{"id":"https://openalex.org/W7167928825","doi":"https://doi.org/10.1007/s10207-026-01294-2","title":"Reproducibility in event-log research: a parametrised generator and benchmark for event-based signatures","display_name":"Reproducibility in event-log research: a parametrised generator and benchmark for event-based signatures","publication_year":2026,"publication_date":"2026-07-10","ids":{"openalex":"https://openalex.org/W7167928825","doi":"https://doi.org/10.1007/s10207-026-01294-2"},"language":"en","primary_location":{"id":"doi:10.1007/s10207-026-01294-2","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-026-01294-2","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-026-01294-2.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10207-026-01294-2.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5140393754","display_name":"Saad Khan","orcid":null},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Saad Khan","raw_affiliation_strings":["Department of Computer Science, University of Huddersfield, Queensgate, Huddersfield, HD1 3DH, West Yorkshire, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Huddersfield, Queensgate, Huddersfield, HD1 3DH, West Yorkshire, UK","institution_ids":["https://openalex.org/I133837150"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037686924","display_name":"Simon Parkinson","orcid":"https://orcid.org/0000-0002-1747-9914"},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Simon Parkinson","raw_affiliation_strings":["Department of Computer Science, University of Huddersfield, Queensgate, Huddersfield, HD1 3DH, West Yorkshire, UK"],"raw_orcid":"https://orcid.org/0000-0002-1747-9914","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Huddersfield, Queensgate, Huddersfield, HD1 3DH, West Yorkshire, UK","institution_ids":["https://openalex.org/I133837150"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5087829338","display_name":"Monika Roopak","orcid":"https://orcid.org/0000-0002-3654-6035"},"institutions":[{"id":"https://openalex.org/I147554453","display_name":"University of Bedfordshire","ror":"https://ror.org/0400avk24","country_code":"GB","type":"education","lineage":["https://openalex.org/I147554453"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Monika Roopak","raw_affiliation_strings":["School of Science and Technology, University of Bedfordshire, Luton, LU1 3JU, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Science and Technology, University of Bedfordshire, Luton, LU1 3JU, UK","institution_ids":["https://openalex.org/I147554453"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5037686924"],"corresponding_institution_ids":["https://openalex.org/I133837150"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.86780527,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"25","issue":"4","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.5824000239372253,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.5824000239372253,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.09480000287294388,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.02969999983906746,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/benchmarking","display_name":"Benchmarking","score":0.8694999814033508},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.857200026512146},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.6933000087738037},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6697999835014343},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.6230999827384949},{"id":"https://openalex.org/keywords/signature","display_name":"Signature (topology)","score":0.5475999712944031},{"id":"https://openalex.org/keywords/generator","display_name":"Generator (circuit theory)","score":0.5296000242233276},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.3763999938964844}],"concepts":[{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.8694999814033508},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8636000156402588},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.857200026512146},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.6933000087738037},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6697999835014343},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6230999827384949},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6225000023841858},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.5475999712944031},{"id":"https://openalex.org/C2780992000","wikidata":"https://www.wikidata.org/wiki/Q17016113","display_name":"Generator (circuit theory)","level":3,"score":0.5296000242233276},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3847000002861023},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3763999938964844},{"id":"https://openalex.org/C20556612","wikidata":"https://www.wikidata.org/wiki/Q4469374","display_name":"Volume (thermodynamics)","level":2,"score":0.34540000557899475},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.33090001344680786},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32760000228881836},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.30959999561309814},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.29179999232292175},{"id":"https://openalex.org/C92446256","wikidata":"https://www.wikidata.org/wiki/Q3306762","display_name":"Data validation","level":2,"score":0.2874000072479248},{"id":"https://openalex.org/C2777382242","wikidata":"https://www.wikidata.org/wiki/Q6017816","display_name":"Index (typography)","level":2,"score":0.28189998865127563},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2800999879837036},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.26660001277923584},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.26440000534057617},{"id":"https://openalex.org/C111442797","wikidata":"https://www.wikidata.org/wiki/Q7291446","display_name":"Rand index","level":3,"score":0.26179999113082886},{"id":"https://openalex.org/C2778135862","wikidata":"https://www.wikidata.org/wiki/Q5416719","display_name":"Event monitoring","level":3,"score":0.2567000091075897},{"id":"https://openalex.org/C2775928411","wikidata":"https://www.wikidata.org/wiki/Q2041312","display_name":"Fault injection","level":3,"score":0.25}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s10207-026-01294-2","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-026-01294-2","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-026-01294-2.