{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T23:47:44Z","timestamp":1792799264638,"version":"4.5.0"},"reference-count":182,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2022,12,3]],"date-time":"2022-12-03T00:00:00Z","timestamp":1670025600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Ministry of Business, Innovation, and Employment (MBIE) of New Zealand","award":["MAUX1912"],"award-info":[{"award-number":["MAUX1912"]}],"id":[{"id":"https:\/\/ror.org\/02jtq1b51","id-type":"ROR","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,5,31]]},"abstract":"<jats:p>Cyberspace is full of uncertainty in terms of advanced and sophisticated cyber threats that are equipped with novel approaches to learn the system and propagate themselves, such as AI-powered threats. To debilitate these types of threats, a modern and intelligent Cyber Situation Awareness (SA) system needs to be developed that has the ability of monitoring and capturing various types of threats, analyzing, and devising a plan to avoid further attacks. This article provides a comprehensive study on the current state-of-the-art in the cyber SA to discuss the following aspects of SA: key design principles, framework, classifications, data collection, analysis of the techniques, and evaluation methods. Last, we highlight misconceptions, insights, and limitations of this study and suggest some future work directions to address the limitations.<\/jats:p>","DOI":"10.1145\/3530809","type":"journal-article","created":{"date-parts":[[2022,4,22]],"date-time":"2022-04-22T11:28:19Z","timestamp":1650626899000},"page":"1-37","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":45,"title":["A Survey on Cyber Situation-awareness Systems: Framework, Techniques, and Insights"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0033-6706","authenticated-orcid":false,"given":"Hooman","family":"Alavizadeh","sequence":"first","affiliation":[{"name":"University of New South Wales (UNSW), Canberra, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1002-057X","authenticated-orcid":false,"given":"Julian","family":"Jang-Jaccard","sequence":"additional","affiliation":[{"name":"Massey University, Auckland, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0970-3621","authenticated-orcid":false,"given":"Simon Yusuf","family":"Enoch","sequence":"additional","affiliation":[{"name":"Federal University of Kashere, Gombe, Gombe, Nigeria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4633-6135","authenticated-orcid":false,"given":"Harith","family":"Al-Sahaf","sequence":"additional","affiliation":[{"name":"Victoria University of Wellington (VUW), Kelburn, Wellington, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5968-182X","authenticated-orcid":false,"given":"Ian","family":"Welch","sequence":"additional","affiliation":[{"name":"Victoria University of Wellington (VUW), Kelburn, Wellington, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6353-8359","authenticated-orcid":false,"given":"Seyit A.","family":"Camtepe","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2605-187X","authenticated-orcid":false,"given":"Dan Dongseong","family":"Kim","sequence":"additional","affiliation":[{"name":"University of Queensland (UQ), Queensland, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,3]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"issue":"4","key":"e_1_3_2_3_2","first-page":"651","article-title":"Multiple correspondence analysis","volume":"2","author":"Abdi Herv\u00e9","year":"2007","unstructured":"Herv\u00e9 Abdi and Dominique Valentin. 2007. Multiple correspondence analysis. Encycl. Measur. Statist. 2, 4 (2007), 651-657.","journal-title":"Encycl. Measur. Statist."},{"issue":"15","key":"e_1_3_2_4_2","first-page":"113","article-title":"Development of threats detection model for cyber situation awareness","volume":"2","author":"Dauda A. Adenusi","year":"2017","unstructured":"A. Adenusi Dauda, E. C. Ayeleso, A. K. Kawonise, J. B. Ekuewa, and A. A. Adebayo. 2017. Development of threats detection model for cyber situation awareness. Technology (ICONSEET) 2, 15 (2017), 113-126.","journal-title":"Technology (ICONSEET)"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.3390\/computers11030041"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/TETC.2022.3155272"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102091"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-61152-5_1"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/AICCSA.2018.8612856"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.5555\/2635955"},{"key":"e_1_3_2_11_2","volume-title":"Introduction to Machine Learning (4th ed.)","author":"Alpaydin Ethem","year":"2020","unstructured":"Ethem Alpaydin. 