{"id":"https://openalex.org/W3034563243","doi":"https://doi.org/10.1109/access.2020.3001374","title":"Featureless Discovery of Correlated and False Intrusion Alerts","display_name":"Featureless Discovery of Correlated and False Intrusion Alerts","publication_year":2020,"publication_date":"2020-01-01","ids":{"openalex":"https://openalex.org/W3034563243","doi":"https://doi.org/10.1109/access.2020.3001374","mag":"3034563243"},"language":"en","primary_location":{"id":"doi:10.1109/access.2020.3001374","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3001374","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09113304.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09113304.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5000067262","display_name":"Egon Kidmose","orcid":"https://orcid.org/0000-0003-0542-5334"},"institutions":[{"id":"https://openalex.org/I4210163995","display_name":"Lego (Denmark)","ror":"https://ror.org/04vx9dd09","country_code":"DK","type":"company","lineage":["https://openalex.org/I4210163995"]},{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Egon Kidmose","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, Aalborg \u00d8st, Denmark","LEGO System A/S, Billund, Denmark"],"raw_orcid":"https://orcid.org/0000-0003-0542-5334","affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, Aalborg \u00d8st, Denmark","institution_ids":["https://openalex.org/I891191580"]},{"raw_affiliation_string":"LEGO System A/S, Billund, Denmark","institution_ids":["https://openalex.org/I4210163995"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5055505636","display_name":"Matija Stevanovic","orcid":"https://orcid.org/0000-0002-9579-4901"},"institutions":[{"id":"https://openalex.org/I4210163995","display_name":"Lego (Denmark)","ror":"https://ror.org/04vx9dd09","country_code":"DK","type":"company","lineage":["https://openalex.org/I4210163995"]},{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Matija Stevanovic","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, Aalborg \u00d8st, Denmark","LEGO System A/S, Billund, Denmark"],"raw_orcid":"https://orcid.org/0000-0002-9579-4901","affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, Aalborg \u00d8st, Denmark","institution_ids":["https://openalex.org/I891191580"]},{"raw_affiliation_string":"LEGO System A/S, Billund, Denmark","institution_ids":["https://openalex.org/I4210163995"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060890210","display_name":"S\u00f8ren Brandbyge","orcid":"https://orcid.org/0000-0002-5745-6573"},"institutions":[{"id":"https://openalex.org/I4210163995","display_name":"Lego (Denmark)","ror":"https://ror.org/04vx9dd09","country_code":"DK","type":"company","lineage":["https://openalex.org/I4210163995"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Soren Brandbyge","raw_affiliation_strings":["LEGO System A/S, Billund, Denmark"],"raw_orcid":"https://orcid.org/0000-0002-5745-6573","affiliations":[{"raw_affiliation_string":"LEGO System A/S, Billund, Denmark","institution_ids":["https://openalex.org/I4210163995"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5034797912","display_name":"Jens Myrup Pedersen","orcid":"https://orcid.org/0000-0002-1903-2921"},"institutions":[{"id":"https://openalex.org/I891191580","display_name":"Aalborg University","ror":"https://ror.org/04m5j1k67","country_code":"DK","type":"education","lineage":["https://openalex.org/I891191580"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Jens M. Pedersen","raw_affiliation_strings":["Department of Electronic Systems, Aalborg University, Aalborg \u00d8st, Denmark"],"raw_orcid":"https://orcid.org/0000-0002-1903-2921","affiliations":[{"raw_affiliation_string":"Department of Electronic Systems, Aalborg University, Aalborg \u00d8st, Denmark","institution_ids":["https://openalex.org/I891191580"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.5363,"has_fulltext":true,"cited_by_count":13,"citation_normalized_percentile":{"value":0.70197138,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":98},"biblio":{"volume":"8","issue":null,"first_page":"108748","last_page":"108765"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.817063570022583},{"id":"https://openalex.org/keywords/feature-engineering","display_name":"Feature