{"id":"https://openalex.org/W4309675214","doi":"https://doi.org/10.1109/cns56114.2022.9947246","title":"An Active Learning Approach to Dynamic Alert Prioritization for Real-time Situational Awareness","display_name":"An Active Learning Approach to Dynamic Alert Prioritization for Real-time Situational Awareness","publication_year":2022,"publication_date":"2022-10-03","ids":{"openalex":"https://openalex.org/W4309675214","doi":"https://doi.org/10.1109/cns56114.2022.9947246"},"language":"en","primary_location":{"id":"doi:10.1109/cns56114.2022.9947246","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns56114.2022.9947246","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077076300","display_name":"Yeongwoo Kim","orcid":"https://orcid.org/0009-0002-6228-9332"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Yeongwoo Kim","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology,Division of Network and Systems Engineering,Stockholm,Sweden","Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology,Division of Network and Systems Engineering,Stockholm,Sweden","institution_ids":["https://openalex.org/I86987016"]},{"raw_affiliation_string":"Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5086721943","display_name":"Gy\u00f6rgy D\u00e1n","orcid":"https://orcid.org/0000-0002-4876-0223"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Gyorgy Dan","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology,Division of Network and Systems Engineering,Stockholm,Sweden","Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology,Division of Network and Systems Engineering,Stockholm,Sweden","institution_ids":["https://openalex.org/I86987016"]},{"raw_affiliation_string":"Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I86987016"],"apc_list":null,"apc_paid":null,"fwci":1.6176,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.83340982,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"154","last_page":"162"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7765582799911499},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.7597737312316895},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.6595946550369263},{"id":"https://openalex.org/keywords/prioritization","display_name":"Prioritization","score":0.6308766007423401},{"id":"https://openalex.org/keywords/hidden-markov-model","display_name":"Hidden Markov model","score":0.5540934801101685},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.5521687865257263},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5171008110046387},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5144365429878235},{"id":"https://openalex.org/keywords/proxy","display_name":"Proxy (statistics)","score":0.4561249017715454},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.4546142816543579},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.42524483799934387},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4035138487815857},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.38958555459976196},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.34309154748916626},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.11110866069793701}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7765582799911499},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.7597737312316895},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.6595946550369263},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.6308766007423401},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.5540934801101685},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.5521687865257263},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5171008110046387},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5144365429878235},{"id":"https://openalex.org/C2780148112","wikidata":"https://www.wikidata.org/wiki/Q1432581","display_name":"Proxy (statistics)","level":2,"score":0.4561249017715454},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.4546142816543579},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42524483799934387},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4035138487815857},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.38958555459976196},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.34309154748916626},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.11110866069793701},{"id":"https://openalex.org/C146978453","wikidata":"https://www.wikidata.org/wiki/Q3798668","display_name":"Aerospace engineering","level":1,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C111368507","wikidata":"https://www.wikidata.org/wiki/Q43518","display_name":"Oceanography","level":1,"score":0.0},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cns56114.2022.9947246","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns56114.2022.9947246","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7900000214576721,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G406204845","display_name":"Resilienta n\u00e4tverkade system i fientliga milj\u00f6er","funder_award_id":"2020-03860","funder_id":"https://openalex.org/F4320322581","funder_display_name":"Vetenskapsr\u00e5det"},{"id":"https://openalex.org/G8600725529","display_name":"CLAS: Cybers\u00e4kra l\u00e4rande reglersystem","funder_award_id":"RIT17-0046","funder_id":"https://openalex.org/F4320320940","funder_display_name":"Stiftelsen f\u00f6r\u00a0Strategisk Forskning"}],"funders":[{"id":"https://openalex.org/F4320320940","display_name":"Stiftelsen f\u00f6r\u00a0Strategisk Forskning","ror":"https://ror.org/044wr7g58"},{"id":"https://openalex.org/F4320322581","display_name":"Vetenskapsr\u00e5det","ror":"https://ror.org/03zttf063"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W1995716850","https://openalex.org/W2120839938","https://openalex.org/W2146092999","https://openalex.org/W2146440914","https://openalex.org/W2337357805","https://openalex.org/W2520200210","https://openalex.org/W2522792437","https://openalex.org/W2739823785","https://openalex.org/W2760313715","https://openalex.org/W2792721951","https://openalex.org/W2802236629","https://openalex.org/W2907590737","https://openalex.org/W4248986893","https://openalex.org/W4249173680","https://openalex.org/W6703429934"],"related_works":["https://openalex.org/W2506292322","https://openalex.org/W2053269318","https://openalex.org/W2364370872","https://openalex.org/W4283209547","https://openalex.org/W2025614924","https://openalex.org/W2294335174","https://openalex.org/W2097963413","https://openalex.org/W3145575561","https://openalex.org/W2001275470","https://openalex.org/W2073996508"],"abstract_inverted_index":{"Real-time":[0],"situational":[1],"awareness":[2],"(SA)":[3],"plays":[4],"an":[5],"essential":[6],"role":[7],"in":[8,64],"accurate":[9],"and":[10,33,95,158,167],"timely":[11],"incident":[12],"response.":[13],"Maintaining":[14],"SA":[15],"is,":[16],"however,":[17],"extremely":[18],"costly":[19],"due":[20],"to":[21,47,52,72,105,124,128,151,154,162,168],"excessive":[22],"false":[23,164],"alerts":[24,49,104],"generated":[25],"by":[26,36,55,149],"intrusion":[27],"detection":[28],"systems,":[29],"which":[30],"require":[31],"prioritization":[32],"manual":[34],"investigation":[35,170],"security":[37,81,147],"analysts.":[38],"In":[39],"this":[40],"paper,":[41],"we":[42,96],"propose":[43,71],"a":[44,65,84,129],"novel":[45],"approach":[46],"prioritizing":[48],"so":[50],"as":[51,59,83],"maximize":[53],"SA,":[54],"formulating":[56],"the":[57,74,77,80,87,93,109,114,118,140,143,146,169],"problem":[58],"that":[60,107,136],"of":[61,76,79,92,117,131,142,145],"active":[62],"learning":[63],"hidden":[66],"Markov":[67],"model":[68],"(HMM).":[69],"We":[70,121,134],"use":[73,122],"entropy":[75],"belief":[78,144],"state":[82,148],"proxy":[85],"for":[86,102],"mean":[88],"squared":[89],"error":[90],"(MSE)":[91],"belief,":[94],"develop":[97],"two":[98],"computationally":[99],"tractable":[100],"policies":[101,127,138],"choosing":[103],"investigate":[106],"minimize":[108],"entropy,":[110],"taking":[111],"into":[112],"account":[113],"potential":[115],"uncertainty":[116],"investigations'":[119],"results.":[120],"simulations":[123],"compare":[125],"our":[126,137],"variety":[130],"baseline":[132,156],"policies.":[133],"find":[135],"reduce":[139],"MSE":[141],"up":[150],"50%":[152],"compared":[153],"static":[155],"policies,":[157],"they":[159],"are":[160],"robust":[161],"high":[163],"alert":[165],"rates":[166],"errors.":[171]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":4}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}