{"id":"https://openalex.org/W203201158","doi":null,"title":"Event correlation for detecting advanced multi-stage cyber-attacks","display_name":"Event correlation for detecting advanced multi-stage cyber-attacks","publication_year":2013,"publication_date":"2013-07-12","ids":{"openalex":"https://openalex.org/W203201158","mag":"203201158"},"language":"en","primary_location":{"id":"pmh:oai:tudelft.nl:uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","doi":null,"is_oa":true,"landing_page_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","pdf_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","source":{"id":"https://openalex.org/S4306400906","display_name":"Research Repository (Delft University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I98358874","host_organization_name":"Delft University of Technology","host_organization_lineage":["https://openalex.org/I98358874"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"master thesis"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5049494590","display_name":"A. Spadaro","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"A. Spadaro","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5049494590"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.001500000013038516,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/event-correlation","display_name":"event correlation","score":0.890999972820282},{"id":"https://openalex.org/keywords/cyberattack-detection","display_name":"cyberattack detection","score":0.7409999966621399},{"id":"https://openalex.org/keywords/incident-reconstruction","display_name":"incident reconstruction","score":0.8069999814033508},{"id":"https://openalex.org/keywords/heterogeneous-data-integration","display_name":"heterogeneous data integration","score":0.5690000057220459},{"id":"https://openalex.org/keywords/threat-prioritization","display_name":"threat prioritization","score":0.6980000138282776},{"id":"https://openalex.org/keywords/false-alarm-reduction","display_name":"false alarm reduction","score":0.5239999890327454}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7642408609390259},{"id":"https://openalex.org/C168725872","wikidata":"https://www.wikidata.org/wiki/Q991663","display_name":"Sophistication","level":2,"score":0.7097561955451965},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7020309567451477},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.6025609374046326},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5804117321968079},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5386282205581665},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5072021484375},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.4745177626609802},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.12928548455238342},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:tudelft.nl:uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","doi":null,"is_oa":true,"landing_page_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","pdf_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","source":{"id":"https://openalex.org/S4306400906","display_name":"Research Repository (Delft University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I98358874","host_organization_name":"Delft University of Technology","host_organization_lineage":["https://openalex.org/I98358874"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"master thesis"},{"id":"mag:203201158","doi":null,"is_oa":false,"landing_page_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":{"id":"pmh:oai:tudelft.nl:uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","doi":null,"is_oa":true,"landing_page_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","pdf_url":"http://resolver.tudelft.nl/uuid:d7d43988-f1b0-4549-8b44-3b5c9f1f401b","source":{"id":"https://openalex.org/S4306400906","display_name":"Research Repository (Delft University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I98358874","host_organization_name":"Delft University of Technology","host_organization_lineage":["https://openalex.org/I98358874"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"master thesis"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W203201158.pdf","grobid_xml":"https://content.openalex.org/works/W203201158.grobid-xml"},"referenced_works_count":44,"referenced_works":["https://openalex.org/W109441098","https://openalex.org/W124349154","https://openalex.org/W191098608","https://openalex.org/W351141490","https://openalex.org/W1546161684","https://openalex.org/W1546690352","https://openalex.org/W1549716092","https://openalex.org/W1554596310","https://openalex.org/W1562402498","https://openalex.org/W1587979610","https://openalex.org/W1621186777","https://openalex.org/W1670263352","https://openalex.org/W1684452600","https://openalex.org/W1968492600","https://openalex.org/W1974102697","https://openalex.org/W1999448603","https://openalex.org/W2006862475","https://openalex.org/W2011078788","https://openalex.org/W2019