{"id":"https://openalex.org/W2792297184","doi":"https://doi.org/10.1007/s11416-018-0318-x","title":"SEQUIN: a grammar inference framework for analyzing malicious system behavior","display_name":"SEQUIN: a grammar inference framework for analyzing malicious system behavior","publication_year":2018,"publication_date":"2018-03-26","ids":{"openalex":"https://openalex.org/W2792297184","doi":"https://doi.org/10.1007/s11416-018-0318-x","mag":"2792297184"},"language":"en","primary_location":{"id":"doi:10.1007/s11416-018-0318-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-018-0318-x","pdf_url":"https://link.springer.com/content/pdf/10.1007%2Fs11416-018-0318-x.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007%2Fs11416-018-0318-x.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086413609","display_name":"Robert Luh","orcid":"https://orcid.org/0000-0001-6536-6706"},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]},{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["AT","GB"],"is_corresponding":true,"raw_author_name":"Robert Luh","raw_affiliation_strings":["De Montfort University, Leicester, UK","Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":"https://orcid.org/0000-0001-6536-6706","affiliations":[{"raw_affiliation_string":"De Montfort University, Leicester, UK","institution_ids":["https://openalex.org/I66943878"]},{"raw_affiliation_string":"Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065156568","display_name":"Gregor Schramm","orcid":null},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Gregor Schramm","raw_affiliation_strings":["Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000928551","display_name":"Markus Wagner","orcid":"https://orcid.org/0000-0002-6619-6494"},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Markus Wagner","raw_affiliation_strings":["Institute for Creative Media Technologies, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute for Creative Media Technologies, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035745103","display_name":"Helge Janicke","orcid":"https://orcid.org/0000-0002-1345-2829"},"institutions":[{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Helge Janicke","raw_affiliation_strings":["De Montfort University, Leicester, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"De Montfort University, Leicester, UK","institution_ids":["https://openalex.org/I66943878"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5055367812","display_name":"Sebastian Schrittwieser","orcid":"https://orcid.org/0000-0003-2115-2022"},"institutions":[{"id":"https://openalex.org/I25485817","display_name":"University of Applied Sciences St P\u00f6lten","ror":"https://ror.org/039a2re55","country_code":"AT","type":"education","lineage":["https://openalex.org/I25485817"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Sebastian Schrittwieser","raw_affiliation_strings":["Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Josef Ressel Center TARGET, St. P\u00f6lten University of Applied Sciences, St. P\u00f6lten, Austria","institution_ids":["https://openalex.org/I25485817"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5086413609"],"corresponding_institution_ids":["https://openalex.org/I25485817","https://openalex.org/I66943878"],"apc_list":{"value":2990,"currency":"USD","value_usd":2990},"apc_paid":{"value":2990,"currency":"USD","value_usd":2990},"fwci":0.7871,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.71923621,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":97},"biblio":{"volume":"14","issue":"4","first_page":"291","last_page":"311"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9952999949455261,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.9120384454727173},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.6134099960327148},{"id":"https://openalex.org/keywords/grammar","display_name":"Grammar","score":0.6003769040107727},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5276269316673279},{"id":"https://openalex.org/keywords/string","display_name":"String (physics)","score":0.4992635250091553},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4583525061607361},{"id":"https://openalex.org/keywords/grammar-induction","display_name":"Grammar