2020. Introduction to Machine Learning (4th ed.). The MIT Press."},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cola.2018.12.007"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2015.7312764"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.5555\/548530"},{"key":"e_1_3_2_16_2","first-page":"1","volume-title":"Proceedings of the APWG Symposium on Electronic Crime Research (eCrime)","author":"Bahnsen Alejandro Correa","year":"2018","unstructured":"Alejandro Correa Bahnsen, Ivan Torroledo, Luis David Camacho, and Sergio Villegas. 2018. DeepPhish: Simulating malicious AI. In Proceedings of the APWG Symposium on Electronic Crime Research (eCrime). 1-8."},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-0140-8_5"},{"key":"e_1_3_2_18_2","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/978-1-4419-0140-8_1","volume-title":"Cyber Situational Awareness","author":"Barford Paul","year":"2010","unstructured":"Paul Barford, Marc Dacier, Thomas G. Dietterich, Matt Fredrikson, Jon Giffin, Sushil Jajodia, Somesh Jha, Jason Li, Peng Liu, Peng Ning, et\u00a0al. 2010. Cyber SA: Situational awareness for cyber defense. In Cyber Situational Awareness. Springer, 3-13."},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics10050589"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1145\/2808769.2808773"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850805"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.5555\/1162264"},{"key":"e_1_3_2_23_2","first-page":"94690I","volume-title":"Sensors and Systems for Space Applications VIII","author":"Blasch Erik","year":"2015","unstructured":"Erik Blasch, Dan Shen, Khanh D. Pham, and Genshe Chen. 2015. Review of game theory applications for situation awareness. In Sensors and Systems for Space Applications VIII, Vol. 9469. International Society for Optics and Photonics, 94690I."},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1007\/s13218-012-0179-2"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSCloud.2017.11"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-38930-1_12"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33690-4_7"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/2462096.2462100"},{"issue":"12","key":"e_1_3_2_29_2","article-title":"Survey of adaptive resonance theory techniques in IDS","volume":"4","author":"Champaneria Krishna","year":"2014","unstructured":"Krishna Champaneria and Bhavin Shah Krunal Panchal. 2014. Survey of adaptive resonance theory techniques in IDS. Int. J. Emerg. Technol. Adv. Eng. 4, 12 (2014).","journal-title":"Int. J. Emerg. Technol. Adv. Eng."},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/PCCC.2010.5682295"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/IAdCC.2014.6779330"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICICES.2014.7033844"},{"key":"e_1_3_2_33_2","first-page":"377","volume-title":"Proceedings of the IEEE 4th International Conference on Software Engineering and Service Science","author":"Chen Fenglan","year":"2013","unstructured":"Fenglan Chen, Yongjun Shen, Guidong Zhang, and Xin Liu. 2013. The network security situation predicting technology based on the small-world echo state network. In Proceedings of the IEEE 4th International Conference on Software Engineering and Service Science. IEEE, 377-380."},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1109\/HASE.2016.48"},{"key":"e_1_3_2_35_2","article-title":"Artificial-intelligence-colloquium (CGC)","year":"2019","unstructured":"DARPA. cited August 2019. Artificial-intelligence-colloquium (CGC). Retrieved from https:\/\/www.darpa.mil\/news-events\/artificial-intelligence-colloquium.","journal-title":"R"},{"key":"e_1_3_2_36_2","article-title":"Cyber-Hunting at Scale (CHASE) - Defense Advanced Research Projects Agency","year":"2020","unstructured":"DARPA. cited August 2020. Cyber-Hunting at Scale (CHASE) - Defense Advanced Research Projects Agency. Retrieved from https:\/\/www.darpa.mil\/program\/cyber-hunting-at-scale.","journal-title":"R"},{"key":"e_1_3_2_37_2","article-title":"Transparent Computing (TC)","year":"2014","unstructured":"DARPA. cited December 2014. Transparent Computing (TC). Retrieved from https:\/\/www.darpa.mil\/program\/transparent-computing.","journal-title":"R"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2002.1011541"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1561\/2000000039"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-0140-8_11"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/MHS.1995.494215"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1177\/154193128803200221"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1518\/001872095779049499"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/HPEC.2019.8916559"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2497690"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39454-6_70"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2012.11.050"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/2671491.2671495"},{"issue":"1","key":"e_1_3_2_49_2","first-page":"14","article-title":"MASON: Mobile autonomic security for network access controls","volume":"18","author":"Fitzgerald William M.","year":"2013","unstructured":"William M. Fitzgerald, Ultan Neville, and Simon N. Foley. 