{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,19]],"date-time":"2026-02-19T14:26:43Z","timestamp":1771511203960,"version":"3.50.1"},"reference-count":46,"publisher":"Wiley","license":[{"start":{"date-parts":[[2020,12,4]],"date-time":"2020-12-04T00:00:00Z","timestamp":1607040000000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61902265"],"award-info":[{"award-number":["61902265"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["2016YFE0206700"],"award-info":[{"award-number":["2016YFE0206700"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["2018YFB0804503"],"award-info":[{"award-number":["2018YFB0804503"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program","doi-asserted-by":"crossref","award":["61902265"],"award-info":[{"award-number":["61902265"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program","doi-asserted-by":"crossref","award":["2016YFE0206700"],"award-info":[{"award-number":["2016YFE0206700"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program","doi-asserted-by":"crossref","award":["2018YFB0804503"],"award-info":[{"award-number":["2018YFB0804503"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Communication Networks"],"published-print":{"date-parts":[[2020,12,4]]},"abstract":"<jats:p>As Advanced Persistent Threat (APT) becomes increasingly frequent around the world, security experts are starting to look at how to observe, predict, and mitigate the damage from APT attacks. In the meantime, the Internet of things devices are also risky and heavily exposed to the Internet, making them more easily used by hacker organizations to launch APT attacks. An excellent attacker can take down millions of Internet of things devices in a short time. Once the IoT botnet is built, attackers can use it to launch complex attacks which could damage Internet infrastructure and cause network disconnection. This paper proposes GroupTracer, a framework for observing and predicting the Internet of things attacks. GroupTracer is designed to automatically extract the TTP profiles (i.e., tactics, techniques, and procedures) that can describe the behavior of attackers through their tactics, techniques, and processes and dig out the potential attacker groups behind complex attacks. Firstly, it captures attacks by IoT honeypots and extracts relevant fields from logs. Then, attack behaviors are automatically mapped to the ATT&amp;CK framework to achieve automatic TTP profiles extraction. After that, GroupTracer presents four feature groups, including TTP profiles, Time, IP, and URL features, a total of 18 features, mines potential attack groups through hierarchical clustering algorithm, and compares the clustering results with two baseline algorithms. As the ground truth labels are unknown, we apply three internal validation indexes to evaluate the cluster quantity. Experimental results showed that the proposed framework has achieved an excellent performance in exploiting potential groups as the Calinski\u2013Harabasz index reaches 3416.93. Eventually, attack trees are generated for each cluster where nodes indicate attack commands and edges represent command sequences. These attack trees could help better understand each attack group\u2019s actions and techniques.<\/jats:p>","DOI":"10.1155\/2020\/8842539","type":"journal-article","created":{"date-parts":[[2020,12,4]],"date-time":"2020-12-04T21:23:17Z","timestamp":1607116997000},"page":"1-14","source":"Crossref","is-referenced-by-count":12,"title":["GroupTracer: Automatic Attacker TTP Profile Extraction and Group Cluster in Internet of Things"],"prefix":"10.1155","volume":"2020","author":[{"given":"Yixin","family":"Wu","sequence":"first","affiliation":[{"name":"College of Cybersecurity, Sichuan University, Chengdu 610065, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5871-946X","authenticated-orcid":true,"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[{"name":"College of Cybersecurity, Sichuan University, Chengdu 610065, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xing","family":"Zhang","sequence":"additional","affiliation":[{"name":"NSFOCUS, Beijing 100089, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hongyi","family":"Zhou","sequence":"additional","affiliation":[{"name":"NSFOCUS, Beijing 100089, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","reference":[{"key":"1"},{"key":"2","article-title":"Dyn","author":"H. Scott","year":"2019"},{"key":"3"},{"key":"4","article-title":"The pyramid of pain","author":"D. J. Bianco","year":"2019"},{"key":"5","volume-title":"Definitive Guide to Cyber Threat Intelligence: Using Knowledge about Adversaries to Win the War against Targeted Attacks","author":"J. Friedman","year":"2015"},{"key":"6"},{"key":"7"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2014.10.031"},{"key":"9","first-page":"1","article-title":"An