{"id":"https://openalex.org/W2240632035","doi":null,"title":"Assessing Network Intrusion Detection System performance: forensic implications","display_name":"Assessing Network Intrusion Detection System performance: forensic implications","publication_year":2013,"publication_date":"2013-01-01","ids":{"openalex":"https://openalex.org/W2240632035","mag":"2240632035"},"language":"en","primary_location":{"id":"pmh:oai:openrepository.aut.ac.nz:10292/5655","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/10292/5655","pdf_url":"http://hdl.handle.net/10292/5655","source":{"id":"https://openalex.org/S4306401809","display_name":"Tuwhera (Auckland University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I39854758","host_organization_name":"Auckland University of Technology","host_organization_lineage":["https://openalex.org/I39854758"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Thesis"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"http://hdl.handle.net/10292/5655","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089908151","display_name":"Muteb Alqahtani","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Muteb Alqahtani","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5089908151"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5468999743461609,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5468999743461609,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.43459999561309814,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.010099999606609344,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/network-intrusion-detection-systems","display_name":"network intrusion detection systems","score":0.9829999804496765},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"digital forensics","score":0.8769999742507935},{"id":"https://openalex.org/keywords/network-forensics","display_name":"network forensics","score":0.8510000109672546},{"id":"https://openalex.org/keywords/snort","display_name":"Snort","score":0.7120000123977661},{"id":"https://openalex.org/keywords/suricata","display_name":"Suricata","score":0.9940000176429749},{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"cross-site scripting","score":0.9470000267028809},{"id":"https://openalex.org/keywords/sql-injection","display_name":"SQL injection","score":0.9990000128746033},{"id":"https://openalex.org/keywords/preservation-of-evidence","display_name":"evidence preservation","score":0.5120000243186951},{"id":"https://openalex.org/keywords/attack-detection","display_name":"attack detection","score":0.32899999618530273},{"id":"https://openalex.org/keywords/system-resource-usage","display_name":"system resource usage","score":0.48500001430511475},{"id":"https://openalex.org/keywords/web-application-security","display_name":"web application security","score":0.4180000126361847},{"id":"https://openalex.org/keywords/attack-vectors","display_name":"attack vectors","score":0.34200000762939453}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7842354774475098},{"id":"https://openalex.org/C140505726","wikidata":"https://www.wikidata.org/wiki/Q495304","display_name":"Forensic science","level":2,"score":0.5028612017631531},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4731151759624481},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.43102818727493286},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4164774715900421},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.13836362957954407},{"id":"https://openalex.org/C54355233","wikidata":"https://www.wikidata.org/wiki/Q7162","display_name":"Genetics","level":1,"score":0.08419176936149597}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:openrepository.aut.ac.nz:10292/5655","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/10292/5655","pdf_url":"http://hdl.handle.net/10292/5655","source":{"id":"https://openalex.org/S4306401809","display_name":"Tuwhera (Auckland University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I39854758","host_organization_name":"Auckland University of Technology","host_organization_lineage":["https://openalex.org/I39854758"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Thesis"},{"id":"pmh:oai:aut.researchgateway.ac.nz:10292/5655","doi":null,"is_oa":true,"landing_page_url":"http://hdl.handle.net/10292/5655","pdf_url":null,"source":{"id":"https://openalex.org/S4306401809","display_name":"Tuwhera (Auckland University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I39854758","host_organization_name":"Auckland University of Technology","host_organization_lineage":["https://openalex.org/I39854758"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Thesis"},{"id":"mag:2240632035","doi":null,"is_oa":false,"landing_page_url":"https://aut.researchgateway.ac.nz/handle/10292/5655","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":{"id":"pmh:oai:openrepository.aut.ac.nz:10292/5655","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/10292/5655","pdf_url":"http://hdl.handle.net/10292/5655","source":{"id":"https://openalex.org/S4306401809","display_name":"Tuwhera (Auckland University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I39854758","host_organization_name":"Auckland University of Technology","host_organization_lineage":["https://openalex.org/I39854758"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Thesis"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2240632035.pdf","grobid_xml":"https://content.openalex.org/works/W2240632035.grobid-xml"},"referenced_works_count":31,"referenced_works":["https://openalex.org/W24678375","https://openalex.org/W33764377","https://openalex.org/W110541984","https://openalex.org/W145324293","https://openalex.org/W1519243992","https://openalex.org/W1546208215","https://openalex.org/W1588018534","https://openalex.org/W1835640267","https://openalex.org/W1968043276","https://openalex.org/W1970399788","https://openalex.org/W1985996547","https://openalex.org/W1986678460","https://openalex.org/W2006508099","https://openalex.org/W2015652442","https://openalex.org/W2048376129","https://openalex.org/W2062394878","https://openalex.org/W2093232845","https://openalex.org/W2106017115","https://openalex.org/W2106109262","https://openalex.org/W2113005368","https://openalex.org/W2114214262","https://openalex.org/W2114891701","https://openalex.org/W2119026482","https://openalex.org/W2130537748","https://openalex.org/W2135017562","https://openalex.org/W2146467316","https://openalex.org/W2211674239","https://openalex.org/W2620229640","https://openalex.org/W2750688521","https://openalex.org/W2912060910","https://openalex.org/W4253072731"],"related_works":["https://openalex.org/W1492454131","https://openalex.org/W4383684160","https://openalex.org/W2558536022","https://openalex.org/W2103206157","https://openalex.org/W2102484091","https://openalex.org/W2791945607","https://openalex.org/W1593597372","https://openalex.org/W2291396120","https://openalex.org/W1985394250","https://openalex.org/W2106828752"],"abstract_inverted_index":{"Network":[0],"Intrusion":[1],"detection":[2],"systems":[3,7],"(NIDS)":[4],"are":[5,111,215],"security":[6,11],"utilized":[8],"to":[9,13,52,70,85,96,113,184,294,321,336,381,438,484,492,495,525,580],"detect":[10],"threats":[12],"computer":[14],"networks.":[15,304],"They":[16],"usually":[17],"log":[18],"events":[19],"and":[20,47,95,108,124,139,169,174,191,212,220,242,249,280,282,296,329,344,354,369,383,392,406,419,433,440,488,529,575],"store":[21],"other":[22],"information":[23],"that":[24,33,61,451,505,516],"is":[25,83,183,481],"useful":[26],"for":[27,132,141,172,189,269,397,535],"forensic":[28,35,134,285],"purposes.":[29],"Laurensen":[30],"(2010)":[31],"showed":[32],"the":[34,55,98,143,158,162,186,205,246,254,270,290,299,310,313,323,326,330,339,347,352,358,361,364,370,373,385,388,393,398,408,416,420,430,435,442,446,452,485,497,500,503,506,509,520,536,539,562,565,569],"capability":[36,138,531],"of":[37,54,89,136,157,164,198,204,209,261,312,325,346,351,356,372,387,410,415,426,429,445,461,470,508,564],"IDS":[38,69],"in":[39,146,413],"wireless":[40],"networks":[41,211,214,259],"was":[42,379,547],"dependent":[43],"on":[44,578],"packet":[45],"rates":[46],"under":[48,100,179],"high":[49],"workloads":[50],"up":[51],"50%":[53],"packets":[56,474],"passed":[57],"uninspected.":[58],"He":[59],"concluded":[60],"a":[62,87,133,216,221,262,265,273,284,288,459],"forensically":[63,297],"ready":[64],"network":[65,176,219,226,232,359,365],"required":[66],"more":[67],"than":[68],"assure":[71],"sufficient":[72],"evidence":[73,178,431,510,540],"could":[74],"be":[75,114,131,456,493,512,