{"id":"https://openalex.org/W2049551352","doi":"https://doi.org/10.1109/tdsc.2014.2334305","title":"An OS-level Framework for Anomaly Detection in Complex Software Systems","display_name":"An OS-level Framework for Anomaly Detection in Complex Software Systems","publication_year":2014,"publication_date":"2014-07-01","ids":{"openalex":"https://openalex.org/W2049551352","doi":"https://doi.org/10.1109/tdsc.2014.2334305","mag":"2049551352"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2014.2334305","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2014.2334305","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"http://hdl.handle.net/2158/889119","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5061270829","display_name":"Antonio Bovenzi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Antonio Bovenzi","raw_affiliation_strings":["Dipartimento di Ingegneria Elettrica e delle Tecnologie dell\u2019Informazione, Universit\u00e0 di Napoli Federico II, Italy","Dipartimento di Ingegneria Elettrica e delle Tecnologie dell'Informazione, Universit\u00e0 di Napoli Federico II, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Dipartimento di Ingegneria Elettrica e delle Tecnologie dell\u2019Informazione, Universit\u00e0 di Napoli Federico II, Italy","institution_ids":[]},{"raw_affiliation_string":"Dipartimento di Ingegneria Elettrica e delle Tecnologie dell'Informazione, Universit\u00e0 di Napoli Federico II, Italy","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037394247","display_name":"Francesco Brancati","orcid":"https://orcid.org/0000-0003-3624-2354"},"institutions":[{"id":"https://openalex.org/I4210135661","display_name":"ResilTech (Italy)","ror":"https://ror.org/04cz70931","country_code":"IT","type":"company","lineage":["https://openalex.org/I4210135661"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Francesco Brancati","raw_affiliation_strings":["Resiltech S.R.L., Pontedera (PI), Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Resiltech S.R.L., Pontedera (PI), Italy","institution_ids":["https://openalex.org/I4210135661"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002197803","display_name":"Stefano Russo","orcid":"https://orcid.org/0000-0002-8747-3446"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Stefano Russo","raw_affiliation_strings":["Dipartimento di Ingegneria Elettrica e delle Tecnologie dell\u2019Informazione, Universit\u00e0 di Napoli Federico II, Italy","Dipartimento di Ingegneria Elettrica e delle Tecnologie dell'Informazione, Universit\u00e0 di Napoli Federico II, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Dipartimento di Ingegneria Elettrica e delle Tecnologie dell\u2019Informazione, Universit\u00e0 di Napoli Federico II, Italy","institution_ids":[]},{"raw_affiliation_string":"Dipartimento di Ingegneria Elettrica e delle Tecnologie dell'Informazione, Universit\u00e0 di Napoli Federico II, Italy","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016669256","display_name":"Andrea Bondavalli","orcid":"https://orcid.org/0000-0001-7366-6530"},"institutions":[{"id":"https://openalex.org/I45084792","display_name":"University of Florence","ror":"https://ror.org/04jr1s763","country_code":"IT","type":"education","lineage":["https://openalex.org/I45084792"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Andrea Bondavalli","raw_affiliation_strings":["Departimento di Sistemi e Informatica, Italy","Departimento di Sistemi e Informatica, Universit\u00e0 di Firenze"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Departimento di Sistemi e Informatica, Italy","institution_ids":[]},{"raw_affiliation_string":"Departimento di Sistemi e Informatica, Universit\u00e0 di Firenze","institution_ids":["https://openalex.org/I45084792"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.5192,"has_fulltext":false,"cited_by_count":24,"citation_normalized_percentile":{"value":0.90438266,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"12","issue":"3","first_page":"366","last_page":"372"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7627766132354736},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7556646466255188},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.6479480862617493},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.64417964220047},{"id":"https://openalex.org/keywords/sensitivity","display_name":"Sensitivity (control systems)","score":0.5744122266769409},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.5676817297935486},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.5209804177284241},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.510941207408905},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.4670730233192444},{"id":"https://openalex.org/keywords/software-system","display_name":"Software system","score":0.4563920199871063},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4263766407966614},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.36745691299438477},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.3643028140068054},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3331357538700104},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.09534099698066711},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.09294846653938293}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7627766132354736},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7556646466255188},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.6479480862617493},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.64417964220047},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.5744122266769409},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.5676817297935486},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.5209804177284241},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.510941207408905},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.4670730233192444},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.4563920199871063},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4263766407966614},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.36745691299438477},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3643028140068054},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3331357538700104},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.09534099698066711},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.09294846653938293},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C24326235","wikidata":"https://www.wikidata.org/wiki/Q126095","display_name":"Electronic