{"id":"https://openalex.org/W2010326631","doi":"https://doi.org/10.1108/09593840910962186","title":"Developing expertise for network intrusion detection","display_name":"Developing expertise for network intrusion detection","publication_year":2009,"publication_date":"2009-05-23","ids":{"openalex":"https://openalex.org/W2010326631","doi":"https://doi.org/10.1108/09593840910962186","mag":"2010326631"},"language":"en","primary_location":{"id":"doi:10.1108/09593840910962186","is_oa":false,"landing_page_url":"https://doi.org/10.1108/09593840910962186","pdf_url":null,"source":{"id":"https://openalex.org/S185256354","display_name":"Information Technology and People","issn_l":"0959-3845","issn":["0959-3845","1758-5813"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information Technology & People","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5003251468","display_name":"John R. Goodall","orcid":"https://orcid.org/0000-0001-6810-4517"},"institutions":[{"id":"https://openalex.org/I4210151375","display_name":"Applied Visions (United States)","ror":"https://ror.org/04ntqmb28","country_code":"US","type":"company","lineage":["https://openalex.org/I4210151375"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"John R. Goodall","raw_affiliation_strings":["Secure Decisions Division, Applied Visions, Inc., Northport, New York, USA","(Secure Decisions Division, Applied Visions, Inc., Northport, New York, USA)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Secure Decisions Division, Applied Visions, Inc., Northport, New York, USA","institution_ids":["https://openalex.org/I4210151375"]},{"raw_affiliation_string":"(Secure Decisions Division, Applied Visions, Inc., Northport, New York, USA)","institution_ids":["https://openalex.org/I4210151375"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084223766","display_name":"Wayne G. Lutters","orcid":"https://orcid.org/0000-0003-4193-2114"},"institutions":[{"id":"https://openalex.org/I126744593","display_name":"University of Maryland, Baltimore","ror":"https://ror.org/04rq5mt64","country_code":"US","type":"education","lineage":["https://openalex.org/I126744593"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wayne G. Lutters","raw_affiliation_strings":["Department of Information Systems, University of Maryland, Baltimore, Maryland, USA","University of Maryland, Baltimore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Systems, University of Maryland, Baltimore, Maryland, USA","institution_ids":["https://openalex.org/I126744593"]},{"raw_affiliation_string":"University of Maryland, Baltimore","institution_ids":["https://openalex.org/I126744593"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082395187","display_name":"Anita Koml\u00f3di","orcid":"https://orcid.org/0000-0001-5303-8780"},"institutions":[{"id":"https://openalex.org/I126744593","display_name":"University of Maryland, Baltimore","ror":"https://ror.org/04rq5mt64","country_code":"US","type":"education","lineage":["https://openalex.org/I126744593"]},{"id":"https://openalex.org/I29770179","display_name":"Budapest University of Technology and Economics","ror":"https://ror.org/02w42ss30","country_code":"HU","type":"education","lineage":["https://openalex.org/I29770179"]}],"countries":["HU","US"],"is_corresponding":false,"raw_author_name":"Anita Komlodi","raw_affiliation_strings":["Department of Information Systems, University of Maryland, Baltimore, Maryland, USA","Budapest Univ. of Technology & Economics"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Systems, University of Maryland, Baltimore, Maryland, USA","institution_ids":["https://openalex.org/I126744593"]},{"raw_affiliation_string":"Budapest Univ. of Technology & Economics","institution_ids":["https://openalex.org/I29770179"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.6288,"has_fulltext":false,"cited_by_count":66,"citation_normalized_percentile":{"value":0.93123092,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"22","issue":"2","first_page":"92","last_page":"108"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9923999905586243,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.791396975517273},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6812185049057007},{"id":"https://openalex.org/keywords/situated","display_name":"Situated","score":0.5724543333053589},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.5604413151741028},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.5434021353721619},{"id":"https://openalex.org/keywords/originality","display_name":"Originality","score":0.4925287663936615},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.4765121042728424},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4457229673862457},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.43434882164001465},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.42579877376556396},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.41148820519447327},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.35583698749542236},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1292051076889038}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.791396975517273},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6812185049057007},{"id":"https://openalex.org/C132829578","wikidata":"https://www.wikidata.org/wiki/Q581151","display_name":"Situated","level":2,"score":0.5724543333053589},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.5604413151741028},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.5434021353721619},{"id":"https://openalex.org/C2776950860","wikidata":"https://www.wikidata.org/wiki/Q2914681","display_name":"Originality","level":3,