{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,30]],"date-time":"2026-10-30T17:33:40Z","timestamp":1793381620144,"version":"4.5.0"},"update-to":[{"DOI":"10.12688\/openreseurope.21702.1","type":"new_version","label":"New version","source":"publisher","updated":{"date-parts":[[2026,8,8]],"date-time":"2026-08-08T00:00:00Z","timestamp":1786147200000}}],"reference-count":35,"publisher":"CERN","license":[{"start":{"date-parts":[[2026,8,8]],"date-time":"2026-08-08T00:00:00Z","timestamp":1786147200000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"European Commission","award":["101132439"],"award-info":[{"award-number":["101132439"]}],"id":[{"id":"https:\/\/ror.org\/00k4n6c32","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Open Res Europe"],"abstract":"<jats:p>Background\n                    Foreign Information Manipulation and Interference (FIMI) represents a growing hybrid threat targeting democratic processes, social cohesion, and diaspora communities. Detecting it requires identifying underlying tactics, techniques, and procedures (TTPs) described in frameworks such as DISARM, AMITT, and MITRE ATT&amp;CK. Although many open-source intelligence (OSINT) tools exist, their evaluation remains fragmented and lacks methodological standardisation. This article presents a framework for testing OSINT tools for TTP detection, developed within the Horizon Europe project RESONANT.\n                \n                \n                    Methods\n                    The methodology integrates three components: a structured multi-source collection of OSINT tools informed by academic, operational, and grey literature; a controlled, mixed-source evaluation corpus of project-prepared examples, public reference material, and selected third-party datasets across text, multimedia, network and infrastructure analysis; and controlled testing by law enforcement partners from Greece and Ukraine. Tools were classified into eight categories and evaluated using predefined indicators of accuracy, usability, interoperability, coverage of adversarial behaviours, and sustainability.\n                \n                \n                    Results\n                    Several content-verification and multimedia-forensics tools performed well on the retained material, and infrastructure-level tools gave useful indicators; these are time-bound descriptive observations, not general rankings. Exact case-level replication is limited, as the package does not preserve the full CT-A\/CT-B mapping, run-level outputs, denominators, or configurations. Social media analytics and bot-detection tools were least stable under platform API restrictions. Shortcomings recurred in multilingual processing, interoperability, explainability, and integration into threat-intelligence formats.\n                \n                \n                    Conclusions\n                    The study offers a transferable methodology for evaluating OSINT tools in the context of FIMI TTP detection. Combining a mixed-source corpus, structured testing, practitioner validation, and publication of the available material, it advances methodological transparency while clarifying the limits of both automated outputs and the retained replication record. The proposed tool suite is a layered decision-support baseline, not a verdict-producing system. Future work should expand multilingual and out-of-distribution testing, operationalise bias and explainability metrics, preserve run-level records, and pursue lawful access to platform data.<\/jats:p>","DOI":"10.12688\/openreseurope.21702.2","type":"journal-article","created":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T09:29:10Z","timestamp":1787218150000},"update-policy":"https:\/\/doi.org\/10.68336\/openreseurope.updatepolicy","source":"Crossref","is-referenced-by-count":0,"title":["Detecting FIMI: A methodological framework for testing OSINT tools in TTPs detection"],"prefix":"10.68336","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8708-2739","authenticated-orcid":true,"given":"Konstantinos","family":"Margaros","sequence":"first","affiliation":[{"name":"Center for Security Studies (KEMEA), Athens, 10177, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-0786-9018","authenticated-orcid":true,"given":"Theodoros","family":"Paparrigopoulos","sequence":"additional","affiliation":[{"name":"Center for Security Studies (KEMEA), Athens, 10177, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-0631-9090","authenticated-orcid":true,"given":"Georgios","family":"Giataganas","sequence":"additional","affiliation":[{"name":"Center for Security Studies (KEMEA), Athens, 10177, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Orfeas","family":"Filippopoulos","sequence":"additional","affiliation":[{"name":"Center for Security Studies (KEMEA), Athens, 10177, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nikolaos","family":"Georgiou","sequence":"additional","affiliation":[{"name":"Hellenic Police, Athens, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5435-5921","authenticated-orcid":true,"given":"Oleksandr","family":"Manzhai","sequence":"additional","affiliation":[{"name":"Kharkiv National University of Internal Affairs, Kharkiv, Ukraine"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Panagiota","family":"Benekou","sequence":"additional","affiliation":[{"name":"Center for Security Studies (KEMEA), Athens, 10177, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"13904","published-online":{"date-parts":[[2026,8,8]]},"reference":[{"key":"110823","unstructured":"1. EEAS: 2022 report on EEAS activities to counter FIMI. European External Action Service;2023. Reference Source (https:\/\/www.eeas.europa.eu\/eeas\/1st-eeas-report-foreign-information-manipulation-and-interference-threats_en)"},{"key":"110824","unstructured":"2. EEAS: How to Detect & Analyse Identity-Based Disinformation\/FIMI: A Practical Guide to Conduct Open Source Investigations. European External Action Service;2024. Reference Source (https:\/\/www.eeas.europa.eu\/eeas\/how-detect-analyse-identity-based-disinformationfimi-practical-guide-conduct-open-source_en)"},{"key":"110825","unstructured":"3. Government of Canada: Foreign information manipulation and interference targeting Canada\u2019s democratic processes: Special report for 2019\u20132023. Canadian Security Intelligence Service (CSIS) & Communications Security Establishment (CSE);2023."