{"id":"https://openalex.org/W4229028905","doi":"https://doi.org/10.1109/percomworkshops53856.2022.9767375","title":"Design and Development of Automated Threat Hunting in Industrial Control Systems","display_name":"Design and Development of Automated Threat Hunting in Industrial Control Systems","publication_year":2022,"publication_date":"2022-03-21","ids":{"openalex":"https://openalex.org/W4229028905","doi":"https://doi.org/10.1109/percomworkshops53856.2022.9767375"},"language":"en","primary_location":{"id":"doi:10.1109/percomworkshops53856.2022.9767375","is_oa":false,"landing_page_url":"https://doi.org/10.1109/percomworkshops53856.2022.9767375","pdf_url":null,"source":{"id":"https://openalex.org/S4363608020","display_name":"2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"http://hdl.handle.net/10072/417158","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5023180736","display_name":"Masumi Arafune","orcid":null},"institutions":[{"id":"https://openalex.org/I160993911","display_name":"Queensland University of Technology","ror":"https://ror.org/03pnv4752","country_code":"AU","type":"education","lineage":["https://openalex.org/I160993911"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Masumi Arafune","raw_affiliation_strings":["Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000","institution_ids":["https://openalex.org/I160993911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077887944","display_name":"Sidharth Rajalakshmi","orcid":null},"institutions":[{"id":"https://openalex.org/I160993911","display_name":"Queensland University of Technology","ror":"https://ror.org/03pnv4752","country_code":"AU","type":"education","lineage":["https://openalex.org/I160993911"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Sidharth Rajalakshmi","raw_affiliation_strings":["Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000","institution_ids":["https://openalex.org/I160993911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008382562","display_name":"Luigi Jaldon","orcid":null},"institutions":[{"id":"https://openalex.org/I160993911","display_name":"Queensland University of Technology","ror":"https://ror.org/03pnv4752","country_code":"AU","type":"education","lineage":["https://openalex.org/I160993911"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Luigi Jaldon","raw_affiliation_strings":["Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000","institution_ids":["https://openalex.org/I160993911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080148923","display_name":"Zahra Jadidi","orcid":"https://orcid.org/0000-0002-6694-7753"},"institutions":[{"id":"https://openalex.org/I11701301","display_name":"Griffith University","ror":"https://ror.org/02sc3r913","country_code":"AU","type":"education","lineage":["https://openalex.org/I11701301"]},{"id":"https://openalex.org/I160993911","display_name":"Queensland University of Technology","ror":"https://ror.org/03pnv4752","country_code":"AU","type":"education","lineage":["https://openalex.org/I160993911"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Zahra Jadidi","raw_affiliation_strings":["Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000","School of Information and Communication Technology, Griffith University, QLD, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000","institution_ids":["https://openalex.org/I160993911"]},{"raw_affiliation_string":"School of Information and Communication Technology, Griffith University, QLD, Australia","institution_ids":["https://openalex.org/I11701301"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043613674","display_name":"Shantanu Pal","orcid":"https://orcid.org/0000-0002-8784-0154"},"institutions":[{"id":"https://openalex.org/I160993911","display_name":"Queensland University of Technology","ror":"https://ror.org/03pnv4752","country_code":"AU","type":"education","lineage":["https://openalex.org/I160993911"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Shantanu Pal","raw_affiliation_strings":["Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000","institution_ids":["https://openalex.org/I160993911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014449585","display_name":"Ernest Foo","orcid":"https://orcid.org/0000-0002-3971-6415"},"institutions":[{"id":"https://openalex.org/I11701301","display_name":"Griffith University","ror":"https://ror.org/02sc3r913","country_code":"AU","type":"education","lineage":["https://openalex.org/I11701301"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Ernest Foo","raw_affiliation_strings":["Griffith University,School of Information and Communication Technology,QLD,Australia,4222"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Griffith University,School of Information and Communication Technology,QLD,Australia,4222","institution_ids":["https://openalex.org/I11701301"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5081458994","display_name":"Nagarajan Venkatachalam","orcid":"https://orcid.org/0000-0002-5545-0549"},"institutions":[{"id":"https://openalex.org/I160993911","display_name":"Queensland University of Technology","ror":"https://ror.org/03pnv4752","country_code":"AU","type":"education","lineage":["https://openalex.org/I160993911"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Nagarajan Venkatachalam","raw_affiliation_strings":["Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Queensland University of Technology,School of Computer Science,Brisbane,QLD,Australia,4000","institution_ids":["https://openalex.org/I160993911"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":21,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"618","last_page":"623"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9950000047683716,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9909999966621399,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.516676664352417},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.500830888748169},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.4179452955722809},{"id":"https://openalex.org/keywords/control-system","display_name":"Control