{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,19]],"date-time":"2026-07-19T09:47:11Z","timestamp":1784454431595,"version":"3.55.0"},"reference-count":50,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100005073","name":"Agency for Defense Development, Republic of Korea","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100005073","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3578233","type":"journal-article","created":{"date-parts":[[2025,6,9]],"date-time":"2025-06-09T17:33:36Z","timestamp":1749490416000},"page":"6162-6174","source":"Crossref","is-referenced-by-count":5,"title":["MuCamp: Generating Cyber Campaign Variants via TTP Synonym Replacement for Group Attribution"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9822-9860","authenticated-orcid":false,"given":"Insup","family":"Lee","sequence":"first","affiliation":[{"name":"Agency for Defense Development, Daejeon, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-4302-3522","authenticated-orcid":false,"given":"Changhee","family":"Choi","sequence":"additional","affiliation":[{"name":"Agency for Defense Development, Daejeon, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1603","article-title":"Mutating cyber camapaign with TTP word replacement","volume-title":"Proc. Korea Inst. Mil. Sci. Technol.","author":"Lee"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.icte.2022.04.007"},{"key":"ref3","first-page":"1","article-title":"Lazarus group: A mahjong game played with different sets of tiles","volume-title":"Proc. Virus Bull. Int. Conf.","author":"Kalnai"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101589"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2014.6997496"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24549"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3032570"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3098977"},{"key":"ref9","first-page":"3989","article-title":"CLARION: Sound and clear provenance tracking for microservice deployments","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Chen"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3208815"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2015.2458581"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/2740070.2626335"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243749"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2022.3231406"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/LNET.2022.3185553"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2025.3533084"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.14569\/IJACSA.2020.0110504"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.13052\/jwe1540-9589.2019"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104222"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3474792"},{"key":"ref21","article-title":"Mitre ATT&CK: Design and philosophy","author":"Strom","year":"2018"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.2971484"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3009748"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.3390\/s21196522"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3306593"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/1699657"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3322427"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607208"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104220"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.icte.2023.05.008"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2019.00190"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ICC40277.2020.9148946"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-05981-0_7"},{"key":"ref34","article-title":"Generative deep learning techniques for password generation","author":"Biesner","year":"2020","journal-title":"arXiv:2012.05685"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3140015"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev53368.2022.00017"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/5021125"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3216902"},{"key":"ref39","article-title":"ThreatCrawl: A BERT-based focused crawler for the cybersecurity domain","author":"Kuehn","year":"2023","journal-title":"arXiv:2304.11960"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3181682"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3268532"},{"key":"ref42","first-page":"1","article-title":"Sequence to sequence learning with neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"27","author":"Sutskever"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.10804"},{"key":"ref44","volume-title":"Apt & Cybercriminals Campaign Collection","year":"2023"},{"key":"ref45","article-title":"Automated retrieval of ATT&CK tactics and techniques for cyber threat reports","volume-title":"arXiv:2004.14322","author":"Legoy","year":"2020"},{"key":"ref46","volume-title":"The Center for Threat-Informed Defense, Tram is an Open-Source Platform Designed to Advance Research Into Automating the Mapping of Cyber Threat Intelligence Reports to Mitre ATT&CK","year":"2023"},{"key":"ref47","volume-title":"Lazarus Targets Defense Industry With Threatneedle","year":"2023"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1670"},{"key":"ref49","volume-title":"MITRE ATT&CK Enterprise Tactics","year":"2023"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1613\/jair.953"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11029111.pdf?arnumber=11029111","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,25]],"date-time":"2025-06-25T18:21:37Z","timestamp":1750875697000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11029111\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":50,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3578233","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}