induction","score":0.4519902169704437},{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.4306790232658386},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.42898428440093994},{"id":"https://openalex.org/keywords/rule-based-machine-translation","display_name":"Rule-based machine translation","score":0.4188566207885742},{"id":"https://openalex.org/keywords/visualization","display_name":"Visualization","score":0.41088762879371643},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.3847751021385193},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3583570122718811},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.35390934348106384},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.12615573406219482}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9120384454727173},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.6134099960327148},{"id":"https://openalex.org/C26022165","wikidata":"https://www.wikidata.org/wiki/Q8091","display_name":"Grammar","level":2,"score":0.6003769040107727},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5276269316673279},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.4992635250091553},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4583525061607361},{"id":"https://openalex.org/C56601403","wikidata":"https://www.wikidata.org/wiki/Q5593673","display_name":"Grammar induction","level":3,"score":0.4519902169704437},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.4306790232658386},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.42898428440093994},{"id":"https://openalex.org/C53893814","wikidata":"https://www.wikidata.org/wiki/Q7378909","display_name":"Rule-based machine translation","level":2,"score":0.4188566207885742},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.41088762879371643},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3847751021385193},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3583570122718811},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.35390934348106384},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.12615573406219482},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s11416-018-0318-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-018-0318-x","pdf_url":"https://link.springer.com/content/pdf/10.1007%2Fs11416-018-0318-x.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},{"id":"pmh:oai:dora.dmu.ac.uk:2086/16131","is_oa":false,"landing_page_url":"http://hdl.handle.net/2086/16131","pdf_url":null,"source":{"id":"https://openalex.org/S4306400394","display_name":"DMU Open Research Archive (De Montfort University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I66943878","host_organization_name":"De Montfort University","host_organization_lineage":["https://openalex.org/I66943878"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article"}],"best_oa_location":{"id":"doi:10.1007/s11416-018-0318-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-018-0318-x","pdf_url":"https://link.springer.com/content/pdf/10.1007%2Fs11416-018-0318-x.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6600000262260437,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G3284068406","display_name":"KAVA-Time","funder_award_id":"P25489","funder_id":"https://openalex.org/F4320321181","funder_display_name":"Austrian Science Fund"}],"funders":[{"id":"https://openalex.org/F4320311813","display_name":"\u00d6sterreichische Nationalstiftung f\u00fcr Forschung, Technologie und Entwicklung","ror":"https://ror.org/04hb33h70"},{"id":"https://openalex.org/F4320321181","display_name":"Austrian Science Fund","ror":"https://ror.org/013tf3c58"},{"id":"https://openalex.org/F4320321896","display_name":"Bundesministerium f\u00fcr Wissenschaft, Forschung und Wirtschaft","ror":"https://ror.org/02d229b24"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2792297184.pdf","grobid_xml":"https://content.openalex.org/works/W2792297184.grobid-xml"},"referenced_works_count":63,"referenced_works":["https://openalex.org/W187473460","https://openalex.org/W192433963","https://openalex.org/W286869598","https://openalex.org/W1491178396","https://openalex.org/W1508113248","https://openalex.org/W1536482207","https://openalex.org/W1570974058","https://openalex.org/W1577544661","https://openalex.org/W1585280831","https://openalex.org/W1594453896","https://openalex.org/W1851403712","https://openalex.org/W1964459432","https://openalex.org/W1970569592","https://openalex.org/W1980937678","https://openalex.org/W1995945562","https://openalex.org