{"id":"https://openalex.org/W4389629105","doi":"https://doi.org/10.1109/icspis60075.2023.10343783","title":"Automated Mapping Method for Sysmon Logs to ATT&CK Techniques by Leveraging Atomic Red Team","display_name":"Automated Mapping Method for Sysmon Logs to ATT&CK Techniques by Leveraging Atomic Red Team","publication_year":2023,"publication_date":"2023-11-08","ids":{"openalex":"https://openalex.org/W4389629105","doi":"https://doi.org/10.1109/icspis60075.2023.10343783"},"language":"en","primary_location":{"id":"doi:10.1109/icspis60075.2023.10343783","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icspis60075.2023.10343783","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 6th International Conference on Signal Processing and Information Security (ICSPIS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076761458","display_name":"Momoka Okuma","orcid":null},"institutions":[{"id":"https://openalex.org/I158123994","display_name":"Toyo University","ror":"https://ror.org/059d6yn51","country_code":"JP","type":"education","lineage":["https://openalex.org/I158123994"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Momoka Okuma","raw_affiliation_strings":["Toyo University,INIAD,Tokyo,Japan","INIAD, Toyo University, Tokyo, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Toyo University,INIAD,Tokyo,Japan","institution_ids":["https://openalex.org/I158123994"]},{"raw_affiliation_string":"INIAD, Toyo University, Tokyo, Japan","institution_ids":["https://openalex.org/I158123994"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015056725","display_name":"Koki Watarai","orcid":null},"institutions":[{"id":"https://openalex.org/I158123994","display_name":"Toyo University","ror":"https://ror.org/059d6yn51","country_code":"JP","type":"education","lineage":["https://openalex.org/I158123994"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Koki Watarai","raw_affiliation_strings":["Toyo University,INIAD,Tokyo,Japan","INIAD, Toyo University, Tokyo, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Toyo University,INIAD,Tokyo,Japan","institution_ids":["https://openalex.org/I158123994"]},{"raw_affiliation_string":"INIAD, Toyo University, Tokyo, Japan","institution_ids":["https://openalex.org/I158123994"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035470984","display_name":"Satoshi Okada","orcid":"https://orcid.org/0000-0003-0894-6477"},"institutions":[{"id":"https://openalex.org/I158123994","display_name":"Toyo University","ror":"https://ror.org/059d6yn51","country_code":"JP","type":"education","lineage":["https://openalex.org/I158123994"]},{"id":"https://openalex.org/I74801974","display_name":"The University of Tokyo","ror":"https://ror.org/057zh3y96","country_code":"JP","type":"education","lineage":["https://openalex.org/I74801974"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Satoshi Okada","raw_affiliation_strings":["Toyo University The University of Tokyo,INIAD,Tokyo,Japan","INIAD, Toyo University The University of Tokyo, Tokyo, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Toyo University The University of Tokyo,INIAD,Tokyo,Japan","institution_ids":["https://openalex.org/I158123994"]},{"raw_affiliation_string":"INIAD, Toyo University The University of Tokyo, Tokyo, Japan","institution_ids":["https://openalex.org/I158123994","https://openalex.org/I74801974"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058910521","display_name":"Takuho Mitsunaga","orcid":"https://orcid.org/0009-0003-0089-7997"},"institutions":[{"id":"https://openalex.org/I158123994","display_name":"Toyo University","ror":"https://ror.org/059d6yn51","country_code":"JP","type":"education","lineage":["https://openalex.org/I158123994"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Takuho Mitsunaga","raw_affiliation_strings":["Toyo University The Tokyo Foundation for Policy Research,INIAD,Tokyo,Japan","INIAD, Toyo University The Tokyo Foundation for Policy Research, Tokyo, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Toyo University The Tokyo Foundation for Policy Research,INIAD,Tokyo,Japan","institution_ids":["https://openalex.org/I158123994"]},{"raw_affiliation_string":"INIAD, Toyo University The Tokyo Foundation for Policy Research, Tokyo, Japan","institution_ids":["https://openalex.org/I158123994"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.2654,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":{"value":0.93824868,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"104","last_page":"109"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7391045689582825},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.6107974052429199},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.385333776473999},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.33993035554885864},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.26397815346717834}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7391045689582825},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.6107974052429199},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.385333776473999},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33993035554885864},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.26397815346717834}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icspis60075.2023.10343783","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icspis60075.2023.10343783","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 6th International Conference on Signal Processing and Information Security (ICSPIS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":9,"referenced_works":["https://openalex.org/W1980867644","https://openalex.org/W3003546211","https://openalex.org/W4283650315","https://openalex.org/W4294343684","https://openalex.org/W4308086462","https://openalex.org/W4318969265","https://openalex.org/W4318969511","https://openalex.org/W4394911615","https://openalex.org/W6774337651"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W2358668433","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W2382290278","https://openalex.org/W2350741829","https://openalex.org/W2530322880","https://openalex.org/W1596801655","https://openalex.org/W2359140296"],"abstract_inverted_index":{"As":[0],"cyber-attacks":[1],"escalate":[2],"in":[3],"frequency":[4],"and":[5,34,47,52,64,68,105,112,127,143],"complexity,":[6],"the":[7,74],"world\u2019s":[8],"most":[9],"widely":[10],"used":[11],"operating":[12],"system,":[13],"Windows,":[14,23],"is":[15,50,76,106,122,136],"often":[16],"targeted.":[17],"Sysmon,":[18],"a":[19,25,40,86,174],"monitoring":[20],"tool":[21],"for":[22,54,78],"collects":[24],"lot":[26],"of":[27,151,159,177],"system":[28],"activity":[29],"logs":[30,92,147],"including":[31],"process":[32],"creation":[33],"network":[35],"connections.":[36],"Also,":[37],"it":[38,113,135],"has":[39],"possibility":[41],"to":[42,93,116,124,138],"log":[43,115],"adversaries\u2019s":[44],"malicious":[45],"actions":[46],"its":[48],"data":[49],"valuable":[51],"useful":[53],"cyber":[55,140],"attack":[56,66,75,141,167],"analysis.":[57],"However,":[58],"manually":[59],"analyzing":[60],"this":[61,81,83,133],"huge":[62],"amount":[63],"complex":[65],"data,":[67],"moreover":[69],"considering":[70],"effective":[71],"countermeasures":[72],"against":[73],"difficult":[77],"analysts.":[79],"Addressing":[80],"problem,":[82],"paper":[84],"proposes":[85],"method":[87,98],"that":[88,157],"automates":[89],"maps":[90,114],"Sysmon":[91,146],"MITRE":[94],"ATT&CK":[95,118,121],"techniques.":[96],"Our":[97],"leverages":[99],"Atomic":[100],"Red":[101],"Team\u2019s":[102],"attack-simulating":[103],"dataset,":[104],"based":[107,164],"on":[108,165],"executed":[109],"command":[110,162],"lines,":[111],"an":[117],"technique.":[119],"MITER":[120],"linked":[123],"specific":[125],"mitigation":[126,142],"detection":[128,144],"methods.":[129],"Hence,":[130],"by":[131],"automating":[132],"mapping,":[134],"possible":[137],"correlate":[139],"from":[145],"efficiently.":[148],"An":[149],"evaluation":[150],"our":[152],"method\u2019s":[153],"mapping":[154],"accuracy":[155],"revealed":[156],"out":[158],"36":[160],"test":[161],"lines":[163],"real-world":[166],"scenarios,":[168],"34":[169],"were":[170],"accurately":[171],"mapped,":[172],"marking":[173],"success":[175],"rate":[176],"96%.":[178]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}