{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,10,30]],"date-time":"2024-10-30T22:22:19Z","timestamp":1730326939689,"version":"3.28.0"},"publisher-location":"New York, NY, USA","reference-count":71,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,10,16]]},"DOI":"10.1145\/3607199.3607208","type":"proceedings-article","created":{"date-parts":[[2023,10,3]],"date-time":"2023-10-03T22:30:51Z","timestamp":1696372251000},"page":"92-108","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI"],"prefix":"10.1145","author":[{"ORCID":"http:\/\/orcid.org\/0000-0003-4284-2743","authenticated-orcid":false,"given":"Md Tanvirul","family":"Alam","sequence":"first","affiliation":[{"name":"Rochester Institute of Technology, USA"}]},{"ORCID":"http:\/\/orcid.org\/0000-0003-1214-1954","authenticated-orcid":false,"given":"Dipkamal","family":"Bhusal","sequence":"additional","affiliation":[{"name":"Rochester Institute of Technology, USA"}]},{"ORCID":"http:\/\/orcid.org\/0000-0002-4579-9261","authenticated-orcid":false,"given":"Youngja","family":"Park","sequence":"additional","affiliation":[{"name":"IBM Research, USA"}]},{"ORCID":"http:\/\/orcid.org\/0000-0002-2002-3213","authenticated-orcid":false,"given":"Nidhi","family":"Rastogi","sequence":"additional","affiliation":[{"name":"Rochester Institute of Technology, United States of America"}]}],"member":"320","published-online":{"date-parts":[[2023,10,16]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2023. LitePower. https:\/\/attack.mitre.org\/software\/S0680\/"},{"volume-title":"Proceedings of the 2019 North American Chapter of the Association for Computational Linguistics (NAACL-Demonstrations). 54\u201359","year":"2019","author":"Akbik Alan","key":"e_1_3_2_1_2_1","unstructured":"Alan Akbik, Tanja Bergmann, Duncan Blythe, Kashif Rasul, Stefan Schweter, and Roland Vollgraf. 2019. FLAIR: An easy-to-use framework for state-of-the-art NLP. In Proceedings of the 2019 North American Chapter of the Association for Computational Linguistics (NAACL-Demonstrations). 54\u201359."},{"volume-title":"ATLAS: A Sequence-based Learning Approach for Attack Investigation. In 30th USENIX Security Symposium (USENIX Security 21)","year":"2021","author":"Alsaheel Abdulellah","key":"e_1_3_2_1_3_1","unstructured":"Abdulellah Alsaheel, Yuhong Nan, Shiqing Ma, Le Yu, Gregory Walkup, Z\u00a0Berkay Celik, Xiangyu Zhang, and Dongyan Xu. 2021. ATLAS: A Sequence-based Learning Approach for Attack Investigation. In 30th USENIX Security Symposium (USENIX Security 21). 3005\u20133022."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991111"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"crossref","unstructured":"Ivana Bala\u017eevi\u0107 Carl Allen and Timothy\u00a0M Hospedales. 2019. TuckER: Tensor Factorization for Knowledge Graph Completion. (2019) 5185\u20135194.","DOI":"10.18653\/v1\/D19-1522"},{"key":"e_1_3_2_1_6_1","first-page":"1","article-title":"Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX)","volume":"11","author":"Barnum Sean","year":"2012","unstructured":"Sean Barnum. 2012. Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX). Mitre Corporation 11 (2012), 1\u201322.","journal-title":"Mitre Corporation"},{"key":"e_1_3_2_1_7_1","unstructured":"Bitdefender. 2022. New FluBot and TeaBot Global Malware Campaigns Discovered. https:\/\/www.bitdefender.com\/blog\/labs\/new-flubot-and-teabot-global-malware-campaigns-discovered."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.5555\/3489212.3489237"},{"volume-title":"Automatic Labeling for Entity Extraction in Cyber Security. CoRR abs\/1308.4941","year":"2013","author":"Bridges A.","key":"e_1_3_2_1_9_1","unstructured":"Robert\u00a0A. Bridges, Corinne\u00a0L. Jones, Michael\u00a0D. Iannacone, and John\u00a0R. Goodall. 