573],"available":[76],"after":[77],"events.":[78],"In":[79,519],"this":[80,559],"research":[81,159,314,521],"it":[82],"proposed":[84,206,271,291,399,453],"test":[86,327,378],"selection":[88],"common":[90,105,165,239,582],"NIDS":[91,137,148,276,412],"(as":[92],"listed":[93],"below)":[94],"evaluate":[97,382],"performance":[99,366,389,409,528],"different":[101,545],"work":[102],"loadings.":[103],"The":[104,128,154,181,202,230,257,376,448,479],"attack":[106,125],"problems":[107],"short":[109,144],"comings":[110],"also":[112],"explored.":[115],"For":[116],"example":[117],"input":[118,199],"validation":[119,200],"attacks,":[120,272],"signature":[121],"recognition":[122],"algorithms":[123],"vector":[126],"information.":[127],"implications":[129],"will":[130],"treatment":[135],"recommendations":[140],"fixing":[142],"falls":[145],"current":[147,570],"tools":[149,241,571],"by":[150,543],"specifying":[151],"system":[152,207,292,368,391],"requirements.":[153],"main":[155],"goal":[156],"project":[160],"addresses":[161],"implementation":[163,353],"open":[166],"source":[167,460],"NIDSs":[168,362,466],"their":[170,477],"capabilities":[171,386],"acquiring":[173],"preserving":[175],"digital":[177,462],"workloads.":[180],"objective":[182],"report":[185],"best":[187,436],"practice":[188,437],"handling":[190],"reporting":[192],"evidentiary":[193,443],"trails":[194,444],"from":[195,238,468],"two":[196,210,316,332,345,427,544],"types":[197],"attacks.":[201,400,447],"architecture":[203],"consists":[208,425],"these":[213],"simulated":[217],"internet":[218,231],"host-only":[222],"production":[223,258],"network.":[224],"Each":[225],"has":[227],"specific":[228],"components.":[229],"includes":[233],"four":[234,424],"machines":[235],"producing":[236,245],"traffic":[237,301,405],"stress":[240],"one":[243,343],"machine":[244],"Cross-site":[247],"scripting":[248],"SQL":[250],"injection":[251],"attacks":[252],"against":[253],"web":[255,267],"server.":[256,286],"consist":[260,350],"webserver":[263],"with":[264,275,554],"vulnerable":[266],"application":[268],"firewall":[274],"including":[277,472],"Snort,":[278],"Suricata":[279],"Bro-IDS,":[281],"finally":[283],"As":[287],"result,":[289],"works":[293],"monitor":[295],"study":[298],"transmitted":[300],"between":[302],"both":[303],"Four":[305],"phases":[306,318,333],"were":[307,319,334,523],"conducted":[308,320,335],"during":[309],"life":[311],"project:":[315],"initial":[317,348,377],"ensure":[322],"stability":[324],"bed":[328],"final":[331],"carry":[337],"out":[338],"formal":[340],"testing.":[341],"Phases":[342],"testing":[349],"installation":[355],"all":[357],"components,":[360],"configurations,":[363],"monitoring":[367,390],"creation":[371],"training":[374],"traffic.":[375],"built":[380],"determine":[384],"NIDSs\u2019":[394,454],"alert":[395],"detections":[396],"Phase":[401,423],"three":[402],"recreated":[403],"workload":[404],"measured":[407],"each":[411],"term":[414],"resources":[417],"usages":[418],"detected":[421],"alerts.":[422],"methods":[428,546],"collection":[432],"recording":[434],"acquire":[439],"preserve":[441],"findings":[449,501],"demonstrate":[450,502],"can":[455,511,572],"used":[457],"as":[458],"evidence.":[463],"However,":[464],"those":[465,489],"suffer":[467],"number":[469],"issues":[471],"dropped":[473],"before":[475],"reaching":[476],"engines.":[478],"issue":[480],"largely":[482],"related":[483],"interception":[486],"functions":[487,490],"need":[491],"improved":[494],"eliminate":[496],"problem.":[498],"Also,":[499],"fact":[504],"extraction":[507],"another":[513],"problem":[514],"area":[515],"needs":[517],"solution.":[518],"scripts":[522],"written":[524],"improve":[526],"tool":[527],"preservation":[530],"(see":[532],"Appendix":[533],"F":[534],"code).":[537],"Moreover,":[538],"analysis":[541],"examined":[542],"either":[548],"time":[549],"consuming":[550],"or":[551],"had":[552],"difficulties":[553],"making":[555],"correct":[556],"timestamps.":[557],"Overall,":[558],"thesis":[560],"shows":[561,567],"limitations":[563],"NIDS,":[566],"how":[568,579],"improved,":[574],"provides":[576],"advice":[577],"overcome":[581],"investigation":[583],"issues.":[584]},"counts_by_year":[{"year":2021,"cited_by_count":1}],"updated_date":"2026-10-12T09:40:04.860316","created_date":"2016-06-24T00:00:00"}