Authors : Ekangwo Hernadez Ebolo; Kum Bertrand Kum; Tagne Poupi Theodore Armand; Austin Oguejiofor Amaechi

Volume/Issue : Volume 11 - 2026, Issue 8 - August

Google Scholar : https://tinyurl.com/nhb5u7n2

Scribd : https://tinyurl.com/52cyet6f

DOI : https://doi.org/10.38124/ijisrt/26aug526

Note : A published paper may take 4-5 working days from the publication date to appear in PlumX Metrics, Semantic Scholar, and ResearchGate.

Abstract : face of these evolving dangers. It argues that while compliance-based frameworks provide a necessary governance foundation, they are insufficient without the integration of proactive strategies like Threat Hunting and Threat Intelligence. In this paper, we present the Integrated Threat Hunting and Security Orchestration, Automation and Response (SOAR) Automation Workflow (THSAW) highlighting the necessity of shifting from a reactive "alert-driven" posture to a proactive "hunt-driven" methodology to ensure organizational resilience. Using a design science paradigm, we describe the solution design rationale and artifact development. The proactive approach can be used to develop the offensive security-aware environment for organizations to uncover advanced attack mechanisms and test their ability for attack detection. Experimental results demonstrate the workflow's effectiveness in autonomous threat detection, behavioral analysis, and automated incident response.

Keywords : Cyber-Security, Advanced Persistent Threats (APTs), Threat Hunting, Security Operations Center (SOC), MITRE ATT&CK, Cyber Kill Chain, Threat Intelligence.

References :

