{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T11:47:02Z","timestamp":1784893622833,"version":"3.55.0"},"reference-count":20,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2021,6,1]],"date-time":"2021-06-01T00:00:00Z","timestamp":1622505600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,6,1]],"date-time":"2021-06-01T00:00:00Z","timestamp":1622505600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,6,1]],"date-time":"2021-06-01T00:00:00Z","timestamp":1622505600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Serv. Manage."],"published-print":{"date-parts":[[2021,6]]},"DOI":"10.1109\/tnsm.2021.3056999","type":"journal-article","created":{"date-parts":[[2021,2,3]],"date-time":"2021-02-03T21:42:23Z","timestamp":1612388543000},"page":"1321-1333","source":"Crossref","is-referenced-by-count":36,"title":["From TTP to IoC: Advanced Persistent Graphs for Threat Hunting"],"prefix":"10.1109","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7515-271X","authenticated-orcid":false,"given":"Aimad","family":"Berady","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5714-3251","authenticated-orcid":false,"given":"Mathieu","family":"Jaume","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4838-2952","authenticated-orcid":false,"given":"Valerie Viet Triem","family":"Tong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gilles","family":"Guette","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref10","first-page":"1","article-title":"An emerging threat fileless malware: A survey and research challenges","volume":"32","author":"kumar","year":"2020","journal-title":"Cybersecurity"},{"key":"ref11","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-030-37228-6_12","article-title":"Closing the gap with APTs through semantic clusters and automated cybergames","author":"gianvecchio","year":"2019","journal-title":"Lecture Notes of the Institute for Computer Sciences Social Informatics and Telecommunications Engineering"},{"key":"ref12","first-page":"865","article-title":"Cyber kill chain-based taxonomy of advanced persistent threat actors: Analogy of tactics, techniques, and procedures","volume":"15","author":"bahrami","year":"2019","journal-title":"J Inf Process Syst"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991111"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359791"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991122"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS47738.2020.9110439"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-64793-3_24"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2009.5235344"},{"key":"ref19","author":"bilinski","year":"2020","journal-title":"Lie Another Day Demonstrating Bias in a Multi-round Cyber Deception Game of Questionable Veracity"},{"key":"ref4","year":"2019","journal-title":"ATT&CK Evaluation"},{"key":"ref3","author":"rodriguez","year":"2020","journal-title":"APT29 Activity From the ATT&CK Evaluations"},{"key":"ref6","year":"2018","journal-title":"The MITRE Cyber Analytics Repository (CAR)"},{"key":"ref5","year":"2017","journal-title":"STIX a Structured Language for Cyber Threat Intelligence"},{"key":"ref8","first-page":"96","article-title":"Modeling the operational phases of APT campaigns","author":"berady","year":"2019","journal-title":"Proc 6th Annu Conf Comput Sci Comput Intell"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3199478.3199490"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2017.8258514"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4842-5608-4_7"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359808"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-34266-0_12"}],"container-title":["IEEE Transactions on Network and Service Management"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/4275028\/9450206\/09345788.pdf?arnumber=9345788","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T14:52:40Z","timestamp":1652194360000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9345788\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6]]},"references-count":20,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tnsm.2021.3056999","relation":{},"ISSN":["1932-4537","2373-7379"],"issn-type":[{"value":"1932-4537","type":"electronic"},{"value":"2373-7379","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6]]}}}