{"id":"https://openalex.org/W55714864","doi":null,"title":"FIRESTORM: Exploring the Need for a Forensic Tool for Pattern Correlation in Windows NT Audit Logs","display_name":"FIRESTORM: Exploring the Need for a Forensic Tool for Pattern Correlation in Windows NT Audit Logs","publication_year":2002,"publication_date":"2002-01-01","ids":{"openalex":"https://openalex.org/W55714864","mag":"55714864"},"language":"en","primary_location":{"id":"mag:55714864","doi":null,"is_oa":false,"landing_page_url":"https://findanexpert.unimelb.edu.au/scholarlywork/253603-firestorm--exploring-the-need-for-a-forensic-tool-for-pattern-correlation-in-windows-nt-audit-logs","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5002573450","display_name":"Atif Ahmad","orcid":"https://orcid.org/0000-0002-8862-5755","observed_orcids":["https://orcid.org/0000-0002-8862-5755"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Atif Ahmad","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-8862-5755","affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5110692173","display_name":"A.B. Ruighaver","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"A.B. Ruighaver","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":95},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10799","display_name":"Data Visualization and Analytics","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1704","display_name":"Computer Graphics and Computer-Aided Design"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/firestorms","display_name":"firestorms","score":0.902999997138977},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"digital forensics","score":0.847000002861023},{"id":"https://openalex.org/keywords/windows-nt","display_name":"Windows NT","score":0.7059999704360962},{"id":"https://openalex.org/keywords/audit-logs","display_name":"audit logs","score":0.9769999980926514},{"id":"https://openalex.org/keywords/pattern-correlation","display_name":"pattern correlation","score":0.8610000014305115},{"id":"https://openalex.org/keywords/semantic-compression","display_name":"semantic compression","score":0.7710000276565552},{"id":"https://openalex.org/keywords/security-incident-analysis","display_name":"security incident analysis","score":0.7789999842643738},{"id":"https://openalex.org/keywords/forensic-tools","display_name":"forensic tools","score":0.6909999847412109},{"id":"https://openalex.org/keywords/log-visualization","display_name":"log visualization","score":0.3479999899864197}],"concepts":[{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.733777642250061},{"id":"https://openalex.org/C140505726","wikidata":"https://www.wikidata.org/wiki/Q495304","display_name":"Forensic science","level":2,"score":0.7094166278839111},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6092286109924316},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.6002615690231323},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.4304744303226471},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.34759247303009033},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27762559056282043},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.10239240527153015},{"id":"https://openalex.org/C42972112","wikidata":"https://www.wikidata.org/wiki/Q170201","display_name":"Veterinary medicine","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C187736073","wikidata":"https://www.wikidata.org/wiki/Q2920921","display_name":"Management","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"mag:55714864","doi":null,"is_oa":false,"landing_page_url":"https://findanexpert.unimelb.edu.au/scholarlywork/253603-firestorm--exploring-the-need-for-a-forensic-tool-for-pattern-correlation-in-windows-nt-audit-logs","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":5,"referenced_works":["https://openalex.org/W1516691786","https://openalex.org/W1548980824","https://openalex.org/W1614068708","https://openalex.org/W1922827592","https://openalex.org/W2124184151"],"related_works":["https://openalex.org/W2012954690","https://openalex.org/W2104841399","https://openalex.org/W2083137491","https://openalex.org/W2076980798","https://openalex.org/W2389203509","https://openalex.org/W2384208514","https://openalex.org/W7166024962","https://openalex.org/W567729968","https://openalex.org/W228428911","https://openalex.org/W2100362559"],"abstract_inverted_index":{"Computer":[0],"Forensic":[1],"investigators":[2,50],"have":[3,32,96,113],"traditionally":[4],"been":[5,24,97],"concentrating":[6],"on":[7,26],"the":[8,27,40,61,69,89,104],"extraction":[9],"of":[10,29,47,88,106],"evidence":[11],"from":[12],"confiscated":[13],"computer":[14,53],"systems":[15,30],"used":[16],"by":[17],"suspected":[18],"offenders.":[19],"Relatively":[20],"less":[21],"emphasis":[22],"has":[23],"placed":[25],"analysis":[28],"that":[31,95],"experienced":[33],"a":[34,72],"security":[35,54],"violation.":[36],"This":[37],"paper":[38],"discusses":[39],"need":[41,70],"for":[42,71],"new":[43,73],"forensic":[44,49,62,74],"tools":[45],"capable":[46],"assisting":[48],"in":[51,64,92],"analyzing":[52],"incidents.":[55],"In":[56],"an":[57,83],"effort":[58],"to":[59,85,102],"assist":[60],"investigator":[63,84],"this":[65,115],"process,":[66],"we":[67],"explore":[68],"tool,":[75],"FIRESTORM.":[76],"We":[77,112],"discuss":[78],"how":[79],"FIRESTORM":[80],"would":[81],"allow":[82],"compress":[86],"some":[87],"non-relevant":[90],"details":[91],"those":[93],"patterns":[94],"identified":[98],"as":[99],"possibly":[100],"relevant,":[101],"improve":[103],"visualizing":[105],"any":[107],"correlations":[108],"between":[109],"these":[110],"patterns.":[111],"called":[114],"technique":[116],"semantic":[117],"compression.":[118]},"counts_by_year":[{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":1},{"year":2012,"cited_by_count":1}],"updated_date":"2025-11-06T04:12:42.849631","created_date":"2016-06-24T00:00:00"}