2013. MASON: Mobile autonomic security for network access controls. J. Inf. Secur. Applic. 18, 1 (2013), 14-29.","journal-title":"J. Inf. Secur. Applic."},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.06.008"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1190"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00502-015-0287-4"},{"key":"e_1_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2018.2865029"},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/CompComm.2016.7924882"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.1007\/s41635-017-0003-4"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101801"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2012.6400503"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.2991\/iccse-17.2017.24"},{"key":"e_1_3_2_59_2","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1007\/978-3-319-11391-3_8","volume-title":"Cyber Defense and Situational Awareness","author":"Healey Christopher G.","year":"2014","unstructured":"Christopher G. Healey, Lihua Hao, and Steve E. Hutchinson. 2014. Visualizations and analysts. In Cyber Defense and Situational Awareness. Springer, 145-165."},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-21568-2_11"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1016\/0893-6080(89)90020-8"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/3407642"},{"key":"e_1_3_2_64_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-34139-8_3"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2939490"},{"key":"e_1_3_2_66_2","article-title":"Generating adversarial malware examples for black-box attacks based on GAN","author":"Hu Weiwei","year":"2017","unstructured":"Weiwei Hu and Ying Tan. 2017. Generating adversarial malware examples for black-box attacks based on GAN. arXiv preprint arXiv:1702.05983 (2017).","journal-title":"arXiv preprint arXiv:1702.05983"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1145\/3064814.3064828"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2871866"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-014-5473-9"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1186\/s13635-016-0034-3"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046742"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/3407642"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1002\/wfs2.1418"},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"e_1_3_2_75_2","first-page":"114130J","volume-title":"Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications II","author":"Jiang Meng","year":"2020","unstructured":"Meng Jiang. 2020. Improving situational awareness with collective artificial intelligence over knowledge graphs. In Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications II, Vol. 11413. International Society for Optics and Photonics, 114130J."},{"key":"e_1_3_2_76_2","first-page":"200","volume-title":"Proceedings of the 16th International Conference on Machine Learning","author":"Joachims Thorsten","year":"1999","unstructured":"Thorsten Joachims. 1999. Transductive inference for text classification using support vector machines. In Proceedings of the 16th International Conference on Machine Learning. Morgan Kaufmann, 200-209."},{"key":"e_1_3_2_77_2","article-title":"A statistical interpretation of term specificity and its application in retrieval","author":"Jones Karen Sparck","year":"1972","unstructured":"Karen Sparck Jones. 1972. A statistical interpretation of term specificity and its application in retrieval. J. Document. (1972).","journal-title":"J. Document."},{"key":"e_1_3_2_78_2","volume-title":"Evolutionary Computation: A Unified Approach","author":"Jong Kenneth A. De","year":"2006","unstructured":"Kenneth A. De Jong. 2006. Evolutionary Computation: A Unified Approach. The MIT Press."},{"key":"e_1_3_2_79_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372823"},{"key":"e_1_3_2_80_2","doi-asserted-by":"publisher","DOI":"10.1109\/QRS-C.2016.14"},{"key":"e_1_3_2_81_2","first-page":"1723","volume-title":"Proceedings of the 3rd annual Conference on Privacy, Security and Trust","volume":"94","author":"Kayacik H. G\u00fcnes","year":"2005","unstructured":"H. G\u00fcnes Kayacik, A. Nur Zincir-Heywood, and Malcolm I. Heywood. 