{"id":"https://openalex.org/W4393034384","doi":"https://doi.org/10.1109/tnsm.2024.3378972","title":"AUTOMA: Automated Generation of Attack Hypotheses and Their Variants for Threat Hunting Using Knowledge Discovery","display_name":"AUTOMA: Automated Generation of Attack Hypotheses and Their Variants for Threat Hunting Using Knowledge Discovery","publication_year":2024,"publication_date":"2024-03-21","ids":{"openalex":"https://openalex.org/W4393034384","doi":"https://doi.org/10.1109/tnsm.2024.3378972"},"language":"en","primary_location":{"id":"doi:10.1109/tnsm.2024.3378972","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2024.3378972","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073380087","display_name":"Boubakr Nour","orcid":"https://orcid.org/0000-0001-5609-856X"},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Boubakr Nour","raw_affiliation_strings":["GFTL Security Research, Ericsson, Montreal, QC, Canada"],"raw_orcid":"https://orcid.org/0000-0001-5609-856X","affiliations":[{"raw_affiliation_string":"GFTL Security Research, Ericsson, Montreal, QC, Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077892893","display_name":"Makan Pourzandi","orcid":"https://orcid.org/0000-0001-9775-6231"},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Makan Pourzandi","raw_affiliation_strings":["GFTL Security Research, Ericsson, Montreal, QC, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"GFTL Security Research, Ericsson, Montreal, QC, Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5094209598","display_name":"Rushaan Kamran Qureshi","orcid":"https://orcid.org/0009-0007-0032-7846"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Rushaan Kamran Qureshi","raw_affiliation_strings":["Gina Cody School of Engineering and Computer Science, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"],"raw_orcid":"https://orcid.org/0009-0007-0032-7846","affiliations":[{"raw_affiliation_string":"Gina Cody School of Engineering and Computer Science, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028605138","display_name":"Mourad Debbabi","orcid":"https://orcid.org/0000-0003-3015-3043"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["Gina Cody School of Engineering and Computer Science, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Gina Cody School of Engineering and Computer Science, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.1249,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":{"value":0.91901562,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"21","issue":"5","first_page":"5178","last_page":"5196"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.972599983215332,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.972599983215332,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9569000005722046,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9241999983787537,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7974476218223572},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.44290027022361755},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.34305065870285034}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7974476218223572},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44290027022361755},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.34305065870285034}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2024.3378972","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2024.3378972","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1562405179","https://openalex.org/W1973383391","https://openalex.org/W2026498605","https://openalex.org/W2027264060","https://openalex.org/W2077937403","https://openalex.org/W2082182279","https://openalex.org/W2100176599","https://openalex.org/W2109294083","https://openalex.org/W2111142701","https://openalex.org/W2152163260","https://openalex.org/W2278186031","https://openalex.org/W2560810941","https://openalex.org/W2586235276","https://openalex.org/W2794360330","https://openalex.org/W2818789173","https://openalex.org/W2886752452","https://openalex.org/W2890262614","https://openalex.org/W2917178550","https://openalex.org/W2962703433","https://openalex.org/W2962756421","https://openalex.org/W2963224