system","score":0.4123561382293701},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.23852938413619995},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.13531216979026794},{"id":"https://openalex.org/keywords/electrical-engineering","display_name":"Electrical engineering","score":0.0745096504688263}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.516676664352417},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.500830888748169},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.4179452955722809},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.4123561382293701},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.23852938413619995},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.13531216979026794},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0745096504688263}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/percomworkshops53856.2022.9767375","is_oa":false,"landing_page_url":"https://doi.org/10.1109/percomworkshops53856.2022.9767375","pdf_url":null,"source":{"id":"https://openalex.org/S4363608020","display_name":"2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops)","raw_type":"proceedings-article"},{"id":"pmh:oai:research-repository.griffith.edu.au:10072/417158","is_oa":true,"landing_page_url":"http://hdl.handle.net/10072/417158","pdf_url":null,"source":{"id":"https://openalex.org/S4306402548","display_name":"Griffith Research Online (Griffith University, Queensland, Australia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I11701301","host_organization_name":"Griffith University","host_organization_lineage":["https://openalex.org/I11701301"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference output"}],"best_oa_location":{"id":"pmh:oai:research-repository.griffith.edu.au:10072/417158","is_oa":true,"landing_page_url":"http://hdl.handle.net/10072/417158","pdf_url":null,"source":{"id":"https://openalex.org/S4306402548","display_name":"Griffith Research Online (Griffith University, Queensland, Australia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I11701301","host_organization_name":"Griffith University","host_organization_lineage":["https://openalex.org/I11701301"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference output"},"sustainable_development_goals":[{"score":0.7900000214576721,"id":"https://metadata.un.org/sdg/6","display_name":"Clean water and sanitation"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W2561742697","https://openalex.org/W2741086811","https://openalex.org/W2818789173","https://openalex.org/W2889553682","https://openalex.org/W2896579058","https://openalex.org/W2908520504","https://openalex.org/W2920971804","https://openalex.org/W2951062106","https://openalex.org/W2955881216","https://openalex.org/W2986458967","https://openalex.org/W2999796443","https://openalex.org/W3011894540","https://openalex.org/W3014544197","https://openalex.org/W3132882316","https://openalex.org/W3152977613","https://openalex.org/W3174621618","https://openalex.org/W3200022502","https://openalex.org/W3202224668","https://openalex.org/W4205911522"],"related_works":["https://openalex.org/W2355865573","https://openalex.org/W2486991799","https://openalex.org/W2155981143","https://openalex.org/W2155245395","https://openalex.org/W2110796433","https://openalex.org/W3155069932","https://openalex.org/W1993066969","https://openalex.org/W2382834095","https://openalex.org/W2615607975","https://openalex.org/W1986502878"],"abstract_inverted_index":{"Traditional":[0],"industrial":[1],"systems,":[2],"e.g.,":[3,176],"power":[4],"plants,":[5,8],"water":[6],"treatment":[7],"etc.,":[9],"were":[10],"built":[11],"to":[12,27,36,49,60,148,161],"operate":[13],"highly":[14],"isolated":[15],"and":[16,34,68,85,122,125,159,169,185,200,214],"controlled":[17],"capacity.":[18],"Recently,":[19],"Industrial":[20],"Control":[21],"Systems":[22],"(ICSs)":[23],"have":[24],"been":[25],"exposed":[26],"the":[28,63,76,91,100,106,123,143,150,193,197,211,228,232],"Internet":[29],"for":[30],"ease":[31],"of":[32,65,108,119,127,231],"access":[33],"adaptation":[35],"advanced":[37],"technologies.":[38],"However,":[39],"it":[40],"creates":[41],"security":[42,64],"vulnerabilities.":[43],"Attackers":[44],"often":[45],"exploit":[46],"these":[47],"vulnerabilities":[48],"launch":[50],"attacks":[51,199],"on":[52,90,138,210],"ICSs.":[53],"Towards":[54],"this,":[55],"threat":[56,80,93,109,120,134,139,203],"hunting":[57,110,135],"is":[58,166],"performed":[59],"proactively":[61],"monitor":[62],"ICS":[66,112,144,218],"networks":[67],"protect":[69],"them":[70],"against":[71],"threats":[72,84],"that":[73,192],"could":[74],"make":[75],"systems":[77],"malfunction.":[78],"A":[79],"hunter":[81,204],"manually":[82],"identifies":[83],"provides":[86],"a":[87,128,167,186,202,206,222],"hypothesis":[88,207],"based":[89,137,209],"available":[92],"intelligence.":[94],"In":[95],"this":[96],"paper,":[97],"we":[98],"motivate":[99],"gap":[101],"in":[102,105,111],"lacking":[103],"research":[104],"automation":[107],"networks.":[113],"We":[114,130],"propose":[115],"an":[116,132],"automated":[117,133],"extraction":[118],"intelligence":[121,140],"generation":[124],"validation":[126],"hypothesis.":[129],"present":[131],"framework":[136,147],"provided":[141],"by":[142],"MITRE":[145,219],"ATT&CK":[146],"automate":[149],"tasks.":[151],"Unlike":[152],"other":[153],"solutions":[154],"which":[155],"are":[156],"cloud-based,":[157],"costly":[158],"prone":[160],"human":[162],"errors,":[163],"our":[164],"solution":[165,194],"central":[168],"open-source":[170],"implemented":[171],"using":[172],"different":[173],"opensource":[174],"technologies,":[175],"Elasticsearch,":[177],"Conpot,":[178],"Metasploit,":[179],"Web":[180],"Single":[181],"Page":[182],"Application":[183],"(SPA),":[184],"machine":[187,223],"learning":[188,224],"analyser.":[189],"Results":[190],"demonstrate":[191],"can":[195],"identify":[196],"network’s":[198],"alert":[201],"with":[205],"generated":[208],"techniques,":[212],"tactics,":[213],"procedures":[215],"(TTPs)":[216],"from":[217],"ATT&CK.":[220],"Then,":[221],"classifier":[225],"automatically":[226],"predicts":[227],"future":[229],"actions":[230],"attack.":[233]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":7},{"year":2022,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}