{"id":"https://openalex.org/W4412623370","doi":"https://doi.org/10.1109/tdsc.2025.3592127","title":"Dynamic Alert Prioritization for Real-Time Situational Awareness: A Hidden Markov Model Framework With Active Learning","display_name":"Dynamic Alert Prioritization for Real-Time Situational Awareness: A Hidden Markov Model Framework With Active Learning","publication_year":2025,"publication_date":"2025-07-24","ids":{"openalex":"https://openalex.org/W4412623370","doi":"https://doi.org/10.1109/tdsc.2025.3592127"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2025.3592127","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3592127","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/tdsc.2025.3592127","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077076300","display_name":"Yeongwoo Kim","orcid":"https://orcid.org/0009-0002-6228-9332"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Yeongwoo Kim","raw_affiliation_strings":["Division of Network, Systems Engineering School of Electrical Engineering, Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0009-0002-6228-9332","affiliations":[{"raw_affiliation_string":"Division of Network, Systems Engineering School of Electrical Engineering, Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]},{"raw_affiliation_string":"Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5086721943","display_name":"Gy\u00f6rgy D\u00e1n","orcid":"https://orcid.org/0000-0002-4876-0223"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Gy\u00f6rgy D\u00e1n","raw_affiliation_strings":["Division of Network, Systems Engineering School of Electrical Engineering, Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-4876-0223","affiliations":[{"raw_affiliation_string":"Division of Network, Systems Engineering School of Electrical Engineering, Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]},{"raw_affiliation_string":"Division of Network and Systems Engineering, School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I86987016"],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":{"value":2645,"currency":"USD","value_usd":2645},"fwci":4.5479,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.94393602,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"22","issue":"6","first_page":"6913","last_page":"6928"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10711","display_name":"Target Tracking and Data Fusion in Sensor Networks","score":0.9240999817848206,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10711","display_name":"Target Tracking and Data Fusion in Sensor Networks","score":0.9240999817848206,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9187999963760376,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7981629371643066},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.728895902633667},{"id":"https://openalex.org/keywords/prioritization","display_name":"Prioritization","score":0.6896884441375732},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.5417883992195129},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.49427199363708496},{"id":"https://openalex.org/keywords/hidden-markov-model","display_name":"Hidden Markov model","score":0.45018163323402405},{"id":"https://openalex.org/keywords/dynamic-bayesian-network","display_name":"Dynamic Bayesian network","score":0.42940810322761536},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4008636474609375},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3991621434688568},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.35404083132743835},{"id":"https://openalex.org/keywords/bayesian-network","display_name":"Bayesian network","score":0.24818363785743713},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.1053667664527893}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7981629371643066},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.728895902633667},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.6896884441375732},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.5417883992195129},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.49427199363708496},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.45018163323402405},{"id":"https://openalex.org/C82142266","wikidata":"https://www.wikidata.org/wiki/Q3456604","display_name":"Dynamic Bayesian network","level":3,"score":0.42940810322761536},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4008636474609375},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3991621434688568},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.35404083132743835},{"id":"https://openalex.org/C33724603","wikidata":"https://www.wikidata.org/wiki/Q812540","display_name":"Bayesian network","level":2,"score":0.24818363785743713},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.1053667664527893},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C146978453","wikidata":"https://www.wikidata.org/wiki/Q3798668","display_name":"Aerospace engineering","level":1,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2025.3592127","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3592127","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/tdsc.2025.3592127","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3592127","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5,"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities"}],"awards":[{"id":"https://openalex.org/G2725578610","display_name":"Robust