approach for detection and family classification of malware based on behavioral analysis","author":"S. S. Hansen"},{"key":"10","first-page":"183","article-title":"Novel feature extraction, selection and fusion for effective malware family classification","author":"M. Ahmadi"},{"key":"11","first-page":"1","article-title":"Malware analysis and classification using artificial neural network","author":"A. Makandar"},{"key":"12","first-page":"595","article-title":"Meerkat: detecting website defacements through image-based object recognition","author":"K. Borgolte"},{"key":"13","first-page":"255","article-title":"Detecting malicious exploit kits using tree-based similarity searches","author":"T. Taylor"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.1145\/3264948"},{"key":"15","first-page":"231","article-title":"Honeypot: a supplemented active defense system for network security","author":"F. Zhang"},{"key":"16","first-page":"1","article-title":"Motivating a market or regulatory solution to iot insecurity with the mirai botnet code","author":"J. A. Jerkins"},{"key":"17","first-page":"2177","article-title":"Iot sentinel: automated device-type identification for security enforcement in iot","author":"M. Miettinen"},{"key":"18","first-page":"551","article-title":"Securing vulnerable home iot devices with an in-hub security manager","author":"A. K. Simpson"},{"key":"19","article-title":"Thingpot: an interactive internet-of-things honeypot","author":"M. Wang","year":"2018"},{"key":"20","article-title":"Iotpot: analysing the rise of iot compromises","author":"Y. M. P. Pa"},{"key":"21","first-page":"1","article-title":"A zigbee honeypot to assess iot cyberattack behaviour","author":"S. Dowling"},{"key":"22","first-page":"625","article-title":"Who is knocking on the telnet port: a large-scale empirical study of network scanning","author":"H. Heo"},{"key":"23"},{"key":"24","first-page":"103","article-title":"Ttpdrill: automatic and accurate extraction of threat actions from unstructured text of cti sources","author":"G. Husari"},{"key":"25","first-page":"478","article-title":"Unsupervised deep embedding for clustering analysis","author":"J. Xie"},{"key":"26","first-page":"10","article-title":"Unsupervised classification and characterization of honeypot attacks","author":"P. Owezarski"},{"key":"27","first-page":"1220","article-title":"The study of prediction of same attack group by comparing similarity of domain","author":"H. Cho"},{"key":"28","first-page":"61","article-title":"Fingerprinting tooling used for {SSH} compromisation attempts","author":"V. Ghi\u00ebtte"},{"key":"29"},{"key":"30","first-page":"1","article-title":"Understanding source code evolution using abstract syntax tree matching","author":"I. Neamtiu"},{"key":"31"},{"key":"32"},{"key":"33"},{"key":"34"},{"key":"35"},{"key":"36","doi-asserted-by":"publisher","DOI":"10.1007\/bf02289588"},{"key":"37","volume-title":"Linear Operators Part I: General Theory","author":"N. Dunford","year":"1958"},{"key":"38","first-page":"629","article-title":"Internet home network electrical appliance control on the internet with the upnp expansion","author":"K. S. Kim"},{"key":"39"},{"key":"40","first-page":"27","article-title":"Internal versus external cluster validation indexes","volume":"5","author":"E. Rend\u00f3n","year":"2011","journal-title":"International Journal of Computers and Communications"},{"key":"41","doi-asserted-by":"publisher","DOI":"10.1080\/03610927408827101"},{"key":"42","doi-asserted-by":"publisher","DOI":"10.1016\/0377-0427(87)90125-7"},{"key":"43","doi-asserted-by":"publisher","DOI":"10.1109\/tpami.1979.4766909"},{"key":"44","doi-asserted-by":"crossref","first-page":"790","DOI":"10.1109\/34.400568","article-title":"Mean shift, mode seeking, and clustering","volume":"17","author":"Y. Cheng","year":"1995","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"45","doi-asserted-by":"publisher","DOI":"10.2307\/2346830"},{"key":"46"}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2020\/8842539.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2020\/8842539.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2020\/8842539.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,12,4]],"date-time":"2020-12-04T21:23:23Z","timestamp":1607117003000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/scn\/2020\/8842539\/"}},"subtitle":[],"editor":[{"given":"Ting","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2020,12,4]]},"references-count":46,"alternative-id":["8842539","8842539"],"URL":"https:\/\/doi.org\/10.1155\/2020\/8842539","relation":{},"ISSN":["1939-0122","1939-0114"],"issn-type":[{"value":"1939-0122","type":"electronic"},{"value":"1939-0114","type":"print"}],"subject":[],"published":{"date-parts":[[2020,12,4]]}}}