{"id":"https://openalex.org/W2080378870","doi":"https://doi.org/10.1145/2445566.2445569","title":"Automated Anomaly Detector Adaptation using Adaptive Threshold Tuning","display_name":"Automated Anomaly Detector Adaptation using Adaptive Threshold Tuning","publication_year":2013,"publication_date":"2013-04-01","ids":{"openalex":"https://openalex.org/W2080378870","doi":"https://doi.org/10.1145/2445566.2445569","mag":"2080378870"},"language":"en","primary_location":{"id":"doi:10.1145/2445566.2445569","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2445566.2445569","pdf_url":null,"source":{"id":"https://openalex.org/S2642811","display_name":"ACM Transactions on Information and System Security","issn_l":"1094-9224","issn":["1094-9224","1557-7406"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Information and System Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5108432257","display_name":"Muhammad Qasim Ali","orcid":"https://orcid.org/0009-0004-5340-3310"},"institutions":[{"id":"https://openalex.org/I102149020","display_name":"University of North Carolina at Charlotte","ror":"https://ror.org/04dawnj30","country_code":"US","type":"education","lineage":["https://openalex.org/I102149020"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Muhammad Qasim Ali","raw_affiliation_strings":["University of North Carolina Charlotte (UNCC)","University of North Carolina-Charlotte (UNCC),"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina Charlotte (UNCC)","institution_ids":["https://openalex.org/I102149020"]},{"raw_affiliation_string":"University of North Carolina-Charlotte (UNCC),","institution_ids":["https://openalex.org/I102149020"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043893479","display_name":"Ehab Al\u2010Shaer","orcid":"https://orcid.org/0000-0002-7665-8293"},"institutions":[{"id":"https://openalex.org/I102149020","display_name":"University of North Carolina at Charlotte","ror":"https://ror.org/04dawnj30","country_code":"US","type":"education","lineage":["https://openalex.org/I102149020"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ehab Al-Shaer","raw_affiliation_strings":["University of North Carolina Charlotte (UNCC)","University of North Carolina-Charlotte (UNCC),"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina Charlotte (UNCC)","institution_ids":["https://openalex.org/I102149020"]},{"raw_affiliation_string":"University of North Carolina-Charlotte (UNCC),","institution_ids":["https://openalex.org/I102149020"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051330490","display_name":"Hassan Aqeel Khan","orcid":"https://orcid.org/0000-0002-5501-160X"},"institutions":[{"id":"https://openalex.org/I110357561","display_name":"University of the Sciences","ror":"https://ror.org/048gmay44","country_code":"US","type":"education","lineage":["https://openalex.org/I110357561"]},{"id":"https://openalex.org/I929597975","display_name":"National University of Sciences and Technology","ror":"https://ror.org/03w2j5y17","country_code":"PK","type":"education","lineage":["https://openalex.org/I929597975"]}],"countries":["PK","US"],"is_corresponding":false,"raw_author_name":"Hassan Khan","raw_affiliation_strings":["National University of Sciences and Technology (NUST), Pakistan","National University of Sciences and Technology - NUST (PAKISTAN)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Sciences and Technology (NUST), Pakistan","institution_ids":["https://openalex.org/I929597975"]},{"raw_affiliation_string":"National University of Sciences and Technology - NUST (PAKISTAN)","institution_ids":["https://openalex.org/I110357561"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5110173633","display_name":"Syed Ali Khayam","orcid":null},"institutions":[{"id":"https://openalex.org/I2800923599","display_name":"EirGrid (Ireland)","ror":"https://ror.org/05khvz726","country_code":"IE","type":"company","lineage":["https://openalex.org/I2800923599"]}],"countries":["IE"],"is_corresponding":false,"raw_author_name":"Syed Ali Khayam","raw_affiliation_strings":["PLUMgrid Inc"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"PLUMgrid Inc","institution_ids":["https://openalex.org/I2800923599"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.1095,"has_fulltext":false,"cited_by_count":29,"citation_normalized_percentile":{"value":0.92534286,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"15","issue":"4","first_page":"1","last_page":"30"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7859244346618652},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7741179466247559},{"id":"https://openalex.org/keywords/thresholding","display_name":"Thresholding","score":0.7124197483062744},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5953733325004578},{"id":"https://openalex.org/keywords/threshold-limit-value","display_name":"Threshold limit value","score":0.5123778581619263},{"id":"https://openalex.org/keywords/threshold-model","display_name":"Threshold model","score":0.5096950531005859},{"id":"https://openalex.org/keywords/markov-chain","display_name":"Markov chain","score":0.4914795160293579},{"id":"https://openalex.org/keywords/adaptation","display_name":"Adaptation (eye)","score":0.4440808892250061},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.4434514343738556},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.43151727318763733},{"id":"https://openalex.org/keywords/change-detection","display_name":"Change detection","score":0.4203195571899414},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3734560012817383},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3639475107192993},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.32246267795562744},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.21930110454559326},{"id":"https://openalex.org/keywords/image","display_name":"Image (mathematics)","score":0.10529348254203796}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7859244346618652},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7741179466247559},{"id":"https://openalex.org/C191178318","wikidata":"https://www.wikidata.org/wiki/Q2256906","display_name":"Thresholding","level":3,"score":0.7124197483062744},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5953733325004578},{"id":"https://openalex.org/C64413873","wikidata":"https://www.wikidata.org/wiki/Q21005","display_name":"Threshold