{"id":"https://openalex.org/W2139406430","doi":null,"title":"Deriving behavior primitives from aggregate network features using support vector machines","display_name":"Deriving behavior primitives from aggregate network features using support vector machines","publication_year":2013,"publication_date":"2013-06-04","ids":{"openalex":"https://openalex.org/W2139406430","mag":"2139406430"},"language":"en","primary_location":{"id":"mag:2139406430","doi":null,"is_oa":false,"landing_page_url":"http://ccdcoe.org/publications/2013proceedings/d2r2s2_mccusker.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306419315","display_name":"International Conference on Cyber Conflict","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"International Conference on Cyber Conflict","raw_type":null},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019030289","display_name":"Owen McCusker","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210126669","display_name":"Sonalysts (United States)","ror":"https://ror.org/03htvw360","country_code":"US","type":"company","lineage":["https://openalex.org/I4210126669"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Owen McCusker","raw_affiliation_strings":["Sonalysts, Inc., Waterford, CT, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sonalysts, Inc., Waterford, CT, USA","institution_ids":["https://openalex.org/I4210126669"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075159964","display_name":"Scott Brunza","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210126669","display_name":"Sonalysts (United States)","ror":"https://ror.org/03htvw360","country_code":"US","type":"company","lineage":["https://openalex.org/I4210126669"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Scott Brunza","raw_affiliation_strings":["Sonalysts, Inc., Waterford, CT, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sonalysts, Inc., Waterford, CT, USA","institution_ids":["https://openalex.org/I4210126669"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5111370894","display_name":"Dipankar Dasgupta","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I94658018","display_name":"University of Memphis","ror":"https://ror.org/01cq23130","country_code":"US","type":"education","lineage":["https://openalex.org/I94658018"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dipankar Dasgupta","raw_affiliation_strings":["Computer Science, University of Memphis, Memphis, TN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Science, University of Memphis, Memphis, TN, USA","institution_ids":["https://openalex.org/I94658018"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.4501,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.5998121,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":93},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"18"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/network-flow-data","display_name":"network flow data","score":0.8180000185966492},{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.8009999990463257},{"id":"https://openalex.org/keywords/threat-detection","display_name":"threat detection","score":0.5789999961853027},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.6470000147819519},{"id":"https://openalex.org/keywords/data-fusion","display_name":"data fusion","score":0.656000018119812},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"support vector machine","score":0.7229999899864197},{"id":"https://openalex.org/keywords/situational-awareness","display_name":"situational awareness","score":0.47099998593330383}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.779437780380249},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6399567127227783},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.5942503213882446},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.593014657497406},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.5243996977806091},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.41830167174339294},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3852854371070862},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3277464509010315},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3274109959602356},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.24139666557312012},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0960749089717865},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0},{"id":"https://openalex.org/C159985019","wikidata":"https://www.wikidata.org/wiki/Q181790","display_name":"Composite material","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"mag:2139406430","doi":null,"is_oa":false,"landing_page_url":"http://ccdcoe.org/publications/2013proceedings/d2r2s2_mccusker.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306419315","display_name":"International Conference on Cyber Conflict","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"International Conference on Cyber Conflict","raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W9561701","https://openalex.org/W149175888","https://openalex.org/W191098608","https://openalex.org/W288285141","https://openalex.org/W1516506771","https://openalex.org/W1529060400","https://openalex.org/W1574452805","https://openalex.org/W1592090113","https://openalex.org/W1674877186","https://openalex.org/W1909945809","https://openalex.org/W1984068243","https://openalex.org/W2002194532","https://openalex.org/W2078191206","https://openalex.org/W2126952531","https://openalex.org/W2130523241","https://openalex.org/W2134070140","https://openalex.org/W2140542782","https://openalex.org/W2155788085","https://openalex.org/W2165904201","https://openalex.org/W2278493350","https://openalex.org/W2802348331"],"related_works":["https://openalex.org/W7164757109","https://openalex.org/W4403674664","https://openalex.org/W7026988543","https://openalex.org/W3036446512","https://openalex.org/W3198184073","https://openalex.org/W7220675824","https://openalex.org/W2032233042","https://openalex.org/W4328089740","https://openalex.org/W1615570909","https://openalex.org/W4408324953"],"abstract_inverted_index":{"Establishing":[0],"long-view":[1],"situation":[2],"awareness":[3],"of":[4,16,24,50,56,96,116,123,199],"threat":[5,124],"agents":[6],"requires":[7],"an":[8],"operational":[9],"capability":[10],"that":[11,119,170],"scales":[12],"to":[13,22,28,69,127,149],"large":[14,192],"volumes":[15],"network":[17,91,141,174,193],"data,":[18],"leveraging":[19],"the":[20,25,30,47,80,107,121,135,200],"past":[21],"make-sense":[23],"present":[26],"and":[27,82,112,186,203],"anticipate":[29],"future.":[31],"Yet,":[32],"today":[33],"we":[34,105,133],"are":[35,59],"dominated":[36],"by":[37,41,46,86,179],"short-view":[38],"capabilities":[39],"driven":[40],"misuse":[42],"based":[43,77],"strategies;":[44],"triggered":[45],"structural":[48,54,75],"qualities":[49],"attack":[51,72],"vectors.":[52,73],"The":[53,196],"aspects":[55],"cyber":[57,87,129,152,161],"threats":[58,88,130,153],"in":[60,110,188,191],"a":[61,90,114,166],"constant":[62],"flux,":[63],"rendering":[64],"most":[65],"defensive":[66],"technologies":[67],"reactive":[68],"previously":[70],"unknown":[71],"Unlike":[74],"signature":[76],"approaches,":[78],"both":[79],"real-time":[81],"aggregate":[83,137],"behaviors":[84,138],"exhibited":[85],"over":[89],"provide":[92],"insight":[93],"into":[94],"making-sense":[95],"anomalies":[97],"found":[98],"on":[99],"our":[100],"networks.":[101],"In":[102],"this":[103],"work,":[104],"explore":[106],"challenges":[108],"posed":[109],"identifying":[111],"developing":[113],"set":[115],"behavior":[117,146],"primitives":[118],"facilitate":[120],"creation":[122],"narratives":[125],"use":[126,136],"describe":[128],"anomalies.":[131],"Thus,":[132],"investigate":[134],"derived":[139],"from":[140,173],"flow":[142,175],"data":[143,162,176,194],"establishing":[144],"initial":[145],"models":[147,205],"used":[148],"detect":[150],"complex":[151],"such":[154],"as":[155],"Advanced":[156],"Persistent":[157],"Threats":[158],"(APTs).":[159],"Our":[160],"fusion":[163],"prototype":[164],"employs":[165],"unique":[167],"layered":[168],"methodology":[169,202],"extracts":[171],"features":[172],"aggregating":[177],"it":[178],"time.":[180],"This":[181],"approach":[182],"is":[183],"more":[184],"scalable":[185],"flexible":[187],"its":[189],"application":[190],"volumes.":[195],"preliminary":[197],"evaluation":[198],"proposed":[201],"supporting":[204],"shows":[206],"some":[207],"promising":[208],"results.":[209]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":1}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2016-06-24T00:00:00"}