{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,6]],"date-time":"2025-12-06T16:47:33Z","timestamp":1765039653117,"version":"3.37.3"},"reference-count":39,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001321","name":"National Research Foundation Singapore","doi-asserted-by":"publisher","award":["NRF2016NCR-NCR001-006"],"award-info":[{"award-number":["NRF2016NCR-NCR001-006"]}],"id":[{"id":"10.13039\/501100001321","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100005501","name":"U.S.-Israel Energy Center managed by the Israel-U.S. Binational Industrial Research and Development (BIRD) Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100005501","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/tifs.2022.3215010","type":"journal-article","created":{"date-parts":[[2022,11,3]],"date-time":"2022-11-03T20:54:05Z","timestamp":1667508845000},"page":"477-490","source":"Crossref","is-referenced-by-count":6,"title":["MABAT: A Multi-Armed Bandit Approach for Threat-Hunting"],"prefix":"10.1109","volume":"18","author":[{"given":"Liad","family":"Dekel","sequence":"first","affiliation":[{"name":"Cyber@BGU Laboratories, Beer-Sheva, Israel"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ilia","family":"Leybovich","sequence":"additional","affiliation":[{"name":"Cyber@BGU Laboratories, Beer-Sheva, Israel"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Polina","family":"Zilberman","sequence":"additional","affiliation":[{"name":"Cyber@BGU Laboratories, Beer-Sheva, Israel"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7229-3899","authenticated-orcid":false,"given":"Rami","family":"Puzis","sequence":"additional","affiliation":[{"name":"Cyber@BGU Laboratories, Beer-Sheva, Israel"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2013.30"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2016.12.079"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3298689.3346984"},{"key":"ref32","first-page":"103","article-title":"Evaluation and analysis of the performance of the EXP3 algorithm in stochastic environments","author":"seldin","year":"2013","journal-title":"Proc of European Workshop on Reinforcement Learning"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1277741.1277790"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14267-3"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-47436-2_53"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/2663474.2663481"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2016.2600633"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2866041"},{"key":"ref10","first-page":"359","article-title":"The KL-UCB algorithm for bounded stochastic bandits and beyond","author":"garivier","year":"2011","journal-title":"Proc 24th Annu Conf Learn Theory"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1023\/A:1013689704352"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TCOMM.2019.2927570"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1080\/08850607.2016.1230701"},{"article-title":"Who’s using cyberthreat intelligence and how","year":"2015","author":"shackleford","key":"ref14"},{"key":"ref15","first-page":"433","article-title":"A different cup of TI? The added value of commercial threat intelligence","author":"bouwman","year":"2020","journal-title":"Proc 29th USENIX Secur Symp"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CYBConf.2017.7985754"},{"journal-title":"Mcafee Threat Intelligence Exchange (Datasheet)","year":"2019","key":"ref17"},{"journal-title":"Threat Intelligence in Splunk","year":"2017","author":"plona","key":"ref18"},{"journal-title":"Cyber Threat Hunting (1) Intro","year":"2016","author":"alonso","key":"ref19"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ICTCS.2017.22"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/1273496.1273587"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2017.1394049"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1017\/9781108571401"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1214\/aoap\/1177005588"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(19)30106-X"},{"journal-title":"Reinforcement Learning An Introduction","year":"2018","author":"sutton","key":"ref29"},{"key":"ref8","first-page":"151","article-title":"Combinatorial multi-armed bandit: General framework and applications","author":"chen","year":"2013","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref7","first-page":"2307","article-title":"Ecofuzz: Adaptive energy-saving greybox fuzzing as a variant of the adversarial multi-armed bandit","author":"yue","year":"2020","journal-title":"Proc 29th USENIX Secur Symp"},{"journal-title":"A Guide to Cyber Threat Hunting","year":"2018","author":"tyler technologies","key":"ref2"},{"key":"ref9","first-page":"1","article-title":"Analysis of Thompson sampling for the multi-armed bandit problem","author":"agrawal","year":"2012","journal-title":"Proc Conf Learn Theory"},{"key":"ref1","first-page":"75","author":"haber","year":"2018","journal-title":"Threat Hunting"},{"journal-title":"A framework for cyber threat hunting","year":"2016","author":"sqrrl data","key":"ref20"},{"journal-title":"Dynamic adaptive defense for cyber-security threats","year":"2017","author":"thomas","key":"ref22"},{"journal-title":"Automate Threat Hunting Operations","year":"2019","author":"enterprise","key":"ref21"},{"journal-title":"Crowdstrike Falcon Overwatch Managed Threat Hunting","year":"2019","key":"ref24"},{"journal-title":"Mcafee Investigator Transform Analysts Into Expert Investigators","year":"2019","key":"ref23"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.tcs.2009.01.016"},{"key":"ref25","first-page":"161","article-title":"Trading off scientific knowledge and user learning with multi-armed bandits","author":"liu","year":"2014","journal-title":"IEDM Tech Dig"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/9970396\/09920950.pdf?arnumber=9920950","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,14]],"date-time":"2025-01-14T19:44:18Z","timestamp":1736883858000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9920950\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":39,"URL":"https:\/\/doi.org\/10.1109\/tifs.2022.3215010","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2023]]}}}