2013. Automatic Labeling for Entity Extraction in Cyber Security. CoRR abs\/1308.4941 (2013). arXiv:1308.4941http:\/\/arxiv.org\/abs\/1308.4941"},{"key":"e_1_3_2_1_10_1","unstructured":"Jagadeesh Chandraiah. 2018. Red Alert 2.0: Android Trojan. https:\/\/news.sophos.com\/en-us\/2018\/07\/23\/red-alert-2-0-android-trojan-targets-security-seekers\/."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485353"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.747"},{"volume-title":"The trusted automated exchange of indicator information (taxii)","year":"2014","author":"Connolly Julie","key":"e_1_3_2_1_13_1","unstructured":"Julie Connolly, Mark Davidson, and Charles Schmidt. 2014. The trusted automated exchange of indicator information (taxii). The MITRE Corporation (2014), 1\u201320."},{"key":"e_1_3_2_1_14_1","unstructured":"Henry Dalziel. 2014. How to define and build an effective cyber threat intelligence capability. Syngress."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigData50022.2020.9378482"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1"},{"key":"e_1_3_2_1_17_1","unstructured":"Marcel Feller. 2020. Anubis Targets Android. https:\/\/cofense.com\/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications\/."},{"volume-title":"CyberRel: Joint Entity and Relation Extraction for Cybersecurity Concepts. In International Conference on Information and Communications Security. Springer, 447\u2013463","year":"2021","author":"Guo Yongyan","key":"e_1_3_2_1_18_1","unstructured":"Yongyan Guo, Zhengyu Liu, Cheng Huang, Jiayong Liu, Wangyuan Jing, Ziwang Wang, and Yanghao Wang. 2021. CyberRel: Joint Entity and Relation Extraction for Cybersecurity Concepts. In International Conference on Information and Communications Security. Springer, 447\u2013463."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134646"},{"volume-title":"A survey on knowledge graphs: Representation, acquisition, and applications","year":"2021","author":"Ji Shaoxiong","key":"e_1_3_2_1_20_1","unstructured":"Shaoxiong Ji, Shirui Pan, Erik Cambria, Pekka Marttinen, and S\u00a0Yu Philip. 2021. A survey on knowledge graphs: Representation, acquisition, and applications. IEEE Transactions on Neural Networks and Learning Systems (2021)."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2746266.2746277"},{"key":"e_1_3_2_1_22_1","unstructured":"Kaspersky. 2022. Kaspersky daily. https:\/\/usa.kaspersky.com\/blog\/"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30796-7_13"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-020-01122-6"},{"volume-title":"Kingma and Jimmy Ba","year":"2015","author":"P.","key":"e_1_3_2_1_25_1","unstructured":"Diederik\u00a0P. Kingma and Jimmy Ba. 2015. Adam: A Method for Stochastic Optimization. (2015). http:\/\/arxiv.org\/abs\/1412.6980"},{"key":"e_1_3_2_1_26_1","unstructured":"Alec Koumjian. 2023. datefinder. https:\/\/github.com\/akoumjian\/datefinder."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006328"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.2981314"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_29"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978315"},{"volume-title":"RoBERTa: A Robustly Optimized BERT Pretraining Approach. CoRR abs\/1907.11692","year":"2019","author":"Liu Yinhan","key":"e_1_3_2_1_31_1","unstructured":"Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. RoBERTa: A Robustly Optimized BERT Pretraining Approach. CoRR abs\/1907.11692 (2019). arXiv:1907.11692http:\/\/arxiv.org\/abs\/1907.11692"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSCWD49262.2021.9437745"},{"key":"e_1_3_2_1_33_1","unstructured":"Malopedia. 2022. Anubis APK. https:\/\/malpedia.caad.fkie.fraunhofer.de\/details\/apk.anubis."},{"key":"e_1_3_2_1_34_1","unstructured":"Malopedia. 2022. Flubot APK. https:\/\/malpedia.caad.fkie.fraunhofer.de\/details\/apk.flubot."