{"id":"https://openalex.org/W7166707525","doi":"https://doi.org/10.7148/2026-0295","title":"Prioritizing detection rules in soc using mitre att&ck technique co-occurrence analysis","display_name":"Prioritizing detection rules in soc using mitre att&ck technique co-occurrence analysis","publication_year":2026,"publication_date":"2026-06-23","ids":{"openalex":"https://openalex.org/W7166707525","doi":"https://doi.org/10.7148/2026-0295"},"language":null,"primary_location":{"id":"doi:10.7148/2026-0295","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0295","pdf_url":"https://doi.org/10.7148/2026-0295","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.7148/2026-0295","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139713218","display_name":"Kamil Wisniewski","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kamil Wisniewski","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5092650552","display_name":"Andrzej Mycek","orcid":"https://orcid.org/0000-0002-2720-6071"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Andrzej Mycek","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"295","last_page":"302"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9018999934196472,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9018999934196472,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.027799999341368675,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.009600000455975533,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/centrality","display_name":"Centrality","score":0.7580999732017517},{"id":"https://openalex.org/keywords/ranking","display_name":"Ranking (information retrieval)","score":0.5764999985694885},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5533999800682068},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5401999950408936},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.445499986410141}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7784000039100647},{"id":"https://openalex.org/C53811970","wikidata":"https://www.wikidata.org/wiki/Q5062194","display_name":"Centrality","level":2,"score":0.7580999732017517},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5841000080108643},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.5764999985694885},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5533999800682068},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5401999950408936},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.445499986410141},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3978999853134155},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3917999863624573},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.37130001187324524},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3151000142097473},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.2865999937057495}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.7148/2026-0295","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0295","pdf_url":"https://doi.org/10.7148/2026-0295","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.7148/2026-0295","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0295","pdf_url":"https://doi.org/10.7148/2026-0295","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7166707525.pdf","grobid_xml":"https://content.openalex.org/works/W7166707525.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Security":[0],"Operations":[1],"Centers":[2],"(SOCs)":[3],"continuously":[4],"expand":[5],"detection":[6,18,35],"content,":[7],"yet":[8],"limited":[9],"engineering":[10],"capacity":[11],"makes":[12],"it":[13],"difficult":[14],"to":[15,124],"decide":[16],"which":[17],"rules":[19,36],"should":[20],"be":[21],"implemented,":[22],"tuned,":[23],"or":[24],"reviewed":[25],"first.":[26],"This":[27],"paper":[28],"proposes":[29],"a":[30,49,82,118,187],"knowledge-driven":[31],"method":[32],"for":[33,152],"prioritizing":[34],"using":[37,69,117],"the":[38,87,94,98,106,162],"MITRE":[39],"ATT&CK":[40,55,90],"framework":[41],"and":[42,62,65,75,115,133,147,172,197,205],"co-occurrence":[43,52,184],"analysis":[44],"of":[45,89,121],"techniques.":[46,141],"We":[47,77,104],"construct":[48],"weighted":[50,96],"technique":[51,67,155,183],"graph":[53,70],"from":[54],"STIX":[56],"that":[57,137,145,182,191],"uses":[58],"relationships":[59],"across":[60,101],"campaigns":[61],"intrusion":[63],"sets,":[64],"quantify":[66],"importance":[68,88],"centrality":[71,185],"measures":[72],"(eigenvector,":[73],"betweenness,":[74],"closeness).":[76],"then":[78],"assign":[79],"each":[80],"rule":[81,112,159],"Priority":[83,164],"Score":[84,165],"by":[85,93,97,131],"aggregating":[86],"techniques":[91,196],"referenced":[92],"rule,":[95],"technique's":[99],"prevalence":[100],"threat":[102,122],"entities.":[103],"evaluate":[105],"approach":[107],"offline":[108],"on":[109],"two":[110],"public":[111],"corpora":[113],"(Sigma":[114],"Elastic)":[116],"train/test":[119],"split":[120],"entities":[123],"avoid":[125],"information":[126],"leakage.":[127],"Effectiveness":[128],"is":[129],"measured":[130],"Coverage@K":[132],"an":[134],"importance-weighted":[135,170],"variant":[136],"emphasizes":[138],"centrally":[139],"positioned":[140],"The":[142,179],"results":[143],"show":[144],"frequency-only":[146],"centrality-only":[148],"baselines":[149,175],"are":[150],"strong":[151],"maximizing":[153],"unweighted":[154],"coverage":[156],"at":[157],"small":[158],"budgets,":[160],"while":[161],"proposed":[163],"becomes":[166],"more":[167],"competitive":[168],"under":[169],"evaluation":[171],"can":[173],"outperform":[174],"in":[176],"selected":[177],"settings.":[178],"findings":[180],"indicate":[181],"provides":[186],"transparent":[188],"prioritization":[189],"signal":[190],"aligns":[192],"with":[193],"emphasizing":[194],"high-leverage":[195],"suggest":[198],"practical":[199],"extensions,":[200],"such":[201],"as":[202],"diversity-aware":[203],"ranking":[204],"environment-specific":[206],"calibration.":[207]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-07-01T00:00:00"}