{"id":"https://openalex.org/W4323338438","doi":"https://doi.org/10.1109/tsc.2023.3253307","title":"A Novel Team Formation Framework Based on Performance in a Cybersecurity Operations Center","display_name":"A Novel Team Formation Framework Based on Performance in a Cybersecurity Operations Center","publication_year":2023,"publication_date":"2023-03-06","ids":{"openalex":"https://openalex.org/W4323338438","doi":"https://doi.org/10.1109/tsc.2023.3253307"},"language":"en","primary_location":{"id":"doi:10.1109/tsc.2023.3253307","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tsc.2023.3253307","pdf_url":null,"source":{"id":"https://openalex.org/S204223317","display_name":"IEEE Transactions on Services Computing","issn_l":"1939-1374","issn":["1939-1374","2372-0204"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Services Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046576682","display_name":"Ankit Shah","orcid":"https://orcid.org/0000-0002-8314-6392"},"institutions":[{"id":"https://openalex.org/I2613432","display_name":"University of South Florida","ror":"https://ror.org/032db5x82","country_code":"US","type":"education","lineage":["https://openalex.org/I2613432"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ankit Shah","raw_affiliation_strings":["University of South Florida, Tampa, FL, USA"],"raw_orcid":"https://orcid.org/0000-0002-8314-6392","affiliations":[{"raw_affiliation_string":"University of South Florida, Tampa, FL, USA","institution_ids":["https://openalex.org/I2613432"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080033909","display_name":"Rajesh Ganesan","orcid":"https://orcid.org/0000-0003-1875-548X"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rajesh Ganesan","raw_affiliation_strings":["Center for Secure Information Systems, George Mason University, Fairfax, VA, USA"],"raw_orcid":"https://orcid.org/0000-0003-1875-548X","affiliations":[{"raw_affiliation_string":"Center for Secure Information Systems, George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010727123","display_name":"Sushil Jajodia","orcid":"https://orcid.org/0000-0003-3210-558X"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sushil Jajodia","raw_affiliation_strings":["Center for Secure Information Systems, George Mason University, Fairfax, VA, USA"],"raw_orcid":"https://orcid.org/0000-0003-3210-558X","affiliations":[{"raw_affiliation_string":"Center for Secure Information Systems, George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002845585","display_name":"Hasan \u00c7am","orcid":"https://orcid.org/0000-0002-3531-7003"},"institutions":[{"id":"https://openalex.org/I166416128","display_name":"DEVCOM Army Research Laboratory","ror":"https://ror.org/011hc8f90","country_code":"US","type":"government","lineage":["https://openalex.org/I1304082316","https://openalex.org/I1330347796","https://openalex.org/I166416128","https://openalex.org/I2802705668","https://openalex.org/I4210154437"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hasan Cam","raw_affiliation_strings":["Army Research Laboratory, Adelphi, MD, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Army Research Laboratory, Adelphi, MD, USA","institution_ids":["https://openalex.org/I166416128"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016706843","display_name":"Steve Hutchinson","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Steve Hutchinson","raw_affiliation_strings":["Maryland Innovation and Security Institute, Columbia, MD, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Maryland Innovation and Security Institute, Columbia, MD, USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.1762,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":{"value":0.95556048,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"16","issue":"4","first_page":"2359","last_page":"2371"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10970","display_name":"Team Dynamics and Performance","score":0.9864000082015991,"subfield":{"id":"https://openalex.org/subfields/3207","display_name":"Social Psychology"},"field":{"id":"https://openalex.org/fields/32","display_name":"Psychology"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9057000279426575,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7889183163642883},{"id":"https://openalex.org/keywords/metric","display_name":"Metric (unit)","score":0.6215532422065735},{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.413750559091568},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.39566561579704285},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.36473512649536133},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.3418223261833191},{"id":"https://openalex.org/keywords/operations-management","display_name":"Operations management","score":0.11352339386940002},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.08776980638504028}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7889183163642883},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.6215532422065735},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.413750559091568},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.39566561579704285},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.36473512649536133},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3418223261833191},{"id":"https://openalex.org/C21547014","wikidata":"https://www.wikidata.org/wiki/Q1423657","display_name":"Operations