{"id":"https://openalex.org/W4411143840","doi":"https://doi.org/10.1109/tifs.2025.3578233","title":"MuCamp: Generating Cyber Campaign Variants via TTP Synonym Replacement for Group Attribution","display_name":"MuCamp: Generating Cyber Campaign Variants via TTP Synonym Replacement for Group Attribution","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4411143840","doi":"https://doi.org/10.1109/tifs.2025.3578233"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3578233","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3578233","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064588553","display_name":"Inseop Lee","orcid":"https://orcid.org/0000-0002-9822-9860"},"institutions":[{"id":"https://openalex.org/I1344042128","display_name":"Ministry of National Defense","ror":"https://ror.org/05hfet039","country_code":"KR","type":"government","lineage":["https://openalex.org/I1344042128","https://openalex.org/I2801339556"]},{"id":"https://openalex.org/I2801036362","display_name":"Agency for Defense Development","ror":"https://ror.org/05fhe0r85","country_code":"KR","type":"government","lineage":["https://openalex.org/I1327899338","https://openalex.org/I1344042128","https://openalex.org/I2801036362","https://openalex.org/I2801339556"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Insup Lee","raw_affiliation_strings":["Agency for Defense Development, Daejeon, Republic of Korea","Ministry of National Defense, Seoul, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-9822-9860","affiliations":[{"raw_affiliation_string":"Agency for Defense Development, Daejeon, Republic of Korea","institution_ids":["https://openalex.org/I2801036362"]},{"raw_affiliation_string":"Ministry of National Defense, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I1344042128"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5069859356","display_name":"Chang-Hee Choi","orcid":"https://orcid.org/0009-0005-4302-3522"},"institutions":[{"id":"https://openalex.org/I2801036362","display_name":"Agency for Defense Development","ror":"https://ror.org/05fhe0r85","country_code":"KR","type":"government","lineage":["https://openalex.org/I1327899338","https://openalex.org/I1344042128","https://openalex.org/I2801036362","https://openalex.org/I2801339556"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Changhee Choi","raw_affiliation_strings":["Agency for Defense Development, Daejeon, Republic of Korea","Agency for Defense Development, Republic of Korea"],"raw_orcid":"https://orcid.org/0009-0005-4302-3522","affiliations":[{"raw_affiliation_string":"Agency for Defense Development, Daejeon, Republic of Korea","institution_ids":["https://openalex.org/I2801036362"]},{"raw_affiliation_string":"Agency for Defense Development, Republic of Korea","institution_ids":["https://openalex.org/I2801036362"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":4.498,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.94175356,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"20","issue":null,"first_page":"6162","last_page":"6174"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9430000185966492,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9430000185966492,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13083","display_name":"Advanced Text Analysis Techniques","score":0.9333999752998352,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7343512177467346},{"id":"https://openalex.org/keywords/synonym","display_name":"Synonym (taxonomy)","score":0.6587912440299988},{"id":"https://openalex.org/keywords/attribution","display_name":"Attribution","score":0.55808424949646},{"id":"https://openalex.org/keywords/group","display_name":"Group (periodic table)","score":0.502377986907959},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.40133100748062134},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.33275091648101807},{"id":"https://openalex.org/keywords/biology","display_name":"Biology","score":0.08725625276565552},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.07820463180541992}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7343512177467346},{"id":"https://openalex.org/C173483453","wikidata":"https://www.wikidata.org/wiki/Q1040689","display_name":"Synonym (taxonomy)","level":3,"score":0.6587912440299988},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.55808424949646},{"id":"https://openalex.org/C2781311116","wikidata":"https://www.wikidata.org/wiki/Q83306","display_name":"Group (periodic table)","level":2,"score":0.502377986907959},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.40133100748062134},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.33275091648101807},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.08725625276565552},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.07820463180541992},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C178790620","wikidata":"https://www.wikidata.org/wiki/Q11351","display_name":"Organic