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},{"id":"pmh:oai:pure.atira.dk:openaire/1d0a264f-c6ef-43d2-a987-8fb3b3fd6b9b","is_oa":true,"landing_page_url":"https://pure.hud.ac.uk/en/publications/1d0a264f-c6ef-43d2-a987-8fb3b3fd6b9b","pdf_url":null,"source":{"id":"https://openalex.org/S4306402508","display_name":"Huddersfield Research Portal (University of Huddersfield)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I133837150","host_organization_name":"University of Huddersfield","host_organization_lineage":["https://openalex.org/I133837150"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Khan, S, Parkinson, S & Roopak, M 2026, 'Reproducibility in event-log research : a parametrised generator and benchmark for event-based signatures', International Journal of Information Security, vol. 25, no. 4, 121. https://doi.org/10.1007/s10207-026-01294-2","raw_type":"info:eu-repo/semantics/publishedVersion"}],"best_oa_location":{"id":"doi:10.1007/s10207-026-01294-2","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-026-01294-2","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-026-01294-2.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320332972","display_name":"Defence Science and Technology Laboratory","ror":"https://ror.org/04jswqb94"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7167928825.pdf","grobid_xml":"https://content.openalex.org/works/W7167928825.grobid-xml"},"referenced_works_count":64,"referenced_works":["https://openalex.org/W1128809682","https://openalex.org/W2010719841","https://openalex.org/W2083560394","https://openalex.org/W2114600197","https://openalex.org/W2133649842","https://openalex.org/W2526226593","https://openalex.org/W2527994611","https://openalex.org/W2592745293","https://openalex.org/W2595779093","https://openalex.org/W2737324849","https://openalex.org/W2745899231","https://openalex.org/W2746170296","https://openalex.org/W2765279214","https://openalex.org/W2789436223","https://openalex.org/W2791751764","https://openalex.org/W2792581684","https://openalex.org/W2810689795","https://openalex.org/W2891432086","https://openalex.org/W2971290869","https://openalex.org/W2971791628","https://openalex.org/W2974504164","https://openalex.org/W2978182208","https://openalex.org/W2987485128","https://openalex.org/W3006669422","https://openalex.org/W3035943449","https://openalex.org/W3081633905","https://openalex.org/W3093476100","https://openalex.org/W3109671783","https://openalex.org/W3110435694","https://openalex.org/W3183219492","https://openalex.org/W3190222600","https://openalex.org/W3196917904","https://openalex.org/W3213679486","https://openalex.org/W4220880333","https://openalex.org/W4224295192","https://openalex.org/W4225596160","https://openalex.org/W4235169531","https://openalex.org/W4247105055","https://openalex.org/W4249088215","https://openalex.org/W4281784419","https://openalex.org/W4282049692","https://openalex.org/W4285218226","https://openalex.org/W4285401269","https://openalex.org/W4294837811","https://openalex.org/W4308081900","https://openalex.org/W4313644131","https://openalex.org/W4320915505","https://openalex.org/W4360971442","https://openalex.org/W4360974133","https://openalex.org/W4384563661","https://openalex.org/W4388212317","https://openalex.org/W4390741016","https://openalex.org/W4393158805","https://openalex.org/W4400582506","https://openalex.org/W4400681092","https://openalex.org/W4402101053","https://openalex.org/W4402170367","https://openalex.org/W4406206788","https://openalex.org/W4406552162","https://openalex.org/W4408008731","https://openalex.org/W4408673987","https://openalex.org/W4414079790","https://openalex.org/W4416826834","https://openalex.org/W6969518302"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"Event-based":[1],"datasets":[2,37,60,73,126],"are":[3,31,74],"crucial":[4],"for":[5,40,66,101,131],"cybersecurity":[6,179,188],"analysis.":[7],"A":[8],"key":[9],"use":[10],"case":[11],"is":[12,38],"detecting":[13],"event-based":[14,129],"signatures,":[15],"which":[16],"represent":[17],"attacks":[18],"spanning":[19],"multiple":[20],"events":[21,30],"and":[22,33,48,53,63,76,111,176,186],"can":[23],"only":[24],"be":[25],"understood":[26],"once":[27],"the":[28,135,138,150,170],"relevant":[29],"identified":[32],"linked.":[34],"Analysing":[35],"event":[36,103,125],"essential":[39],"monitoring":[41],"system":[42],"security,":[43],"but":[44],"their":[45],"growing":[46],"volume":[47],"frequency":[49],"create":[50],"significant":[51],"scalability":[52],"processing":[54],"difficulties.":[55],"Researchers":[56],"rely":[57],"on":[58,163],"these":[59],"to":[61,82,174,183],"develop":[62,175],"test":[64],"techniques":[65],"automatically":[67],"identifying":[68],"signatures.":[69],"However,":[70],"because":[71],"real":[72],"security-sensitive":[75],"rarely":[77],"shared,":[78],"it":[79],"becomes":[80],"difficult":[81],"perform":[83],"meaningful":[84],"comparative":[85],"evaluation":[86,94],"between":[87],"different":[88],"approaches.":[89],"This":[90,167],"work":[91,168],"addresses":[92],"this":[93],"limitation":[95],"by":[96],"offering":[97],"a":[98,116,142,155],"systematic":[99],"method":[100],"generating":[102],"logs":[104],"with":[105],"known":[106],"ground":[107],"truth,":[108],"enabling":[109],"reproducible":[110],"comparable":[112],"research.":[113],"We":[114],"present":[115],"novel":[117],"parametrised":[118],"generation":[119],"technique":[120],"capable":[121],"of":[122,137,152,172],"producing":[123],"synthetic":[124],"that":[127],"contain":[128],"signatures":[130],"discovery.":[132],"To":[133],"demonstrate":[134],"capabilities":[136],"technique,":[139],"we":[140],"provide":[141],"benchmark":[143,177],"in":[144],"signature":[145],"detection.":[146],"Our":[147],"benchmarking":[148],"demonstrated":[149],"suitability":[151],"DBSCAN,":[153],"achieving":[154],"score":[156],"greater":[157],"than":[158],"0.95":[159],"Adjusted":[160],"Rand":[161],"Index":[162],"most":[164],"generated":[165],"datasets.":[166],"enhances":[169],"ability":[171],"researchers":[173],"new":[178],"techniques,":[180],"ultimately":[181],"contributing":[182],"more":[184],"robust":[185],"effective":[187],"measures.":[189]},"counts_by_year":[],"updated_date":"2026-07-26T07:53:14.480251","created_date":"2026-07-11T00:00:00"}