{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T11:47:06Z","timestamp":1784893626309,"version":"3.55.0"},"reference-count":57,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2022,2,1]],"date-time":"2022-02-01T00:00:00Z","timestamp":1643673600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,2,1]],"date-time":"2022-02-01T00:00:00Z","timestamp":1643673600000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,2,1]],"date-time":"2022-02-01T00:00:00Z","timestamp":1643673600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,2,1]],"date-time":"2022-02-01T00:00:00Z","timestamp":1643673600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100019492","name":"National Natural Science Foundation of China-China Academy of General Technology Joint Fund for Basic Research","doi-asserted-by":"publisher","award":["U1836215"],"award-info":[{"award-number":["U1836215"]}],"id":[{"id":"10.13039\/501100019492","id-type":"DOI","asserted-by":"publisher"}]},{"name":"BUPT Excellent Ph.D. Students Foundation","award":["CX2018216"],"award-info":[{"award-number":["CX2018216"]}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["III-1763325"],"award-info":[{"award-number":["III-1763325"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["III-1909323"],"award-info":[{"award-number":["III-1909323"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1930941"],"award-info":[{"award-number":["CNS-1930941"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2018YFC0830804"],"award-info":[{"award-number":["2018YFC0830804"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Knowl. Data Eng."],"published-print":{"date-parts":[[2022,2,1]]},"DOI":"10.1109\/tkde.2020.2987019","type":"journal-article","created":{"date-parts":[[2020,4,20]],"date-time":"2020-04-20T19:56:01Z","timestamp":1587412561000},"page":"708-722","source":"Crossref","is-referenced-by-count":98,"title":["HinCTI: A Cyber Threat Intelligence Modeling and Identification System Based on Heterogeneous Information Network"],"prefix":"10.1109","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0458-8481","authenticated-orcid":false,"given":"Yali","family":"Gao","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5597-9306","authenticated-orcid":false,"given":"Xiaoyong","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7422-630X","authenticated-orcid":false,"given":"Hao","family":"Peng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Binxing","family":"Fang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3491-5968","authenticated-orcid":false,"given":"Philip S.","family":"Yu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3132847.3132953"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098036"},{"key":"ref33","first-page":"1","article-title":"Detecting malware domains at the upper DNS hierarchy","volume":"11","author":"antonakakis","year":"2011","journal-title":"Proc Usenix Secur Symp"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2017.1394049"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2016.7745437"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2015.7165935"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939754"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623732"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991122"},{"key":"ref34","first-page":"491","article-title":"From throw-away traffic to bots: Detecting the rise of DGA-based malware","author":"antonakakis","year":"2012","journal-title":"Proc 21st USENIX Secur Symp"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-015-9402-8"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2018.8622111"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2874246"},{"key":"ref2","article-title":"Definition: Threat intelligence","author":"mcmillan","year":"2019"},{"key":"ref1","first-page":"1","author":"samtani","year":"2019","journal-title":"Cybersecurity as an Industry A Cyber Threat Intelligence Perspective"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-22915-7_40"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939747"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3029806.3029811"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/2746266.2746278"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/s11063-017-9666-7"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2018.01.004"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/bs.host.2016.07.001"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2012.2184552"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098063"},{"key":"ref57","first-page":"265","article-title":"Tensorflow: A system for large-scale machine learning","author":"abadi","year":"2016","journal-title":"Proc 12th USENIX Symp Operating Syst Des Implementation"},{"key":"ref56","first-page":"42","article-title":"Dynamic programming","volume":"5","author":"wagner","year":"1995","journal-title":"Mathematica J"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3178876.3186005"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/2487575.2487644"},{"key":"ref53","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"srivastava","year":"2014","journal-title":"J Mach Learn Res"},{"key":"ref52","first-page":"1","article-title":"Semi-supervised classification with graph convolutional networks","author":"kipf","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-0017-4"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.01.022"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2005.1555942"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2016.2598561"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/2666652.2666659"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2487575.2487577"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/2020408.2020603"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.09.001"},{"key":"ref17","first-page":"1","article-title":"Standardizing cyber threat intelligence information with the structured threat information eXpression (STIXTM)","volume":"11","author":"barnum","year":"2012","journal-title":"MITRE Corporation"},{"key":"ref18","article-title":"RFC 5070: The incident object description exchange format","author":"danyliw","year":"2007"},{"key":"ref19","article-title":"White Paper: Sophisticated indicators for the modern threat landscape: An introduction to OpenIOC","year":"2013"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CIC.2016.060"},{"key":"ref3","article-title":"The Pyramid of Pain","author":"bianco","year":"2013"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2994539.2994546"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2015.05.002"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978315"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/PlatCon.2018.8472752"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/1557019.1557153"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134646"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219862"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098026"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2885561"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.14778\/3402707.3402736"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3308558.3313562"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2008.2005605"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/449"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219965"}],"container-title":["IEEE Transactions on Knowledge and Data Engineering"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/69\/9677034\/9072563-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/69\/9677034\/09072563.pdf?arnumber=9072563","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,8]],"date-time":"2022-04-08T18:49:05Z","timestamp":1649443745000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9072563\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,1]]},"references-count":57,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tkde.2020.2987019","relation":{},"ISSN":["1041-4347","1558-2191","2326-3865"],"issn-type":[{"value":"1041-4347","type":"print"},{"value":"1558-2191","type":"electronic"},{"value":"2326-3865","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,1]]}}}