{"id":"https://openalex.org/W1966967710","doi":"https://doi.org/10.1145/1065907.1066041","title":"The role of suspicion in model-based intrusion detection","display_name":"The role of suspicion in model-based intrusion detection","publication_year":2005,"publication_date":"2005-01-01","ids":{"openalex":"https://openalex.org/W1966967710","doi":"https://doi.org/10.1145/1065907.1066041","mag":"1966967710"},"language":"en","primary_location":{"id":"doi:10.1145/1065907.1066041","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1065907.1066041","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2004 workshop on New security paradigms - NSPW '04","raw_type":"proceedings-article"},"type":"conference-abstract","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5065267822","display_name":"Timothy Hollebeek","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Timothy Hollebeek","raw_affiliation_strings":["Teknowledge Corporation, Marina del Rey, CA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Teknowledge Corporation, Marina del Rey, CA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5090180638","display_name":"Rand Waltzman","orcid":"https://orcid.org/0000-0003-3455-1540"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rand Waltzman","raw_affiliation_strings":["Teknowledge Corporation, Marina del Rey, CA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Teknowledge Corporation, Marina del Rey, CA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"87","last_page":"87"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7427818775177002},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.6863037347793579},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5513970255851746},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.5037586092948914},{"id":"https://openalex.org/keywords/inclusion","display_name":"Inclusion (mineral)","score":0.48304420709609985},{"id":"https://openalex.org/keywords/audit-trail","display_name":"Audit trail","score":0.4730238914489746},{"id":"https://openalex.org/keywords/order","display_name":"Order (exchange)","score":0.4541563093662262},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.36205020546913147},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3467080593109131},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.33317768573760986},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.16200020909309387}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7427818775177002},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.6863037347793579},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5513970255851746},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.5037586092948914},{"id":"https://openalex.org/C109359841","wikidata":"https://www.wikidata.org/wiki/Q728944","display_name":"Inclusion (mineral)","level":2,"score":0.48304420709609985},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.4730238914489746},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.4541563093662262},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.36205020546913147},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3467080593109131},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.33317768573760986},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.16200020909309387},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.0},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C187736073","wikidata":"https://www.wikidata.org/wiki/Q2920921","display_name":"Management","level":1,"score":0.0},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/1065907.1066041","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1065907.1066041","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2004 workshop on New security paradigms - NSPW '04","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.364.7830","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.364.7830","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.nspw.org/papers/2004/nspw2004-hollebeek.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.6700000166893005,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W17854248","https://openalex.org/W34732858","https://openalex.org/W1483652549","https://openalex.org/W1549872659","https://openalex.org/W1583975142","https://openalex.org/W1590452455","https://openalex.org/W1621186777","https://openalex.org/W1752750208","https://openalex.org/W1941427975","https://openalex.org/W2048465382","https://openalex.org/W2083859938","https://openalex.org/W2100215068","https://openalex.org/W2107409339","https://openalex.org/W2128217000","https://openalex.org/W2135143063","https://openalex.org/W2140711496","https://openalex.org/W2146196597","https://openalex.org/W2288766236"],"related_works":["https://openalex.org/W3185553570","https://openalex.org/W2133389611","https://openalex.org/W2470977754","https://openalex.org/W2124184151","https://openalex.org/W2750461430","https://openalex.org/W2487194309","https://openalex.org/W2948428544","https://openalex.org/W2374959091","https://openalex.org/W2581634534","https://openalex.org/W2079105056"],"abstract_inverted_index":{"We":[0,72],"argue":[1],"in":[2,17,23,60,96,138],"favor":[3],"of":[4,8,20,31,39,89,113,148,161],"the":[5,18,27,69],"explicit":[6],"inclusion":[7],"suspicion":[9,90],"as":[10,126],"a":[11,40,65,141,156],"concrete":[12],"concept":[13],"to":[14,25,37,63,91,154,165],"be":[15],"used":[16],"analysis":[19],"audit":[21],"data":[22],"order":[24],"guide":[26],"search":[28],"for":[29,68],"evidence":[30,128,149],"misuse.":[32],"Our":[33],"approach":[34],"is":[35,109,129,163],"similar":[36],"that":[38,48,102],"human":[41],"forensic":[42],"analyst,":[43],"who":[44],"first":[45],"notices":[46],"details":[47,112],"seem":[49],"slightly":[50],"odd,":[51],"and":[52,56,85,87,116,120,158],"then":[53],"investigates":[54],"further":[55],"cross":[57],"checks":[58],"information":[59],"an":[61,97],"attempt":[62],"build":[64],"coherent":[66,159],"explanation":[67],"observed":[70],"details.":[71],"use":[73],"deductive":[74],"reasoning":[75],"combined":[76],"with":[77],"expert":[78],"knowledge":[79],"about":[80],"system":[81],"behavior,":[82],"potential":[83],"attacks":[84],"evidence,":[86],"patterns":[88],"link":[92],"individual":[93],"clues":[94],"together":[95,152],"automated":[98],"way.A":[99],"prototype":[100],"implementation":[101],"was":[103],"designed":[104],"based":[105],"on":[106,140],"these":[107,122],"considerations":[108],"presented,":[110],"including":[111],"how":[114,121,134],"suspicions":[115],"deductions":[117],"are":[118,124,150],"represented,":[119],"structures":[123],"updated":[125],"new":[127],"discovered.":[130],"Finally,":[131],"we":[132],"describe":[133],"this":[135],"algorithm":[136],"performs":[137],"practice":[139],"realistic":[142],"example":[143],"where":[144],"five":[145],"discrete":[146],"pieces":[147],"brought":[151],"automatically":[153],"create":[155],"unified":[157],"description":[160],"what":[162],"believed":[164],"have":[166],"occurred.":[167]},"counts_by_year":[],"updated_date":"2026-07-19T07:52:34.831488","created_date":"2025-10-10T00:00:00"}