2005. Selecting features for intrusion detection: A feature relevance analysis on KDD 99 intrusion detection datasets. In Proceedings of the 3rd annual Conference on Privacy, Security and Trust, Vol. 94. Citeseer, 1723-1722."},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2017.11.022"},{"key":"e_1_3_2_83_2","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2013.6682753"},{"key":"e_1_3_2_84_2","doi-asserted-by":"publisher","DOI":"10.1109\/PlatCon.2016.7456805"},{"key":"e_1_3_2_85_2","article-title":"DeepLocker-Concealing targeted attacks with AI locksmithing","author":"Kirat Dhilung","year":"2018","unstructured":"Dhilung Kirat, Jiyong Jang, and Marc Stoecklin. 2018. DeepLocker-Concealing targeted attacks with AI locksmithing. Blackhat USA 1 (2018), 1-29.","journal-title":"Blackhat USA"},{"key":"e_1_3_2_86_2","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523682"},{"key":"e_1_3_2_87_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2014.6883587"},{"key":"e_1_3_2_88_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-92624-7_5"},{"key":"e_1_3_2_89_2","doi-asserted-by":"publisher","DOI":"10.1049\/cje.2018.10.007"},{"key":"e_1_3_2_90_2","first-page":"919","volume-title":"Proceedings of the 4th International Conference on Computer Science and Network Technology (ICCSNT)","author":"Kun Wang","year":"2015","unstructured":"Wang Kun, Qiu Hui, Yang Haopu, and Hou Di. 2015. Network security situation evaluation method based on attack intention recognition. In Proceedings of the 4th International Conference on Computer Science and Network Technology (ICCSNT). IEEE, 919-924."},{"key":"e_1_3_2_91_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-013-0178-3"},{"key":"e_1_3_2_92_2","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029219"},{"key":"e_1_3_2_93_2","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390224"},{"key":"e_1_3_2_94_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-46742-8_39"},{"key":"e_1_3_2_95_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICNC.2013.6818041"},{"key":"e_1_3_2_96_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-43309-3_85"},{"key":"e_1_3_2_97_2","doi-asserted-by":"publisher","DOI":"10.1186\/s13638-019-1506-1"},{"key":"e_1_3_2_98_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_2"},{"key":"e_1_3_2_99_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2007.4370711"},{"key":"e_1_3_2_100_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICICIC.2008.436"},{"key":"e_1_3_2_101_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-0140-8_8"},{"key":"e_1_3_2_102_2","doi-asserted-by":"publisher","DOI":"10.1109\/SNPD.2016.7515951"},{"key":"e_1_3_2_103_2","first-page":"829404","volume-title":"Visualization and Data Analysis 2012","author":"Mansmann Florian","year":"2012","unstructured":"Florian Mansmann, Milos Krstajic, Fabian Fischer, and Enrico Bertini. 2012. StreamSqueeze: A dynamic stream visualization for monitoring of event data. In Visualization and Data Analysis 2012, Vol. 8294. International Society for Optics and Photonics, 829404."},{"key":"e_1_3_2_104_2","doi-asserted-by":"publisher","DOI":"10.1109\/SECON.2017.7925383"},{"key":"e_1_3_2_105_2","doi-asserted-by":"publisher","DOI":"10.1109\/SECON.2016.7506766"},{"key":"e_1_3_2_106_2","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2017.8170757"},{"key":"e_1_3_2_107_2","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2015.7312771"},{"key":"e_1_3_2_108_2","first-page":"1","volume-title":"Proceedings of the 15th International Conference on Availability, Reliability and Security","author":"Medenou Roumen Daton","year":"2020","unstructured":"Roumen Daton Medenou, Victor Manuel Calzado Mayo, Miriam Garcia Balufo, Miguel P\u00e1ramo Castrillo, Francisco Jos\u00e9 Gonz\u00e1lez Garrido, Alvaro Luis Martinez, David Nevado Catal\u00e1n, Ao Hu, David Sandoval Rodr\u00edguez-Bermejo, Jorge Maestre Vidal, et\u00a0al. 2020. CYSAS-S3: A novel dataset for validating cyber situational awareness related tools for supporting military operations. In Proceedings of the 15th International Conference on Availability, Reliability and Security. 1-9."},{"issue":"7","key":"e_1_3_2_109_2","first-page":"70","article-title":"Network security situation prediction model based on HHGA-RBF neural network","volume":"38","author":"Meng Jin","year":"2011","unstructured":"Jin Meng, Chi Ma, J.-L. He, and Hong Zhang. 2011. Network security situation prediction model based on HHGA-RBF neural network. Comput. Sci. 38, 7 (2011), 70.","journal-title":"Comput. Sci."