{"id":"https://openalex.org/W3013353882","doi":"https://doi.org/10.1186/s42400-020-00048-4","title":"Under false flag: using technical artifacts for cyber attack attribution","display_name":"Under false flag: using technical artifacts for cyber attack attribution","publication_year":2020,"publication_date":"2020-03-20","ids":{"openalex":"https://openalex.org/W3013353882","doi":"https://doi.org/10.1186/s42400-020-00048-4","mag":"3013353882"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-020-00048-4","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-020-00048-4","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-020-00048-4","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-020-00048-4","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088439816","display_name":"Florian Skopik","orcid":"https://orcid.org/0000-0002-1922-7892"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":true,"raw_author_name":"Florian Skopik","raw_affiliation_strings":["Center for Digital Safety and Security, AIT Austrian Institute of Technology, Austria, Giefinggasse 4, Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0002-1922-7892","affiliations":[{"raw_affiliation_string":"Center for Digital Safety and Security, AIT Austrian Institute of Technology, Austria, Giefinggasse 4, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5034162617","display_name":"T\u00edmea P\u00e1hi","orcid":"https://orcid.org/0000-0001-7346-3450"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Timea Pahi","raw_affiliation_strings":["Center for Digital Safety and Security, AIT Austrian Institute of Technology, Austria, Giefinggasse 4, Vienna, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Center for Digital Safety and Security, AIT Austrian Institute of Technology, Austria, Giefinggasse 4, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5088439816"],"corresponding_institution_ids":["https://openalex.org/I132118926"],"apc_list":{"value":1230,"currency":"USD","value_usd":1230},"apc_paid":{"value":1230,"currency":"USD","value_usd":1230},"fwci":6.4329,"has_fulltext":true,"cited_by_count":51,"citation_normalized_percentile":{"value":0.96666773,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":93,"max":100},"biblio":{"volume":"3","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7726048827171326},{"id":"https://openalex.org/keywords/blame","display_name":"Blame","score":0.7585133910179138},{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.7079306840896606},{"id":"https://openalex.org/keywords/spoofing-attack","display_name":"Spoofing attack","score":0.6983798742294312},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6128100752830505},{"id":"https://openalex.org/keywords/attribution","display_name":"Attribution","score":0.6055924296379089},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.519580602645874},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4765739440917969},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.46895092725753784},{"id":"https://openalex.org/keywords/flag","display_name":"Flag (linear algebra)","score":0.44536933302879333},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.40742573142051697},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.165795236825943},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.14087605476379395},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.12102991342544556},{"id":"https://openalex.org/keywords/social-psychology","display_name":"Social psychology","score":0.09239330887794495}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7726048827171326},{"id":"https://openalex.org/C2781466463","wikidata":"https://www.wikidata.org/wiki/Q621695","display_name":"Blame","level":2,"score":0.7585133910179138},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.7079306840896606},{"id":"https://openalex.org/C167900197","wikidata":"https://www.wikidata.org/wiki/Q11081100","display_name":"Spoofing attack","level":2,"score":0.6983798742294312},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6128100752830505},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.6055924296379089},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.519580602645874},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4765739440917969},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.46895092725753784},{"id":"https://openalex.org/C2776730729","wikidata":"https://www.wikidata.org/wiki/Q1392130","display_name":"Flag (linear algebra)","level":3,"score":0.44536933302879333},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.40742573142051697},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.165795236825943},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.14087605476379395},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.12102991342544556},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.09239330887794495},{"id":"https://openalex.org/C136119220","wikidata":"https://www.wikidata.org/wiki/Q1000660","display_name":"Algebra over a field","level":2,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-020-00048-4","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-020-00048-4","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-020-00048-4","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:0d49d7c31d1443dd936d7e2d89120800","is_oa":true,"landing_page_url":"https://doaj.org/article/0d49d7c31d1443dd936d7e2d89120800","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 3, Iss 1, Pp 1-20 (2020)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-020-00048-4","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-020-00048-4","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-020-00048-4","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6399999856948853,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320323033","display_name":"Bundesministerium f\u00fcr Verkehr, Innovation und Technologie","ror":"https://ror.org/04marky29"},{"id":"https://openalex.org/F4320324004","display_name":"Forskningsr\u00e5det om H\u00e4lsa, Arbetsliv och V\u00e4lf\u00e4rd","ror":"https://ror.org/02d290r06"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3013353882.pdf","grobid_xml":"https://content.openalex.org/works/W3013353882.grobid-xml"},"referenced_works_count":59,"referenced_works":["https://openalex.org/W19161399","https://openalex.org/W606780114","https://openalex.org/W1222699389","https://openalex.org/W1270572903","https://openalex.org/W1536598138","https://openalex.org/W1540542939","https://openalex.org/W1565302035","https://openalex.org/W1576185228","https://openalex.org/W1594990268","https://openalex.org/W1970867218","https://openalex.org/W1972997473","https://openalex.org/W1974323608","https://openalex.org/W1978627933","https://openalex.org/W1993595248","https://openalex.org/W1994920437","https://openalex.org/W1996665163","https://openalex.org/W2012638397","https://openalex.org/W2014316112","https://openalex.org/W2023481396","https://openalex.org/W2039858940","https://openalex.org/W2055382823","https://openalex.org/W2065890363","https://openalex.org/W2082291215","https://openalex.org/W2082550445","https://openalex.org/W2100307718","https://openalex.org/W2104746370","https://openalex.org/W2111542531","https://openalex.org/W2116985963","https://openalex.org/W2129010475","https://openalex.org/W2131463233","https://openalex.org/W2145722235","https://openalex.org/W2153245338","https://openalex.org/W2255889910","https://openalex.org/W2269788763","https://openalex.org/W2297001999","https://openalex.org/W2339166448","https://openalex.org/W2404532944","https://openalex.org/W2408452443","https://openalex.org/W2414847921","https://openalex.org/W2472535631","https://openalex.org/W2486489830","https://openalex.org/W2493571674","https://openalex.org/W2533698187","https://openalex.org/W2704626971","https://openalex.org/W2748696935","https://openalex.org/W2963980822","https://openalex.org/W2996392491","https://openalex.org/W3008124741","https://openalex.org/W3085911214","https://openalex.org/W3098102491","https://openalex.org/W3121806972","https://openalex.org/W3128155874","https://openalex.org/W3143747655","https://openalex.org/W4242370298","https://openalex.org/W4248074453","https://openalex.org/W4285719527","https://openalex.org/W4289038676","https://openalex.org/W6608060369","https://openalex.org/W6633223026"],"related_works":["https://openalex.org/W2324035390","https://openalex.org/W2695311495","https://openalex.org/W3175137310","https://openalex.org/W3034984450","https://openalex.org/W3139271019","https://openalex.org/W2098156551","https://openalex.org/W1895129854","https://openalex.org/W146973812","https://openalex.org/W155568406","https://openalex.org/W2209303598"],"abstract_inverted_index":{"Abstract":[0],"The":[1,9],"attribution":[2,131,172],"of":[3,36,47,62,88,149,170],"cyber":[4,121,155],"attacks":[5,122],"is":[6,12,33,43,66],"often":[7],"neglected.":[8],"consensus":[10],"still":[11],"that":[13,84],"little":[14],"can":[15,186],"be":[16,27,187],"done":[17],"to":[18,96,100,127,135,139,195],"prosecute":[19],"the":[20,40,45,60,86,94,111,154,171],"perpetrators":[21],"\u2013":[22,133],"and":[23,76,81,90,165,189],"unfortunately,":[24],"this":[25,143],"might":[26],"right":[28],"in":[29,44,59,168],"many":[30],"cases.":[31],"What":[32],"however":[34],"only":[35],"limited":[37],"interest":[38,48],"for":[39,49,70,79],"private":[41],"industry":[42],"center":[46],"nation":[50,64],"states.":[51],"Investigating":[52],"if":[53],"an":[54,147],"attack":[55,151,163],"was":[56],"carried":[57],"out":[58],"name":[61],"a":[63,67,104],"state":[65],"crucial":[68],"task":[69],"secret":[71],"services.":[72],"Many":[73],"methods,":[74],"tools":[75],"processes":[77],"exist":[78],"network-":[80],"computer":[82],"forensics":[83],"allow":[85],"collection":[87],"traces":[89,137,160,185],"evidences.":[91],"They":[92],"are":[93,117,174],"basis":[95],"associate":[97],"adversarial":[98],"actions":[99],"threat":[101],"actors.":[102],"However,":[103],"serious":[105],"problem":[106],"which":[107,123,166],"has":[108],"not":[109],"got":[110],"appropriate":[112],"attention":[113],"from":[114],"research":[115],"yet,":[116],"false":[118,197],"flag":[119,198],"campaigns,":[120],"apply":[124],"covert":[125],"tactics":[126],"deceive":[128],"or":[129,138],"misguide":[130],"attempts":[132],"either":[134],"hide":[136],"blame":[140],"others.":[141],"In":[142],"paper":[144],"we":[145,181],"provide":[146],"overview":[148],"prominent":[150],"techniques":[152,164],"along":[153],"kill":[156],"chain.":[157],"We":[158],"investigate":[159],"left":[161],"by":[162,176],"questions":[167],"course":[169],"process":[173],"answered":[175],"investigating":[177],"these":[178],"traces.":[179],"Eventually,":[180],"assess":[182],"how":[183],"easily":[184],"spoofed":[188],"rate":[190],"their":[191],"relevancy":[192],"with":[193],"respect":[194],"identifying":[196],"campaigns.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":14},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":11},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":2}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}