{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T03:45:16Z","timestamp":1784864716351,"version":"3.55.0"},"reference-count":215,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Ericsson Research"},{"DOI":"10.13039\/501100002914","name":"Concordia University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002914","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Cybersecurity Consortium (NCC) under the Cyber Security Innovation Network"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/comst.2023.3299519","type":"journal-article","created":{"date-parts":[[2023,8,14]],"date-time":"2023-08-14T18:07:58Z","timestamp":1692036478000},"page":"2299-2324","source":"Crossref","is-referenced-by-count":79,"title":["A Survey on Threat Hunting in Enterprise Networks"],"prefix":"10.1109","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5609-856X","authenticated-orcid":false,"given":"Boubakr","family":"Nour","sequence":"first","affiliation":[{"name":"Gina Cody School of Engineering and Computer Science, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Makan","family":"Pourzandi","sequence":"additional","affiliation":[{"name":"GFTL Security Research, Ericsson, Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mourad","family":"Debbabi","sequence":"additional","affiliation":[{"name":"Gina Cody School of Engineering and Computer Science, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"State of Cybersecurity Resilience 2021: How Aligning Security and the Business Creates Cyber Resilience","year":"2021"},{"key":"ref2","volume-title":"Cybersecurity Almanac: 100 Facts, Figures, Predictions and Statistics","year":"2020"},{"issue":"4","key":"ref3","first-page":"16","article-title":"The NIST cybersecurity framework: Overview and potential impacts","volume":"10","author":"Shen","year":"2014","journal-title":"Scitech Lawyer"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3204171"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/ICoICT52021.2021.9527434"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39945-3_6"},{"key":"ref8","first-page":"1","article-title":"Using learned models for the root cause analysis of cyber-physical production systems","volume-title":"Proc. Int. Workshop Principle Diagn. (DX)","author":"Niggemann"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243829"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(19)30074-1"},{"key":"ref11","article-title":"A systematic literature review on cyber threat hunting","author":"Wang","year":"2022","journal-title":"arXiv:2212.05310"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(17)30050-8"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2018.8599748"},{"key":"ref14","first-page":"257","article-title":"Detecting lateral movement in enterprise computer networks with unsupervised graph AI","volume-title":"Proc. Int. Symp. Res. Attacks Intrusions Defenses (RAID)","author":"Bowman"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102401"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108288"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2021.3117338"},{"key":"ref18","article-title":"A framework for cyber threat hunting","year":"2018"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.89"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3233703"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.3390\/s22041335"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3062204"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3508398.3511515"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2976609"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2021.3139052"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1177\/1550147717741463"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3191430"},{"key":"ref28","volume-title":"SANS 2018 Threat Hunting Survey Results","author":"Lee","year":"2018"},{"key":"ref29","volume-title":"SANS 2019 Threat Hunting Survey: The Differing Needs of New and Experienced Hunters","author":"Fuchs","year":"2019"},{"key":"ref30","volume-title":"2021 SANS Cyber Threat Intelligence (CTI) Survey","author":"Brown","year":"2021"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3181278"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.07.045"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/BigData52589.2021.9671958"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/4577141"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-022-00111-2"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3559768"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.03.010"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3091427"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3331524"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102282"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/DSC55868.2022.00053"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2940713"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.3390\/s21144759"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.07.015"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2020.300922"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2871866"},{"key":"ref49","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty","year":"2018","journal-title":"arXiv:1810.00069"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2982955"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2891891"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1016\/j.phycom.2020.101001"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2896380"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(21)00009-9"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.11.006"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355600"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2847722"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.3390\/app12083929"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.23919\/CyCon51939.2021.9468305"},{"key":"ref60","volume-title":"Cybersecurity Incident & Vulnerability Response playbooks\u2014Operational Procedures for Planning and Conducting Cybersecurity Incident and Vulnerability Response Activities in FCEB Information Systems","year":"2021"},{"key":"ref61","article-title":"Towards a new cyber threat actor typology","author":"Bruijne","year":"2740"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/j.istr.2010.04.004"},{"key":"ref63","volume-title":"Global Threat Report","year":"2023"},{"issue":"1","key":"ref64","first-page":"4","article-title":"Insiders and insider threats\u2014An overview of definitions and mitigation techniques","volume":"2","author":"Hunker","year":"2011","journal-title":"J. Wireless Mobile Netw. Ubiquitous Comput. Depend. Appl."