limit value","level":2,"score":0.5123778581619263},{"id":"https://openalex.org/C202632270","wikidata":"https://www.wikidata.org/wiki/Q7798106","display_name":"Threshold model","level":2,"score":0.5096950531005859},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.4914795160293579},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.4440808892250061},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.4434514343738556},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.43151727318763733},{"id":"https://openalex.org/C203595873","wikidata":"https://www.wikidata.org/wiki/Q25389927","display_name":"Change detection","level":2,"score":0.4203195571899414},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3734560012817383},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3639475107192993},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.32246267795562744},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.21930110454559326},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.10529348254203796},{"id":"https://openalex.org/C99454951","wikidata":"https://www.wikidata.org/wiki/Q932068","display_name":"Environmental health","level":1,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2445566.2445569","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2445566.2445569","pdf_url":null,"source":{"id":"https://openalex.org/S2642811","display_name":"ACM Transactions on Information and System Security","issn_l":"1094-9224","issn":["1094-9224","1557-7406"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Information and System Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":41,"referenced_works":["https://openalex.org/W44307044","https://openalex.org/W839735142","https://openalex.org/W1482228399","https://openalex.org/W1500551892","https://openalex.org/W1536252645","https://openalex.org/W1604044955","https://openalex.org/W1744212210","https://openalex.org/W1747767590","https://openalex.org/W1964274671","https://openalex.org/W1994894547","https://openalex.org/W1999427165","https://openalex.org/W2016159616","https://openalex.org/W2039390926","https://openalex.org/W2050969957","https://openalex.org/W2067032582","https://openalex.org/W2068085072","https://openalex.org/W2070134328","https://openalex.org/W2083477206","https://openalex.org/W2085533912","https://openalex.org/W2096846143","https://openalex.org/W2098266409","https://openalex.org/W2107135371","https://openalex.org/W2109224931","https://openalex.org/W2116065364","https://openalex.org/W2118372007","https://openalex.org/W2118778444","https://openalex.org/W2123770058","https://openalex.org/W2128217000","https://openalex.org/W2128750409","https://openalex.org/W2128785082","https://openalex.org/W2130416896","https://openalex.org/W2132029108","https://openalex.org/W2134867621","https://openalex.org/W2138543759","https://openalex.org/W2157578436","https://openalex.org/W2162863295","https://openalex.org/W2163030488","https://openalex.org/W2164210932","https://openalex.org/W2168386304","https://openalex.org/W2545351092","https://openalex.org/W4230593636"],"related_works":["https://openalex.org/W2164995725","https://openalex.org/W4382490379","https://openalex.org/W2409959017","https://openalex.org/W2348476256","https://openalex.org/W2846133431","https://openalex.org/W2348915282","https://openalex.org/W4287759329","https://openalex.org/W3034750348","https://openalex.org/W2383108529","https://openalex.org/W2964797463"],"abstract_inverted_index":{"Real-time":[0],"network-":[1,100],"and":[2,17,31,49,72,96,101,162,182,188,192,212],"host-based":[3,102],"Anomaly":[4],"Detection":[5],"Systems":[6],"(ADSs)":[7],"transform":[8],"a":[9,27,41,50,62,70,108,132],"continuous":[10],"stream":[11],"of":[12,81,99,203],"input":[13,44],"data":[14],"into":[15,179],"meaningful":[16],"quantifiable":[18],"anomaly":[19,57,104],"scores.":[20],"These":[21],"scores":[22,105],"are":[23,127],"subsequently":[24],"compared":[25],"to":[26,75,106,137,153,159,167],"fixed":[28,51],"detection":[29,58,79,141],"threshold":[30,52,80,87,142,205],"classified":[32],"as":[33],"either":[34],"benign":[35,114],"or":[36],"malicious.":[37],"We":[38,117,148,196],"argue":[39],"that":[40,84],"real-time":[42,146],"ADS\u2019":[43,140],"changes":[45,161],"considerably":[46],"over":[47,186],"time":[48,110],"value":[53],"cannot":[54],"guarantee":[55],"good":[56],"accuracy":[59,214],"for":[60,216],"such":[61],"time-varying":[63],"input.":[64],"In":[65,165],"this":[66,90],"article,":[67],"we":[68,92,172],"propose":[69],"simple":[71],"generic":[73],"technique":[74,209],"adaptively":[76],"tune":[77],"the":[78,119,155,169,174,201,207],"any":[82],"ADS":[83],"works":[85],"on":[86],"method.":[88],"To":[89],"end,":[91],"first":[93],"perform":[94],"statistical":[95,151],"information-theoretic":[97],"analysis":[98],"ADSs\u2019":[103],"reveal":[107],"consistent":[109,213],"correlation":[111,121],"structure":[112,122],"during":[113],"activity":[115],"periods.":[116],"model":[118],"observed":[120],"using":[123],"Markov":[124],"chains,":[125],"which":[126],"in":[128,131,143],"turn":[129],"used":[130],"stochastic":[133],"target":[134],"tracking":[135],"framework":[136],"adapt":[138],"an":[139],"accordance":[144],"with":[145],"measurements.":[147],"also":[149],"use":[150],"techniques":[152],"make":[154],"proposed":[156,170,175,208],"algorithm":[157],"resilient":[158],"sporadic":[160],"evasion":[163],"attacks.":[164],"order":[166],"evaluate":[168,183],"approach,":[171],"incorporate":[173],"adaptive":[176],"thresholding":[177],"module":[178],"multiple":[180],"ADSs":[181,185],"those":[184],"comprehensive":[187],"independently":[189],"collected":[190],"network":[191],"host":[193],"attack":[194],"datasets.":[195],"show":[197],"that,":[198],"while":[199],"reducing":[200],"need":[202],"human":[204],"configuration,":[206],"provides":[210],"considerable":[211],"improvements":[215],"all":[217],"evaluated":[218],"ADSs.":[219]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":4},{"year":2015,"cited_by_count":2},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}