engineering","score":0.7741082906723022},{"id":"https://openalex.org/keywords/implementation","display_name":"Implementation","score":0.7406286001205444},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.7178439497947693},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6280051469802856},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.6075308322906494},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5485353469848633},{"id":"https://openalex.org/keywords/relevance","display_name":"Relevance (law)","score":0.5181554555892944},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.49330344796180725},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4921054244041443},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.41797545552253723},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.30621129274368286},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.24547237157821655},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.13275951147079468}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.817063570022583},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.7741082906723022},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.7406286001205444},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.7178439497947693},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6280051469802856},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.6075308322906494},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5485353469848633},{"id":"https://openalex.org/C158154518","wikidata":"https://www.wikidata.org/wiki/Q7310970","display_name":"Relevance (law)","level":2,"score":0.5181554555892944},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.49330344796180725},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4921054244041443},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.41797545552253723},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30621129274368286},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.24547237157821655},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.13275951147079468},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/access.2020.3001374","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3001374","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09113304.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:pure.atira.dk:publications/48411b4b-adc9-4dd6-8a1a-81b25a053cd4","is_oa":true,"landing_page_url":"https://vbn.aau.dk/da/publications/48411b4b-adc9-4dd6-8a1a-81b25a053cd4","pdf_url":"https://vbn.aau.dk/ws/files/335849967/09113304.pdf","source":{"id":"https://openalex.org/S4306401731","display_name":"VBN Forskningsportal (Aalborg Universitet)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I891191580","host_organization_name":"Aalborg University","host_organization_lineage":["https://openalex.org/I891191580"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Kidmose, E, Stevanovic, M, Brandbyge, S & Pedersen, J M 2020, 'Featureless discovery of correlated and false intrusion alerts', IEEE Access, vol. 8, 9113304, pp. 108748-108765. https://doi.org/10.1109/ACCESS.2020.3001374","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:doaj.org/article:5f83265c3b5a4251b391878e1200d862","is_oa":true,"landing_page_url":"https://doaj.org/article/5f83265c3b5a4251b391878e1200d862","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 8, Pp 108748-108765 (2020)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2020.3001374","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3001374","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09113304.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G8861387134","display_name":null,"funder_award_id":"5016-00018","funder_id":"https://openalex.org/F4320313796","funder_display_name":"Innovationsfonden"}],"funders":[{"id":"https://openalex.org/F4320313796","display_name":"Innovationsfonden","ror":"https://ror.org/00daj4111"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3034563243.pdf","grobid_xml":"https://content.openalex.org/works/W3034563243.grobid-xml"},"referenced_works_count":41,"referenced_works":["https://openalex.org/W109441098","https://openalex.org/W191098608","https://openalex.org/W313713733","https://openalex.org/W1495304983","https://openalex.org/W1516506771","https://openalex.org/W1554596310","https://openalex.org/W1583098994","https://openalex.org/W1605708511","https://openalex.org