},{"key":"e_1_3_2_1_35_1","unstructured":"McAfee. 2022. McAfee Blogs. https:\/\/www.mcafee.com\/blogs"},{"key":"e_1_3_2_1_36_1","unstructured":"Metaspoilt. 2023. Metaspoilt. https:\/\/www.metasploit.com\/"},{"key":"e_1_3_2_1_37_1","unstructured":"Microsoft. 2016. MS-Bulletin. https:\/\/docs.microsoft.com\/en-us\/previous-versions\/dn602597(v=msdn.10)?redirectedfrom=MSDN"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363217"},{"key":"e_1_3_2_1_40_1","unstructured":"Mitre. 2022. Ke3chang. https:\/\/attack.mitre.org\/groups\/G0004\/."},{"key":"e_1_3_2_1_41_1","unstructured":"MITRE. 2022. Masquerading. https:\/\/attack.mitre.org\/versions\/v11\/techniques\/T1036\/"},{"key":"e_1_3_2_1_42_1","unstructured":"MITRE. 2022. MITRE ATT&CK. https:\/\/attack.mitre.org\/"},{"volume-title":"Early Detection of Cybersecurity Threats Using Collaborative Cognition. 2018 IEEE 4th International Conference on Collaboration and Internet Computing (CIC)","year":"2018","author":"Narayanan Sandeep\u00a0Nair","key":"e_1_3_2_1_43_1","unstructured":"Sandeep\u00a0Nair Narayanan, Ashwinkumar Ganesan, Karuna\u00a0Pande Joshi, Tim Oates, Anupam Joshi, and Timothy\u00a0W. Finin. 2018. Early Detection of Cybersecurity Threats Using Collaborative Cognition. 2018 IEEE 4th International Conference on Collaboration and Internet Computing (CIC) (2018), 354\u2013363."},{"volume-title":"Constructing knowledge graphs and their biomedical applications. Computational and structural biotechnology journal 18","year":"2020","author":"Nicholson N","key":"e_1_3_2_1_44_1","unstructured":"David\u00a0N Nicholson and Casey\u00a0S Greene. 2020. Constructing knowledge graphs and their biomedical applications. Computational and structural biotechnology journal 18 (2020), 1414\u20131428."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2015.2483592"},{"key":"e_1_3_2_1_46_1","unstructured":"NIST. 2022. Threat intelligence. https:\/\/csrc.nist.gov\/glossary\/term\/threat_intelligence"},{"key":"e_1_3_2_1_47_1","unstructured":"Lindsey O\u2019Donnell. 2020. Cerberus unleashed. https:\/\/threatpost.com\/cerberus-banking-trojan-unleashed-google-play\/157218\/."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341161.3343519"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3039234"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom56396.2022.00225"},{"volume-title":"MALOnt: An Ontology for Malware Threat Intelligence. In International Workshop on Deployable Machine Learning for Security Defense. Springer, 28\u201344","year":"2020","author":"Rastogi Nidhi","key":"e_1_3_2_1_51_1","unstructured":"Nidhi Rastogi, Sharmishtha Dutta, Mohammed\u00a0J Zaki, Alex Gittens, and Charu Aggarwal. 2020. MALOnt: An Ontology for Malware Threat Intelligence. In International Workshop on Deployable Machine Learning for Security Defense. Springer, 28\u201344."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1410"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2021.107524"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00046"},{"volume-title":"WIRTE\u2019s campaign in the Middle East \u2018living off the land","year":"2019","key":"e_1_3_2_1_55_1","unstructured":"SecureList. 2021. WIRTE\u2019s campaign in the Middle East \u2018living off the land\u2019 since at least 2019. https:\/\/securelist.com\/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019\/105044\/"},{"volume-title":"28th USENIX Security Symposium, USENIX Security 2019","year":"2019","author":"Shen Yun","key":"e_1_3_2_1_56_1","unstructured":"Yun Shen and Gianluca Stringhini. 2019. ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks. In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019. USENIX Association, 905\u2013921. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/shen"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243829"},{"key":"e_1_3_2_1_58_1","unstructured":"Sudeep Singh and Naveen Selvan. 