoC)":[58],"is":[59],"observed.":[60],"However,":[61],"current":[62],"Intrusion":[63],"Detection":[64],"Systems":[65],"(IDS)":[66],"generate":[67],"many":[68],"false":[69],"positives,":[70],"leading":[71],"alert":[73],"fatigue.":[74],"The":[75],"raised":[76],"alerts":[77,125],"also":[78],"do":[79],"not":[80],"show":[81],"the":[82,121],"whole":[83],"attack":[84],"they":[86],"need":[87],"be":[89],"reviewed":[90],"individually.":[91],"Our":[92,129],"work":[93],"presents":[94],"simplified":[96],"approach":[97],"enables":[99],"efficient":[100],"real-time":[102,140],"construction":[103],"by":[106,126],"correlating":[107],"alerts.":[108],"Tests":[109],"with":[110,141],"different":[111],"network":[112],"datasets":[113],"suggest":[114],"our":[116],"prioritisation":[117],"mechanisms":[118],"can":[119,135],"reduce":[120],"number":[122],"false-positive":[124],"99":[127],"%.":[128],"performance":[130],"evaluation":[131],"indicates":[132],"we":[134],"multi-stage":[137],"in":[139],"low":[143],"memory":[144],"footprint":[145],"short":[147],"execution":[148],"time.":[149]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-16T00:00:00"}