207321","https://openalex.org/W2036512235","https://openalex.org/W2048125321","https://openalex.org/W2057855325","https://openalex.org/W2072113943","https://openalex.org/W2073165180","https://openalex.org/W2103806672","https://openalex.org/W2108118522","https://openalex.org/W2115149820","https://openalex.org/W2128116119","https://openalex.org/W2130087897","https://openalex.org/W2136451344","https://openalex.org/W2137928260","https://openalex.org/W2141200504","https://openalex.org/W2143692712","https://openalex.org/W2152449272","https://openalex.org/W2159126236","https://openalex.org/W2161830378","https://openalex.org/W2170701348","https://openalex.org/W2171635164","https://openalex.org/W2542498933","https://openalex.org/W2678934292","https://openalex.org/W2797148637","https://openalex.org/W2912625373","https://openalex.org/W3193347044","https://openalex.org/W3214823556"],"related_works":["https://openalex.org/W4378531151","https://openalex.org/W2511403125","https://openalex.org/W3093557737","https://openalex.org/W2615535895","https://openalex.org/W4402443725","https://openalex.org/W4388182717","https://openalex.org/W2068518386","https://openalex.org/W2140947476","https://openalex.org/W2015973347","https://openalex.org/W7096041105"],"abstract_inverted_index":{"Rapidly":[0],"evolving":[1],"IT":[2,27,212],"infrastructures":[3],"bring":[4],"beneficial":[5],"effects":[6],"to":[7,22,87,118,122,134,161,186,192,211,228,287],"society":[8],"and":[9,13,26,39,59,97,110,124,144,184,200,206,256,270,291],"promote":[10],"information":[11,202,210],"sharing":[12],"use.":[14],"However,":[15,100],"vulnerabilities":[16],"create":[17],"opportunities":[18],"for":[19,37,195,207,294],"hostile":[20],"users":[21],"perform":[23,242],"malicious":[24,56],"activities":[25,57],"security":[28,75,139,176,213],"has":[29],"gradually":[30],"turned":[31],"into":[32],"a":[33,72,163,226],"critical":[34],"research":[35],"area":[36],"organizations":[38,47],"governments.":[40],"Processes":[41],"of":[42,54,74,104,166,225,237,265],"decision":[43],"making":[44],"in":[45,63,78,112,178,203],"large":[46,80,102,197],"are":[48,84,158],"widely":[49],"influenced":[50],"by":[51,60,71,175,233],"their":[52],"capability":[53],"detecting":[55],"effectively,":[58],"the":[61,101,107,167,223,238,278,285,289],"correctness":[62],"analyzing":[64],"suspicious":[65,231,268],"phenomena,":[66],"which":[67,241],"can":[68,141],"be":[69,182],"observed":[70],"number":[73],"sensors":[76],"deployed":[77],"such":[79,170],"networks.":[81],"Several":[82],"techniques":[83,290],"currently":[85],"employed":[86],"detect":[88,123,143],"incidents":[89],"starting":[90],"from":[91],"captured":[92],"security-related":[93],"events":[94,232,269],"within":[95],"networks":[96],"computer":[98],"systems.":[99],"volume":[103],"observable":[105],"events,":[106],"continuous":[108],"sophistication":[109],"changes":[111],"attack":[113],"strategies":[114],"make":[115],"it":[116,180,189,248],"challenging":[117],"provide":[119],"effective":[120],"solutions":[121],"reconstruct":[125],"cyber-security":[126],"incidents.":[127,168,274],"In":[128,275],"particular,":[129],"advanced":[130],"multi-stage":[131,218,273],"attacks":[132],"tend":[133],"remain":[135],"undiscovered":[136],"because":[137],"common":[138],"mechanisms":[140],"generally":[142],"flag":[145],"harmful":[146],"activity":[147],"\u2013":[148,155],"sometimes":[149],"with":[150],"unsatisfactory":[151],"false":[152],"alert":[153],"rates":[154],"but":[156],"they":[157],"not":[159],"able":[160],"draw":[162],"big":[164],"picture":[165],"Since":[169],"task":[171],"is":[172,190],"usually":[173],"performed":[174],"experts":[177],"full,":[179],"may":[181],"expensive":[183],"prone":[185],"errors.":[187],"Therefore,":[188],"essential":[191],"develop":[193],"procedures":[194],"combining":[196,234],"heterogeneous":[198],"datasets":[199],"system\u2019s":[201],"meaningful":[204],"way,":[205],"supplying":[208],"detailed":[209],"management.":[214],"By":[215],"examining":[216],"realistic":[217],"incidents,":[219],"this":[220],"thesis":[221],"proposes":[222],"design":[224],"model":[227],"correlate":[229],"detectable":[230],"complementary":[235],"state":[236],"art":[239],"methods,":[240],"correlation":[243],"along":[244],"different":[245],"axis.":[246],"Thus,":[247],"aims":[249],"at":[250],"providing":[251],"standard":[252],"data":[253],"formats,":[254],"prioritizing":[255],"clustering":[257],"data,":[258],"increasing":[259],"confidence":[260],"about":[261],"threats,":[262],"finding":[263],"relations":[264],"causality":[266],"between":[267],"eventually":[271],"reconstructing":[272],"addition,":[276],"reviewing":[277],"most":[279],"influential":[280],"scientific":[281],"papers":[282],"gives":[283],"us":[284],"chance":[286],"categorize":[288],"suggest":[292],"practices":[293],"further":[295],"implementation.":[296]},"counts_by_year":[{"year":2023,"cited_by_count":1}],"updated_date":"2026-09-09T07:26:56.047234","created_date":"2016-06-24T00:00:00"}