Active Learning for Semi-autonomous Cyber Incident Detection","funder_award_id":"2024-05269","funder_id":"https://openalex.org/F4320322581","funder_display_name":"Vetenskapsr\u00e5det"},{"id":"https://openalex.org/G406204845","display_name":"Resilienta n\u00e4tverkade system i fientliga milj\u00f6er","funder_award_id":"2020-03860","funder_id":"https://openalex.org/F4320322581","funder_display_name":"Vetenskapsr\u00e5det"},{"id":"https://openalex.org/G8869864247","display_name":"NAISS","funder_award_id":"2022-06725","funder_id":"https://openalex.org/F4320322581","funder_display_name":"Vetenskapsr\u00e5det"}],"funders":[{"id":"https://openalex.org/F4320322581","display_name":"Vetenskapsr\u00e5det","ror":"https://ror.org/03zttf063"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1995716850","https://openalex.org/W2054127354","https://openalex.org/W2098046554","https://openalex.org/W2120839938","https://openalex.org/W2146092999","https://openalex.org/W2146440914","https://openalex.org/W2165836036","https://openalex.org/W2168877982","https://openalex.org/W2473965074","https://openalex.org/W2520200210","https://openalex.org/W2522792437","https://openalex.org/W2598566119","https://openalex.org/W2739823785","https://openalex.org/W2755588949","https://openalex.org/W2760313715","https://openalex.org/W2792721951","https://openalex.org/W2802236629","https://openalex.org/W2893240802","https://openalex.org/W2903912339","https://openalex.org/W2907590737","https://openalex.org/W2964304846","https://openalex.org/W2982379385","https://openalex.org/W2986291326","https://openalex.org/W2997124832","https://openalex.org/W3037267797","https://openalex.org/W3039222472","https://openalex.org/W3217253123","https://openalex.org/W4205463438","https://openalex.org/W4214906203","https://openalex.org/W4221054774","https://openalex.org/W4248986893","https://openalex.org/W4283376654","https://openalex.org/W4309675214","https://openalex.org/W4312495508","https://openalex.org/W4313325293","https://openalex.org/W4387298384","https://openalex.org/W4388867311","https://openalex.org/W4391540746","https://openalex.org/W4394935822","https://openalex.org/W4400233968","https://openalex.org/W4402264324","https://openalex.org/W4402957950","https://openalex.org/W4403937334"],"related_works":["https://openalex.org/W2506292322","https://openalex.org/W2053269318","https://openalex.org/W2364370872","https://openalex.org/W4283209547","https://openalex.org/W2097963413","https://openalex.org/W2294335174","https://openalex.org/W2017210410","https://openalex.org/W1993009522","https://openalex.org/W1995792634","https://openalex.org/W2135672910"],"abstract_inverted_index":{"Real-time":[0],"cyber":[1],"situational":[2],"awareness":[3],"(SA)":[4],"is":[5,45],"crucial":[6],"for":[7,113,126],"effective":[8],"and":[9,119,134,139,159,190,199],"timely":[10],"incident":[11],"response.":[12],"However,":[13],"maintaining":[14],"SA":[15],"requires":[16],"substantial":[17],"human":[18],"effort;":[19],"security":[20],"analysts":[21,49],"must":[22],"analyze":[23],"large":[24],"volumes":[25],"of":[26,29,98,107,116,150,179],"alerts,":[27],"many":[28],"which":[30],"are":[31,192],"false":[32,196],"positives":[33],"triggered":[34],"by":[35,182,216],"anomaly-based":[36],"intrusion":[37],"detection":[38],"systems":[39],"(IDSs).":[40],"Efficiently":[41],"prioritizing":[42],"these":[43],"alerts":[44,128],"vital":[46],"to":[47,50,66,91,103,129,145,163,184,187,194,200],"enable":[48],"focus":[51],"on":[52,157],"real":[53,160],"threats":[54],"without":[55,218],"delay.":[56],"In":[57],"this":[58],"paper,":[59],"we":[60,71,120,132],"present":[61],"two":[62,122],"key":[63],"contributions":[64],"designed":[65],"improve":[67],"real-time":[68],"SA.":[69],"First,":[70],"propose":[72,102,133],"modeling":[73],"dynamic":[74],"alert":[75,197],"prioritization":[76],"as":[77,110],"an":[78,140],"active":[79],"learning":[80],"problem":[81],"in":[82,222],"a":[83,111,136,219],"hidden":[84],"Markov":[85],"model":[86],"(HMM)":[87],"with":[88],"the":[89,93,99,105,108,114,117,147,151,165,172,177,180,213,223],"objective":[90],"minimize":[92],"mean":[94],"squared":[95],"error":[96],"(MSE)":[97],"belief.":[100],"We":[101,154],"use":[104,155],"uncertainty":[106],"belief":[109,152,181,224],"proxy":[112],"MSE":[115,178],"belief,":[118],"develop":[121],"computationally":[123],"tractable":[124],"policies":[125,175],"choosing":[127],"investigate.":[130],"Second,":[131],"evaluate":[135,164],"state":[137,208],"space":[138,142,209],"exploit":[141],"reduction":[143,210],"method":[144],"reduce":[146,176,212],"computational":[148],"complexity":[149],"update.":[153],"simulations":[156],"synthetic":[158],"dependency":[161],"graphs":[162],"proposed":[166,173],"policies.":[167],"Our":[168,203],"results":[169,204],"show":[170,206],"that":[171,207],"investigation":[174,201],"up":[183],"50%":[185],"compared":[186],"baseline":[188],"policies,":[189],"they":[191],"robust":[193],"high":[195],"rates":[198],"errors.":[202],"also":[205],"can":[211],"computation":[214],"time":[215],"85%":[217],"significant":[220],"increase":[221],"MSE.":[225]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}