{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,8]],"date-time":"2026-03-08T01:53:00Z","timestamp":1772934780531,"version":"3.50.1"},"reference-count":29,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,12,8]],"date-time":"2025-12-08T00:00:00Z","timestamp":1765152000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,12,8]],"date-time":"2025-12-08T00:00:00Z","timestamp":1765152000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,12,8]]},"DOI":"10.1109\/bigdata66926.2025.11401712","type":"proceedings-article","created":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T20:57:57Z","timestamp":1772830677000},"page":"2130-2135","source":"Crossref","is-referenced-by-count":0,"title":["Reflective Beam Search for Automated TTP Extraction and Sigma Rule Generation from Cyber Threat Intelligence"],"prefix":"10.1109","author":[{"given":"Jeffrey","family":"Fairbanks","sequence":"first","affiliation":[{"name":"Boise State University,Boise,Idaho,USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Edoardo","family":"Serra","sequence":"additional","affiliation":[{"name":"Boise State University,Boise,Idaho,USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"issue":"3","key":"ref1","first-page":"49","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume":"9","author":"Hutchins","year":"2011","journal-title":"IEEE Security & Privacy"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.09.001"},{"key":"ref3","volume-title":"Cost of cybercrime study","year":"2023"},{"key":"ref4","volume-title":"Cost of a data breach report","year":"2023"},{"key":"ref5","volume-title":"Data breach investigations report","year":"2023"},{"key":"ref6","volume-title":"New survey reveals $ 2 trillion market opportunity for cybersecurity technology and service providers","author":"Aiyer","year":"2024"},{"key":"ref7","volume-title":"2022 state of the phish report","year":"2022"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_29"},{"key":"ref9","volume-title":"CRUcialG: Reconstruct integrated attack scenario graphs by cyber threat intelligence reports","author":"Cheng","year":"2024"},{"key":"ref10","volume-title":"MultiKG: Multi-source threat intelligence aggregation for high-quality knowledge graph representation of attack techniques","author":"Wang","year":"2024"},{"key":"ref11","volume-title":"A string-based ml model to detect malicious activity","author":"Crenshaw","year":"2020"},{"issue":"9","key":"ref12","doi-asserted-by":"crossref","DOI":"10.3390\/drones8090437","article-title":"A ddos tracking scheme utilizing adaptive beam search with unmanned aerial vehicles in smart grid","volume":"8","author":"Guo","year":"2024","journal-title":"Drones"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW61312.2024.00018"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2019"},{"key":"ref15","article-title":"CRITIC: Large language models can self-correct with tool-interactive critiquing","volume-title":"Proc. 12th Int. Conf. on Learning Representations (ICLR 2024)","author":"Gou","year":"2024"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3468914"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.123"},{"key":"ref18","volume-title":"SigmaGen: AI-powered ATT&CK-mapped threat detection with Sigma rules","year":"2025"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-021-00106-5"},{"key":"ref20","volume-title":"LLMCloudHunter: Harnessing LLMs for automated extraction of detection rules from cloud-based CTI","author":"Schwartz","year":"2024"},{"key":"ref21","volume-title":"Cyber threat intelligence advisories","year":"2025"},{"key":"ref22","article-title":"Automatic mapping of unstructured Cyber Threat Intelligence: An experimental study","volume-title":"Proceedings of the 33rd IEEE International Symposium on Software Reliability Engineering (ISSRE)","author":"Orbinato"},{"key":"ref23","volume-title":"Threat intelligence","year":"2025"},{"key":"ref24","volume-title":"Extracting ttps and generating sigma rules from cyber threat intelligence via densified knowledge graph rag and optimized reflective agentic ai: Code","author":"Fairbanks","year":"2025"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3579375.3579391"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00046"},{"key":"ref27","volume-title":"rcatt","year":"2025"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134646"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104220"}],"event":{"name":"2025 IEEE International Conference on Big Data (BigData)","location":"Macau, China","start":{"date-parts":[[2025,12,8]]},"end":{"date-parts":[[2025,12,11]]}},"container-title":["2025 IEEE International Conference on Big Data (BigData)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11400704\/11400712\/11401712.pdf?arnumber=11401712","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T07:16:52Z","timestamp":1772867812000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11401712\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,8]]},"references-count":29,"URL":"https:\/\/doi.org\/10.1109\/bigdata66926.2025.11401712","relation":{},"subject":[],"published":{"date-parts":[[2025,12,8]]}}}