{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,10]],"date-time":"2025-11-10T23:23:01Z","timestamp":1762816981298,"version":"build-2065373602"},"publisher-location":"Singapore","reference-count":22,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819542123","type":"print"},{"value":"9789819542130","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T00:00:00Z","timestamp":1762819200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T00:00:00Z","timestamp":1762819200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-95-4213-0_10","type":"book-chapter","created":{"date-parts":[[2025,11,10]],"date-time":"2025-11-10T23:18:15Z","timestamp":1762816695000},"page":"172-188","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Formal Construction of\u00a0Threat Detections from\u00a0Attack Trees"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5322-126X","authenticated-orcid":false,"given":"Dumitru-Bogdan","family":"Prelipcean","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5981-4533","authenticated-orcid":false,"given":"C\u0103t\u0103lin","family":"Dima","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-6500-2153","authenticated-orcid":false,"given":"Daniele","family":"Varacca","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,11,11]]},"reference":[{"key":"10_CR1","unstructured":"CADP: Construction and Analysis of Distributed Processes. https:\/\/cadp.inria.fr\/. Concurrency toolbox with process-algebraic modeling and verification"},{"key":"10_CR2","unstructured":"Nusmv. http:\/\/nusmv.fbk.eu\/. Symbolic model checker for CTL\/LTL verification"},{"key":"10_CR3","unstructured":"Proverif. https:\/\/prosecco.gforge.inria.fr\/personal\/bblanche\/proverif\/. Automated cryptographic protocol verifier"},{"key":"10_CR4","unstructured":"MITRE ATT &CK matrix (2025). https:\/\/attack.mitre.org\/matrices\/enterprise\/"},{"key":"10_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1007\/978-3-319-66402-6_7","volume-title":"Computer Security \u2013 ESORICS 2017","author":"M Audinot","year":"2017","unstructured":"Audinot, M., Pinchinat, S., Kordy, B.: Is my attack tree correct? In: Foley, S.N., Gollmann, D., Snekkenes, E. (eds.) ESORICS 2017, Part I. LNCS, vol. 10492, pp. 83\u2013102. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-66402-6_7"},{"key":"10_CR6","doi-asserted-by":"publisher","unstructured":"Audinot, M., Pinchinat, S., Kordy, B.: Guided design of attack trees: a system-based approach. In: 31st IEEE Computer Security Foundations Symposium, CSF 2018, Oxford, United Kingdom, 9\u201312 July 2018, pp. 61\u201375. IEEE Computer Society (2018). https:\/\/doi.org\/10.1109\/CSF.2018.00012","DOI":"10.1109\/CSF.2018.00012"},{"key":"10_CR7","doi-asserted-by":"publisher","unstructured":"Brihaye, T., Pinchinat, S., Terefenko, A.: Adversarial formal semantics of attack trees and related problems. 370, 162\u2013177 (2022). https:\/\/doi.org\/10.4204\/EPTCS.370.11","DOI":"10.4204\/EPTCS.370.11"},{"key":"10_CR8","doi-asserted-by":"publisher","unstructured":"Bryans, J.W., Liew, L.S., Nguyen, H.N., Sabaliauskaite, G., Shaikh, S.A.: Formal template-based generation of attack-defence trees for automated security analysis. Inf. 14(9), 481 (2023). https:\/\/doi.org\/10.3390\/INFO14090481","DOI":"10.3390\/INFO14090481"},{"key":"10_CR9","unstructured":"FireEye: APT29: the dukes cozy bear (2017). https:\/\/www.fireeye.com\/blog\/threat-research\/2017\/05\/apt29_targeted_attacks.html"},{"key":"10_CR10","unstructured":"FireEye: Red team operations: real-world adversary simulation (2017). https:\/\/www.fireeye.com\/current-threats\/anatomy-of-a-red-team-attack.html"},{"issue":"2","key":"10_CR11","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1007\/s10009-012-0244-z","volume":"15","author":"H Garavel","year":"2013","unstructured":"Garavel, H., Lang, F., Mateescu, R., Serwe, W.: CADP 2011: a toolbox for the construction and analysis of distributed processes. Int. J. Softw. Tools Technol. Transf. 