{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T14:18:26Z","timestamp":1787062706344,"version":"3.56.0"},"publisher-location":"Cham","reference-count":31,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030415785","type":"print"},{"value":"9783030415792","type":"electronic"}],"license":[{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2020]]},"DOI":"10.1007\/978-3-030-41579-2_9","type":"book-chapter","created":{"date-parts":[[2020,2,17]],"date-time":"2020-02-17T11:09:09Z","timestamp":1581937749000},"page":"145-164","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":26,"title":["Automated Cyber Threat Intelligence Reports Classification for Early Warning of Cyber Attacks in Next Generation SOC"],"prefix":"10.1007","author":[{"given":"Wenzhuo","family":"Yang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kwok-Yan","family":"Lam","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2020,2,18]]},"reference":[{"key":"9_CR1","unstructured":"Barros, A., Chuvakin, A.: How to plan, design, operate and evolve a SOC (2016)"},{"issue":"Jan","key":"9_CR2","first-page":"993","volume":"3","author":"DM Blei","year":"2003","unstructured":"Blei, D.M., Ng, A.Y., Jordan, M.I.: Latent dirichlet allocation. J. Mach. Learn. Res. 3(Jan), 993\u20131022 (2003)","journal-title":"J. Mach. Learn. Res."},{"key":"9_CR3","doi-asserted-by":"crossref","unstructured":"Deliu, I., Leichter, C., Franke, K.: Collecting cyber threat intelligence from hacker forums via a two-stage, hybrid process using support vector machines and latent dirichlet allocation. In: 2018 IEEE International Conference on Big Data (Big Data), pp. 5008\u20135013. IEEE (2018)","DOI":"10.1109\/BigData.2018.8622469"},{"key":"9_CR4","series-title":"Lecture Notes in Computer Science (Lecture Notes in Artificial Intelligence)","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1007\/978-3-540-74565-5_5","volume-title":"KI 2007: Advances in Artificial Intelligence","author":"Y Elovici","year":"2007","unstructured":"Elovici, Y., Shabtai, A., Moskovitch, R., Tahan, G., Glezer, C.: Applying machine learning techniques for detection of malicious code in network traffic. In: Hertzberg, J., Beetz, M., Englert, R. (eds.) KI 2007. LNCS (LNAI), vol. 4667, pp. 44\u201350. Springer, Heidelberg (2007). https:\/\/doi.org\/10.1007\/978-3-540-74565-5_5"},{"key":"9_CR5","doi-asserted-by":"crossref","unstructured":"Gegick, M., Rotella, P., Xie, T.: Identifying security bug reports via text mining: an industrial case study. In: 2010 7th IEEE Working Conference on Mining Software Repositories (MSR 2010), Cape Town, South Africa, pp. 11\u201320. IEEE, IEEE Computer Society (2010)","DOI":"10.1109\/MSR.2010.5463340"},{"key":"9_CR6","doi-asserted-by":"crossref","unstructured":"Ghazi, Y., Anwar, Z., Mumtaz, R., Saleem, S., Tahir, A.: A supervised machine learning based approach for automatically extracting high-level threat intelligence from unstructured sources. In: 2018 International Conference on Frontiers of Information Technology (FIT), Islamabad, Pakistan, pp. 129\u2013134. IEEE Computer Society (2018)","DOI":"10.1109\/FIT.2018.00030"},{"issue":"2\u20133","key":"9_CR7","doi-asserted-by":"publisher","first-page":"146","DOI":"10.1080\/00437956.1954.11659520","volume":"10","author":"ZS Harris","year":"1954","unstructured":"Harris, Z.S.: Distributional structure. Word 10(2\u20133), 146\u2013162 (1954)","journal-title":"Word"},{"issue":"9","key":"9_CR8","doi-asserted-by":"publisher","first-page":"1098","DOI":"10.1109\/JRPROC.1952.273898","volume":"40","author":"DA Huffman","year":"1952","unstructured":"Huffman, D.A.: A method for the construction of minimum-redundancy codes. Proc. IRE 40(9), 1098\u20131101 (1952)","journal-title":"Proc. IRE"},{"key":"9_CR9","doi-asserted-by":"crossref","unstructured":"Husari, G., Al-Shaer, E., Ahmed, M., Chu, B., Niu, X.: TTPDrill: automatic and accurate extraction of threat actions from unstructured text of CTI sources. In: Proceedings of the 33rd Annual Computer Security Applications Conference, Orlando, FL, USA, pp. 103\u2013115. ACM (2017)","DOI":"10.1145\/3134600.3134646"},{"key":"9_CR10","unstructured":"Kambhampati, S., Knoblock, C.A. (eds.): Proceedings of IJCAI-03 Workshop on Information Integration on the Web (IIWeb 2003), Acapulco, Mexico, 9\u201310 August 2003 (2003)"},{"key":"9_CR11","unstructured":"Le, Q., Mikolov, T.: Distributed representations of sentences and documents. In: International Conference on Machine Learning, Beijing, China, pp. 1188\u20131196. JMLR.org (2014)"},{"key":"9_CR12","doi-asserted-by":"crossref","unstructured":"Liao, X., Yuan, K., Wang, X., Li, Z., Xing, L., Beyah, R.: Acing the IOC game: toward automatic discovery and analysis of open-source cyber threat intelligence. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, pp. 755\u2013766. ACM (2016)","DOI":"10.1145\/2976749.2978315"},{"key":"9_CR13","unstructured":"McMillan, R.: Definition: threat intelligence. Gartner 2013 (2013)"},{"key":"9_CR14","unstructured":"Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781 (2013)"},{"key":"9_CR15","unstructured":"Mikolov, T., Sutskever, I., Chen, K., Corrado, G.S., Dean, J.: Distributed representations of words and phrases and their compositionality. In: Advances in Neural Information Processing Systems, Lake Tahoe, Nevada, United States, pp. 3111\u20133119. MIT Press (2013)"},{"key":"9_CR16","volume-title":"Security Operations Center: Building, Operating, and Maintaining Your SOC","author":"J Muniz","year":"2015","unstructured":"Muniz, J., McIntyre, G., AlFardan, N.: Security Operations Center: Building, Operating, and Maintaining Your SOC. Cisco Press, Indianapolis (2015)"},{"key":"9_CR17","unstructured":"Packard, H.: 5G\/SOC: SOC generations. HP ESP Security Intelligence and Operations Consulting Services (2013). http:\/\/www.cnmeonline.com\/myresources\/hpe\/docs\/HP_ArcSight_WhitePapers_5G-SOC_SOC_Generations.PDF. Accessed 25 Aug 2019"},{"key":"9_CR18","first-page":"2825","volume":"12","author":"F Pedregosa","year":"2011","unstructured":"Pedregosa, F., et al.: Scikit-learn: machine learning in python. J. Mach. Learn. Res. 12, 2825\u20132830 (2011)","journal-title":"J. Mach. Learn. Res."},{"issue":"3","key":"9_CR19","first-page":"61","volume":"10","author":"J Platt","year":"1999","unstructured":"Platt, J., et al.: Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods. Adv. Large Margin Classif. 10(3), 61\u201374 (1999)","journal-title":"Adv. Large Margin Classif."},{"key":"9_CR20","series-title":"Advanced Sciences and Technologies for Security Applications","doi-asserted-by":"publisher","first-page":"169","DOI":"10.1007\/978-3-319-97181-0_8","volume-title":"Cyber Criminology","author":"S Pournouri","year":"2018","unstructured":"Pournouri, S., Zargari, S., Akhgar, B.: Predicting the cyber attackers; a comparison of different classification techniques. In: Jahankhani, H. (ed.) Cyber Criminology. ASTSA, pp. 169\u2013181. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-97181-0_8"},{"key":"9_CR21","unstructured":"Rebekah Brown, R.M.L.: The evolution of cyber threat intelligence (CTI): 2019 SANS CTI survey, February 2019. https:\/\/www.sans.org\/reading-room\/whitepapers\/threats\/paper\/38790. Accessed 25 Aug 2019"},{"key":"9_CR22","unstructured":"\u0158eh\u016f\u0159ek, R., Sojka, P.: Software framework for topic modelling with large corpora. In: Proceedings of the LREC 2010 Workshop on New Challenges for NLP Frameworks, Valletta, Malta, pp. 45\u201350. ELRA, May 2010. http:\/\/is.muni.cz\/publication\/884893\/en"},{"issue":"3","key":"9_CR23","first-page":"1","volume":"5","author":"DE Rumelhart","year":"1988","unstructured":"Rumelhart, D.E., Hinton, G.E., Williams, R.J., et al.: Learning representations by back-propagating errors. Cogn. Model. 