/W1674877186","https://openalex.org/W1775772884","https://openalex.org/W2017434035","https://openalex.org/W2031163547","https://openalex.org/W2046304221","https://openalex.org/W2057358937","https://openalex.org/W2077488147","https://openalex.org/W2099836119","https://openalex.org/W2100307718","https://openalex.org/W2108867737","https://openalex.org/W2158997610","https://openalex.org/W2163277533","https://openalex.org/W2171035369","https://openalex.org/W2171278097","https://openalex.org/W2172122080","https://openalex.org/W2251921768","https://openalex.org/W2344552164","https://openalex.org/W2406996511","https://openalex.org/W2466206609","https://openalex.org/W2584335703","https://openalex.org/W2789828921","https://openalex.org/W4231518042","https://openalex.org/W4388297464","https://openalex.org/W6604511647","https://openalex.org/W6607784307","https://openalex.org/W6633128530","https://openalex.org/W6634779276","https://openalex.org/W6637096788","https://openalex.org/W6638021444","https://openalex.org/W6691429666","https://openalex.org/W6703949738","https://openalex.org/W6713468891","https://openalex.org/W6719918161"],"related_works":["https://openalex.org/W2770234245","https://openalex.org/W96612179","https://openalex.org/W2097492617","https://openalex.org/W4229499248","https://openalex.org/W2566006169","https://openalex.org/W2753240997","https://openalex.org/W1567818861","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W3214491504"],"abstract_inverted_index":{"Malware":[0],"and":[1,29,64,78,98,111,122,137,149,161,167,201,237],"cyber-attacks":[2],"cause":[3],"substantial":[4,69,93],"damage":[5],"to":[6,36,177,218,228,239,242],"corporations.":[7],"A":[8],"common":[9,183],"countermeasure":[10],"is":[11,43],"Intrusion":[12],"Detection":[13],"Systems":[14],"(IDSs).":[15],"Unfortunately,":[16],"IDSs":[17],"typically":[18],"raise":[19],"many":[20],"alerts":[21,31,47,153],"on":[22,57,72,108,163,168,182,196],"a":[23,86,132,164,169],"single":[24],"incident,":[25],"with":[26,139,179],"redundant":[27],"information,":[28],"false":[30],"that":[32,46,106,142,187,233],"are":[33,48,159,175,205,234],"only":[34],"noise":[35],"analysts.":[37],"For":[38],"out-of-the-box":[39],"performance,":[40],"the":[41,73,116,140,209,213,219,243],"impact":[42,71],"so":[44],"large":[45],"of":[49,75,85,95,118,192,215,225],"limited":[50],"practical":[51,197,226],"use.":[52],"Existing":[53],"solutions":[54],"rely":[55],"heavily":[56],"domain":[58,109],"expertise,":[59,100],"in":[60,125],"feature":[61,81,112,147,189],"engineering":[62,82,113,148,190],"procedures":[63],"explicit":[65],"algorithms.":[66],"This":[67],"has":[68],"negative":[70],"costs":[74],"development,":[76],"deployment,":[77,216],"maintenance.":[79],"Using":[80],"as":[83,154],"part":[84],"method":[87],"boosts":[88],"classification":[89],"metrics,":[90,185],"but":[91],"requires":[92],"investment,":[94],"data":[96,171],"science":[97],"security":[99],"for":[101,135,199],"each":[102],"deployment.":[103],"We":[104],"find":[105,223],"reliance":[107],"expertise":[110],"severely":[114],"inhibits":[115],"feasibility":[117],"applying":[119],"existing":[120,180,244],"correlation":[121],"filtering":[123,200],"methods":[124,143,150,181],"practice.":[126],"To":[127],"address":[128],"this,":[129],"we":[130,222],"propose":[131],"novel":[133],"approach":[134],"correlating":[136],"filtering,":[138],"constraints":[141],"must":[144,151],"be":[145],"without":[146],"consume":[152],"text":[155],"strings.":[156],"Two":[157],"implementations":[158,174,204],"presented":[160],"evaluated":[162],"partly":[165],"private":[166],"public":[170],"set.":[172],"Our":[173],"unable":[176],"compete":[178],"detection":[184],"suggesting":[186],"investing":[188],"pays":[191],"towards":[193],"those.":[194],"Measured":[195],"metrics":[198],"correlating,":[202],"our":[203],"promising,":[206],"while":[207],"at":[208],"same":[210],"time":[211],"cutting":[212],"cost":[214],"according":[217],"constraints.":[220],"Consequently,":[221],"it":[224],"relevance":[227],"consider":[229],"methods,":[230],"like":[231],"ours,":[232],"much":[235],"easier":[236],"cheaper":[238],"deploy,":[240],"compared":[241],"ones.":[245]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":2},{"year":2021,"cited_by_count":2}],"updated_date":"2026-07-20T07:56:41.581041","created_date":"2025-10-10T00:00:00"}