},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-52727-7_11"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3199478.3199490"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3224896"},{"key":"ref68","first-page":"103","article-title":"Threat hunting as a method of protection against cyber threats","volume-title":"Proc. IT I","author":"Lukova-Chuiko"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/DSC47296.2019.8937641"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CCNC46108.2020.9045113"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.3390\/s22207999"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88418-5_34"},{"key":"ref73","article-title":"What is threat hunting?","year":"2022"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2017.8258514"},{"issue":"1","key":"ref75","first-page":"80","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume":"1","author":"Hutchins","year":"2011","journal-title":"Leading Issues Inf. Warfare Security Res."},{"key":"ref76","volume-title":"MITRE ATT&CK: Design and Philosophy","author":"Strom","year":"2018"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2019.8852142"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3407062"},{"key":"ref79","volume-title":"The Who, What, Where, When, Why and how of Effective Threat Hunting","author":"Lee","year":"2016"},{"key":"ref80","volume-title":"Threat hunting, definition and framework","author":"Liliengren","year":"2018"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/EIT.2019.8833792"},{"key":"ref82","article-title":"NetSet: A set visualization tool for network metadata exploration and threat hunting","author":"Fouss","year":"2018"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17143-7_23"},{"key":"ref84","first-page":"1111","article-title":"Automatic techniques to systematically discover new heap exploitation primitives","volume-title":"Proc. USENIX Security Symp. (USENIX Security)","author":"Yun"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.4018\/978-1-5225-9742-1.ch007"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-10684-2_7"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101589"},{"key":"ref88","article-title":"Looking beyond IoCs: Automatically extracting attack patterns from external CTI","author":"Alam","year":"2022","journal-title":"arXiv:2211.01753"},{"key":"ref89","first-page":"9","article-title":"The development of a common enumeration of vulnerabilities and exposures","volume-title":"Proc. Recent Adv. Intrusion Detect.","volume":"7","author":"Baker"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.3390\/app11188735"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2863942"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2963791"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2885561"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/BigData50022.2020.9378294"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/3331174"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2836950"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/W-FiCloud.2016.29"},{"key":"ref98","article-title":"Linking threat tactics, techniques, and patterns with defensive weaknesses, vulnerabilities and affected platform configurations for cyber hunting","author":"Hemberg","year":"2020","journal-title":"arXiv:2010.00533"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ICECET52533.2021.9698447"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/FAS-W.2017.165"},{"key":"ref101","article-title":"Evidential cyber threat hunting","author":"Araujo","year":"2021","journal-title":"arXiv:2104.10319"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/CSCloud.2015.71"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2018.00132"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3104260"},{"key":"ref105","first-page":"905","article-title":"ATTACK2VEC: Leveraging temporal word embeddings to understand the evolution of cyberattacks","volume-title":"Proc. USENIX Security Symp. (USENIX Security)","author":"Shen"},{"key":"ref106","first-page":"3093","article-title":"Hopper: Modeling and detecting lateral movement","volume-title":"Proc. USENIX Security Symp. (USENIX Security)","author":"Ho"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/CSR51186.2021.9527936"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/ICTCS.2017.22"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00046"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3523261"},{"key":"ref111","article-title":"Cybersecurity threat hunting and vulnerability analysis using a Neo4j graph database of open source intelligence","author":"Pelofske","year":"2023","journal-title":"arXiv:2301.12013"},{"key":"ref112","first-page":"3183","article-title":"Causal analysis for software-defined networking attacks","volume-title":"Proc. USENIX Security Symp. (USENIX Security)","author":"Ujcich"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23103"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991122"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3056999"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_29"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3133260"},{"key":"ref118","article-title":"ATHAFI: Agile threat hunting and forensic investigation","author":"Puzis","year":"2020","journal-title":"arXiv:2003.03663"},{"key":"ref119","article-title":"ProAPT: Projection of APT threats with deep reinforcement learning","author":"Dehghan","year":"2022","journal-title":"arXiv:2209.07215"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.02.005"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE51399.2021.00024"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE51399.2021.00309"},{"key":"ref123","article-title":"Automating cyber threat hunting using NLP, automated query generation, and genetic perturbation","author":"Karuna","year":"2021","journal-title":"arXiv:2104.11576"},{"key":"ref124","first-page":"3005","article-title":"ATLAS: A sequence-based learning approach for attack investigation","volume-title":"Proc. USENIX Security Symp. (USENIX Security)","author":"Alsaheel"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2966760"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3135639"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.23919\/ICACT53585.2022.9728949"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1145\/3491260"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/ICCE.2019.8661952"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3091150"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.6028\/nist.ir.8011-2"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1145\/2746266.2746278"},{"key":"ref133","volume-title":"Standardizing Cyber Threat Intelligence Information With the Structured Threat Information Expression (STIX)","author":"Barnum","year":"2012"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-15-0199-9_30"},{"key":"ref135","article-title":"An automated, end-to-end framework for modeling attacks from vulnerability descriptions","author":"Binyamini","year":"2020","journal-title":"arXiv:2008.04377"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/FNWF55208.2022.00046"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2019.2907247"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/GCAT52182.2021.9587507"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1016\/j.dcan.2022.09.008"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2021.107120"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.3036778"},{"key":"ref142","volume-title":"Cortex