{"id":"https://openalex.org/W4409155981","doi":"https://doi.org/10.1109/trustcom63139.2024.00218","title":"UniTTP: A Unified Framework for Tactics, Techniques, and Procedures Mapping in Cyber Threats","display_name":"UniTTP: A Unified Framework for Tactics, Techniques, and Procedures Mapping in Cyber Threats","publication_year":2024,"publication_date":"2024-12-17","ids":{"openalex":"https://openalex.org/W4409155981","doi":"https://doi.org/10.1109/trustcom63139.2024.00218"},"language":"en","primary_location":{"id":"doi:10.1109/trustcom63139.2024.00218","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom63139.2024.00218","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109755000","display_name":"Jie Zhang","orcid":"https://orcid.org/0000-0002-1135-2031"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jie Zhang","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079575403","display_name":"Hui Wen","orcid":"https://orcid.org/0000-0003-0854-4152"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hui Wen","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062908646","display_name":"Lun Li","orcid":"https://orcid.org/0000-0002-9984-5948"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lun Li","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5087012171","display_name":"Hongsong Zhu","orcid":"https://orcid.org/0000-0003-3720-7403"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongsong Zhu","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1580","last_page":"1588"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.965399980545044,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.965399980545044,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9577999711036682,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6707165241241455},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.49837708473205566}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6707165241241455},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.49837708473205566}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/trustcom63139.2024.00218","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom63139.2024.00218","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321133","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W2089216878","https://openalex.org/W2771963642","https://openalex.org/W2784054170","https://openalex.org/W2971013448","https://openalex.org/W3013924132","https://openalex.org/W3022088706","https://openalex.org/W3097904228","https://openalex.org/W3107245277","https://openalex.org/W3205347361","https://openalex.org/W3206415475","https://openalex.org/W3211888892","https://openalex.org/W4226346873","https://openalex.org/W4294343684","https://openalex.org/W4298874344","https://openalex.org/W4304759028","https://openalex.org/W4311313865","https://openalex.org/W4312995921","https://openalex.org/W4313598843","https://openalex.org/W4324031781","https://openalex.org/W4377042690","https://openalex.org/W4400121705","https://openalex.org/W6606475831","https://openalex.org/W6755207826","https://openalex.org/W6776615434","https://openalex.org/W6776700526","https://openalex.org/W6778883912","https://openalex.org/W6785444229","https://openalex.org/W6790937267","https://openalex.org/W6797085616","https://openalex.org/W6842345019","https://openalex.org/W6848909144","https://openalex.org/W6850202480","https://openalex.org/W6853777504","https://openalex.org/W6860650126","https://openalex.org/W6860958763"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"The":[0],"increasing":[1],"complexity":[2],"of":[3,40,80,124,136,159],"cyber":[4,76,106,146],"threats":[5],"necessitates":[6],"advanced":[7,57],"methods":[8],"for":[9,144],"understanding":[10,135],"and":[11,16,33,56,65,72,91,132,155],"countering":[12],"adversarial":[13],"tactics,":[14],"techniques,":[15,60],"procedures":[17],"(TTPs).":[18],"Despite":[19],"the":[20,24,37,109,122,134,142,157],"support":[21],"provided":[22],"by":[23,112,148],"ATT&CK":[25],"framework,":[26],"challenges":[27],"such":[28],"as":[29],"imbalanced":[30],"sample":[31],"distribution":[32],"technique":[34],"overlap":[35],"limit":[36],"effective":[38],"mapping":[39],"complex":[41,75,160],"attack":[42,137],"patterns.":[43],"To":[44],"address":[45],"these":[46,96],"challenges,":[47],"we":[48],"propose":[49],"a":[50],"framework":[51],"that":[52],"integrates":[53],"language":[54,126],"models":[55,127],"artificial":[58],"intelligence":[59],"including":[61],"hierarchical":[62],"attention":[63],"embedding":[64],"contrastive":[66],"learning,":[67],"to":[68,114,128],"achieve":[69],"TTP":[70],"recognition":[71,130],"classification":[73],"in":[74],"threats.":[77,161],"UniTTP":[78],"consists":[79],"five":[81],"modules:":[82],"data":[83],"processing,":[84],"tactic":[85],"classification,":[86,90],"multi-feature":[87],"embedding,":[88],"techniques":[89],"LLM":[92],"post-assistance.":[93],"By":[94],"combining":[95],"modules,":[97],"our":[98],"method":[99],"not":[100],"only":[101],"accurately":[102],"identifies":[103],"TTPs":[104],"within":[105],"threats,":[107],"improving":[108],"F1":[110],"score":[111],"3.23%":[113],"13.66%":[115],"across":[116],"different":[117],"datasets,":[118],"but":[119],"also":[120],"leverages":[121],"capabilities":[123],"large":[125],"verify":[129],"results":[131],"deepen":[133],"behaviors.":[138],"This":[139],"study":[140],"lays":[141],"foundation":[143],"robust":[145],"defense":[147],"providing":[149],"deeper":[150],"insights":[151],"into":[152],"adversary":[153],"behaviors":[154],"enhancing":[156],"predictability":[158]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":4}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}