15(2), 89\u2013107 (2013). https:\/\/doi.org\/10.1007\/s10009-012-0244-z","journal-title":"Int. J. Softw. Tools Technol. Transf."},{"issue":"5","key":"10_CR12","doi-asserted-by":"publisher","first-page":"279","DOI":"10.1109\/32.588521","volume":"23","author":"GJ Holzmann","year":"1997","unstructured":"Holzmann, G.J.: The SPIN model checker. IEEE Trans. Software Eng. 23(5), 279\u2013295 (1997). https:\/\/doi.org\/10.1109\/32.588521","journal-title":"IEEE Trans. Software Eng."},{"key":"10_CR13","doi-asserted-by":"publisher","unstructured":"Khraisat, A., Gondal, I., Vamplew, P., Kamruzzaman, J.: Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecur. 2(1), 20 (2019). https:\/\/doi.org\/10.1186\/S42400-019-0038-7","DOI":"10.1186\/S42400-019-0038-7"},{"issue":"1","key":"10_CR14","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1093\/logcom\/exs029","volume":"24","author":"B Kordy","year":"2014","unstructured":"Kordy, B., Mauw, S., Radomirovi\u0107, S., Schweitzer, P.: Attack-defense trees. J. Log. Comput. 24(1), 55\u201387 (2014). https:\/\/doi.org\/10.1093\/logcom\/exs029","journal-title":"J. Log. Comput."},{"key":"10_CR15","doi-asserted-by":"publisher","unstructured":"Pouzol, J., Ducass\u00e9, M.: Formal specification of intrusion signatures and detection rules. In: 15th IEEE Computer Security Foundations Workshop (CSFW-15 2002), Cape Breton, Canada. IEEE Computer Society (2002). https:\/\/doi.org\/10.1109\/CSFW.2002.1021807","DOI":"10.1109\/CSFW.2002.1021807"},{"issue":"1","key":"10_CR16","first-page":"229","volume":"99","author":"M Roesch","year":"1999","unstructured":"Roesch, M.: Snort: lightweight intrusion detection for networks. Lisa 99(1), 229\u2013238 (1999)","journal-title":"Lisa"},{"key":"10_CR17","unstructured":"Ryan, P., Schneider, S., Goldsmith, M., Lowe, G., Roscoe, B.: The Modelling and Analysis of Security Protocols: The CSP Approach. Addison-Wesley (2000)"},{"key":"10_CR18","unstructured":"Schneier, B.: Attack trees. Dr. Dobb\u2019s J. 24(12), 21\u201329 (1999). https:\/\/www.schneier.com\/academic\/archives\/1999\/12\/attack_trees.html"},{"key":"10_CR19","unstructured":"Sigma Community: Sigma: Generic and open signature format for siem systems (2024). https:\/\/sigmahq.io\/. Accessed 01 June 2025"},{"key":"10_CR20","doi-asserted-by":"crossref","unstructured":"Vigna, G., Kemmerer, R.A.: NetSTAT: a network-based intrusion detection approach. In: Proceedings of the 14th Annual Computer Security Application Conference, pp. 25\u201334. IEEE (1998)","DOI":"10.1109\/CSAC.1998.738566"},{"key":"10_CR21","doi-asserted-by":"publisher","unstructured":"Widel, W., Audinot, M., Fila, B., Pinchinat, S.: Beyond 2014: formal methods for attack tree-based security modeling. ACM Comput. Surv. 52(4), 75:1\u201375:36 (2019). https:\/\/doi.org\/10.1145\/3331524","DOI":"10.1145\/3331524"},{"key":"10_CR22","unstructured":"YARA Project: Yara: The pattern matching swiss knife (2024). https:\/\/yara.readthedocs.io\/. Accessed 01 June 2025"}],"container-title":["Lecture Notes in Computer Science","Formal Methods and Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-95-4213-0_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,10]],"date-time":"2025-11-10T23:18:17Z","timestamp":1762816697000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-95-4213-0_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,11]]},"ISBN":["9789819542123","9789819542130"],"references-count":22,"URL":"https:\/\/doi.org\/10.1007\/978-981-95-4213-0_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,11]]},"assertion":[{"value":"11 November 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICFEM","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Formal Engineering Methods","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Hangzhou","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"10 November 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"13 November 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"icfem2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/icfem2025.github.io\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}