5(3), 1 (1988)","journal-title":"Cogn. Model."},{"issue":"10","key":"9_CR24","doi-asserted-by":"publisher","first-page":"993","DOI":"10.1109\/TSE.2014.2340398","volume":"40","author":"R Scandariato","year":"2014","unstructured":"Scandariato, R., Walden, J., Hovsepyan, A., Joosen, W.: Predicting vulnerable software components via text mining. IEEE Trans. Software Eng. 40(10), 993\u20131006 (2014)","journal-title":"IEEE Trans. Software Eng."},{"key":"9_CR25","unstructured":"Shackleford, D.: Who\u2019s using cyberthreat intelligence and how? SANS Institute (2015)"},{"key":"9_CR26","unstructured":"Shevchenko, S.: Welcome to threatexpert blog!, February 2008. http:\/\/blog.threatexpert.com\/2008\/02\/welcome-to-threatexpert-blog.html. Accessed 25 Aug 2019"},{"key":"9_CR27","unstructured":"Symantec: Petya ransomware outbreak: Here\u2019s what you need to know, December 2017. https:\/\/www.symantec.com\/blogs\/threat-intelligence\/petya-ransomware-wiper. Accessed 25 Aug 2019"},{"key":"9_CR28","volume-title":"Introduction to Data Mining","author":"PN Tan","year":"2007","unstructured":"Tan, P.N., et al.: Introduction to Data Mining. Pearson Education India, New Delhi (2007)"},{"key":"9_CR29","doi-asserted-by":"publisher","first-page":"212","DOI":"10.1016\/j.cose.2017.09.001","volume":"72","author":"W Tounsi","year":"2018","unstructured":"Tounsi, W., Rais, H.: A survey on technical threat intelligence in the age of sophisticated cyber attacks. Comput. Secur. 72, 212\u2013233 (2018)","journal-title":"Comput. Secur."},{"key":"9_CR30","doi-asserted-by":"crossref","unstructured":"Xiao, X., Paradkar, A., Thummalapenta, S., Xie, T.: Automated extraction of security policies from natural-language software documents. In: Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering, p. 12. ACM (2012)","DOI":"10.1145\/2393596.2393608"},{"key":"9_CR31","doi-asserted-by":"crossref","unstructured":"Zhu, Z., Dumitras, T.: ChainSmith: automatically learning the semantics of malicious campaigns by mining threat intelligence reports. In: 2018 IEEE European Symposium on Security and Privacy (EuroS&P), London, United Kingdom, pp. 458\u2013472. IEEE (2018)","DOI":"10.1109\/EuroSP.2018.00039"}],"container-title":["Lecture Notes in Computer Science","Information and Communications Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-41579-2_9","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,26]],"date-time":"2020-11-26T15:14:06Z","timestamp":1606403646000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-41579-2_9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020]]},"ISBN":["9783030415785","9783030415792"],"references-count":31,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-41579-2_9","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020]]},"assertion":[{"value":"18 February 2020","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Information and Communications Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Beijing","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 December 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"17 December 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"icics2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Easy Chair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"199","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"47","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"24% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"8","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"No","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}