{"id":"https://openalex.org/W1967024415","doi":"https://doi.org/10.1109/tdsc.2014.2327966","title":"DDSGA: A Data-Driven Semi-Global Alignment Approach for Detecting Masquerade Attacks","display_name":"DDSGA: A Data-Driven Semi-Global Alignment Approach for Detecting Masquerade Attacks","publication_year":2014,"publication_date":"2014-06-03","ids":{"openalex":"https://openalex.org/W1967024415","doi":"https://doi.org/10.1109/tdsc.2014.2327966","mag":"1967024415"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2014.2327966","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2014.2327966","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5079318114","display_name":"Hisham A. Kholidy","orcid":"https://orcid.org/0000-0002-7673-5850"},"institutions":[{"id":"https://openalex.org/I108290504","display_name":"University of Pisa","ror":"https://ror.org/03ad39j10","country_code":"IT","type":"education","lineage":["https://openalex.org/I108290504"]},{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]},{"id":"https://openalex.org/I60342839","display_name":"Qatar University","ror":"https://ror.org/00yhnba62","country_code":"QA","type":"education","lineage":["https://openalex.org/I60342839"]},{"id":"https://openalex.org/I66513531","display_name":"Fayoum University","ror":"https://ror.org/023gzwx10","country_code":"EG","type":"education","lineage":["https://openalex.org/I66513531"]}],"countries":["EG","IT","QA","US"],"is_corresponding":false,"raw_author_name":"Hisham A. Kholidy","raw_affiliation_strings":["Department of Computer Science and Engineering, Qatar University, Doha, Qatar","Dipartimento di Informatica, Universit\u00e0 di Pisa, Pisa, Italy","Faculty of Computers and Information, Fayoum University, Fayoum, Egypt","NSF Cloud and Autonomic Computing Center, College of Electrical and Computer Engineering, University of Arizona, Tucson, Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Qatar University, Doha, Qatar","institution_ids":["https://openalex.org/I60342839"]},{"raw_affiliation_string":"Dipartimento di Informatica, Universit\u00e0 di Pisa, Pisa, Italy","institution_ids":["https://openalex.org/I108290504"]},{"raw_affiliation_string":"Faculty of Computers and Information, Fayoum University, Fayoum, Egypt","institution_ids":["https://openalex.org/I66513531"]},{"raw_affiliation_string":"NSF Cloud and Autonomic Computing Center, College of Electrical and Computer Engineering, University of Arizona, Tucson, Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048647728","display_name":"Fabrizio Baiardi","orcid":"https://orcid.org/0000-0001-9797-2380"},"institutions":[{"id":"https://openalex.org/I108290504","display_name":"University of Pisa","ror":"https://ror.org/03ad39j10","country_code":"IT","type":"education","lineage":["https://openalex.org/I108290504"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Fabrizio Baiardi","raw_affiliation_strings":["Department of Computer Science, Pisa University, Pisa 56017, Tuscany, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Pisa University, Pisa 56017, Tuscany, Italy","institution_ids":["https://openalex.org/I108290504"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5057335897","display_name":"Salim Hariri","orcid":"https://orcid.org/0000-0003-3956-3401"},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Salim Hariri","raw_affiliation_strings":["NSF Cloud and Autonomic Computing Center, College of Electrical and Computer Engineering, University of Arizona, Tucson, Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NSF Cloud and Autonomic Computing Center, College of Electrical and Computer Engineering, University of Arizona, Tucson, Arizona","institution_ids":["https://openalex.org/I138006243"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.8756,"has_fulltext":false,"cited_by_count":57,"citation_normalized_percentile":{"value":0.95228862,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"12","issue":"2","first_page":"164","last_page":"178"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11269","display_name":"Algorithms and Data Compression","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8724744319915771},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.7606271505355835},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.5021800994873047},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.4111288785934448},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4067445993423462},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.375455766916275},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.36633312702178955},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.3202272951602936},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.21417590975761414},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11815929412841797}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8724744319915771},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.7606271505355835},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.5021800994873047},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.4111288785934448},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4067445993423462},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.375455766916275},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.36633312702178955},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3202272951602936},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.21417590975761414},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11815929412841797},{"id":"https://openalex.org/C94625758","wikidata":"https://www.wikidata.org/wiki/Q7163","display_name":"Politics","level":2,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tdsc.2014.2327966","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2014.2327966","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},{"id":"pmh:oai:arpi.unipi.it:11568/583309","is_oa":false,"landing_page_url":"http://hdl.handle.net/11568/583309","pdf_url":null,"source":{"id":"https://openalex.org/S4377196265","display_name":"CINECA