},{"key":"110826","unstructured":"4. CogSec Collaborative, & Threet LLC: AMITT TTP guide. n.d. Reference Source (https:\/\/github.com\/cogsec-collaborative\/amitt)"},{"key":"110827","unstructured":"5. Dou W, Wang X, Ribarsky W, et al.: Event detection in social media data. University of North Carolina at Charlotte & IBM Almaden Research Center;2012."},{"key":"110828","unstructured":"6. Chinnov A, Kerschke P, Meske C, et al.: An overview of topic discovery in Twitter communication through social media analytics. In Proceedings of the Twenty-first Americas Conference on Information Systems (AMCIS 2015). 2015."},{"key":"110829","doi-asserted-by":"publisher","DOI":"10.1145\/2818717"},{"key":"110830","doi-asserted-by":"publisher","DOI":"10.1016\/j.clsr.2019.04.003"},{"key":"110831","doi-asserted-by":"publisher","DOI":"10.1080\/23738871.2024.2301346"},{"key":"110832","doi-asserted-by":"publisher","DOI":"10.4337\/9781789904255.00018"},{"key":"110833","unstructured":"11. CogSec Collaborative, & Threet LLC: AMITT user guide. n.d. Reference Source (https:\/\/github.com\/cogsec-collaborative\/amitt)"},{"key":"110834","unstructured":"12. CogSec Collaborative, & Threet LLC: AMITT incident list. n.d. Reference Source (https:\/\/github.com\/cogsec-collaborative\/amitt)"},{"key":"110835","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2024.103738"},{"key":"110836","doi-asserted-by":"publisher","DOI":"10.1287\/isre.1120.0470"},{"key":"110837","doi-asserted-by":"publisher","DOI":"10.25300\/MISQ\/2014\/38.1.13"},{"key":"110838","doi-asserted-by":"publisher","DOI":"10.1186\/s13673-015-0027-1"},{"key":"110839","doi-asserted-by":"publisher","DOI":"10.1177\/00104140221119176"},{"key":"110840","doi-asserted-by":"publisher","DOI":"10.17234\/INFUTURE.2019.23"},{"key":"110841","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/1290129"},{"key":"110842","unstructured":"20. Tuominen S: OSINT: Intelligence and its application. Poliisiammattikorkeakoulun raportteja. 2019; 138: 1\u201374. Reference Source (https:\/\/urn.fi\/URN:ISBN:978-951-815-415-3)"},{"key":"110843","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2011.11.014"},{"key":"110844","doi-asserted-by":"publisher","DOI":"10.15394\/jdfsl.2023.1865"},{"key":"110845","doi-asserted-by":"publisher","DOI":"10.32754\/JMT.2023.1.05"},{"key":"110846","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4842-3213-7"},{"key":"110847","unstructured":"25. Meredith A: The OSINT handbook: A practical guide to intelligence gathering. Routledge;2024."},{"key":"110848","unstructured":"26. Adetokunbo A, Awodele O, Ogbonna AC: A review of the waterfall model and object-oriented approach. Int. J. Eng. Res. Appl. 2013; 3(6): 729\u2013732."},{"key":"110849","doi-asserted-by":"publisher","DOI":"10.29081\/jesr.v25i3.0000"},{"key":"110850","doi-asserted-by":"crossref","unstructured":"28. Aroral H: Waterfall process operations in the fast-paced world. International Journal of Creative Research Thoughts. 2021; 9(6): 2324\u20132330.","DOI":"10.68099\/ijabms.2021.224"},{"key":"110851","doi-asserted-by":"publisher","DOI":"10.26483\/ijarcs"},{"key":"110852","unstructured":"30. Eason O: An analysis of waterfall to agile methodology. International Journal of Engineering Research and General Science. 2016; 4(3): 781\u2013788."},{"key":"110853","doi-asserted-by":"publisher","DOI":"10.1007\/s10676-025-09886-7"},{"key":"110854","doi-asserted-by":"publisher","DOI":"10.1126\/sciadv.adz2924"},{"key":"110855","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2409.05283"},{"key":"110856","unstructured":"34. Pamment J, Smith V: Attributing Information Influence Operations: Identifying those Responsible for Malicious Behaviour Online. NATO Strategic Communication Centre of Excellence;2022. Reference Source (https:\/\/stratcomcoe.org\/publications\/attributing-information-influence-operations-identifying-those-responsible-for-malicious-behaviour-online\/244)"},{"key":"110857","doi-asserted-by":"publisher","DOI":"10.5281\/zenodo.19045753"}],"container-title":["Open Research Europe"],"original-title":[],"link":[{"URL":"https:\/\/open-research-europe.ec.europa.eu\/articles\/6-157\/v2\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ore.eu\/ore\/article\/download\/1352\/version\/2291\/4579","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ore.eu\/ore\/article\/download\/1352\/version\/2291\/4580","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ore.eu\/ore\/article\/download\/1352\/version\/2291\/4579","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,30]],"date-time":"2026-10-30T17:11:27Z","timestamp":1793380287000},"score":1,"resource":{"primary":{"URL":"https:\/\/ore.eu\/ore\/article\/view\/1352\/version\/2291"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,8]]},"references-count":35,"URL":"https:\/\/doi.org\/10.12688\/openreseurope.21702.2","relation":{"is-version-of":[{"id-type":"doi","id":"10.12688\/openreseurope.21702.1","asserted-by":"subject"}],"has-review":[{"id-type":"doi","id":"10.21956\/openreseurope.26801.r78801","asserted-by":"object"}]},"ISSN":["2732-5121"],"issn-type":[{"value":"2732-5121","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,8]]},"assertion":[{"value":"2026-08-08","name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}},{"value":"This project has received funding from the European Union\u2019s Horizon Europe research and innovation programme under grant agreement No [101132439] (RESONANT).   \n\n                    The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.","name":"funding_statement","label":"Funding Statement","group":{"name":"funding_information","label":"Funding Information"}}],"article-number":"157"}}