{"id":"https://openalex.org/W2562792568","doi":"https://doi.org/10.1109/milcom.2016.7795424","title":"\u201cI know what you did before\u201d: General framework for correlation analysis of cyber threat incidents","display_name":"\u201cI know what you did before\u201d: General framework for correlation analysis of cyber threat incidents","publication_year":2016,"publication_date":"2016-11-01","ids":{"openalex":"https://openalex.org/W2562792568","doi":"https://doi.org/10.1109/milcom.2016.7795424","mag":"2562792568"},"language":"en","primary_location":{"id":"doi:10.1109/milcom.2016.7795424","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom.2016.7795424","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2016 - 2016 IEEE Military Communications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064846122","display_name":"Daegeon Kim","orcid":"https://orcid.org/0000-0002-6142-9682"},"institutions":[{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Daegeon Kim","raw_affiliation_strings":["Graduate School of Information Security, Korea University, Seoul, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Security, Korea University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I197347611"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027662394","display_name":"Jiyoung Woo","orcid":"https://orcid.org/0000-0001-8231-0018"},"institutions":[{"id":"https://openalex.org/I24541011","display_name":"Soonchunhyang University","ror":"https://ror.org/03qjsrb10","country_code":"KR","type":"education","lineage":["https://openalex.org/I24541011"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"JiYoung Woo","raw_affiliation_strings":["Department of Big Data Engineering, Soonchunghyang University, Asan, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Big Data Engineering, Soonchunghyang University, Asan, Republic of Korea","institution_ids":["https://openalex.org/I24541011"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5091602017","display_name":"Huy Kang Kim","orcid":"https://orcid.org/0000-0002-0760-8807"},"institutions":[{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Huy Kang Kim","raw_affiliation_strings":["Graduate School of Information Security, Korea University, Seoul, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Security, Korea University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I197347611"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"2","issue":null,"first_page":"782","last_page":"787"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7077379822731018},{"id":"https://openalex.org/keywords/usability","display_name":"Usability","score":0.6288725137710571},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5442202091217041},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5386497974395752},{"id":"https://openalex.org/keywords/cyber-threats","display_name":"Cyber threats","score":0.4890623986721039},{"id":"https://openalex.org/keywords/relation","display_name":"Relation (database)","score":0.43530458211898804},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4343235194683075},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.362687885761261},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.33529388904571533},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.3219221830368042},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.16715306043624878},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.08173888921737671},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.06907385587692261}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7077379822731018},{"id":"https://openalex.org/C170130773","wikidata":"https://www.wikidata.org/wiki/Q216378","display_name":"Usability","level":2,"score":0.6288725137710571},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5442202091217041},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5386497974395752},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.4890623986721039},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.43530458211898804},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4343235194683075},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.362687885761261},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33529388904571533},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3219221830368042},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.16715306043624878},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.08173888921737671},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.06907385587692261},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/milcom.2016.7795424","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom.2016.7795424","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2016 - 2016 IEEE Military Communications Conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/17","display_name":"Partnerships for the goals","score":0.46000000834465027}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":7,"referenced_works":["https://openalex.org/W1494372926","https://openalex.org/W2013627100","https://openalex.org/W2134626688","https://openalex.org/W2155421596","https://openalex.org/W2406116398","https://openalex.org/W4234110021","https://openalex.org/W6714007974"],"related_works":["https://openalex.org/W4389670110","https://openalex.org/W2429057255","https://openalex.org/W2187546663","https://openalex.org/W148745890","https://openalex.org/W2611942503","https://openalex.org/W4315621326","https://openalex.org/W2899790217","https://openalex.org/W2598865957","https://openalex.org/W1576092969","https://openalex.org/W2524154428"],"abstract_inverted_index":{"The":[0],"importance":[1],"of":[2,69,75,92,118,141],"correlation":[3,90,147],"analysis":[4,70,91],"between":[5],"cyber":[6,25,35,59,93],"threat":[7,94],"incidents":[8,95],"using":[9,96],"Cyber":[10],"Threat":[11],"Intelligence":[12],"(CTI)":[13],"from":[14],"multiple":[15],"sources":[16],"is":[17,122],"growing":[18],"for":[19,45,145],"the":[20,63,67,73,88,99,106,115,119,130,139,146],"enhanced":[21],"international":[22],"collaboration":[23],"on":[24,133],"threats.":[26,36,60],"Well-analyzed":[27],"CTI":[28,47,135],"can":[29],"increase":[30,52],"capabilities":[31],"to":[32,51,56,86],"deter":[33],"possible":[34],"To":[37,77],"this":[38,79],"end,":[39],"many":[40],"standards":[41,64],"have":[42],"been":[43],"proposed":[44],"efficient":[46,89],"expression":[48],"and":[49,55,114,143],"sharing":[50],"attack":[53],"tractability":[54],"prevent":[57],"future":[58],"Even":[61],"though":[62],"are":[65,103],"proposed,":[66],"lack":[68],"methodologies":[71],"reduces":[72],"usability":[74],"CTI.":[76,97],"overcome":[78],"limitation,":[80],"we":[81,137],"propose":[82],"a":[83],"general":[84],"framework":[85],"support":[87],"In":[98],"framework,":[100],"related":[101],"events":[102],"represented":[104],"by":[105,124],"tree":[107],"structure":[108],"named":[109],"Event":[110,125],"Relation":[111],"Tree":[112],"(ERT),":[113],"temporal":[116],"transition":[117],"event":[120],"characteristics":[121],"expressed":[123],"Transition":[126],"Graph":[127],"(ETG).":[128],"Through":[129],"case":[131],"studies":[132],"our":[134],"dataset,":[136],"show":[138],"usefulness":[140],"ERT":[142],"ETG":[144],"analysis.":[148]},"counts_by_year":[{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2},{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}