management","level":1,"score":0.11352339386940002},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.08776980638504028},{"id":"https://openalex.org/C78458016","wikidata":"https://www.wikidata.org/wiki/Q840400","display_name":"Evolutionary biology","level":1,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tsc.2023.3253307","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tsc.2023.3253307","pdf_url":null,"source":{"id":"https://openalex.org/S204223317","display_name":"IEEE Transactions on Services Computing","issn_l":"1939-1374","issn":["1939-1374","2372-0204"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Services Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1801732737","display_name":null,"funder_award_id":"N00014-18-1-2670","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G2119979900","display_name":null,"funder_award_id":"CNS-1822094","funder_id":"https://openalex.org/F4320335353","funder_display_name":"National Science Foundation of Sri Lanka"},{"id":"https://openalex.org/G3404260178","display_name":null,"funder_award_id":"N00014-20-1-2407","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"}],"funders":[{"id":"https://openalex.org/F4320335353","display_name":"National Science Foundation of Sri Lanka","ror":"https://ror.org/010xaa060"},{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W109631643","https://openalex.org/W1494756088","https://openalex.org/W1982700507","https://openalex.org/W2004632618","https://openalex.org/W2012082729","https://openalex.org/W2034944426","https://openalex.org/W2045883408","https://openalex.org/W2107358904","https://openalex.org/W2108183130","https://openalex.org/W2113156617","https://openalex.org/W2133800002","https://openalex.org/W2188383940","https://openalex.org/W2506654222","https://openalex.org/W2518687972","https://openalex.org/W2573229068","https://openalex.org/W2588452010","https://openalex.org/W2593932391","https://openalex.org/W2765702350","https://openalex.org/W2767799834","https://openalex.org/W2795461338","https://openalex.org/W2800771502","https://openalex.org/W2802236629","https://openalex.org/W2891331030","https://openalex.org/W2964753394","https://openalex.org/W3013184828","https://openalex.org/W3123020175","https://openalex.org/W3128155874","https://openalex.org/W6724834502","https://openalex.org/W6766551778"],"related_works":["https://openalex.org/W2959160600","https://openalex.org/W2142113611","https://openalex.org/W2119956050","https://openalex.org/W2056065776","https://openalex.org/W4324301570","https://openalex.org/W2045629210","https://openalex.org/W2017927971","https://openalex.org/W1708141795","https://openalex.org/W3029533605","https://openalex.org/W4292355925"],"abstract_inverted_index":{"A":[0],"Cybersecurity":[1],"Operations":[2],"Center":[3],"(CSOC)":[4],"performs":[5],"various":[6,38],"tasks":[7],"to":[8,20,26,113,141,178],"protect":[9],"an":[10,48],"organization":[11],"from":[12,37,157],"cyber":[13],"threats.":[14],"Several":[15],"types":[16],"of":[17,34,101,125,163,189],"personnel":[18],"collaborate":[19],"function":[21],"effectively":[22],"as":[23,81],"a":[24,98,129,147],"team":[25,107,131],"analyze":[27],"the":[28,32,56,60,102,161,185,191],"threat":[29],"signals,":[30],"in":[31,47,50,70],"form":[33,114,142],"alerts,":[35],"arriving":[36],"sources.":[39],"Teams":[40],"are":[41,84,169],"often":[42],"formed":[43],"ad":[44],"hoc,":[45],"resulting":[46],"imbalance":[49],"their":[51,91,154],"performances":[52],"and":[53,93,109,138,145,171,181],"thereby":[54],"increasing":[55],"risk":[57],"associated":[58],"with":[59],"low-performing":[61],"teams.":[62],"The":[63],"current":[64],"approach":[65,174],"taken":[66],"by":[67,104],"behavioral":[68],"scientists":[69],"forming":[71],"effective":[72,143,164],"teams":[73,88,117,144,165],"focuses":[74],"on":[75,90],"first":[76,105,186],"qualitatively":[77],"assessing":[78],"individuals":[79,112],"such":[80],"analysts,":[82],"who":[83],"then":[85,110],"grouped":[86],"into":[87],"based":[89],"credentials":[92],"expertise.":[94],"Our":[95,173],"work":[96],"takes":[97],"holistic":[99],"view":[100],"CSOC":[103],"defining":[106],"requirements":[108,121],"selecting":[111],"several":[115],"collaborative":[116,149,167],"that":[118,134,152],"meet":[119],"these":[120],"for":[122],"every":[123],"shift":[124],"operation.":[126],"We":[127],"present":[128],"novel":[130],"formation":[132,162],"framework":[133],"integrates":[135],"optimization,":[136],"simulation,":[137],"scoring":[139],"methods":[140],"introduce":[146],"new":[148],"score":[150],"metric":[151],"measures":[153],"effectiveness.":[155],"Results":[156],"simulated":[158],"experiments":[159],"show":[160],"whose":[166],"scores":[168],"maximized":[170],"balanced.":[172],"is":[175],"also":[176],"able":[177],"identify":[179],"high":[180],"low":[182],"performers":[183],"within":[184],"few":[187],"months":[188],"implementing":[190],"framework.":[192]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":2}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}