},{"key":"e_1_3_2_110_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2002.1007774"},{"key":"e_1_3_2_111_2","doi-asserted-by":"publisher","DOI":"10.1109\/NBiS.2016.25"},{"key":"e_1_3_2_112_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cor.2016.05.005"},{"key":"e_1_3_2_113_2","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016908"},{"key":"e_1_3_2_114_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2011.2166158"},{"issue":"3","key":"e_1_3_2_115_2","first-page":"9","article-title":"Achieving cyber survivability in a contested environment using a cyber moving target","volume":"7","author":"Okhravi Hamed","year":"2011","unstructured":"Hamed Okhravi, J. W. Haines, and K. Ingols. 2011. Achieving cyber survivability in a contested environment using a cyber moving target. High Front. J. 7, 3 (2011), 9-13.","journal-title":"High Front. J."},{"key":"e_1_3_2_116_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00056"},{"key":"e_1_3_2_117_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_118_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_119_2","article-title":"Interpretable probabilistic password strength meters via deep learning","author":"Pasquini Dario","year":"2020","unstructured":"Dario Pasquini, Giuseppe Ateniese, and Massimo Bernsaschi. 2020. Interpretable probabilistic password strength meters via deep learning. arXiv preprint arXiv:2004.07179 (2020).","journal-title":"arXiv preprint arXiv:2004.07179"},{"key":"e_1_3_2_120_2","doi-asserted-by":"publisher","DOI":"10.1145\/3005714"},{"key":"e_1_3_2_121_2","first-page":"307","volume-title":"Proceedings of the International Conference on Security and Cryptography","author":"Prieto Iria","year":"2011","unstructured":"Iria Prieto, Eduardo Maga\u00f1a, Daniel Morat\u00f3, and Mikel Izal. 2011. Botnet detection based on DNS records and active probing. In Proceedings of the International Conference on Security and Cryptography. IEEE, 307-316."},{"key":"e_1_3_2_122_2","first-page":"1","volume-title":"Proceedings of the USENIX Security Symposium","author":"Provos Niels","year":"2004","unstructured":"Niels Provos et\u00a0al. 2004. A virtual honeypot framework. In Proceedings of the USENIX Security Symposium. 1-14."},{"key":"e_1_3_2_123_2","first-page":"496","volume-title":"Proceedings of the 2nd Conference on Environmental Science and Information Application Technology","author":"Qu Zhao-Yang","year":"2010","unstructured":"Zhao-Yang Qu, Ya-Ying Li, et\u00a0al. 2010. A network security situation evaluation method based on DS evidence theory. In Proceedings of the 2nd Conference on Environmental Science and Information Application Technology. IEEE, 496-499."},{"key":"e_1_3_2_124_2","doi-asserted-by":"crossref","first-page":"203","DOI":"10.1007\/978-3-319-61152-5_8","volume-title":"Theory and Models for Cyber Situation Awareness","author":"Rajivan Prashanth","year":"2017","unstructured":"Prashanth Rajivan and Nancy Cooke. 2017. Impact of team collaboration on cybersecurity situational awareness. In Theory and Models for Cyber Situation Awareness. Springer, 203-226."},{"issue":"10","key":"e_1_3_2_125_2","first-page":"x-xii","article-title":"Artificial intelligence and offensive cyber weapons","volume":"25","year":"2019","unstructured":"Rhodes. 2019. Artificial intelligence and offensive cyber weapons. Strateg. Comments 25, 10 (2019), x-xii.","journal-title":"Strateg. Comments"},{"key":"e_1_3_2_126_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20505-7_26"},{"key":"e_1_3_2_127_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-020-00490-y"},{"key":"e_1_3_2_128_2","doi-asserted-by":"publisher","DOI":"10.5555\/1406354"},{"key":"e_1_3_2_129_2","doi-asserted-by":"publisher","DOI":"10.1145\/3410566.3410606"},{"key":"e_1_3_2_130_2","first-page":"1","article-title":"Weaponizing data science for social engineering: Automated E2E spear phishing on Twitter","volume":"37","author":"Seymour John","year":"2016","unstructured":"John Seymour and Philip Tully. 2016. Weaponizing data science for social engineering: Automated E2E spear phishing on Twitter. Black Hat USA 37 (2016), 1-39.","journal-title":"Black Hat USA"},{"key":"e_1_3_2_131_2","doi-asserted-by":"crossref","first-page":"65710F","DOI":"10.1117\/12.720090","volume-title":"Multisensor, Multisource Information Fusion: Architectures, Algorithms, and Applications 2007","author":"Shen Dan","year":"2007","unstructured":"Dan Shen, Genshe Chen, Jose B. Cruz Jr, Leonard Haynes, Martin Kruger, and Erik Blasch. 2007. A Markov game theoretic data fusion approach for cyber situational awareness. In Multisensor, Multisource Information Fusion: Architectures, Algorithms, and Applications 2007, Vol. 6571. International Society for Optics and Photonics, 65710F."