1. Al-Husain, M. A. F., Hashem, I. A. T., El-fattah, A. A. A., & Wahab, A. A. (2021). A survey on cyber threat intelligence: Challenges, and future trends. Journal of Network and Computer Applications, 183, 103058.
2. Alghanmi, R., Kulaibi, S., Alghamdi, J., Bahashwan, E., & Aeshmawi, A. (2025, May). HuntSmart: Hypothesis-driven threat hunting using GenAI. In 2025 International Conference on Innovation in Artificial Intelligence and Internet of Things (AIIT) (pp. 1-12). IEEE.
3. Almutairi, M., & Sheldon, F. T. (2025). IoT–cloud integration security: A survey of challenges, solutions, and directions. Electronics, 14(7), 1394.
4. Alshamrani, A., Myneni, S., Chowdhary, A., & Huang, D. (2019). A Survey on Advanced Persistent Threats: Techniques, Solutions, Challenges, and Research Opportunities. IEEE Communications Surveys and Tutorials, 21(2), 1851-1877.
5. Alshamrani, A., Chowdhary, A., Mjihil, O., Myneni, S., & Huang, D. (2018). Combining Dynamic and Static Attack Information for Attack Tracing and Event Correlation. In 2018 IEEE Global Communications Conference, GLOBECOM 2018 - Proceedings Article 8647326 (2018 IEEE Global Communications Conference, GLOBECOM 2018 - Proceedings). Institute of Electrical and Electronics Engineers Inc. https://doi.org/10.1109/GLOCOM.2018.8647326
6. Amaechi, A. O., (2025). A methodological framework for fostering cyber-security mindsets and behaviour. International Journal of Science and Research Archive, 2025, 15(02), 1799–1810. https://doi.org/10.30574/ijsra.2025.15.2.1659
7. Asby, W. R. (1979). An Introduction to Cybernetics. Chapman and Hall.
8. Badva, P., Ramokapane, K. M., Pantano, E., & Rashid, A. (2024). Unveiling the {Hunter-Gatherers}: Exploring Threat Hunting Practices and Challenges in Cyber Defense. In 33rd USENIX Security Symposium (USENIX Security 24) (pp. 3313-3330)
9. Barr-Smith, F., Ugarte-Pedrero, X., Graziano, M., Spolaor, R., & Martinovic, I. (2021, May). Survivalism: Systematic analysis of windows malware living-off-the-land. In 2021 IEEE Symposium on Security and Privacy (SP) (pp. 1557-1574). IEEE.
10. Bianco, D. (2015). A Simple Hunting Maturity Model. URL: http://detect-respond. blogspot. com/2015/10/a-simple-hunting-maturity-model. html.
11. Chatziamanetoglou, A., & Rantos, K. (2024). Cyber Threat Intelligence for Industrial Automation. In IGI Global Handbook of Research.
12. Chuvakin, A., Schmidt, K., & Phillips, C. Logging and Log Management; Syngress: Boston, MA, USA, 2013.
13. Costa-Gazcón, V. (2021). Practical Threat Intelligence and Data-driven Threat Hunting: A Hands-on Guide to Threat Hunting with the ATT&CK Framework and Open Source Tools. Packt Publishing.
14. Cybersecurity, C. I. (2018). Framework for improving critical infrastructure cybersecurity. URL: https://nvlpubs. nist. gov/nistpubs/CSWP/NIST. CSWP, 4162018(7).
15. CrowdStrike (2025). CrowdStrike 2025 Global Threat Report: Beware the Enterprising Adversary. https://www.crowdstrike.com/en-us/blog/crowdstrike-2025-global-threat-report-findings/
16. CrowdStrike B. (2024). Global Threat Report 2024: Adapting to the New Normal of Cybercrime. CrowdStrike Intelligence. https://www.crowdstrike.com/global-threat-report/
17. Disterer, G. (2013). "ISO/IEC 27000, 27001 and 27002 for Information Security Management." Journal of Information Security, 4(2), 92-100.
18. Farraj, A., Hammad, E., & Kundur, D. (2017, April). Impact of cyber-attacks on data integrity in transient stability control. In Proceedings of the 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids (pp. 29-34).
19. French, W. (2024). Enhancing Threat Hunting Automation with Large Language Models and SOAR. University of North Carolina (Niner Commons).
20. Gunter, D., & Seitz, M. (2018). A practical model for conducting cyber threat hunting. Sans. org.
21. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains." Lockheed Martin Corporation.
22. Jiang, Y., et al. (2025). MITRE ATT&CK Applications in Cyber-security and the Way Forward. arXiv preprint arXiv:2502.10825.
23. Jorgensen, John M., and Kevin P. McSweeney. "Cyber Security - Understanding Your Threat Landscape." Paper presented at the Offshore Technology Conference, Houston, Texas, USA, April 2018. https://doi.org/10.4043/28933-MS
24. Kintis, P., Lever, C., Nadji, Y., Dagon, D., & Antonakakis, M. (2017). Hiding Among the Clouds: A Longitudinal Study of Nation-State Actors in Public Cloud Infrastructure. Proceedings of the 26th USENIX Security Symposium, 667–682.
25. Kuhl, M.E.; Sudit, M.; Kistner, J.; Costantini, K. Cyber-attack modeling and simulation for network security analysis. In Proceedings of the 2007 Winter Simulation Conference, Washington, DC, USA, 9–12 December 2007; IEEE: Piscataway, NJ, USA, 2007.
