{"id":"https://openalex.org/W1801744584","doi":null,"title":"A Normal Profile Updating Method for False Positives Reduction in Anomaly Detection Systems","display_name":"A Normal Profile Updating Method for False Positives Reduction in Anomaly Detection Systems","publication_year":2013,"publication_date":"2013-01-01","ids":{"openalex":"https://openalex.org/W1801744584","mag":"1801744584"},"language":"en","primary_location":{"id":"mag:1801744584","doi":null,"is_oa":false,"landing_page_url":"http://sdiwc.net/digital-library/a-normal-profile-updating-method-for-false-positives-reduction-in-anomaly-detection-systems.html","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5033256078","display_name":"Mohd Nizam Omar","orcid":"https://orcid.org/0000-0003-3727-7874","observed_orcids":["https://orcid.org/0000-0003-3727-7874"]},"institutions":[{"id":"https://openalex.org/I94625822","display_name":"Universiti Utara Malaysia","ror":"https://ror.org/01ss10648","country_code":"MY","type":"education","lineage":["https://openalex.org/I94625822"]}],"countries":["MY"],"is_corresponding":false,"raw_author_name":"Mohd Nizam Omar","raw_affiliation_strings":["Universiti Utara, Malaysia"],"raw_orcid":"https://orcid.org/0000-0003-3727-7874","affiliations":[{"raw_affiliation_string":"Universiti Utara, Malaysia","institution_ids":["https://openalex.org/I94625822"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053689890","display_name":"Walid Mohamed Alsharafi","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I94625822","display_name":"Universiti Utara Malaysia","ror":"https://ror.org/01ss10648","country_code":"MY","type":"education","lineage":["https://openalex.org/I94625822"]}],"countries":["MY"],"is_corresponding":false,"raw_author_name":"Walid Mohamed Alsharafi","raw_affiliation_strings":["Universiti Utara, Malaysia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universiti Utara, Malaysia","institution_ids":["https://openalex.org/I94625822"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I94625822"],"apc_list":null,"apc_paid":null,"fwci":0.4227,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.69038626,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":93},"biblio":{"volume":null,"issue":null,"first_page":"182","last_page":"187"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9926999807357788,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9926999807357788,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.003800000064074993,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":0.002300000051036477,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/false-positive-reduction","display_name":"false positive reduction","score":0.9810000061988831},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.9369999766349792},{"id":"https://openalex.org/keywords/intrusion-detection-systems","display_name":"intrusion detection systems","score":0.8389999866485596},{"id":"https://openalex.org/keywords/network-traffic-analysis","display_name":"network traffic analysis","score":0.5789999961853027}],"concepts":[{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.8925514221191406},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.8627349734306335},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.8330803513526917},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.6771953105926514},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6309589743614197},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6045147180557251},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6031760573387146},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5831108689308167},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.5243004560470581},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.47111988067626953},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.4693416357040405},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4643346071243286},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.46295270323753357},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.44248029589653015},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.4279518127441406},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3298007547855377},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.18275460600852966},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.11817702651023865},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.09104952216148376},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.08332332968711853},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"mag:1801744584","doi":null,"is_oa":false,"landing_page_url":"http://sdiwc.net/digital-library/a-normal-profile-updating-method-for-false-positives-reduction-in-anomaly-detection-systems.html","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W44307044","https://openalex.org/W1563854199","https://openalex.org/W1574033492","https://openalex.org/W1583975142","https://openalex.org/W1591480890","https://openalex.org/W2050274590","https://openalex.org/W2109856257","https://openalex.org/W2292469963","https://openalex.org/W2336873743","https://openalex.org/W2678934292"],"related_works":["https://openalex.org/W2988433590","https://openalex.org/W2393552796","https://openalex.org/W4405363125","https://openalex.org/W2347820455","https://openalex.org/W2362980026","https://openalex.org/W2348583279","https://openalex.org/W2109856257","https://openalex.org/W2380439867","https://openalex.org/W50213487","https://openalex.org/W2291991398"],"abstract_inverted_index":{"The":[0,126,137,147],"contribution":[1],"of":[2,13,16,31,81,100,109,120,167],"this":[3,38,101],"paper":[4,102],"is":[5,10,48,84,103],"to":[6,68,104,163],"investigate":[7,105],"whether":[8],"there":[9],"a":[11,64,106,160],"possibility":[12],"further":[14],"processing":[15],"both":[17],"the":[18,29,33,79,88,98,118,122,134,156,165,168,172,178],"normal":[19,110],"and":[20,131],"abnormal":[21],"data":[22,139],"identified":[23],"by":[24],"any":[25],"anomaly":[26,44,72,114],"detector":[27,45],"with":[28,117],"intent":[30,119],"reducing":[32,121],"false":[34,82,123,174],"positive":[35,124],"alerts.":[36,125],"For":[37],"end,":[39],"we":[40],"use":[41],"an":[42],"existing":[43],"model":[46,59,67,95,170],"which":[47],"called":[49],"as":[50,63],"Protocol":[51],"based":[52,73,92],"Packet":[53],"Header":[54],"Anomaly":[55],"Detector":[56],"(PbPHAD).":[57],"This":[58],"has":[60,159],"been":[61],"demonstrated":[62],"very":[65],"promising":[66],"be":[69],"used":[70],"for":[71,87,177],"Intrusion":[74],"Detection":[75],"Systems":[76],"(IDSs).":[77],"However,":[78],"percentage":[80],"positives":[83,175],"quite":[85],"big":[86],"detected":[89,179],"anomalous":[90,180],"packets":[91],"on":[93,150],"PbPHAD":[94,135,169],"alone.":[96],"Thus,":[97],"purpose":[99],"proposed":[107,127,157],"method":[108,128,158],"profile":[111],"updating":[112],"in":[113],"detection":[115],"systems":[116],"was":[129],"applied":[130],"tested":[132],"using":[133],"model.":[136],"evaluation":[138],"set":[140],"were":[141],"downloaded":[142],"from":[143],"MIT":[144],"Lincoln":[145],"Laboratory.":[146],"experimental":[148],"results":[149],"one":[151],"selected":[152],"host":[153],"show":[154],"that":[155],"good":[161],"ability":[162],"solve":[164],"shortcoming":[166],"regarding":[171],"high":[173],"rate":[176],"packets.":[181]},"counts_by_year":[{"year":2015,"cited_by_count":1}],"updated_date":"2026-10-08T09:06:37.294493","created_date":"2016-06-24T00:00:00"}