{"id":"https://openalex.org/W2946170942","doi":"https://doi.org/10.1109/ipccc47392.2019.8958734","title":"Efficient Attack Correlation and Identification of Attack Scenarios based on Network-Motifs","display_name":"Efficient Attack Correlation and Identification of Attack Scenarios based on Network-Motifs","publication_year":2019,"publication_date":"2019-10-01","ids":{"openalex":"https://openalex.org/W2946170942","doi":"https://doi.org/10.1109/ipccc47392.2019.8958734","mag":"2946170942"},"language":"en","primary_location":{"id":"doi:10.1109/ipccc47392.2019.8958734","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc47392.2019.8958734","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/1905.06685","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Steffen Haas","orcid":null},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Steffen Haas","raw_affiliation_strings":["University Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University Hamburg","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Florian Wilkens","orcid":null},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Florian Wilkens","raw_affiliation_strings":["University Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University Hamburg","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"last","author":{"id":null,"display_name":"Mathias Fischer","orcid":null},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mathias Fischer","raw_affiliation_strings":["University Hamburg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University Hamburg","institution_ids":["https://openalex.org/I159176309"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I159176309"],"apc_list":null,"apc_paid":null,"fwci":1.2018,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":{"value":0.75239711,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"11"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9855999946594238,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5716999769210815},{"id":"https://openalex.org/keywords/attack-model","display_name":"Attack model","score":0.5647000074386597},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.5235000252723694},{"id":"https://openalex.org/keywords/correlation-attack","display_name":"Correlation attack","score":0.47839999198913574},{"id":"https://openalex.org/keywords/correlation","display_name":"Correlation","score":0.4778999984264374},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.44749999046325684}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7057999968528748},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5716999769210815},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.5647000074386597},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.5235000252723694},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.49160000681877136},{"id":"https://openalex.org/C120226833","wikidata":"https://www.wikidata.org/wiki/Q5172844","display_name":"Correlation attack","level":4,"score":0.47839999198913574},{"id":"https://openalex.org/C117220453","wikidata":"https://www.wikidata.org/wiki/Q5172842","display_name":"Correlation","level":2,"score":0.4778999984264374},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.44749999046325684},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.41659998893737793},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.3384000062942505},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.33329999446868896},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3287999927997589},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2924000024795532},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26829999685287476}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/ipccc47392.2019.8958734","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc47392.2019.8958734","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:1905.06685","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1905.06685","pdf_url":"https://arxiv.org/pdf/1905.06685","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:1905.06685","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1905.06685","pdf_url":"https://arxiv.org/pdf/1905.06685","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W1772700132","https://openalex.org/W2013627100","https://openalex.org/W2108867737","https://openalex.org/W2111769012","https://openalex.org/W2137430899","https://openalex.org/W2153624566","https://openalex.org/W2161830378","https://openalex.org/W2162670059","https://openalex.org/W2263741877","https://openalex.org/W2560810941","https://openalex.org/W2590855676","https://openalex.org/W2810737462","https://openalex.org/W2889233068","https://openalex.org/W2963197901","https://openalex.org/W6604511647","https://openalex.org/W6636189822","https://openalex.org/W6677979620","https://openalex.org/W6684904464","https://openalex.org/W6736520436"],"related_works":[],"abstract_inverted_index":{"An":[0],"Intrusion":[1],"Detection":[2],"System":[3],"(IDS)":[4],"to":[5,29,32,65,86,103,116,160],"secure":[6],"computer":[7],"networks":[8],"reports":[9],"indicators":[10],"for":[11,121],"an":[12],"attack":[13,18,73,106,156],"as":[14],"alerts.":[15],"However,":[16],"every":[17],"can":[19,152,166],"result":[20],"in":[21,136,142],"a":[22,45,54,127],"multitude":[23],"of":[24,37,51,62,72,130,158,162,172,175],"IDS":[25],"alerts":[26,52],"that":[27,48],"need":[28],"be":[30],"correlated":[31],"see":[33],"the":[34,38,79,173,176],"full":[35,177],"picture":[36],"attack.":[39],"In":[40],"this":[41],"paper,":[42],"we":[43,59],"present":[44],"correlation":[46],"approach":[47,151],"transforms":[49],"clusters":[50],"into":[53],"graph":[55],"structure":[56],"on":[57,146],"which":[58],"compute":[60],"signatures":[61,120],"network":[63],"motifs":[64],"characterize":[66],"these":[67],"clusters.":[68],"A":[69],"motif":[70],"representation":[71],"characteristics":[74,169],"is":[75],"magnitudes":[76],"smaller":[77],"than":[78],"original":[80],"alert":[81,148,178],"data,":[82,149],"but":[83,114],"still":[84],"allows":[85,100],"efficiently":[87],"compare":[88],"and":[89,95,111,138,154,165],"correlate":[90],"attacks":[91,134,164],"with":[92,96],"each":[93],"other":[94],"reference":[97,119],"signatures.":[98],"This":[99],"not":[101],"only":[102],"identify":[104],"known":[105],"scenarios,":[107,131],"e.g.,":[108],"DDoS,":[109],"scan,":[110],"worm":[112],"attacks,":[113],"also":[115],"derive":[117],"new":[118],"unknown":[122],"scenarios.":[123],"Our":[124],"results":[125],"indicate":[126],"reliable":[128],"identification":[129],"even":[132],"when":[133],"differ":[135],"size":[137,174],"at":[139],"least":[140],"slightly":[141],"their":[143,168],"characteristics.":[144],"Applied":[145],"real-world":[147],"our":[150],"classify":[153],"assign":[155],"scenarios":[157],"up":[159],"96%":[161],"all":[163],"represent":[167],"using":[170],"1%":[171],"data.":[179]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2019-05-29T00:00:00"}