26. Kummarapurugu, Charan Shankar. (2024). Architectural Framework for Threat Intelligence Integration with SIEM and SOAR in Hybrid Cloud Security Environments.
27. Lee, R. M., & Bianco, D. Generating hypotheses for successful threat hunting. SANS Institute InfoSec Reading Room. (2016).
28. Lockheed Martin. Gaining the Advantage: Applying Cyber Kill Chain® Methodology to Network Defense, Lockheed Martin Corporation, Maryland, USA (2015) https://www.lockheedmartin.com/content/dam/lockheedmartin/rms/documents/cyber/Gaining_the_Advantage_Cyber_Kill_Chain.pdf
29. Maciel Paz Milani, A., Anderson, N., & Storey, M. A. (2026, April). Towards a Cognitive-Support Tool for Threat Hunters. In Proceedings of the 2026 ACM/IEEE 7th International Workshop on Engineering and Cybersecurity of Critical Systems (pp. 1-8).
30. Mahboubi, A., Luong, K., Aboutorab, H., Bui, H. T., Jarrad, G., Bahutair, M., ... & Gately, H. (2024). Evolving techniques in cyber threat hunting: A systematic review. Journal of Network and Computer Applications, Volume 232, 2024, 104004, https://doi.org/10.1016/j.jnca.2024.104004.
31. Mgbemele, A. F. (2026). Advancing Cyber Threat Detection through SIEM-Based Automation and MITRE ATT&CK Aligned Analytics: A Systematic Review. Asian Journal of Research in Computer Science, 19(1), 233–254. https://doi.org/10.9734/ajrcos/2026/v19i1816
32. MITRE Corporation. (2023). MITRE ATT&CK Framework: Design and Philosophy. https://attack.mitre.org/matrices/enterprise
33. Mughal, A. A., (2022). Building and securing the modern security operations center (soc). International Journal of Business Intelligence and Big Data Analytics, vol. 5, no. 1, pp. 1–15, 2022, https://research.tensorgate.org/index.php/IJBIBDA/article/view/21.
34. Netwitness (2025). Threat Hunting Process. https://www.netwitness.com/cyber-glossary/threat-hunting-process/
35. Nour, B., Pourzandi, M., & Debbabi, M. (2023). A survey on threat hunting in enterprise networks. IEEE communications surveys & tutorials, 25(4), 2299-2324. http://doi.org/10.1109/COMST.2023.3299519
36. Paul-Arthur. (2022). Boost Threat Hunting Efficiency with SOAR: Automating Detection And Response. https://mindflow.io/blog/threat-hunting-tools
37. Runeson, P., Engström, E., & Storey, M. A. (2020). The design science paradigm as a frame for empirical software engineering. In Contemporary empirical methods in software engineering (pp. 127-147). Cham: Springer International Publishing.
38. Rahman, Rayhanur & Williams, Laurie. (2022). An investigation of security controls and MITRE ATT\&CK techniques. 10.48550/arXiv.2211.06500.
39. Rahman, A. (2024). A Qualitative Study on The Reduction of Dwell Time Exceeding 200 Days. Capella University.
40. Salim, D. T., Singh, M. M., & Keikhosrokiani, P. (2023). A systematic literature review for APT detection and Effective Cyber Situational Awareness (ECSA) conceptual model. Heliyon, 9(7). https://doi.org/10.1016/j.heliyon.2023.e17156.
41. Sarker, I.H., Ed., AI-Driven Cyber-security and Threat Intelligence, Springer Nature Switzerland, 3-19.
42. Sauerwein, C.; Sillaber, C.; Mussmann, A.; Breu, R. (2017): Threat Intelligence Sharing Platforms: An Exploratory Study of Software Vendors and Research Perspectives, in Leimeister, J.M.; Brenner, W. (Hrsg.): Proceedings der 13. Internationalen Tagung Wirtschaftsinformatik (WI 2017), St. Gallen, S. 837-851
43. Singh, J., Pasquier, T., Bacon, J., Ko, H., & Eyers, D. (2016). Twenty security considerations for cloud-supported Internet of Things. IEEE Internet of Things Journal, 3(3), 269–284.
44. Souppaya, M and Scarfone, K. Guide to Data-Centric System Threat Modeling, Technical Report. National Institute of Standards and Technology, Gaithersburg, MD, USA (2016). https://csrc.nist.gov/Pubs/sp/800/154/IPD
45. Srinivasan, Suraj, and Li-Kuan Ni. "Ransomware Attack at Colonial Pipeline Company." Harvard Business School Case 123-069, March 2023.
46. Stafford B. Brain of the Firm. John Wiley & Sons, 2nd edition, 1981.
47. Tatam M, Shanmugam B, Azam S, Kannoorpatti K. A review of threat modelling approaches for APT-style attacks. Heliyon. 2021 Jan 16;7(1):e05969. https://doi.org/10.1016/j.heliyon.2021.e05969.
48. Tounsi, W., Rais, H.: A survey on technical threat intelligence in the age of sophisticated cyber-attacks. Computers & security 72, 212–233 (2018)
49. Vielberth, M., Böhm, F., Fichtinger, I., & Pernul, G. (2020). “Security operations center: A systematic study and open challenges”, IEEE Access, vol. 8, pp. 227 756–227 779, 2020. https://doi.org/10.1109/ACCESS.2020.3045514.