{"id":"https://openalex.org/W2289300083","doi":"https://doi.org/10.1109/pccc.2015.7410270","title":"Parallel and distributed normalization of security events for instant attack analysis","display_name":"Parallel and distributed normalization of security events for instant attack analysis","publication_year":2015,"publication_date":"2015-12-01","ids":{"openalex":"https://openalex.org/W2289300083","doi":"https://doi.org/10.1109/pccc.2015.7410270","mag":"2289300083"},"language":"en","primary_location":{"id":"doi:10.1109/pccc.2015.7410270","is_oa":false,"landing_page_url":"https://doi.org/10.1109/pccc.2015.7410270","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2015 IEEE 34th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068035706","display_name":"David A. Jaeger","orcid":"https://orcid.org/0000-0001-9463-3199"},"institutions":[{"id":"https://openalex.org/I143288331","display_name":"Hasso Plattner Institute","ror":"https://ror.org/058rn5r42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I143288331","https://openalex.org/I176453806"]},{"id":"https://openalex.org/I176453806","display_name":"University of Potsdam","ror":"https://ror.org/03bnmw459","country_code":"DE","type":"education","lineage":["https://openalex.org/I176453806"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"David Jaeger","raw_affiliation_strings":["Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany","institution_ids":["https://openalex.org/I143288331","https://openalex.org/I176453806"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047826517","display_name":"Andrey Sapegin","orcid":"https://orcid.org/0000-0002-6895-1692"},"institutions":[{"id":"https://openalex.org/I143288331","display_name":"Hasso Plattner Institute","ror":"https://ror.org/058rn5r42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I143288331","https://openalex.org/I176453806"]},{"id":"https://openalex.org/I176453806","display_name":"University of Potsdam","ror":"https://ror.org/03bnmw459","country_code":"DE","type":"education","lineage":["https://openalex.org/I176453806"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Andrey Sapegin","raw_affiliation_strings":["Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany","institution_ids":["https://openalex.org/I143288331","https://openalex.org/I176453806"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001383529","display_name":"Martin Ussath","orcid":null},"institutions":[{"id":"https://openalex.org/I143288331","display_name":"Hasso Plattner Institute","ror":"https://ror.org/058rn5r42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I143288331","https://openalex.org/I176453806"]},{"id":"https://openalex.org/I176453806","display_name":"University of Potsdam","ror":"https://ror.org/03bnmw459","country_code":"DE","type":"education","lineage":["https://openalex.org/I176453806"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Martin Ussath","raw_affiliation_strings":["Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany","institution_ids":["https://openalex.org/I143288331","https://openalex.org/I176453806"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5107387385","display_name":"Feng Cheng","orcid":null},"institutions":[{"id":"https://openalex.org/I143288331","display_name":"Hasso Plattner Institute","ror":"https://ror.org/058rn5r42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I143288331","https://openalex.org/I176453806"]},{"id":"https://openalex.org/I176453806","display_name":"University of Potsdam","ror":"https://ror.org/03bnmw459","country_code":"DE","type":"education","lineage":["https://openalex.org/I176453806"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Feng Cheng","raw_affiliation_strings":["Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany","institution_ids":["https://openalex.org/I143288331","https://openalex.org/I176453806"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5102919398","display_name":"Christoph Meinel","orcid":"https://orcid.org/0000-0002-3410-3193"},"institutions":[{"id":"https://openalex.org/I143288331","display_name":"Hasso Plattner Institute","ror":"https://ror.org/058rn5r42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I143288331","https://openalex.org/I176453806"]},{"id":"https://openalex.org/I176453806","display_name":"University of Potsdam","ror":"https://ror.org/03bnmw459","country_code":"DE","type":"education","lineage":["https://openalex.org/I176453806"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Christoph Meinel","raw_affiliation_strings":["Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hasso Plattner Institute (HPI) University of Potsdam, Potsdam, Germany","institution_ids":["https://openalex.org/I143288331","https://openalex.org/I176453806"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.5295,"has_fulltext":false,"cited_by_count":7,"citation_normalized_percentile":{"value":0.60816242,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7589153051376343},{"id":"https://openalex.org/keywords/normalization","display_name":"Normalization (sociology)","score":0.6485354900360107},{"id":"https://openalex.org/keywords/big-data","display_name":"Big