},{"key":"e_1_3_2_132_2","doi-asserted-by":"publisher","DOI":"10.5555\/1577069.1755873"},{"key":"e_1_3_2_133_2","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813687"},{"key":"e_1_3_2_134_2","article-title":"How artificial intelligence will shape the future of malware","author":"Simon Batt","year":"2019","unstructured":"Batt Simon. 2019. How artificial intelligence will shape the future of malware. Retrieved from https:\/\/www.makeuseof.com\/tag\/artificial-intelligence-future-malware\/.","journal-title":"R"},{"key":"e_1_3_2_135_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.04.003"},{"key":"e_1_3_2_136_2","article-title":"DeepLocker: How AI can power a stealthy new breed of malware","volume":"8","author":"Stoecklin Marc Ph.","year":"2018","unstructured":"Marc Ph. Stoecklin. 2018. DeepLocker: How AI can power a stealthy new breed of malware. Secur. Intell. 8 (Aug. 2018).","journal-title":"Secur. Intell."},{"key":"e_1_3_2_137_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2018.04.065"},{"key":"e_1_3_2_138_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-61152-5_4"},{"key":"e_1_3_2_139_2","doi-asserted-by":"publisher","DOI":"10.1109\/TETC.2018.2794611"},{"key":"e_1_3_2_140_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.proeng.2011.08.621"},{"key":"e_1_3_2_141_2","doi-asserted-by":"publisher","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"e_1_3_2_142_2","doi-asserted-by":"publisher","DOI":"10.3390\/info7020020"},{"key":"e_1_3_2_143_2","doi-asserted-by":"publisher","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"e_1_3_2_144_2","doi-asserted-by":"publisher","DOI":"10.1109\/BigData50022.2020.9378294"},{"key":"e_1_3_2_145_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2008.05.012"},{"key":"e_1_3_2_146_2","doi-asserted-by":"publisher","DOI":"10.1109\/iThings-GreenCom-CPSCom-SmartData.2016.165"},{"key":"e_1_3_2_147_2","article-title":"On adaptive attacks to adversarial example defenses","author":"Tramer Florian","year":"2020","unstructured":"Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347 (2020).","journal-title":"arXiv preprint arXiv:2002.08347"},{"key":"e_1_3_2_148_2","first-page":"601","volume-title":"Proceedings of the 25th USENIX Security Symposium (USENIX Security\u201916)","author":"Tram\u00e8r Florian","year":"2016","unstructured":"Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction APIs. In Proceedings of the 25th USENIX Security Symposium (USENIX Security\u201916). 601-618."},{"key":"e_1_3_2_149_2","volume-title":"Proceedings of the 13th Annual Conference of the Midwest AIS (MWAIS\u201918)","author":"Trieu Khoa","year":"2018","unstructured":"Khoa Trieu and Yi Yang. 2018. Artificial intelligence-based password brute force attacks. In Proceedings of the 13th Annual Conference of the Midwest AIS (MWAIS\u201918)."},{"key":"e_1_3_2_150_2","volume-title":"Tools and Techniques for Event Log Analysis","author":"Vaarandi Risto","year":"2005","unstructured":"Risto Vaarandi. 2005. Tools and Techniques for Event Log Analysis. Tallinn University of Technology Press."},{"key":"e_1_3_2_151_2","doi-asserted-by":"publisher","DOI":"10.1109\/COGSIMA.2015.7108181"},{"key":"e_1_3_2_152_2","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2018.8406283"},{"key":"e_1_3_2_153_2","doi-asserted-by":"publisher","DOI":"10.5555\/645838.670720"},{"key":"e_1_3_2_154_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_18"},{"key":"e_1_3_2_155_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-8476-8_6"},{"key":"e_1_3_2_156_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-16837-7_6"},{"key":"e_1_3_2_157_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICICSE.2008.55"},{"key":"e_1_3_2_158_2","doi-asserted-by":"publisher","DOI":"10.1007\/BF00992698"},{"key":"e_1_3_2_159_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.04.005"},{"key":"e_1_3_2_160_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2009.8"},{"key":"e_1_3_2_161_2","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-016-0043-6"},{"key":"e_1_3_2_162_2","doi-asserted-by":"publisher","DOI":"10.1145\/2492517.2500257"},{"key":"e_1_3_2_163_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_5"},{"key":"e_1_3_2_164_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78243-8_15"},{"key":"e_1_3_2_165_2","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2016.2616146"},{"key":"e_1_3_2_166_2","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom.2011.62"},{"key":"e_1_3_2_167_2","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2019.2940877"},{"issue":"5","key":"e_1_3_2_168_2","first-page":"129","article-title":"Network information security situation assessment based on Bayesian network","volume":"10","author":"Xing-zhu Wang","year":"2016","unstructured":"Wang Xing-zhu. 2016. Network information security situation assessment based on Bayesian network. Int. J. Secur. Applic. 