{"id":"https://openalex.org/W2938337762","doi":"https://doi.org/10.1109/icassp.2019.8683212","title":"Detecting Cyber Attacks Using Anomaly Detection with Explanations and Expert Feedback","display_name":"Detecting Cyber Attacks Using Anomaly Detection with Explanations and Expert Feedback","publication_year":2019,"publication_date":"2019-04-17","ids":{"openalex":"https://openalex.org/W2938337762","doi":"https://doi.org/10.1109/icassp.2019.8683212","mag":"2938337762"},"language":"en","primary_location":{"id":"doi:10.1109/icassp.2019.8683212","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icassp.2019.8683212","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICASSP 2019 - 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086552939","display_name":"Md Amran Siddiqui","orcid":null},"institutions":[{"id":"https://openalex.org/I131249849","display_name":"Oregon State University","ror":"https://ror.org/00ysfqy60","country_code":"US","type":"education","lineage":["https://openalex.org/I131249849"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Md Amran Siddiqui","raw_affiliation_strings":["School of EECS, Oregon State University, Corvallis, OR, 97331, USA","School of EECS, Oregon State University, Corvallis, OR, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of EECS, Oregon State University, Corvallis, OR, 97331, USA","institution_ids":["https://openalex.org/I131249849"]},{"raw_affiliation_string":"School of EECS, Oregon State University, Corvallis, OR, USA","institution_ids":["https://openalex.org/I131249849"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059859993","display_name":"Jack W. Stokes","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jack W. Stokes","raw_affiliation_strings":["Microsoft Research, Redmond, WA, 98052, USA","Microsoft Research, Redmond, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research, Redmond, WA, 98052, USA","institution_ids":["https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Research, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060280412","display_name":"Christian Seifert","orcid":"https://orcid.org/0000-0001-9182-8687"},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Christian Seifert","raw_affiliation_strings":["Microsoft Corporation, Redmond, WA, 98052, USA","Microsoft Corporation, Redmond, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, 98052, USA","institution_ids":["https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029806073","display_name":"Evan Argyle","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Evan Argyle","raw_affiliation_strings":["Microsoft Corporation, Redmond, WA, 98052, USA","Microsoft Corporation, Redmond, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, 98052, USA","institution_ids":["https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049307232","display_name":"Robert McCann","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Robert McCann","raw_affiliation_strings":["Microsoft Corporation, Redmond, WA, 98052, USA","Microsoft Corporation, Redmond, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, 98052, USA","institution_ids":["https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047205676","display_name":"Joshua Neil","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Joshua Neil","raw_affiliation_strings":["Microsoft Corporation, Redmond, WA, 98052, USA","Microsoft Corporation, Redmond, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, 98052, USA","institution_ids":["https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5040835380","display_name":"Justin Carroll","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Justin Carroll","raw_affiliation_strings":["Microsoft Corporation, Redmond, WA, 98052, USA","Microsoft Corporation, Redmond, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, 98052, USA","institution_ids":["https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Corporation, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.0861,"has_fulltext":false,"cited_by_count":41,"citation_normalized_percentile":{"value":0.95176071,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"2872","last_page":"2876"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.8609083890914917},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.8032927513122559},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7864167094230652},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.7197675704956055},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5631140470504761},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.44898444414138794},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4437861442565918},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.42416390776634216},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4101809859275818},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3232002556324005}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.8609083890914917},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.8032927513122559},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7864167094230652},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.7197675704956055},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5631140470504761},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.44898444414138794},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4437861442565918},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42416390776634216},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4101809859275818},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3232002556324005},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icassp.2019.8683212","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icassp.2019.8683212","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICASSP 2019 - 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W1530215515","https://openalex.org/W1966836840","https://openalex.org/W1999518899","https://openalex.org/W2008704879","https://openalex.org/W2106649514","https://openalex.org/W2122646361","https://openalex.org/W2137569638","https://openalex.org/W2143559571","https://openalex.org/W2148583977","https://openalex.org/W2294019357","https://openalex.org/W2296719434","https://openalex.org/W2342408547","https://openalex.org/W2417270923","https://openalex.org/W2466206609","https://openalex.org/W2584401436","https://openalex.org/W2752155475","https://openalex.org/W2809108362","https://openalex.org/W2892139656","https://openalex.org/W2963338867","https://openalex.org/W4300033235","https://openalex.org/W6682578669","https://openalex.org/W6743811318","https://openalex.org/W6754766240"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4214835788","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2667207928","https://openalex.org/W2912112202","https://openalex.org/W4377864969"],"abstract_inverted_index":{"Detecting":[0],"cyber":[1],"attacks":[2],"in":[3,120,133],"large":[4],"computer":[5,51,74],"networks":[6],"is":[7],"crucial":[8],"for":[9,78,96],"many":[10],"organizations.":[11],"To":[12],"that":[13,32,149,163],"purpose,":[14],"different":[15],"types":[16],"of":[17,36,136],"detectors":[18],"capture":[19,147],"the":[20,34,41,49,60,70,73,104,114,128,131,134,143,153,164,170,173,177],"important":[21],"signals":[22,148],"resembling":[23],"a":[24,37,87],"security":[25,38],"attack":[26,97,178],"from":[27,130],"individual":[28],"computers":[29,108],"and":[30,99,138,141,172],"bring":[31],"to":[33,66,69,116,122,146],"attention":[35],"analyst.":[39],"Unfortunately,":[40],"analyst":[42,61,115,132],"sometimes":[43],"has":[44],"no":[45,64],"indications":[46],"about":[47,102],"why":[48,103],"particular":[50],"was":[52,75],"identified":[53,77,106],"as":[54,109],"being":[55],"\"under":[56],"attack\".":[57],"In":[58,82],"addition,":[59],"may":[62],"have":[63],"method":[65],"provide":[67],"feedback":[68,129,175],"detector":[71,90,105,145],"if":[72],"actually":[76],"some":[79],"benign":[80],"reason.":[81],"this":[83],"paper,":[84],"we":[85],"use":[86],"state-of-the-art":[88],"anomaly":[89,144],"called":[91],"an":[92],"Isolation":[93],"Forest":[94],"[1]":[95],"detection":[98,179],"generate":[100],"explanations":[101,112,165],"certain":[107],"anomalous.":[110],"These":[111],"allow":[113],"direct":[117],"their":[118],"investigation":[119],"order":[121],"save":[123],"time.":[124],"We":[125],"then":[126],"take":[127],"form":[135],"true":[137],"false":[139],"positives":[140],"update":[142],"align":[150],"better":[151],"with":[152],"given":[154],"feedback.":[155],"Our":[156],"experiments":[157],"on":[158],"actual":[159],"network":[160],"data":[161],"show":[162],"give":[166],"more":[167],"insight":[168],"into":[169],"detections,":[171],"analyst's":[174],"increases":[176],"rate.":[180]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":9},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":4},{"year":2021,"cited_by_count":6},{"year":2020,"cited_by_count":6},{"year":2019,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}