{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T21:23:02Z","timestamp":1772745782907,"version":"3.50.1"},"reference-count":33,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T00:00:00Z","timestamp":1757289600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T00:00:00Z","timestamp":1757289600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,9,8]]},"DOI":"10.1109\/cns66487.2025.11194951","type":"proceedings-article","created":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T17:34:49Z","timestamp":1760549689000},"page":"1-9","source":"Crossref","is-referenced-by-count":0,"title":["Real-Time Detection of Multi-Stage Attacks Using Kill Chain State Machines"],"prefix":"10.1109","author":[{"given":"Liliana","family":"Kistenmacher","sequence":"first","affiliation":[{"name":"University of Hamburg"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Anum","family":"Talpur","sequence":"additional","affiliation":[{"name":"University of Hamburg"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mathias","family":"Fischer","sequence":"additional","affiliation":[{"name":"University of Hamburg"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.07.001"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-22915-7_40"},{"key":"ref3","first-page":"2783","article-title":"99% false positives: A qualitative study of soc analysts\u2019 perspectives on security alarms","author":"Alahmadi","year":"2022","journal-title":"USENIX Security"},{"key":"ref4","volume-title":"Cost of a data breach report","year":"2024"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3474374.3486918"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2020.2971484"},{"key":"ref7","first-page":"487","article-title":"SLEUTH: real-time attack scenario reconstruction from cots audit data","author":"Hossain","year":"2017","journal-title":"USENIX Security. USENIX Association"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230822"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA52953.2021.00273"},{"key":"ref13","first-page":"6575","article-title":"Distdet: A Cost-Effective distributed cyber threat detection system","author":"Dong","year":"2023","journal-title":"USENIX Security"},{"key":"ref14","first-page":"5197","article-title":"Magic: Detecting advanced persistent threats via masked graph representation learning","author":"Jia","year":"2024","journal-title":"USENIX Security"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833671"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103583"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.3390\/network4010004"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2004.21"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCIIS.2010.37"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3167132.3167239"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/IPCCC47392.2019.8958734"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ISI49825.2020.9280547"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-96-2417-1_15"},{"key":"ref24","volume-title":"The unified kill chain: Raising resilience against advanced cyber attacks","author":"Pols","year":"2023"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom53373.2021.00106"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108340"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2022.103373"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/PST58708.2023.10320192"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2024.06.016"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"ref31","volume-title":"A realistic cyber defense dataset (CSE-CIC-IDS2018)","year":"2018"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59621-7_8"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CNS56114.2022.9947235"}],"event":{"name":"2025 IEEE Conference on Communications and Network Security (CNS)","location":"Avignon, France","start":{"date-parts":[[2025,9,8]]},"end":{"date-parts":[[2025,9,11]]}},"container-title":["2025 IEEE Conference on Communications and Network Security (CNS)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11194903\/11194169\/11194951.pdf?arnumber=11194951","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T20:41:24Z","timestamp":1772743284000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11194951\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,8]]},"references-count":33,"URL":"https:\/\/doi.org\/10.1109\/cns66487.2025.11194951","relation":{},"subject":[],"published":{"date-parts":[[2025,9,8]]}}}