"score":0.4925287663936615},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.4765121042728424},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4457229673862457},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.43434882164001465},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.42579877376556396},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.41148820519447327},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.35583698749542236},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1292051076889038},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C11012388","wikidata":"https://www.wikidata.org/wiki/Q170658","display_name":"Creativity","level":2,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1108/09593840910962186","is_oa":false,"landing_page_url":"https://doi.org/10.1108/09593840910962186","pdf_url":null,"source":{"id":"https://openalex.org/S185256354","display_name":"Information Technology and People","issn_l":"0959-3845","issn":["0959-3845","1758-5813"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information Technology & People","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W13534771","https://openalex.org/W333473489","https://openalex.org/W1532723534","https://openalex.org/W1579352316","https://openalex.org/W1606540910","https://openalex.org/W1658908529","https://openalex.org/W1674877186","https://openalex.org/W1751769270","https://openalex.org/W1967042038","https://openalex.org/W2020800662","https://openalex.org/W2021370805","https://openalex.org/W2049993890","https://openalex.org/W2062050646","https://openalex.org/W2064655388","https://openalex.org/W2065923278","https://openalex.org/W2084575249","https://openalex.org/W2092710282","https://openalex.org/W2101911705","https://openalex.org/W2116199508","https://openalex.org/W2118293831","https://openalex.org/W2131145879","https://openalex.org/W2133800002","https://openalex.org/W2151043139","https://openalex.org/W2153793823","https://openalex.org/W2161830378","https://openalex.org/W2326602587","https://openalex.org/W4245961435","https://openalex.org/W4285719527"],"related_works":["https://openalex.org/W2394374262","https://openalex.org/W2186207034","https://openalex.org/W2008125527","https://openalex.org/W1498285984","https://openalex.org/W2365498287","https://openalex.org/W2517190875","https://openalex.org/W2382434019","https://openalex.org/W4285814174","https://openalex.org/W3120973779","https://openalex.org/W2362367371"],"abstract_inverted_index":{"Purpose":[0],"The":[1,38,83,149,172,230],"paper":[2,124,231],"seeks":[3],"to":[4,44,130,188,220],"provide":[5,176],"a":[6,41,99,152,177,233],"foundational":[7],"understanding":[8,239],"of":[9,22,30,48,62,68,86,94,102,119,135,143,162,180,190,227],"the":[10,20,23,46,115,120,126,158,213,221],"socio\u2010technical":[11],"system":[12],"that":[13,108,142,184],"is":[14],"computer":[15,49,144],"network":[16,50],"intrusion":[17,51,87,163,191,228],"detection,":[18,164],"including":[19,58],"nature":[21],"knowledge":[24],"work,":[25],"situated":[26,103],"expertise,":[27],"and":[28,65,74,96,98,105,112,160,202],"processes":[29,218],"learning":[31,127],"as":[32],"supported":[33],"by":[34],"information":[35,69,168,195,199,224],"technology.":[36],"Design/methodology/approach":[37],"authors":[39],"conducted":[40],"field":[42],"study":[43],"explore":[45],"work":[47,84,139,214],"detection":[52,88,192],"using":[53],"multiple":[54],"data":[55],"collection":[56],"methods,":[57],"semi\u2010structured":[59],"interviews,":[60],"examination":[61,179],"security":[63,70,97,182,196,200,225],"tools":[64],"resources,":[66],"analysis":[67],"mailing":[71],"list":[72],"posts,":[73],"attendance":[75],"at":[76],"several":[77],"domain\u2010specific":[78],"user":[79],"group":[80],"meetings.":[81],"Findings":[82],"practice":[85,140,161,226],"analysts":[89],"involves":[90],"both":[91],"domain":[92,159],"expertise":[93,104,216],"networking":[95],"high":[100],"degree":[101],"problem\u2010solving":[106],"activities":[107],"are":[109],"not":[110],"predefined":[111],"evolve":[113],"with":[114,141],"dynamically":[116],"changing":[117],"context":[118],"analyst's":[121],"environment.":[122],"This":[123],"highlights":[125],"process":[128],"needed":[129],"acquire":[131],"these":[132],"two":[133],"types":[134],"knowledge,":[136],"contrasting":[137],"this":[138,240],"systems":[145],"administrators.":[146],"Research":[147],"limitations/implications":[148],"research":[150,156,211,237],"establishes":[151],"baseline":[153],"for":[154,203,235],"future":[155,236],"into":[157,238],"and,":[165],"more":[166],"broadly,":[167],"security.":[169],"Practical":[170],"implications":[171],"results":[173],"presented":[174],"here":[175],"critical":[178],"current":[181],"practices":[183],"will":[185],"be":[186],"useful":[187],"developers":[189],"support":[193],"tools,":[194],"training":[197],"programs,":[198],"management,":[201],"practitioners":[204],"themselves.":[205],"Originality/value":[206],"There":[207],"has":[208],"been":[209],"no":[210],"examining":[212],"or":[215],"development":[217],"specific":[219],"increasingly":[222],"important":[223],"detection.":[229],"provides":[232],"foundation":[234],"highly":[241],"complex,":[242],"dynamic":[243],"work.":[244]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":2},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":6},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":12},{"year":2017,"cited_by_count":8},{"year":2016,"cited_by_count":3},{"year":2015,"cited_by_count":5},{"year":2014,"cited_by_count":2},{"year":2013,"cited_by_count":2},{"year":2012,"cited_by_count":5}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}