engineering","level":1,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tdsc.2014.2334305","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2014.2334305","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},{"id":"pmh:oai:flore.unifi.it:2158/889119","is_oa":true,"landing_page_url":"http://hdl.handle.net/2158/889119","pdf_url":null,"source":{"id":"https://openalex.org/S4306402033","display_name":"Florence Research (University of Florence)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I45084792","host_organization_name":"University of Florence","host_organization_lineage":["https://openalex.org/I45084792"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"pmh:oai:flore.unifi.it:2158/889119","is_oa":true,"landing_page_url":"http://hdl.handle.net/2158/889119","pdf_url":null,"source":{"id":"https://openalex.org/S4306402033","display_name":"Florence Research (University of Florence)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I45084792","host_organization_name":"University of Florence","host_organization_lineage":["https://openalex.org/I45084792"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2267915601","display_name":null,"funder_award_id":"20103P34XC","funder_id":"https://openalex.org/F4320321873","funder_display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca"},{"id":"https://openalex.org/G7482279930","display_name":null,"funder_award_id":"324334","funder_id":"https://openalex.org/F4320334960","funder_display_name":"Seventh Framework Programme"}],"funders":[{"id":"https://openalex.org/F4320321873","display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca","ror":"https://ror.org/0166hxq48"},{"id":"https://openalex.org/F4320334960","display_name":"Seventh Framework Programme","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320335279","display_name":"Central ElectroChemical Research Institute","ror":"https://ror.org/01qek3q18"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":33,"referenced_works":["https://openalex.org/W1233463431","https://openalex.org/W1583975142","https://openalex.org/W1835741457","https://openalex.org/W1964274671","https://openalex.org/W2015573149","https://openalex.org/W2031411490","https://openalex.org/W2049838008","https://openalex.org/W2065325623","https://openalex.org/W2098334984","https://openalex.org/W2098645860","https://openalex.org/W2102940270","https://openalex.org/W2118372007","https://openalex.org/W2123886726","https://openalex.org/W2124617909","https://openalex.org/W2137576376","https://openalex.org/W2137898330","https://openalex.org/W2140860301","https://openalex.org/W2156205360","https://openalex.org/W2156997627","https://openalex.org/W2164463086","https://openalex.org/W2170657068","https://openalex.org/W3092757230","https://openalex.org/W3136767761","https://openalex.org/W4248659492","https://openalex.org/W6628063145","https://openalex.org/W6634829514","https://openalex.org/W6638604365","https://openalex.org/W6654249264","https://openalex.org/W6666846493","https://openalex.org/W6675027057","https://openalex.org/W6675087345","https://openalex.org/W6675662161","https://openalex.org/W6680445217"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W11100131","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2912112202","https://openalex.org/W2667207928","https://openalex.org/W4377864969"],"abstract_inverted_index":{"Revealing":[0],"anomalies":[1,50],"at":[2],"the":[3,52,87,120,134,141,149,160],"operating":[4],"system":[5,57,96],"(OS)":[6],"level":[7,142],"to":[8,48,56,85,132,139,155,163,165],"support":[9],"online":[10,64],"diagnosis":[11],"activities":[12],"of":[13,89,103,143,148],"complex":[14,94],"software":[15,90],"systems":[16,73],"is":[17,61,70,83,122,152],"a":[18,44,93],"promising":[19],"approach":[20],"when":[21],"traditional":[22],"detection":[23,46],"mechanisms":[24],"(e.g.,":[25],"based":[26,62],"on":[27,63,159],"event":[28],"logs,":[29],"probes":[30],"and":[31,68,78,114,162],"heartbeats)":[32],"are":[33],"inadequate":[34],"or":[35],"cannot":[36],"be":[37,130],"applied.":[38],"In":[39],"this":[40],"paper":[41],"we":[42],"propose":[43],"configurable":[45],"framework":[47,82,128],"reveal":[49],"in":[51,92],"OS":[53],"behavior,":[54],"related":[55],"misbehaviors.":[58],"The":[59,81,127],"detector":[60,121,150],"statistical":[65],"analyses":[66],"techniques,":[67],"it":[69],"designed":[71],"for":[72,97,124,168],"that":[74,119],"operate":[75],"under":[76],"variable":[77],"non-stationary":[79],"conditions.":[80],"evaluated":[84],"detect":[86],"activation":[88],"faults":[91],"distributed":[95],"Air":[98],"Traffic":[99],"Management":[100],"(ATM).":[101],"Results":[102],"experiments":[104],"with":[105],"two":[106],"different":[107],"OSs,":[108],"namely":[109],"Linux":[110],"Red":[111],"Hat":[112],"EL5":[113],"Windows":[115],"Server":[116],"2008,":[117],"show":[118,156],"effective":[123],"mission-critical":[125],"systems.":[126],"can":[129],"configured":[131],"select":[133],"monitored":[135],"indicators":[136],"so":[137],"as":[138],"tune":[140],"intrusivity.":[144],"A":[145],"sensitivity":[146],"analysis":[147],"parameters":[151],"carried":[153],"out":[154],"their":[157],"impact":[158],"performance":[161],"give":[164],"practitioners":[166],"guidelines":[167],"its":[169],"field":[170],"tuning.":[171]},"counts_by_year":[{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":5},{"year":2019,"cited_by_count":7},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":3},{"year":2015,"cited_by_count":2},{"year":2014,"cited_by_count":1}],"updated_date":"2026-06-12T08:23:45.883708","created_date":"2025-10-10T00:00:00"}