data","score":0.5735909342765808},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5732652544975281},{"id":"https://openalex.org/keywords/instant","display_name":"Instant","score":0.5594167113304138},{"id":"https://openalex.org/keywords/thread","display_name":"Thread (computing)","score":0.5143414735794067},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.4293779730796814},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.41443589329719543},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.23843765258789062},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.1118360161781311}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7589153051376343},{"id":"https://openalex.org/C136886441","wikidata":"https://www.wikidata.org/wiki/Q926129","display_name":"Normalization (sociology)","level":2,"score":0.6485354900360107},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.5735909342765808},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5732652544975281},{"id":"https://openalex.org/C2779432360","wikidata":"https://www.wikidata.org/wiki/Q16963779","display_name":"Instant","level":2,"score":0.5594167113304138},{"id":"https://openalex.org/C138101251","wikidata":"https://www.wikidata.org/wiki/Q213092","display_name":"Thread (computing)","level":2,"score":0.5143414735794067},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.4293779730796814},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.41443589329719543},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.23843765258789062},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1118360161781311},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C19165224","wikidata":"https://www.wikidata.org/wiki/Q23404","display_name":"Anthropology","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/pccc.2015.7410270","is_oa":false,"landing_page_url":"https://doi.org/10.1109/pccc.2015.7410270","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2015 IEEE 34th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.5199999809265137,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W1427431057","https://openalex.org/W1601674470","https://openalex.org/W1982540003","https://openalex.org/W2004360894","https://openalex.org/W2006946731","https://openalex.org/W2012169431","https://openalex.org/W2077121139","https://openalex.org/W2084602587","https://openalex.org/W2288292231","https://openalex.org/W2541267187","https://openalex.org/W6671515752","https://openalex.org/W6696501212"],"related_works":["https://openalex.org/W2356370096","https://openalex.org/W2794694000","https://openalex.org/W2094154142","https://openalex.org/W2350999733","https://openalex.org/W2392387319","https://openalex.org/W2359725054","https://openalex.org/W4287262429","https://openalex.org/W4287262247","https://openalex.org/W4287613691","https://openalex.org/W2774547058"],"abstract_inverted_index":{"When":[0],"looking":[1],"at":[2],"media":[3],"reports":[4],"nowadays,":[5],"major":[6],"security":[7],"breaches":[8,31],"of":[9,29,50,84,91,123,134,179],"big":[10,55,183],"companies":[11],"and":[12,35,73,86,137,160,176],"governments":[13],"seem":[14],"to":[15,33,61,113,150,173],"be":[16],"a":[17,131],"normal":[18],"situation.":[19],"An":[20],"important":[21],"step":[22],"for":[23,103],"the":[24,44,48,89,98],"investigation":[25],"or":[26],"even":[27,78],"prevention":[28],"these":[30],"is":[32,171],"normalize":[34,80,115],"analyze":[36],"security-related":[37],"log":[38,51,67,99,135,180],"events":[39,52,181],"from":[40,182],"various":[41],"systems":[42],"in":[43,54,93,118,128],"target":[45],"network.":[46],"However,":[47],"number":[49],"produced":[53],"IT":[56],"landscapes":[57],"can":[58,161],"grow":[59],"up":[60],"multiple":[62,141],"billions":[63],"per":[64],"day.":[65],"Current":[66],"management":[68],"solutions,":[69],"e.g.,":[70],"Security":[71],"Information":[72],"Event":[74],"Management":[75],"(SIEM),":[76],"cannot":[77],"closely":[79],"such":[81],"huge":[82],"amounts":[83],"data":[85,100],"therefore":[87,162],"disable":[88],"tracking":[90],"attacks":[92],"real-time,":[94],"which":[95,170],"means":[96],"that":[97],"remains":[101],"unusable":[102],"attack":[104],"analysis.":[105],"In":[106],"this":[107],"paper,":[108],"we":[109,147],"present":[110],"an":[111],"approach":[112],"fully":[114],"event":[116],"logs":[117],"high-speed":[119],"by":[120],"making":[121],"use":[122],"established":[124],"high-performance":[125],"inter-thread":[126],"messaging":[127],"conjunction":[129],"with":[130],"hierarchical":[132],"knowledge-base":[133],"formats":[136],"parallel":[138],"processing":[139],"on":[140,156],"low-end":[142],"systems.":[143],"Using":[144],"our":[145],"approach,":[146],"are":[148],"able":[149],"process":[151],"more":[152,165],"than":[153,166],"250,000":[154],"events/sec":[155],"relatively":[157],"low-profile":[158],"machines":[159],"easily":[163],"handle":[164,174],"20":[167],"billion":[168],"events/day,":[169],"enough":[172],"average":[175],"peek":[177],"loads":[178],"enterprise":[184],"networks.":[185]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2016,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}