{"id":"https://openalex.org/W4200318794","doi":"https://doi.org/10.1145/3485832.3485918","title":"SODA: A System for Cyber Deception Orchestration and Automation","display_name":"SODA: A System for Cyber Deception Orchestration and Automation","publication_year":2021,"publication_date":"2021-12-06","ids":{"openalex":"https://openalex.org/W4200318794","doi":"https://doi.org/10.1145/3485832.3485918"},"language":"en","primary_location":{"id":"doi:10.1145/3485832.3485918","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3485832.3485918","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5070866953","display_name":"Md Sajidul Islam Sajid","orcid":"https://orcid.org/0000-0001-7269-3748"},"institutions":[{"id":"https://openalex.org/I102149020","display_name":"University of North Carolina at Charlotte","ror":"https://ror.org/04dawnj30","country_code":"US","type":"education","lineage":["https://openalex.org/I102149020"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Md Sajidul Islam Sajid","raw_affiliation_strings":["University of North Carolina at Charlotte, United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Charlotte, United States of America","institution_ids":["https://openalex.org/I102149020"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051564807","display_name":"Jinpeng Wei","orcid":"https://orcid.org/0000-0002-6982-7386"},"institutions":[{"id":"https://openalex.org/I102149020","display_name":"University of North Carolina at Charlotte","ror":"https://ror.org/04dawnj30","country_code":"US","type":"education","lineage":["https://openalex.org/I102149020"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jinpeng Wei","raw_affiliation_strings":["University of North Carolina at Charlotte, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Charlotte, USA","institution_ids":["https://openalex.org/I102149020"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058313825","display_name":"Basel Abdeen","orcid":"https://orcid.org/0009-0002-4059-1928"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Basel Abdeen","raw_affiliation_strings":["University of Texas at Dallas, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Texas at Dallas, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043893479","display_name":"Ehab Al\u2010Shaer","orcid":"https://orcid.org/0000-0002-7665-8293"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ehab Al-Shaer","raw_affiliation_strings":["Carnegie Mellon University, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University, USA","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101904176","display_name":"Md. Mazharul Islam","orcid":"https://orcid.org/0000-0002-0853-6673"},"institutions":[{"id":"https://openalex.org/I102149020","display_name":"University of North Carolina at Charlotte","ror":"https://ror.org/04dawnj30","country_code":"US","type":"education","lineage":["https://openalex.org/I102149020"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Md Mazharul Islam","raw_affiliation_strings":["University of North Carolina at Charlotte, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Charlotte, USA","institution_ids":["https://openalex.org/I102149020"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031677072","display_name":"Walter Diong","orcid":null},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Walter Diong","raw_affiliation_strings":["Carnegie Mellon University, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University, USA","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005002693","display_name":"Latifur Khan","orcid":"https://orcid.org/0000-0002-9300-1576"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Latifur Khan","raw_affiliation_strings":["University of Texas at Dallas, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Texas at Dallas, USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.4405,"has_fulltext":false,"cited_by_count":31,"citation_normalized_percentile":{"value":0.94982029,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"675","last_page":"689"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/deception","display_name":"Deception","score":0.9209766387939453},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9064679741859436},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7201941609382629},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.719730019569397},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.48629364371299744},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.43503713607788086},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.34484192728996277},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.0699450671672821}],"concepts":[{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.9209766387939453},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9064679741859436},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7201941609382629},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.719730019569397},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.48629364371299744},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