chemistry","level":1,"score":0.0},{"id":"https://openalex.org/C59822182","wikidata":"https://www.wikidata.org/wiki/Q441","display_name":"Botany","level":1,"score":0.0},{"id":"https://openalex.org/C157369684","wikidata":"https://www.wikidata.org/wiki/Q34740","display_name":"Genus","level":2,"score":0.0},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3578233","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3578233","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320323103","display_name":"Agency for Defense Development","ror":"https://ror.org/05fhe0r85"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1936523258","https://openalex.org/W1974189812","https://openalex.org/W2148143831","https://openalex.org/W2889836475","https://openalex.org/W2892116995","https://openalex.org/W2964268978","https://openalex.org/W2964522977","https://openalex.org/W2971296908","https://openalex.org/W3005127313","https://openalex.org/W3006997833","https://openalex.org/W3033923469","https://openalex.org/W3042362244","https://openalex.org/W3045858585","https://openalex.org/W3093538749","https://openalex.org/W3130970113","https://openalex.org/W3137205257","https://openalex.org/W3185502221","https://openalex.org/W3203348211","https://openalex.org/W3212868562","https://openalex.org/W4206101301","https://openalex.org/W4224234142","https://openalex.org/W4224923662","https://openalex.org/W4231337418","https://openalex.org/W4285191190","https://openalex.org/W4285198896","https://openalex.org/W4304759028","https://openalex.org/W4312676126","https://openalex.org/W4312826181","https://openalex.org/W4312892982","https://openalex.org/W4366386430","https://openalex.org/W4379054317","https://openalex.org/W4385975676","https://openalex.org/W4387298166","https://openalex.org/W4387415286","https://openalex.org/W4403123573","https://openalex.org/W4404731747","https://openalex.org/W4404734700","https://openalex.org/W4406753841","https://openalex.org/W6679436768","https://openalex.org/W6776615434","https://openalex.org/W6786622127","https://openalex.org/W6796237833","https://openalex.org/W6852172876"],"related_works":["https://openalex.org/W2035546108","https://openalex.org/W2376361520","https://openalex.org/W2133328864","https://openalex.org/W2093949997","https://openalex.org/W2570200690","https://openalex.org/W2389726244","https://openalex.org/W3030478661","https://openalex.org/W2323536476","https://openalex.org/W2104624653","https://openalex.org/W2128730003"],"abstract_inverted_index":{"As":[0],"cyberattack":[1],"operators":[2],"have":[3],"progressed":[4],"to":[5,27,158,195],"encompass":[6],"group":[7,197,206],"and":[8,41,66,115,131,144,154,179],"nation-state":[9],"levels,":[10],"the":[11,49,60,68,91,100,133,137,201,204],"nature":[12],"of":[13,52,63,70,93,103,136,168,192,203],"attacks":[14],"has":[15,44],"evolved":[16],"into":[17],"more":[18],"sophisticated":[19],"forms":[20],"such":[21],"as":[22],"cyber":[23,32],"campaigns.":[24,139],"In":[25],"response":[26],"these":[28],"large-scale":[29,104],"campaigns,":[30],"tactical":[31,53],"threat":[33,160],"intelligence":[34],"(CTI)":[35],"which":[36],"focuses":[37],"on":[38,117],"tactics,":[39],"techniques,":[40,181],"procedures":[42],"(TTPs)":[43],"gained":[45],"significant":[46],"attention.":[47],"However,":[48],"data-driven":[50],"aspects":[51],"CTI":[54,149],"confront":[55],"two":[56],"primary":[57],"challenges:":[58],"(i)":[59],"extreme":[61],"scarcity":[62,153],"campaign":[64,85,95,123],"data":[65,96,152],"(ii)":[67],"difficulty":[69],"effectively":[71,211],"integrating":[72],"security":[73,174],"domain":[74,213],"knowledge.":[75,214],"To":[76],"this":[77,79,118],"end,":[78],"paper":[80],"presents":[81],"MuCamp,":[82],"a":[83,142,165],"novel":[84],"generation":[86],"method":[87,108],"that":[88,110,189],"operates":[89],"in":[90],"context":[92],"limited":[94],"while":[97,210],"also":[98,163],"considering":[99],"unique":[101],"characteristics":[102],"attacks.":[105],"The":[106],"proposed":[107],"assumes":[109],"campaigns":[111,171],"are":[112],"TTP":[113,128],"sequences,":[114],"based":[116],"assumption,":[119],"it":[120],"generates":[121],"valid":[122],"variants":[124],"by":[125,173,199],"replacing":[126],"target":[127],"words":[129],"withTTPsynonyms,":[130],"preserves":[132],"strategic":[134],"goals":[135],"seed":[138],"MuCamp":[140,193],"offers":[141],"scalable":[143],"interpretable":[145],"augmentation":[146],"strategy,":[147],"enhancing":[148],"effectiveness":[150],"under":[151],"facilitating":[155],"rapid":[156],"adaptation":[157],"evolving":[159],"landscapes.":[161],"We":[162],"prepared":[164],"dataset":[166],"consisting":[167],"858":[169],"real-world":[170],"labeled":[172],"experts,":[175],"including":[176],"14":[177],"tactics":[178],"206":[180],"enabling":[182],"reliable":[183],"performance":[184],"evaluation.":[185],"Experimental":[186],"results":[187],"demonstrate":[188],"each":[190],"component":[191],"contributes":[194],"embedding-based":[196],"attribution":[198],"improving":[200],"separability":[202],"correct":[205],"from":[207],"alternative":[208],"candidates,":[209],"reflecting":[212]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}