{"id":"https://openalex.org/W2293069947","doi":"https://doi.org/10.1145/1047915.1047918","title":"Backtracking intrusions","display_name":"Backtracking intrusions","publication_year":2005,"publication_date":"2005-02-02","ids":{"openalex":"https://openalex.org/W2293069947","doi":"https://doi.org/10.1145/1047915.1047918","mag":"2293069947"},"language":"en","primary_location":{"id":"doi:10.1145/1047915.1047918","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1047915.1047918","pdf_url":null,"source":{"id":"https://openalex.org/S193109227","display_name":"ACM Transactions on Computer Systems","issn_l":"0734-2071","issn":["0734-2071","1557-7333"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Computer Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5112039412","display_name":"Samuel T. King","orcid":null},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Samuel T. King","raw_affiliation_strings":["University of Michigan, Ann Arbor, MI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Michigan, Ann Arbor, MI","institution_ids":["https://openalex.org/I27837315"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027819880","display_name":"Peter M. Chen","orcid":"https://orcid.org/0000-0002-5951-4183"},"institutions":[{"id":"https://openalex.org/I27837315","display_name":"University of Michigan","ror":"https://ror.org/00jmfr291","country_code":"US","type":"education","lineage":["https://openalex.org/I27837315"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peter M. Chen","raw_affiliation_strings":["University of Michigan, Ann Arbor, MI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Michigan, Ann Arbor, MI","institution_ids":["https://openalex.org/I27837315"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I27837315"],"apc_list":null,"apc_paid":null,"fwci":17.0309,"has_fulltext":false,"cited_by_count":176,"citation_normalized_percentile":{"value":0.9919312,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":"23","issue":"1","first_page":"51","last_page":"76"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8813951015472412},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.669082760810852},{"id":"https://openalex.org/keywords/backtracking","display_name":"Backtracking","score":0.6227232813835144},{"id":"https://openalex.org/keywords/chaining","display_name":"Chaining","score":0.5491254329681396},{"id":"https://openalex.org/keywords/workload","display_name":"Workload","score":0.5161479711532593},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.5107231140136719},{"id":"https://openalex.org/keywords/point","display_name":"Point (geometry)","score":0.48460516333580017},{"id":"https://openalex.org/keywords/sequence","display_name":"Sequence (biology)","score":0.48398542404174805},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.46237847208976746},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.46029528975486755},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.434776246547699},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3448753356933594},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3435359001159668},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.13163375854492188},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.09945836663246155}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8813951015472412},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.669082760810852},{"id":"https://openalex.org/C156884757","wikidata":"https://www.wikidata.org/wiki/Q798554","display_name":"Backtracking","level":2,"score":0.6227232813835144},{"id":"https://openalex.org/C49020025","wikidata":"https://www.wikidata.org/wiki/Q1059099","display_name":"Chaining","level":2,"score":0.5491254329681396},{"id":"https://openalex.org/C2778476105","wikidata":"https://www.wikidata.org/wiki/Q628539","display_name":"Workload","level":2,"score":0.5161479711532593},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.5107231140136719},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.48460516333580017},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.48398542404174805},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.46237847208976746},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.46029528975486755},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.434776246547699},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3448753356933594},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3435359001159668},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.13163375854492188},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.09945836663246155},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C187736073","wikidata":"https://www.wikidata.org/wiki/Q2920921","display_name":"Management","level":1,"score":0.0},{"id":"https://openalex.org/C54355233","wikidata":"https://www.wikidata.org/wiki/Q7162","display_name":"Genetics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1047915.1047918","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1047915.1047918","pdf_url":null,"source":{"id":"https://openalex.org/S193109227","display_name":"ACM Transactions on Computer Systems","issn_l":"0734-2071","issn":["0734-2071","1557-7333"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Computer Systems","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320334811","display_name":"Changchun Institute of Applied Chemistry","ror":"https://ror.org/00h52n341"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W24839522","https://openalex.org/W303139982","https://openalex.org/W1502173919","https://openalex.org/W1575308494","https://openalex.org/W1600965014","https://openalex.org/W1641762327","https://openalex.org/W2094873755","https://openalex.org/W2099137371","https://openalex.org/W2103499520","https://openalex.org/W2106388306","https://openalex.org/W2117115928","https://openalex.org/W2126058759","https://openalex.org/W2128217000","https://openalex.org/W2142892618","https://openalex.org/W2144801589","https://openalex.org/W2150042079","https://openalex.org/W2154081981","https://openalex.org/W2170967934","https://openalex.org/W3137220996","https://openalex.org/W4290757805","https://openalex.org/W6610773549"],"related_works":["https://openalex.org/W2385758958","https://openalex.org/W2183313954","https://openalex.org/W1969635302","https://openalex.org/W3152476155","https://openalex.org/W2376046849","https://openalex.org/W3146948916","https://openalex.org/W1973375107","https://openalex.org/W2148459958","https://openalex.org/W1585639070","https://openalex.org/W2380456765"],"abstract_inverted_index":{"Analyzing":[0],"intrusions":[1],"today":[2],"is":[3,34,98],"an":[4,28,45,153],"arduous,":[5],"largely":[6],"manual":[7],"task":[8],"because":[9],"system":[10,112],"administrators":[11],"lack":[12],"the":[13,21,103,111,114,123,129],"information":[14],"and":[15,60,69,113,143],"tools":[16],"needed":[17],"to":[18,35,81,100,107,110,122,134],"understand":[19],"easily":[20],"sequence":[22,115],"of":[23,32,40,72,116,149],"steps":[24,41,117],"that":[25,42,62,66,88,119],"occurred":[26,43],"in":[27,44,74,140],"attack.":[29],"The":[30,131],"goal":[31],"BackTracker":[33,57,80,97,136],"identify":[36],"automatically":[37],"potential":[38],"sequences":[39],"intrusion.":[46,130],"Starting":[47],"with":[48],"a":[49,54,75],"single":[50],"detection":[51,67],"point":[52,68,105,121,124],"(e.g.,":[53],"suspicious":[55],"file),":[56],"identifies":[58],"files":[59],"processes":[61],"could":[63],"have":[64],"affected":[65],"displays":[70],"chains":[71],"events":[73],"dependency":[76],"graph.":[77],"We":[78],"use":[79],"analyze":[82],"several":[83],"real":[84],"attacks":[85],"against":[86],"computers":[87],"we":[89,127],"set":[90],"up":[91],"as":[92],"honeypots.":[93],"In":[94],"each":[95],"case,":[96],"able":[99],"highlight":[101],"effectively":[102],"entry":[104,120],"used":[106],"gain":[108],"access":[109],"from":[118],"at":[125],"which":[126],"noticed":[128],"logging":[132],"required":[133],"support":[135],"added":[137],"9%":[138],"overhead":[139],"running":[141],"time":[142],"generated":[144],"1.2":[145],"GB":[146],"per":[147],"day":[148],"log":[150],"data":[151],"for":[152],"operating-system":[154],"intensive":[155],"workload.":[156]},"counts_by_year":[{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":4},{"year":2015,"cited_by_count":6},{"year":2014,"cited_by_count":4},{"year":2013,"cited_by_count":20},{"year":2012,"cited_by_count":16}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}