XDR","year":"2022"},{"key":"ref143","volume-title":"Introducing IBM Security QRadar XDR","year":"2022"},{"key":"ref144","volume-title":"Adopting Splunk\u2019s Analytics-Driven Security Platform as Your SIEM","year":"2020"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.2983930"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3216617"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-014-0365-y"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/PlatCon.2018.8472752"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2018.01.004"},{"key":"ref150","article-title":"A review of knowledge graph application scenarios in cyber security","author":"Liu","year":"2022","journal-title":"arXiv:2204.04769"},{"key":"ref151","first-page":"4","article-title":"The prize collecting Steiner tree problem: Theory and practice","volume-title":"Proc. SODA","volume":"1","author":"Johnson"},{"key":"ref152","volume-title":"XDR at a Glance","year":"2022"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1145\/3170521.3170522"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1109\/AiDAS53897.2021.9574308"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/2059432"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-32653-7"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1109\/EISIC.2017.20"},{"key":"ref158","volume-title":"SIEM Capabilities Through FireEye Helix","year":"2019"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1016\/j.ress.2021.107485"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1145\/1639714.1639740"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.3390\/s21093267"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1109\/IIAIAAI55812.2022.00130"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.21817\/indjcse\/2019\/v10i5\/191005008"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1109\/SOLI54607.2021.9672347"},{"key":"ref165","volume-title":"ArcSight\u2019s Latest and Greatest","year":"2022"},{"key":"ref166","volume-title":"CrowdStrike Falcon XDR","year":"2022"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.3390\/electronics9050824"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.3403\/30250757u"},{"key":"ref169","volume-title":"Information Security, Cybersecurity and Privacy Protection\u2014Information Security Management Systems\u2014Requirements","year":"2022"},{"key":"ref170","volume-title":"Information Security, Cybersecurity and Privacy Protection\u2014Information Security Controls","year":"2022"},{"key":"ref171","volume-title":"Information Technology\u2014Information Security Incident Management","year":"2023"},{"key":"ref172","volume-title":"Information Security, Cybersecurity and Privacy Protection\u2014Guidance on Managing Information Security Risks","year":"2022"},{"key":"ref173","volume-title":"Understanding the Open Cybersecurity Schema Framework","author":"Agbabia","year":"2022"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-92571-0_1"},{"key":"ref175","volume-title":"Open Command and Control (OpenC2)","year":"2021"},{"key":"ref176","volume-title":"Kestrel Threat Hunting Language","year":"2021"},{"key":"ref177","volume-title":"STIX-Shifter","year":"2021"},{"key":"ref178","volume-title":"MSTIC Jupyter and python security tools","year":"2022"},{"key":"ref179","volume-title":"The Trusted Automated Exchange of Indicator Information (TAXII)","author":"Connolly","year":"2014"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1145\/2994539.2994542"},{"key":"ref181","article-title":"MISP core format","author":"Dulaunoy","year":"2022"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101648"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/PerComWorkshops53856.2022.9767375"},{"key":"ref184","article-title":"Comparison of adversary emulation tools for reproducing behavior in cyber attacks","author":"Elgh","year":"2022"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2018.2864536"},{"key":"ref186","first-page":"2","article-title":"Expansion of ICS testbed for security validation based on MITRE attack techniques","volume-title":"Proc. 13th USENIX Conf. Cyber Security Exp. Test","author":"Choi"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2022.3171465"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-93479-8_4"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1145\/3387940.3392199"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/VTC2022-Spring54318.2022.9860581"},{"key":"ref191","first-page":"1","article-title":"A cybersecurity testbed for industrial control systems","volume-title":"Proc. Process Control Safety Symp.","author":"Candell"},{"key":"ref192","first-page":"1","article-title":"ICS testbed tetris: Practical building blocks towards a cyber security resource","volume-title":"Proc. 13th USENIX Workshop Cyber Security Exp. Test (CSET)","author":"Green"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1515\/pik-2014-0009"},{"key":"ref194","volume-title":"Cortex XSOAR: Redefining Security Orchestration, Automation, and Response","year":"2023"},{"key":"ref195","article-title":"Innovation insight for extended detection and response","author":"Firstbrook","year":"2021"},{"key":"ref196","volume-title":"Falcon Insight: Endpoint Detection and Response (EDR)","year":"2022"},{"key":"ref197","volume-title":"Nowhere to Hide: 2021 Threat Hunting Report","year":"2022"},{"key":"ref198","volume-title":"X-Force Threat Intelligence Index 2022","year":"2022"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1145\/3136825.3136904"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102221"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1145\/3300115.3309531"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1145\/3469440"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3031438"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2021.3127267"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-020-00318-5"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.1109\/IDSTA55301.2022.9923170"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2021.3055703"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2019.112948"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2019.112965"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102955"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.1900476"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-15471-3_7"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59621-7_8"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.4018\/IJSPPC.320225"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.2000373"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/10324457\/10216378.pdf?arnumber=10216378","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,14]],"date-time":"2024-03-14T02:16:44Z","timestamp":1710382604000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10216378\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":215,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/comst.2023.3299519","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}