{"id":"https://openalex.org/W4386883399","doi":"https://doi.org/10.1109/icmcis59922.2023.10253465","title":"Detection of Previously Unknown Advanced Persistent Threats Through Visual Analytics with the MASFAD Framework","display_name":"Detection of Previously Unknown Advanced Persistent Threats Through Visual Analytics with the MASFAD Framework","publication_year":2023,"publication_date":"2023-05-16","ids":{"openalex":"https://openalex.org/W4386883399","doi":"https://doi.org/10.1109/icmcis59922.2023.10253465"},"language":"en","primary_location":{"id":"doi:10.1109/icmcis59922.2023.10253465","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1109/icmcis59922.2023.10253465","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 International Conference on Military Communications and Information Systems (ICMCIS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017158574","display_name":"Georgi Nikolov","orcid":"https://orcid.org/0000-0001-7364-7188"},"institutions":[{"id":"https://openalex.org/I150517870","display_name":"Royal Military Academy","ror":"https://ror.org/02vmnye06","country_code":"BE","type":"education","lineage":["https://openalex.org/I150517870"]}],"countries":["BE"],"is_corresponding":false,"raw_author_name":"Georgi Nikolov","raw_affiliation_strings":["Research Unit for Cyber Defense, Royal Military Academy,Brussels,Belgium","Research Unit for Cyber Defense, Royal Military Academy, Brussels, Belgium"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Unit for Cyber Defense, Royal Military Academy,Brussels,Belgium","institution_ids":["https://openalex.org/I150517870"]},{"raw_affiliation_string":"Research Unit for Cyber Defense, Royal Military Academy, Brussels, Belgium","institution_ids":["https://openalex.org/I150517870"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5022101559","display_name":"Wim Mees","orcid":"https://orcid.org/0000-0002-0696-8093"},"institutions":[{"id":"https://openalex.org/I150517870","display_name":"Royal Military Academy","ror":"https://ror.org/02vmnye06","country_code":"BE","type":"education","lineage":["https://openalex.org/I150517870"]}],"countries":["BE"],"is_corresponding":false,"raw_author_name":"Wim Mees","raw_affiliation_strings":["Research Unit for Cyber Defense, Royal Military Academy,Brussels,Belgium","Research Unit for Cyber Defense, Royal Military Academy, Brussels, Belgium"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Unit for Cyber Defense, Royal Military Academy,Brussels,Belgium","institution_ids":["https://openalex.org/I150517870"]},{"raw_affiliation_string":"Research Unit for Cyber Defense, Royal Military Academy, Brussels, Belgium","institution_ids":["https://openalex.org/I150517870"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I150517870"],"apc_list":null,"apc_paid":null,"fwci":0.4356,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.59528125,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":96},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10799","display_name":"Data Visualization and Analytics","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/visual-analytics","display_name":"Visual analytics","score":0.7850640416145325},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7800297141075134},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7297028303146362},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.698795735836029},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6868067383766174},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.6016790270805359},{"id":"https://openalex.org/keywords/visualization","display_name":"Visualization","score":0.5889849066734314},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.571617841720581},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.527385950088501},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.45452654361724854},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.44314640760421753},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.4388326406478882},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2361530363559723},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.10013473033905029}],"concepts":[{"id":"https://openalex.org/C59732488","wikidata":"https://www.wikidata.org/wiki/Q2528440","display_name":"Visual analytics","level":3,"score":0.7850640416145325},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7800297141075134},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7297028303146362},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.698795735836029},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6868067383766174},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.6016790270805359},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.5889849066734314},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.571617841720581},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.527385950088501},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.45452654361724854},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44314640760421753},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4388326406478882},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2361530363559723},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.10013473033905029},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icmcis59922.2023.10253465","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1109/icmcis59922.2023.10253465","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 