{"id":"https://openalex.org/W3125086909","doi":null,"title":"Forensic investigation of event logs by automatic anomaly detection","display_name":"Forensic investigation of event logs by automatic anomaly detection","publication_year":2020,"publication_date":"2020-01-01","ids":{"openalex":"https://openalex.org/W3125086909","mag":"3125086909"},"language":"en","primary_location":{"id":"pmh:oai:alma.61MUN_INST:11136384500007891","doi":null,"is_oa":true,"landing_page_url":"https://researchportal.murdoch.edu.au/esploro/outputs/doctoral/Forensic-investigation-of-event-logs-by/991005544419807891","pdf_url":"https://researchportal.murdoch.edu.au/view/delivery/61MUN_INST/12136384490007891/13136909080007891","source":{"id":"https://openalex.org/S4306400274","display_name":"Murdoch University Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I176790772","host_organization_name":"Murdoch University","host_organization_lineage":["https://openalex.org/I176790772"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Doctoral Thesis"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://researchportal.murdoch.edu.au/view/delivery/61MUN_INST/12136384490007891/13136909080007891","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5084579916","display_name":"Hudan Studiawan","orcid":"https://orcid.org/0000-0002-8884-6208","observed_orcids":["https://orcid.org/0000-0002-8884-6208"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Hudan Studiawan","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-8884-6208","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5084579916"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.736299991607666,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.736299991607666,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.1597999930381775,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.07779999822378159,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/log-based-anomaly-detection","display_name":"log anomaly detection","score":0.746999979019165},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"digital forensics","score":0.7950000166893005},{"id":"https://openalex.org/keywords/event-logs","display_name":"event logs","score":0.7239999771118164},{"id":"https://openalex.org/keywords/named-entity-recognition","display_name":"named entity recognition","score":0.9919999837875366},{"id":"https://openalex.org/keywords/bidirectional-lstm","display_name":"bidirectional LSTM","score":0.9039999842643738},{"id":"https://openalex.org/keywords/deep-autoencoder","display_name":"deep autoencoder","score":0.8420000076293945},{"id":"https://openalex.org/keywords/baseline-model","display_name":"baseline model","score":0.6019999980926514},{"id":"https://openalex.org/keywords/attention-mechanism","display_name":"attention mechanism","score":0.7480000257492065},{"id":"https://openalex.org/keywords/gated-recurrent-unit","display_name":"gated recurrent unit","score":0.972000002861023},{"id":"https://openalex.org/keywords/class-imbalance","display_name":"class imbalance","score":0.8840000033378601},{"id":"https://openalex.org/keywords/tomek-links","display_name":"Tomek links","score":0.9110000133514404},{"id":"https://openalex.org/keywords/weighted-majority-voting","display_name":"weighted majority voting","score":0.5899999737739563}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.806648313999176},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7434514760971069},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.6505814790725708},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.6147599220275879},{"id":"https://openalex.org/C4438859","wikidata":"https://www.wikidata.org/wiki/Q186117","display_name":"Timeline","level":2,"score":0.5623762607574463},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5241087675094604},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5108194351196289},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5037321448326111},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4925268590450287},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.43424057960510254},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.41343969106674194},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C111368507","wikidata":"https://www.wikidata.org/wiki/Q43518","display_name":"Oceanography","level":1,"score":0.0},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:alma.61MUN_INST:11136384500007891","doi":null,"is_oa":true,"landing_page_url":"https://researchportal.murdoch.edu.au/esploro/outputs/doctoral/Forensic-investigation-of-event-logs-by/991005544419807891","pdf_url":"https://researchportal.murdoch.edu.au/view/delivery/61MUN_INST/12136384490007891/13136909080007891","source":{"id":"https://openalex.org/S4306400274","display_name":"Murdoch University Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I176790772","host_organization_name":"Murdoch University","host_organization_lineage":["https://openalex.org/I176790772"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Doctoral Thesis"},{"id":"pmh:oai:researchrepository.murdoch.edu.au:59418","doi":null,"is_oa":true,"landing_page_url":"https://researchrepository.murdoch.edu.au/id/eprint/59418/","pdf_url":"https://researchrepository.murdoch.edu.au/id/eprint/59418/","source":{"id":"https://openalex.org/S4306400274","display_name":"Murdoch University Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I176790772","host_organization_name":"Murdoch University","host_organization_lineage":["https://openalex.org/I176790772"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Studiawan, Hudan <https://researchrepository.murdoch.edu.au/view/author/Studiawan, Hudan.html> (2020) Forensic investigation of event logs by automatic anomaly detection. PhD thesis, Murdoch University.","raw_type":"Thesis"},{"id":"mag:3125086909","doi":null,"is_oa":false,"landing_page_url":"https://researchrepository.murdoch.edu.au/id/eprint/59418/","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":{"id":"pmh:oai:alma.61MUN_INST:11136384500007891","doi":null,"is_oa":true,"landing_page_url":"https://researchportal.murdoch.edu.au/esploro/outputs/doctoral/Forensic-investigation-of-event-logs-by/991005544419807891","pdf_url":"https://researchportal.murdoch.edu.au/view/delivery/61MUN_INST/12136384490007891/13136909080007891","source":{"id":"https://openalex.org/S4306400274","display_name":"Murdoch University Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I176790772","host_organization_name":"Murdoch University","host_organization_lineage":["https://openalex.org/I176790772"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Doctoral Thesis"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320320989","display_name":"Murdoch University","ror":"https://ror.org/00r4sry34"},{"id":"https://openalex.org/F4320328515","display_name":"Lembaga Pengelola Dana Pendidikan","ror":"https://ror.org/05p2xef58"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3125086909.pdf","grobid_xml":"https://content.openalex.org/works/W3125086909.grobid-xml"},"referenced_works_count":218,"referenced_works":["https://openalex.org/W3770943","https://openalex.org/W36102565","https://openalex.org/W75201279","https://openalex.org/W116395549","https://openalex.org/W141761747","https://openalex.org/W142212369","https://openalex.org/W218419718","https://openalex.org/W236656208","https://openalex.org/W323337097","https://openalex.org/W1202984889","https://openalex.org/W1493490255","https://openalex.org/W1515124366","https://openalex.org/W1521626219","https://openalex.org/W1536954562","https://openalex.org/W1550275899","https://openalex.org/W1559870885","https://openalex.org/W1568587784","https://openalex.org/W1573412770","https://openalex.org/W1597710132","https://openalex.org/W1661413208","https://openalex.org/W1757283378","https://openalex.org/W1863678861","https://openalex.org/W1885648011","https://openalex.org/W1962096123","https://openalex.org/W1970199874","https://openalex.org/W1970399788","https://openalex.org/W1971421925","https://openalex.org/W1974552315","https://openalex.org/W1975705975","https://openalex.org/W1976107019","https://openalex.org/W1978495386","https://openalex.org/W1978833744","https://openalex.org/W1982353393","https://openalex.org/W1983345514","https://openalex.org/W1987593503","https://openalex.org/W1988570914","https://openalex.org/W1988932279","https://openalex.org/W1990089904","https://openalex.org/W1990439076","https://openalex.org/W1991300505","https://openalex.org/W1992607645","https://openalex.org/W1992758609","https://openalex.org/W1994418559","https://openalex.org/W1994471836","https://openalex.org/W1994625872","https://openalex.org/W1996087560","https://openalex.org/W1999100894","https://openalex.org/W2000339