/W1997222770","https://openalex.org/W1999880831","https://openalex.org/W2002586403","https://openalex.org/W2009875025","https://openalex.org/W2024657257","https://openalex.org/W2046432510","https://openalex.org/W2054658115","https://openalex.org/W2065890363","https://openalex.org/W2075038621","https://openalex.org/W2096373083","https://openalex.org/W2096589311","https://openalex.org/W2097121457","https://openalex.org/W2105304410","https://openalex.org/W2105686649","https://openalex.org/W2107889964","https://openalex.org/W2107993268","https://openalex.org/W2111046645","https://openalex.org/W2113075298","https://openalex.org/W2113641467","https://openalex.org/W2126415191","https://openalex.org/W2128614934","https://openalex.org/W2141880430","https://openalex.org/W2141955344","https://openalex.org/W2143296986","https://openalex.org/W2153256103","https://openalex.org/W2163568299","https://openalex.org/W2167240430","https://openalex.org/W2167983404","https://openalex.org/W2184822694","https://openalex.org/W2216444195","https://openalex.org/W2222512263","https://openalex.org/W2330930600","https://openalex.org/W2343885978","https://openalex.org/W2346127545","https://openalex.org/W2406760356","https://openalex.org/W2532636001","https://openalex.org/W2582697902","https://openalex.org/W2583683552","https://openalex.org/W2588184971","https://openalex.org/W2591824344","https://openalex.org/W2593280875","https://openalex.org/W2789150702","https://openalex.org/W2797563284","https://openalex.org/W4230960895","https://openalex.org/W4242451260","https://openalex.org/W4243646542","https://openalex.org/W4246656656","https://openalex.org/W4253654031"],"related_works":["https://openalex.org/W2959616428","https://openalex.org/W123468065","https://openalex.org/W1517025915","https://openalex.org/W4237776144","https://openalex.org/W1974236250","https://openalex.org/W3144287057","https://openalex.org/W2170837769","https://openalex.org/W1487802415","https://openalex.org/W2026740477","https://openalex.org/W1964225978"],"abstract_inverted_index":{"Targeted":[0],"attacks":[1,38],"on":[2,87],"IT":[3],"systems":[4],"are":[5],"a":[6,57,82,94],"rising":[7],"threat":[8],"to":[9,31,41,104],"the":[10,16,34,61,73,88,110,129,147,152,159,167],"confidentiality":[11],"of":[12,18,23,36,64,77,117,132,141,166],"sensitive":[13],"data":[14],"and":[15,75,123,144],"availability":[17],"critical":[19],"systems.":[20],"The":[21],"emergence":[22],"Advanced":[24],"Persistent":[25],"Threats":[26],"(APTs)":[27],"made":[28],"it":[29],"paramount":[30],"fully":[32],"understand":[33],"particulars":[35],"such":[37],"in":[39,138],"order":[40],"improve":[42],"or":[43,135],"devise":[44],"effective":[45],"defense":[46],"mechanisms.":[47],"Grammar":[48],"inference":[49,84],"paired":[50],"with":[51,119,154],"visual":[52],"analytics":[53],"(VA)":[54],"techniques":[55],"offers":[56],"powerful":[58],"foundation":[59],"for":[60],"automated":[62,113,126],"extraction":[63],"behavioral":[65],"patterns":[66,137],"from":[67,98],"sequential":[68,139],"event":[69],"traces.":[70],"To":[71],"facilitate":[72],"interpretation":[74],"analysis":[76],"APTs,":[78],"we":[79,108,150],"present":[80],"SEQUIN,":[81],"grammar":[83,96],"system":[85],"based":[86],"Sequitur":[89],"compression":[90],"algorithm":[91],"that":[92,156],"constructs":[93],"context-free":[95],"(CFG)":[97],"string-based":[99],"input":[100,121],"data.":[101],"In":[102],"addition":[103],"recursive":[105],"rule":[106],"extraction,":[107],"expanded":[109],"procedure":[111],"through":[112],"assessment":[114,127],"routines":[115],"capable":[116],"dealing":[118],"multiple":[120],"sources":[122],"types.":[124],"This":[125],"enables":[128],"accurate":[130],"identification":[131],"interesting":[133],"frequent":[134],"anomalous":[136],"corpora":[140],"arbitrary":[142],"quantity":[143],"origin.":[145],"On":[146],"formal":[148],"side,":[149],"extended":[151],"CFG":[153],"attributes":[155],"help":[157],"describe":[158],"extracted":[160],"(malicious)":[161],"actions.":[162],"Discovery-focused":[163],"pattern":[164],"visualization":[165],"output":[168],"is":[169],"provided":[170],"by":[171],"our":[172],"dedicated":[173],"KAMAS":[174],"VA":[175],"prototype.":[176]},"counts_by_year":[{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":2},{"year":2019,"cited_by_count":3}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}