2023. The Unintentional Leak: A glimpse into the attack vectors of APT37. https:\/\/www.zscaler.com\/blogs\/security-research\/unintentional-leak-glimpse-attack-vectors-apt37"},{"volume-title":"Proceedings of the Demonstrations at the 13th Conference of the European Chapter of the Association for Computational Linguistics (EACL).","year":"2012","author":"Stenetorp Pontus","key":"e_1_3_2_1_59_1","unstructured":"Pontus Stenetorp, Sampo Pyysalo, Goran Topic, Tomoko Ohta, Sophia Ananiadou, and Junichi Tsujii. 2012. BRAT: a Web-based Tool for NLP-Assisted Text Annotation. In Proceedings of the Demonstrations at the 13th Conference of the European Chapter of the Association for Computational Linguistics (EACL)."},{"volume-title":"Technical report","author":"Strom E","key":"e_1_3_2_1_60_1","unstructured":"Blake\u00a0E Strom, Andy Applebaum, Doug\u00a0P Miller, Kathryn\u00a0C Nickels, Adam\u00a0G Pennington, and Cody\u00a0B Thomas. 2018. Mitre ATT&CK: Design and philosophy. In Technical report. The MITRE Corporation."},{"key":"e_1_3_2_1_61_1","unstructured":"Symantec. 2022. Symantec Enterprise Blogs\/Threat Intelligence. https:\/\/symantec-enterprise-blogs.security.com\/blogs\/threat-intelligence"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.2197\/ipsjjip.28.1025"},{"key":"e_1_3_2_1_63_1","unstructured":"ThreatFabric. 2019. Ginp - A malware patchwork borrowing from Anubis. https:\/\/www.threatfabric.com\/blogs\/ginp_a_malware_patchwork_borrowing_from_anubis.html"},{"volume-title":"A survey on technical threat intelligence in the age of sophisticated cyber attacks. Computers & security 72","year":"2018","author":"Tounsi Wiem","key":"e_1_3_2_1_64_1","unstructured":"Wiem Tounsi and Helmi Rais. 2018. A survey on technical threat intelligence in the age of sophisticated cyber attacks. Computers & security 72 (2018), 212\u2013233."},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF02289464"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102576"},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","unstructured":"Asahi Ushio and Jos\u00e9 Camacho-Collados. 2021. T-NER: An All-Round Python Library for Transformer-based Named Entity Recognition. (2021) 53\u201362. https:\/\/doi.org\/10.18653\/v1\/2021.eacl-demos.7","DOI":"10.18653\/v1"},{"volume-title":"Attention is All you Need. Advances in neural information processing systems 30","year":"2017","author":"Vaswani Ashish","key":"e_1_3_2_1_68_1","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan\u00a0N Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is All you Need. Advances in neural information processing systems 30 (2017)."},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2017.2754499"},{"key":"e_1_3_2_1_70_1","unstructured":"Wikipedia. 2023. Jaccard Index. https:\/\/en.wikipedia.org\/wiki\/Jaccard_index."},{"key":"e_1_3_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1145\/3357384.3358119"},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2984582"}],"event":{"name":"RAID 2023: The 26th International Symposium on Research in Attacks, Intrusions and Defenses","acronym":"RAID 2023","location":"Hong Kong China"},"container-title":["Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3607199.3607208","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,16]],"date-time":"2024-10-16T10:27:39Z","timestamp":1729074459000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3607199.3607208"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,16]]},"references-count":71,"alternative-id":["10.1145\/3607199.3607208","10.1145\/3607199"],"URL":"https:\/\/doi.org\/10.1145\/3607199.3607208","relation":{},"subject":[],"published":{"date-parts":[[2023,10,16]]},"assertion":[{"value":"2023-10-16","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}