IRIS Institutial research information system (University of Pisa)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I108290504","host_organization_name":"University of Pisa","host_organization_lineage":["https://openalex.org/I108290504"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.699999988079071,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G4764894194","display_name":null,"funder_award_id":"FA9550-12-1-0241","funder_id":"https://openalex.org/F4320338279","funder_display_name":"Air Force Office of Scientific Research"},{"id":"https://openalex.org/G5889474861","display_name":null,"funder_award_id":"DUE-1303362","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8585886784","display_name":null,"funder_award_id":"IIP-0758579","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8680061977","display_name":null,"funder_award_id":"SES-1314631","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320309815","display_name":"Qatar Foundation","ror":"https://ror.org/01cawbq05"},{"id":"https://openalex.org/F4320338279","display_name":"Air Force Office of Scientific Research","ror":"https://ror.org/011e9bt93"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W61807067","https://openalex.org/W148217933","https://openalex.org/W168451370","https://openalex.org/W181041240","https://openalex.org/W1508616427","https://openalex.org/W1537844663","https://openalex.org/W1760565668","https://openalex.org/W1964723226","https://openalex.org/W1973704753","https://openalex.org/W1987513422","https://openalex.org/W2043738378","https://openalex.org/W2062930223","https://openalex.org/W2085686002","https://openalex.org/W2087064593","https://openalex.org/W2123105750","https://openalex.org/W2126269648","https://openalex.org/W2139212933","https://openalex.org/W2142638723","https://openalex.org/W2147311421","https://openalex.org/W2166017159","https://openalex.org/W2167075285","https://openalex.org/W2401432994","https://openalex.org/W2402663542","https://openalex.org/W6602518401","https://openalex.org/W6602994750","https://openalex.org/W6607494380","https://openalex.org/W6632106758","https://openalex.org/W6637902766","https://openalex.org/W6641446620","https://openalex.org/W6647084551","https://openalex.org/W6681619189","https://openalex.org/W6712913683"],"related_works":["https://openalex.org/W2062195135","https://openalex.org/W2952348651","https://openalex.org/W2795079307","https://openalex.org/W2375742443","https://openalex.org/W2149381099","https://openalex.org/W4200520489","https://openalex.org/W1483190388","https://openalex.org/W2793058541","https://openalex.org/W1983629434","https://openalex.org/W2061536531"],"abstract_inverted_index":{"A":[0],"masquerade":[1],"attacker":[2],"impersonates":[3],"a":[4,121,160,168],"legal":[5],"user":[6,10,92,114,122],"to":[7,28,110,124],"utilize":[8],"the":[9,22,38,51,54,61,68,75,100,104,113,118,130,135,140,143,147,152,178,182,202],"services":[11],"and":[12,25,40,53,138,142,189,205],"privileges.":[13],"The":[14],"semi-global":[15],"alignment":[16,81,136],"algorithm":[17],"(SGA)":[18],"is":[19],"one":[20],"of":[21,56,103,120,164,173,181],"most":[23],"effective":[24],"efficient":[26],"techniques":[27],"detect":[29],"these":[30],"attacks":[31],"but":[32],"it":[33,87],"has":[34],"not":[35],"reached":[36],"yet":[37],"accuracy":[39],"performance":[41],"required":[42],"by":[43,78,95,116,185,193],"large":[44],"scale,":[45],"multiuser":[46],"systems.":[47],"To":[48,128],"improve":[49],"both":[50,201],"effectiveness":[52,70],"performances":[55],"this":[57],"algorithm,":[58],"we":[59,150],"propose":[60],"Data-Driven":[62],"Semi-Global":[63],"Alignment,":[64],"DDSGA":[65,73,133,148,158,197],"approach.":[66],"From":[67],"security":[69],"view":[71],"point,":[72],"improves":[74,177],"scoring":[76],"systems":[77],"adopting":[79],"distinct":[80],"parameters":[82],"for":[83],"each":[84],"user.":[85],"Furthermore,":[86],"tolerates":[88],"small":[89,97],"mutations":[90],"in":[91,99,112,199],"command":[93],"sequences":[94],"allowing":[96],"changes":[98,111],"low-level":[101],"representation":[102],"commands":[105],"functionality.":[106],"It":[107,176],"also":[108],"adapts":[109],"behaviour":[115],"updating":[117],"signature":[119],"according":[123],"its":[125],"current":[126],"behaviour.":[127],"optimize":[129],"runtime":[131],"overhead,":[132],"minimizes":[134],"overhead":[137],"parallelizes":[139],"detection":[141],"update.":[144],"After":[145],"describing":[146],"phases,":[149],"present":[151],"experimental":[153],"results":[154,198],"that":[155,157],"show":[156],"achieves":[159],"high":[161],"hit":[162,179,203],"ratio":[163,180,204],"88.4":[165],"percent":[166,188],"with":[167,209],"low":[169],"false":[170,206],"positive":[171,207],"rate":[172],"1.7":[174],"percent.":[175,195],"enhanced":[183],"SGA":[184],"about":[186],"21.9":[187],"reduces":[190],"Maxion-Townsend":[191],"cost":[192],"22.5":[194],"Hence,":[196],"improving":[200],"rates":[208],"an":[210],"acceptable":[211],"computational":[212],"overhead.":[213]},"counts_by_year":[{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":9},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":8},{"year":2017,"cited_by_count":4},{"year":2016,"cited_by_count":4},{"year":2015,"cited_by_count":2},{"year":2014,"cited_by_count":4},{"year":2013,"cited_by_count":1},{"year":2012,"cited_by_count":6}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2016-06-24T00:00:00"}