International Conference on Military Communications and Information Systems (ICMCIS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.4099999964237213,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W17263963","https://openalex.org/W93469597","https://openalex.org/W405461467","https://openalex.org/W1674877186","https://openalex.org/W1823329909","https://openalex.org/W1983576710","https://openalex.org/W2034836133","https://openalex.org/W2043498719","https://openalex.org/W2060565253","https://openalex.org/W2110017066","https://openalex.org/W2116995505","https://openalex.org/W2120969335","https://openalex.org/W2124808847","https://openalex.org/W2141115795","https://openalex.org/W2148185569","https://openalex.org/W2342320086","https://openalex.org/W2527276559","https://openalex.org/W2533698187","https://openalex.org/W2611745632","https://openalex.org/W2766581748","https://openalex.org/W2784097977","https://openalex.org/W2884020303","https://openalex.org/W2938555005","https://openalex.org/W2971624397","https://openalex.org/W2973834203","https://openalex.org/W2998074434","https://openalex.org/W3004179294","https://openalex.org/W3043379545","https://openalex.org/W4239895564","https://openalex.org/W6637096788","https://openalex.org/W6792224288"],"related_works":["https://openalex.org/W2789663798","https://openalex.org/W2375896275","https://openalex.org/W2166943775","https://openalex.org/W1903420481","https://openalex.org/W2158007046","https://openalex.org/W2312996858","https://openalex.org/W2392120181","https://openalex.org/W2307276533","https://openalex.org/W2390124310","https://openalex.org/W2594597562"],"abstract_inverted_index":{"With":[0],"the":[1,5,8,54,59,75,78,88,120,132,138,184,198,212,222,231],"rapid":[2,22],"evolution":[3],"of":[4,10,24,34,80,97,110,134,140,165,186,200],"Internet":[6],"and":[7,44,72,86,126,142,158,177,197,202,215],"prevalence":[9],"sophisticated":[11,101,151],"adversarial":[12],"cyber":[13,152],"threats,":[14],"it":[15,85],"has":[16],"become":[17,49],"apparent":[18],"that":[19],"an":[20],"equally":[21],"development":[23],"new":[25,64,129],"Situation":[26],"Awareness":[27],"techniques":[28],"is":[29,148],"needed.":[30],"The":[31,95],"vast":[32],"amount":[33],"data":[35],"produced":[36],"everyday":[37],"by":[38,53,154,221],"Intrusion":[39],"Detection":[40,194],"Systems,":[41],"Firewalls,":[42],"Honeypots":[43],"other":[45],"systems":[46,67],"can":[47,168,180],"quickly":[48],"insurmountable":[50],"to":[51,69,91,112,123,149,161,174],"analyze":[52],"domain":[55],"experts.":[56],"To":[57],"enhance":[58],"human":[60],"-":[61,230],"machine":[62],"interaction,":[63],"Visual":[65,124],"Analytics":[66,125],"need":[68],"be":[70,169,175,181],"implemented":[71],"tested,":[73],"bridging":[74],"gap":[76],"between":[77],"detection":[79,96,133],"possible":[81],"malicious":[82],"activity,":[83],"identifying":[84],"taking":[87],"necessary":[89],"measures":[90],"stop":[92],"its":[93],"propagation.":[94],"previously":[98],"unknown,":[99],"highly":[100],"Advanced":[102,191],"Persistent":[103,192],"Threats":[104],"(APT)":[105],"adds":[106],"a":[107,128,163],"higher":[108],"degree":[109],"complexity":[111],"this":[113,116],"task.":[114],"In":[115],"paper,":[117],"we":[118],"discuss":[119],"principles":[121],"inherent":[122],"propose":[127],"technique":[130],"for":[131,190],"APT":[135],"attacks":[136],"through":[137,183],"use":[139,185],"anomaly":[141],"behavior-based":[143],"analysis.":[144],"Our":[145],"ultimate":[146],"goal":[147],"define":[150],"threats":[153],"their":[155],"defining":[156],"characteristics":[157],"combining":[159],"those":[160],"construct":[162],"pattern":[164],"behavior,":[166],"which":[167],"presented":[170,210],"in":[171,234],"visual":[172],"form":[173],"explored":[176],"analyzed.":[178],"This":[179,206],"achieved":[182],"our":[187],"Multi-Agent":[188],"System":[189],"Threat":[193],"(MASFAD)":[195],"framework":[196],"combination":[199],"highly-detailed":[201],"dynamic":[203],"visualization":[204],"techniques.":[205],"paper":[207],"was":[208],"originally":[209],"at":[211],"NATO":[213],"Science":[214],"Technology":[216,225],"Organization":[217],"Symposium":[218],"(ICMCIS)":[219],"organized":[220],"Information":[223],"Systems":[224],"(IST)":[226],"Panel,":[227],"IST-200":[228],"RSY":[229],"ICMCIS,":[232],"held":[233],"Skopje,":[235],"North":[236],"Macedonia,":[237],"16\u201317":[238],"May":[239],"2023.":[240]},"counts_by_year":[{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}