.43503713607788086},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34484192728996277},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0699450671672821},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3485832.3485918","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3485832.3485918","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7400000095367432}],"awards":[{"id":"https://openalex.org/G8369502345","display_name":null,"funder_award_id":"N00014-21-1-2171","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G899398412","display_name":null,"funder_award_id":"W911NF2110032","funder_id":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office"}],"funders":[{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"},{"id":"https://openalex.org/F4320338281","display_name":"Army Research Office","ror":"https://ror.org/05epdh915"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W58217822","https://openalex.org/W105015318","https://openalex.org/W1666397912","https://openalex.org/W2003791967","https://openalex.org/W2072610876","https://openalex.org/W2094408325","https://openalex.org/W2115932152","https://openalex.org/W2130778370","https://openalex.org/W2145688371","https://openalex.org/W2151915331","https://openalex.org/W2197836422","https://openalex.org/W2215557951","https://openalex.org/W2402560368","https://openalex.org/W2537238206","https://openalex.org/W2539082945","https://openalex.org/W2572772209","https://openalex.org/W2581532517","https://openalex.org/W2780533491","https://openalex.org/W2903029239","https://openalex.org/W2986451143","https://openalex.org/W2996744292","https://openalex.org/W3046450893","https://openalex.org/W4230928526","https://openalex.org/W4251775324","https://openalex.org/W4289038676"],"related_works":["https://openalex.org/W2165717120","https://openalex.org/W2039390456","https://openalex.org/W2948663225","https://openalex.org/W2029954793","https://openalex.org/W1992683634","https://openalex.org/W4295295666","https://openalex.org/W1978059949","https://openalex.org/W2512387791","https://openalex.org/W70044515","https://openalex.org/W2128448209"],"abstract_inverted_index":{"Active":[0],"Cyber":[1],"Deception":[2,102],"(ACD)":[3],"has":[4],"emerged":[5],"as":[6,44,147,218],"an":[7,175],"effective":[8],"proactive":[9],"cyber":[10,90],"defense":[11],"technique":[12],"that":[13,74,94],"can":[14,75,216],"mislead":[15,80],"adversaries":[16],"by":[17],"presenting":[18],"falsified":[19],"data":[20],"and":[21,41,63,71,79,82,109,128,191,203],"allow":[22],"opportunities":[23],"for":[24,187],"engaging":[25],"with":[26,163,184,199],"them":[27,130],"to":[28,47,56,66,114,131,168,225],"learn":[29],"novel":[30],"attack":[31,37,99],"techniques.":[32,134],"Adversaries":[33],"often":[34],"implement":[35],"their":[36],"techniques":[38,141],"within":[39],"malware":[40,52,59,81,127,145,166,183,222],"use":[42],"it":[43],"the":[45,58,68,112,151,182],"medium":[46],"steal":[48],"valuable":[49],"information.":[50],"Comprehensive":[51],"analysis":[53],"is":[54],"required":[55],"understand":[57],"behaviors":[60],"at":[61],"technical":[62],"tactical":[64],"levels":[65],"create":[67],"honey":[69],"resources":[70],"appropriate":[72,154],"ploys":[73],"leverage":[76],"this":[77],"behavior":[78],"APT":[83],"adversaries.":[84],"This":[85,135],"paper":[86],"presents":[87],"SODA,":[88],"a":[89,104,148,200,208,219],"deception":[91,107,155,171,189,223,229],"orchestration":[92],"system":[93],"analyzes":[95],"real-world":[96,126],"malware,":[97],"discovers":[98],"techniques,":[100],"creates":[101],"Playbooks,":[103],"set":[105],"of":[106,123,153,178,211],"actions,":[108],"finally":[110],"orchestrates":[111],"environment":[113],"deceive":[115],"malware.":[116,233],"SODA":[117,162,215],"extracts":[118],"Malicious":[119],"Sub-graphs":[120],"(MSGs)":[121],"consisting":[122],"WinAPIs":[124],"from":[125],"maps":[129],"MITRE":[132],"ATT&CK":[133,140],"MSG-to-MITRE":[136,205],"mapping":[137,206],"describes":[138],"how":[139],"are":[142],"implemented":[143],"in":[144,180],"and,":[146],"result,":[149],"guides":[150],"construction":[152],"actions.":[156],"We":[157,173],"conducted":[158],"comprehensive":[159],"evaluations":[160],"on":[161],"255":[164],"recent":[165],"samples":[167],"demonstrate":[169],"end-to-end":[170],"effectiveness.":[172],"observed":[174],"average":[176],"accuracy":[177,210],"95%":[179],"deceiving":[181],"negligible":[185],"overhead":[186],"specified":[188],"goals":[190],"strategies.":[192],"Furthermore,":[193],"our":[194,204],"approach":[195],"successfully":[196],"extracted":[197],"MSGs":[198],"97%":[201],"recall":[202],"achieved":[207],"top-1":[209],"88.75%.":[212],"More":[213],"importantly,":[214],"serve":[217],"general":[220],"purpose":[221],"factory":[224],"automatically":[226],"produce":[227],"customized":[228],"playbooks":[230],"against":[231],"arbitrary":[232]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":7},{"year":2023,"cited_by_count":11},{"year":2021,"cited_by_count":1}],"updated_date":"2026-08-18T07:49:30.821534","created_date":"2025-10-10T00:00:00"}