10, 5 (2016), 129-138.","journal-title":"Int. J. Secur. Applic."},{"key":"e_1_3_2_169_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2015.2504420"},{"key":"e_1_3_2_170_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133990"},{"key":"e_1_3_2_171_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-0140-8_3"},{"key":"e_1_3_2_172_2","first-page":"141","volume-title":"Proceedings of the 3rd IEEE International Workshop on Information Assurance (IWIA\u201905)","author":"Yin Xiaoxin","year":"2005","unstructured":"Xiaoxin Yin, William Yurcik, and Adam Slagell. 2005. The design of VisFlowConnect-IP: A link analysis system for IP security situational awareness. In Proceedings of the 3rd IEEE International Workshop on Information Assurance (IWIA\u201905). IEEE, 141-153."},{"key":"e_1_3_2_173_2","first-page":"101","volume-title":"Proceedings of the 2nd International Conference on Software Engineering and Data Mining","author":"Ying Liang","year":"2010","unstructured":"Liang Ying, Li Bingyang, and Wang Huiqiang. 2010. Dynamic awareness of network security situation based on stochastic game theory. In Proceedings of the 2nd International Conference on Software Engineering and Data Mining. IEEE, 101-105."},{"key":"e_1_3_2_174_2","first-page":"87390R","volume-title":"Sensors and Systems for Space Applications VI","author":"Yu Wei","year":"2013","unstructured":"Wei Yu, Shixiao Wei, Dan Shen, Misty Blowers, Erik P. Blasch, Khanh D. Pham, Genshe Chen, Hanlin Zhang, and Chao Lu. 2013. On detection and visualization techniques for cyber security situation awareness. In Sensors and Systems for Space Applications VI, Vol. 8739. International Society for Optics and Photonics, 87390R."},{"key":"e_1_3_2_175_2","doi-asserted-by":"publisher","DOI":"10.1007\/s12555-014-0316-9"},{"issue":"3","key":"e_1_3_2_176_2","first-page":"381","article-title":"Network security situation awareness framework based on threat intelligence","volume":"56","author":"Zhang Hongbin","year":"2018","unstructured":"Hongbin Zhang, Yuzi Yi, Junshe Wang, Ning Cao, and Qiang Duan. 2018. Network security situation awareness framework based on threat intelligence. Comput., Mater. Contin. 56, 3 (2018), 381-399.","journal-title":"Comput., Mater. Contin."},{"issue":"2","key":"e_1_3_2_177_2","first-page":"167","article-title":"Predicting network security situation based on a combination model of multiple neural networks.","volume":"8","author":"Zhang Yaxing","year":"2014","unstructured":"Yaxing Zhang and Shuyuan Jin. 2014. Predicting network security situation based on a combination model of multiple neural networks. Int. J. Softw. Inform. 8, 2 (2014), 167-176.","journal-title":"Int. J. Softw. Inform."},{"key":"e_1_3_2_178_2","first-page":"659","volume-title":"Proceedings of the International Conference on Trustworthy Computing and Services","author":"Zhang Yaxing","year":"2012","unstructured":"Yaxing Zhang, Shuyuan Jin, Xiang Cui, Xi Yin, and Yi Pang. 2012. Network security situation prediction based on BP and RBF neural network. In Proceedings of the International Conference on Trustworthy Computing and Services. Springer, 659-665."},{"key":"e_1_3_2_179_2","doi-asserted-by":"publisher","DOI":"10.3724\/SP.J.1001.2011.03751"},{"key":"e_1_3_2_180_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cie.2018.01.006"},{"key":"e_1_3_2_181_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35211-9_80"},{"key":"e_1_3_2_182_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIE.2019.2893831"},{"key":"e_1_3_2_183_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-61152-5_6"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3530809","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3530809","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T14:09:25Z","timestamp":1750169365000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3530809"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,3]]},"references-count":182,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2023,5,31]]}},"alternative-id":["10.1145\/3530809"],"URL":"https:\/\/doi.org\/10.1145\/3530809","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,3]]},"assertion":[{"value":"2021-01-20","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-04-06","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-12-03","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}