980","https://openalex.org/W2992054303","https://openalex.org/W3010451506","https://openalex.org/W3088400220","https://openalex.org/W3128070938","https://openalex.org/W3153286407","https://openalex.org/W3190778120","https://openalex.org/W3196634763","https://openalex.org/W3204105300","https://openalex.org/W3211888892","https://openalex.org/W3211988487","https://openalex.org/W3214329506","https://openalex.org/W4206342677","https://openalex.org/W4206691071","https://openalex.org/W4252064021","https://openalex.org/W4280511617","https://openalex.org/W4281383000","https://openalex.org/W4297329009","https://openalex.org/W4303649477","https://openalex.org/W4313591697","https://openalex.org/W4318751320","https://openalex.org/W4321160088","https://openalex.org/W4385819961"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W2358668433","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W2382290278","https://openalex.org/W2478288626","https://openalex.org/W4391913857","https://openalex.org/W2350741829","https://openalex.org/W2530322880"],"abstract_inverted_index":{"Threat":[0],"hunting":[1],"is":[2,19,37,62,65,240],"a":[3,69,91,114,166,193,221,250],"proactive":[4],"security":[5,54],"defense":[6],"line":[7],"exercised":[8],"to":[9,25,39,67,124,132,242,255,262],"uncover":[10],"attacks":[11],"that":[12,93,238],"could":[13],"circumvent":[14],"conventional":[15],"detection":[16],"mechanisms.":[17],"It":[18],"based":[20,156],"on":[21,157],"an":[22,44],"iterative":[23],"approach":[24,186],"generate,":[26],"inspect,":[27],"and":[28,64,100,121,150,172,183,200,216,257,270],"revise":[29],"attack":[30,47,78,190,209,226],"hypotheses.":[31,129],"The":[32,56,234],"quality":[33],"of":[34,43,72,97,117,136,161,165,192,202,218],"these":[35,142],"hypotheses":[36,48,74,99,143],"essential":[38],"prove/refute":[40],"the":[41,77,85,95,108,126,134,137,158,162,169,173,198,214,244,267],"existence":[42],"attack.":[45],"Today,":[46],"are":[49,155],"often":[50],"generated":[51,138],"manually":[52],"by":[53,88,144],"analysts.":[55],"generation":[57,96],"process":[58],"requires":[59],"elusive":[60],"expertise,":[61],"costly,":[63],"prone":[66],"produce":[68],"large":[70,251],"number":[71],"irrelevant":[73],"without":[75],"considering":[76],"variants.":[79],"In":[80,130],"this":[81],"paper,":[82],"we":[83],"address":[84],"aforementioned":[86],"challenges":[87],"designing":[89],"AUTOMA,":[90],"solution":[92],"automates":[94],"relevant":[98,128,245,268],"their":[101,122],"variants":[102,191,274],"using":[103,220],"knowledge":[104,115,174],"discovery.":[105],"AUTOMA":[106,140,177,219,239],"incorporates":[107],"system":[109,170],"telemetry":[110,171],"in":[111,168,204],"combination":[112],"with":[113,207,249],"base":[116],"existing":[118],"attacks,":[119],"techniques,":[120],"relationships":[123],"mine":[125],"most":[127],"order":[131],"increase":[133],"relevance":[135],"hypotheses,":[139],"examines":[141],"applying":[145],"matching-based":[146],"similarity,":[147],"success,":[148,180],"likelihood,":[149],"criticality":[151],"evaluations.":[152],"These":[153],"evaluations":[154],"past":[159],"occurrences":[160],"techniques":[163],"part":[164],"hypothesis":[167,194,246,269],"base.":[175],"Additionally,":[176],"uses":[178],"sequence":[179,181],"alignment,":[182],"hierarchical":[184],"similarity":[185],"for":[187,224,265,273],"generating":[188],"potential":[189],"taking":[195],"into":[196],"account":[197],"dynamism":[199],"stealthiness":[201],"attackers":[203],"coming":[205],"up":[206],"alternative":[208],"steps.":[210],"We":[211],"extensively":[212],"evaluate":[213],"effectiveness":[215],"efficiency":[217],"real":[222],"dataset":[223],"284":[225],"campaigns":[227],"distributed":[228],"over":[229],"57":[230],"advanced":[231],"persistent":[232],"threats.":[233],"obtained":[235],"results":[236],"show":[237],"able":[241],"generate":[243],"(top":[247],"3),":[248],"reduction":[252],"rate":[253],"(up":[254,261],"99%),":[256],"fast":[258],"execution":[259],"time":[260],"8":[263],"minutes":[264],"proposing":[266],"10":[271],"seconds":[272],"generation).":[275]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":3}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}