{"id":"https://openalex.org/W4317042585","doi":"https://doi.org/10.1007/s11227-023-05049-x","title":"An ensemble-based framework for user behaviour anomaly detection and classification for cybersecurity","display_name":"An ensemble-based framework for user behaviour anomaly detection and classification for cybersecurity","publication_year":2023,"publication_date":"2023-01-17","ids":{"openalex":"https://openalex.org/W4317042585","doi":"https://doi.org/10.1007/s11227-023-05049-x"},"language":"en","primary_location":{"id":"doi:10.1007/s11227-023-05049-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11227-023-05049-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11227-023-05049-x.pdf","source":{"id":"https://openalex.org/S32326811","display_name":"The Journal of Supercomputing","issn_l":"0920-8542","issn":["0920-8542","1573-0484"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Journal of Supercomputing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11227-023-05049-x.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5013173651","display_name":"Gianluigi Folino","orcid":"https://orcid.org/0000-0002-8139-3445"},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Gianluigi Folino","raw_affiliation_strings":["Department ICAR-CNR, via Bucci 7-9C, 87036, Rende, CS, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department ICAR-CNR, via Bucci 7-9C, 87036, Rende, CS, Italy","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084097625","display_name":"Carla Otranto Godano","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Carla Otranto Godano","raw_affiliation_strings":["HFactor Security, 87036, Rende, CS, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"HFactor Security, 87036, Rende, CS, Italy","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089644793","display_name":"Francesco Sergio Pisani","orcid":"https://orcid.org/0000-0003-2922-0835"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Francesco Sergio Pisani","raw_affiliation_strings":["Department ICAR-CNR, via Bucci 7-9C, 87036, Rende, CS, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department ICAR-CNR, via Bucci 7-9C, 87036, Rende, CS, Italy","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5013173651"],"corresponding_institution_ids":[],"apc_list":{"value":3290,"currency":"USD","value_usd":3290},"apc_paid":{"value":3290,"currency":"USD","value_usd":3290},"fwci":3.9007,"has_fulltext":true,"cited_by_count":29,"citation_normalized_percentile":{"value":0.9359369,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"79","issue":"11","first_page":"11660","last_page":"11683"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8771278858184814},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6335220336914062},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5465081930160522},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.5408315062522888},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5235949754714966},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.5171241760253906},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.44318196177482605},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.1793757677078247},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.15399852395057678}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8771278858184814},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6335220336914062},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5465081930160522},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.5408315062522888},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5235949754714966},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.5171241760253906},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.44318196177482605},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1793757677078247},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.15399852395057678},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s11227-023-05049-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11227-023-05049-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11227-023-05049-x.pdf","source":{"id":"https://openalex.org/S32326811","display_name":"The Journal of Supercomputing","issn_l":"0920-8542","issn":["0920-8542","1573-0484"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Journal of Supercomputing","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s11227-023-05049-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11227-023-05049-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11227-023-05049-x.pdf","source":{"id":"https://openalex.org/S32326811","display_name":"The Journal of Supercomputing","issn_l":"0920-8542","issn":["0920-8542","1573-0484"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Journal of Supercomputing","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320322651","display_name":"Consiglio Nazionale delle Ricerche","ror":"https://ror.org/04zaypm56"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4317042585.pdf","grobid_xml":"https://content.openalex.org/works/W4317042585.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W191357336","https://openalex.org/W1514920417","https://openalex.org/W2017735590","https://openalex.org/W2046704354","https://openalex.org/W2108628477","https://openalex.org/W2115804797","https://openalex.org/W2136040021","https://openalex.org/W2278186031","https://openalex.org/W2296738570","https://openalex.org/W2313407065","https://openalex.org/W2410858171","https://openalex.org/W2432038293","https://openalex.org/W2797357146","https://openalex.org/W2900479030","https://openalex.org/W2976051608","https://openalex.org/W4205471456","https://openalex.org/W4212883601","https://openalex.org/W4224256928","https://openalex.org/W4226183870"],"related_works":["https://openalex.org/W3201228709","https://openalex.org/W2922354075","https://openalex.org/W4389157351","https://openalex.org/W4253977752","https://openalex.org/W2964829536","https://openalex.org/W3120595989","https://openalex.org/W4232561318","https://openalex.org/W2904586340","https://openalex.org/W3156953641","https://openalex.org/W3214090987"],"abstract_inverted_index":{"Abstract":[0],"Nowadays,":[1],"the":[2,5,40,69,80,121,124,130,143,163,178],"speed":[3],"of":[4,68,108,123,129,180],"user":[6,50,58,112,170],"and":[7,28,46,63,86,96,114,128,176],"application":[8],"logs":[9,59],"is":[10,15,34,53,98,139],"so":[11],"quick":[12],"that":[13],"it":[14,52],"almost":[16],"impossible":[17],"to":[18,55,84,110,141],"analyse":[19],"them":[20],"in":[21,90,117,166,169],"real":[22,91,118],"time":[23,92],"without":[24],"using":[25],"high-performance":[26],"systems":[27],"platforms.":[29],"In":[30,133],"cybersecurity,":[31],"human":[32],"behaviour":[33,113],"responsible":[35],"directly":[36],"or":[37,71],"indirectly":[38],"for":[39,100],"most":[41],"common":[42],"attacks":[43],"(i.e.":[44],"ransomware":[45],"phishing).":[47],"To":[48],"monitor":[49],"behaviour,":[51,171],"necessary":[54],"process":[56,85],"fast":[57],"coming":[60],"from":[61,93,151],"different":[62,94],"heterogeneous":[64],"sources,":[65],"having":[66],"part":[67],"data":[70,89,153,160,175],"some":[72],"entire":[73],"sources":[74],"missing.":[75],"A":[76],"framework":[77],"based":[78],"on":[79,157],"elastic":[81],"stack":[82],"(ELK)":[83],"store":[87],"log":[88],"users":[95,144],"applications":[97],"proposed":[99],"this":[101],"aim.":[102],"This":[103],"system":[104],"generates":[105],"an":[106],"ensemble":[107],"models":[109],"classify":[111,142],"detect":[115],"anomalies":[116,168],"time,":[119],"exploiting":[120,146],"advantages":[122],"ELK-based":[125],"software":[126],"architecture":[127],"Kubernetes":[131],"platform.":[132],"addition,":[134],"a":[135],"distributed":[136],"evolutionary":[137],"algorithm":[138],"used":[140],"by":[145],"their":[147],"digital":[148],"footprints":[149],"derived":[150],"many":[152],"sources.":[154],"Experiments":[155],"conducted":[156],"two":[158],"real-life":[159],"sets":[161],"verify":[162],"approach\u2019s":[164],"goodness":[165],"detecting":[167],"coping":[172],"with":[173],"missing":[174],"lowering":[177],"number":[179],"false":[181],"alarms.":[182]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":3}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}