673","https://openalex.org/W2004013580","https://openalex.org/W2005311637","https://openalex.org/W2005490178","https://openalex.org/W2008642148","https://openalex.org/W2009229022","https://openalex.org/W2009874870","https://openalex.org/W2012954690","https://openalex.org/W2014113877","https://openalex.org/W2015979301","https://openalex.org/W2018122138","https://openalex.org/W2020200118","https://openalex.org/W2022477494","https://openalex.org/W2024060531","https://openalex.org/W2025598241","https://openalex.org/W2026448611","https://openalex.org/W2026456060","https://openalex.org/W2028695285","https://openalex.org/W2029053829","https://openalex.org/W2031929387","https://openalex.org/W2037841959","https://openalex.org/W2039157918","https://openalex.org/W2043223258","https://openalex.org/W2049434052","https://openalex.org/W2049551352","https://openalex.org/W2051224630","https://openalex.org/W2053983842","https://openalex.org/W2056760934","https://openalex.org/W2057260173","https://openalex.org/W2059515884","https://openalex.org/W2064675550","https://openalex.org/W2065339563","https://openalex.org/W2065925699","https://openalex.org/W2074598427","https://openalex.org/W2076342816","https://openalex.org/W2076980798","https://openalex.org/W2084221733","https://openalex.org/W2084718378","https://openalex.org/W2085487226","https://openalex.org/W2094124237","https://openalex.org/W2094924503","https://openalex.org/W2095065082","https://openalex.org/W2096793442","https://openalex.org/W2098695822","https://openalex.org/W2102632804","https://openalex.org/W2103295044","https://openalex.org/W2104518905","https://openalex.org/W2104841399","https://openalex.org/W2104933073","https://openalex.org/W2105454049","https://openalex.org/W2107878631","https://openalex.org/W2110485445","https://openalex.org/W2113997717","https://openalex.org/W2115056012","https://openalex.org/W2116007667","https://openalex.org/W2117503840","https://openalex.org/W2117592631","https://openalex.org/W2118978333","https://openalex.org/W2122646361","https://openalex.org/W2125910575","https://openalex.org/W2126806764","https://openalex.org/W2131148434","https://openalex.org/W2132022337","https://openalex.org/W2132775939","https://openalex.org/W2135432543","https://openalex.org/W2136135923","https://openalex.org/W2137466468","https://openalex.org/W2140336868","https://openalex.org/W2141041105","https://openalex.org/W2142486663","https://openalex.org/W2142804492","https://openalex.org/W2143318444","https://openalex.org/W2144012961","https://openalex.org/W2144287717","https://openalex.org/W2144429239","https://openalex.org/W2144578941","https://openalex.org/W2146659008","https://openalex.org/W2146758771","https://openalex.org/W2148143831","https://openalex.org/W2150913437","https://openalex.org/W2151164148","https://openalex.org/W2152546002","https://openalex.org/W2152943117","https://openalex.org/W2153470728","https://openalex.org/W2157331557","https://openalex.org/W2158529366","https://openalex.org/W2158880761","https://openalex.org/W2159447717","https://openalex.org/W2159784400","https://openalex.org/W2160660844","https://openalex.org/W2166706824","https://openalex.org/W2167017180","https://openalex.org/W2167338201","https://openalex.org/W2167482691","https://openalex.org/W2171689381","https://openalex.org/W2179519966","https://openalex.org/W2208211896","https://openalex.org/W2250539671","https://openalex.org/W2251648804","https://openalex.org/W2251805006","https://openalex.org/W2251939518","https://openalex.org/W2252215182","https://openalex.org/W2278030425","https://openalex.org/W2295245052","https://openalex.org/W2296283641","https://openalex.org/W2296719434","https://openalex.org/W2318029894","https://openalex.org/W2362941995","https://openalex.org/W2364045976","https://openalex.org/W2402144811","https://openalex.org/W2405753586","https://openalex.org/W2406986017","https://openalex.org/W2418976032","https://openalex.org/W2462696620","https://openalex.org/W2491717139","https://openalex.org/W2521200999","https://openalex.org/W2521362385","https://openalex.org/W2527994611","https://openalex.org/W2528185000","https://openalex.org/W2529471236","https://openalex.org/W2532953905","https://openalex.org/W2533982999","https://openalex.org/W2536393303","https://openalex.org/W2553353603","https://openalex.org/W2561270329","https://openalex.org/W2573359540