{"id":"https://openalex.org/W4415933972","doi":"https://doi.org/10.1109/nof66640.2025.11223332","title":"Extracting Attack Testflows from Unstructured Cyber Threat Reports using Contextual Analysis","display_name":"Extracting Attack Testflows from Unstructured Cyber Threat Reports using Contextual Analysis","publication_year":2025,"publication_date":"2025-09-30","ids":{"openalex":"https://openalex.org/W4415933972","doi":"https://doi.org/10.1109/nof66640.2025.11223332"},"language":null,"primary_location":{"id":"doi:10.1109/nof66640.2025.11223332","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nof66640.2025.11223332","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 16th International Conference on Network of the Future (NoF)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017976911","display_name":"Faissal Ahmadou","orcid":"https://orcid.org/0000-0002-0198-9653"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Faissal Ahmadou","raw_affiliation_strings":["Concordia University,Montréal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montréal,Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120270168","display_name":"Sepehr Ghaffarzadegan","orcid":null},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Sepehr Ghaffarzadegan","raw_affiliation_strings":["Concordia University,Montréal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montréal,Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073380087","display_name":"Boubakr Nour","orcid":"https://orcid.org/0000-0001-5609-856X"},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Boubakr Nour","raw_affiliation_strings":["Ericsson Security Research,Montréal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ericsson Security Research,Montréal,Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077892893","display_name":"Makan Pourzandi","orcid":"https://orcid.org/0000-0001-9775-6231"},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Makan Pourzandi","raw_affiliation_strings":["Ericsson Security Research,Montréal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ericsson Security Research,Montréal,Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028605138","display_name":"Mourad Debbabi","orcid":"https://orcid.org/0000-0003-3015-3043"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["Concordia University,Montréal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montréal,Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072393948","display_name":"Chadi Assi","orcid":"https://orcid.org/0000-0002-3161-1846"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Chadi Assi","raw_affiliation_strings":["Concordia University,Montréal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia University,Montréal,Canada","institution_ids":["https://openalex.org/I60158472"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"91","last_page":"95"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5483999848365784,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5483999848365784,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.12479999661445618,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.08079999685287476,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6521999835968018},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.5533999800682068},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.4756999909877777},{"id":"https://openalex.org/keywords/public-security","display_name":"Public security","score":0.4300999939441681},{"id":"https://openalex.org/keywords/security-controls","display_name":"Security controls","score":0.3944000005722046},{"id":"https://openalex.org/keywords/unstructured-data","display_name":"Unstructured data","score":0.37630000710487366},{"id":"https://openalex.org/keywords/threat-assessment","display_name":"Threat assessment","score":0.36980000138282776},{"id":"https://openalex.org/keywords/information-extraction","display_name":"Information extraction","score":0.35760000348091125},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.34869998693466187}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7584999799728394},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7135999798774719},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6521999835968018},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.5533999800682068},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.4756999909877777},{"id":"https://openalex.org/C2986045029","wikidata":"https://www.wikidata.org/wiki/Q294240","display_name":"Public security","level":2,"score":0.4300999939441681},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.3944000005722046},{"id":"https://openalex.org/C2781252014","wikidata":"https://www.wikidata.org/wiki/Q1141900","display_name":"Unstructured data","level":3,"score":0.37630000710487366},{"id":"https://openalex.org/C2778868856","wikidata":"https://www.wikidata.org/wiki/Q18394273","display_name":"Threat assessment","level":2,"score":0.36980000138282776},{"id":"https://openalex.org/C195807954","wikidata":"https://www.wikidata.org/wiki/Q1662562","display_name":"Information extraction","level":2,"score":0.35760000348091125},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.34869998693466187},{"id":"https://openalex.org/C71611378","wikidata":"https://www.wikidata.org/wiki/Q5165191","display_name":"Contextual design","level":3,"score":0.34279999136924744},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.33730000257492065},{"id":"https://openalex.org/C2777466982","wikidata":"https://www.wikidata.org/wiki/Q5227287","display_name":"Data extraction","level":3,"score":0.3359000086784363},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.32820001244544983},{"id":"https://openalex.org/C52085439","wikidata":"https://www.wikidata.org/wiki/Q5165173","display_name":"Context analysis","level":3,"score":0.3192000091075897},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.31679999828338623},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.29989999532699585},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.2985000014305115},{"id":"https://openalex.org/C169806903","wikidata":"https://www.wikidata.org/wiki/Q5937752","display_name":"Human error","level":2,"score":0.2888999879360199},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2703999876976013},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2694999873638153},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26930001378059387},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.26570001244544983},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.26159998774528503},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.260699987411499},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.2563999891281128}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/nof66640.2025.11223332","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nof66640.2025.11223332","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 16th International Conference on Network of the Future (NoF)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":9,"referenced_works":["https://openalex.org/W2771963642","https://openalex.org/W2910711617","https://openalex.org/W3176367300","https://openalex.org/W3214329506","https://openalex.org/W4377970407","https://openalex.org/W4383900630","https://openalex.org/W4387298166","https://openalex.org/W4391877047","https://openalex.org/W4392947753"],"related_works":[],"abstract_inverted_index":{"In":[0],"the":[1,6,27,74,132],"ever-evolving":[2],"landscape":[3],"of":[4,11,76,134],"cybersecurity,":[5],"rapid":[7],"identification":[8],"and":[9,30,47,50,66,86,93,105,114,128,141],"mitigation":[10],"Advanced":[12],"Persistent":[13],"Threats":[14],"(APTs)":[15],"is":[16,48],"crucial.":[17],"Security":[18],"practitioners":[19],"rely":[20],"on":[21],"detailed":[22],"threat":[23,81,123,139],"reports":[24,43,124],"to":[25,52,72],"understand":[26],"tactics,":[28],"techniques,":[29],"procedures":[31],"(TTPs)":[32],"employed":[33],"by":[34],"attackers.":[35],"However,":[36],"manually":[37],"extracting":[38],"attack":[39,77,91],"testflows":[40,78],"from":[41,79],"these":[42],"requires":[44],"elusive":[45],"knowledge":[46],"time-consuming":[49],"prone":[51],"errors.":[53],"This":[54,98],"paper":[55],"proposes":[56],"FLOWGUARDIAN,":[57],"a":[58],"novel":[59],"solution":[60],"leveraging":[61],"language":[62],"models":[63],"(i.e.,":[64],"BERT)":[65],"Natural":[67],"Language":[68],"Processing":[69],"(NLP)":[70],"techniques":[71],"automate":[73],"extraction":[75],"unstructured":[80],"reports.":[82],"FLOWGUARDIAN":[83],"systematically":[84],"analyzes":[85],"contextualizes":[87],"security":[88,135],"events,":[89],"reconstructs":[90],"sequences,":[92],"then":[94],"generates":[95],"comprehensive":[96,112],"testflows.":[97],"automated":[99],"approach":[100],"not":[101],"only":[102],"saves":[103],"time":[104],"reduces":[106],"human":[107],"error":[108],"but":[109],"also":[110],"ensures":[111],"coverage":[113],"robustness":[115],"in":[116,137],"cybersecurity":[117],"testing.":[118],"Empirical":[119],"validation":[120],"using":[121],"public":[122],"demonstrates":[125],"FLOWGUARDIAN\u2019s":[126],"accuracy":[127],"efficiency,":[129],"significantly":[130],"enhancing":[131],"capabilities":[133],"teams":[136],"proactive":[138],"hunting":[140],"incident":[142],"response.":[143]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-11-05T00:00:00"}