","https://openalex.org/W2583394428","https://openalex.org/W2583874385","https://openalex.org/W2584429674","https://openalex.org/W2586033114","https://openalex.org/W2599127130","https://openalex.org/W2606347107","https://openalex.org/W2609130030","https://openalex.org/W2610458965","https://openalex.org/W2611828818","https://openalex.org/W2615752844","https://openalex.org/W2618350051","https://openalex.org/W2691976780","https://openalex.org/W2734718015","https://openalex.org/W2741435508","https://openalex.org/W2742353928","https://openalex.org/W2743596624","https://openalex.org/W2767094836","https://openalex.org/W2775696952","https://openalex.org/W2785483921","https://openalex.org/W2789190634","https://openalex.org/W2792645615","https://openalex.org/W2799004609","https://openalex.org/W2799090750","https://openalex.org/W2808359105","https://openalex.org/W2884745705","https://openalex.org/W2887730984","https://openalex.org/W2903655746","https://openalex.org/W2908104715","https://openalex.org/W2911369068","https://openalex.org/W2913070219","https://openalex.org/W2919324643","https://openalex.org/W2930430940","https://openalex.org/W2942788380","https://openalex.org/W2962796276","https://openalex.org/W2963351448","https://openalex.org/W2963644868","https://openalex.org/W2963999143","https://openalex.org/W2964121744","https://openalex.org/W3003705911","https://openalex.org/W3013748100","https://openalex.org/W3033087763","https://openalex.org/W3082952036","https://openalex.org/W3102287432","https://openalex.org/W4245050711","https://openalex.org/W4301519367"],"related_works":["https://openalex.org/W3211131406","https://openalex.org/W2610458965","https://openalex.org/W3099104041","https://openalex.org/W4200415345","https://openalex.org/W2767094836","https://openalex.org/W7045524638","https://openalex.org/W4292968359","https://openalex.org/W7169683752","https://openalex.org/W2951106759","https://openalex.org/W4404688251"],"abstract_inverted_index":{"Attacks":[0],"on":[1,135],"an":[2,41,56,68,166],"operating":[3],"system":[4],"have":[5],"become":[6],"a":[7,50,59,83,94,121,162],"significant":[8],"and":[9,93,169],"increasingly":[10],"common":[11],"problem.This":[12],"type":[13],"of":[14,118],"security":[15],"incident":[16],"is":[17,37,72,86,104,128,132],"recorded":[18],"in":[19,58,165,191],"forensic":[20,60],"artifacts,":[21],"such":[22,34],"as":[23,88,115],"log":[24,64,70,108],"files.Forensic":[25],"investigators":[26,77],"will":[27],"generally":[28],"examine":[29],"the":[30,46,76,99,116,119,136,141,155,184],"logs":[31],"to":[32,40,44,53,81,106,153,157,160,170,182],"analyze":[33],"incidents.An":[35],"anomaly":[36,57,126,130],"highly":[38],"correlated":[39],"attacker's":[42],"attempts":[43],"compromise":[45],"system.This":[47],"thesis":[48,110],"proposes":[49,111],"novel":[51,163],"framework":[52],"automatically":[54],"detect":[55],"timeline":[61],"constructed":[62],"from":[63,140],"files.Before":[65],"identifying":[66],"anomalies,":[67],"automatic":[69,124],"parser":[71],"built":[73],"so":[74],"that":[75,173],"do":[78],"not":[79],"need":[80],"define":[82],"rule-based":[84],"parser.Parsing":[85],"modeled":[87],"named":[89],"entity":[90],"recognition":[91],"problem":[92],"deep":[95],"learning":[96],"technique,":[97],"namely":[98],"bidirectional":[100],"long":[101],"short-term":[102],"memory,":[103],"exploited":[105],"parse":[107],"entries.This":[109],"three":[112],"major":[113],"methods":[114],"base":[117],"framework.First,":[120],"method":[122],"for":[123,177,189],"cluster-based":[125],"detection":[127],"proposed.The":[129],"decision":[131],"made":[133],"based":[134],"estimated":[137],"threshold":[138],"derived":[139],"clustering":[142],"results.It":[143],"considers":[144],"several":[145],"A/Prof.Ferdous":[146],"has":[147],"provided":[148],"incredible":[149],"support":[150],"assisting":[151],"me":[152,181],"manage":[154],"research,":[156],"understand":[158],"how":[159],"propose":[161],"idea":[164],"academic":[167],"paper,":[168],"write":[171],"papers":[172],"would":[174],"be":[175],"accepted":[176],"publication.Dr.":[178],"Christian":[179],"helped":[180],"develop":[183],"critical":[185],"thinking":[186],"skills":[187],"required":[188],"research.Back":[190],"2016,":[192],"when":[193],"no":[194],"one":[195]},"counts_by_year":[{"year":2024,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2021-02-01T00:00:00"}