{"id":"https://openalex.org/W3031331424","doi":"https://doi.org/10.1145/3396743.3396787","title":"Automated Monitoring and Behavior Analysis for Proactive Security Operations","display_name":"Automated Monitoring and Behavior Analysis for Proactive Security Operations","publication_year":2020,"publication_date":"2020-04-07","ids":{"openalex":"https://openalex.org/W3031331424","doi":"https://doi.org/10.1145/3396743.3396787","mag":"3031331424"},"language":"en","primary_location":{"id":"doi:10.1145/3396743.3396787","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3396743.3396787","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2020 2nd International Conference on Management Science and Industrial Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5079645035","display_name":"Vitsunee Teeraratchakarn","orcid":null},"institutions":[{"id":"https://openalex.org/I158708052","display_name":"Chulalongkorn University","ror":"https://ror.org/028wp3y58","country_code":"TH","type":"education","lineage":["https://openalex.org/I158708052"]}],"countries":["TH"],"is_corresponding":false,"raw_author_name":"Vitsunee Teeraratchakarn","raw_affiliation_strings":["Department of Computer Engineering, Chulalongkorn University, Bangkok Thailand"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Chulalongkorn University, Bangkok Thailand","institution_ids":["https://openalex.org/I158708052"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5034606101","display_name":"Yachai Limpiyakorn","orcid":"https://orcid.org/0000-0002-9370-5426"},"institutions":[{"id":"https://openalex.org/I158708052","display_name":"Chulalongkorn University","ror":"https://ror.org/028wp3y58","country_code":"TH","type":"education","lineage":["https://openalex.org/I158708052"]}],"countries":["TH"],"is_corresponding":false,"raw_author_name":"Yachai Limpiyakorn","raw_affiliation_strings":["Department of Computer Engineering, Chulalongkorn University, Bangkok Thailand"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Chulalongkorn University, Bangkok Thailand","institution_ids":["https://openalex.org/I158708052"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I158708052"],"apc_list":null,"apc_paid":null,"fwci":0.9368,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.6898418,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"105","last_page":"109"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9968000054359436,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9797000288963318,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8174819946289062},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.7198506593704224},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.5785223245620728},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.5699704885482788},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5092288255691528},{"id":"https://openalex.org/keywords/unix","display_name":"Unix","score":0.44118908047676086},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.4283221364021301},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.42512527108192444},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.41212576627731323},{"id":"https://openalex.org/keywords/network-administrator","display_name":"Network administrator","score":0.4115253686904907},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.1536967158317566}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8174819946289062},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.7198506593704224},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.5785223245620728},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.5699704885482788},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5092288255691528},{"id":"https://openalex.org/C112968700","wikidata":"https://www.wikidata.org/wiki/Q11368","display_name":"Unix","level":3,"score":0.44118908047676086},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.4283221364021301},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.42512527108192444},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.41212576627731323},{"id":"https://openalex.org/C2779173999","wikidata":"https://www.wikidata.org/wiki/Q680296","display_name":"Network administrator","level":2,"score":0.4115253686904907},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.1536967158317566}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3396743.3396787","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3396743.3396787","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2020 2nd International Conference on Management Science and Industrial Engineering","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6700000166893005,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":2,"referenced_works":["https://openalex.org/W2794463916","https://openalex.org/W2886752452"],"related_works":["https://openalex.org/W1522996108","https://openalex.org/W2469507153","https://openalex.org/W2008790809","https://openalex.org/W2768892939","https://openalex.org/W3164408430","https://openalex.org/W4285507391","https://openalex.org/W2397240470","https://openalex.org/W2602767565","https://openalex.org/W170652726","https://openalex.org/W2883822334"],"abstract_inverted_index":{"This":[0],"research":[1],"presents":[2],"a":[3,81,103,126],"method":[4],"for":[5,116,130],"discovery":[6],"of":[7,74,83,87,165],"malware":[8],"trapped":[9],"in":[10,160],"Honeypot":[11],"bait.":[12],"The":[13,54,137,157,180],"focus":[14],"is":[15,29,89,105,125],"the":[16,20,46,72,96,108,112,144,152,172,186],"network":[17],"intrusion":[18],"on":[19],"Unix":[21],"or":[22,49,100,134,155,167],"Linux":[23],"operating":[24],"system.":[25],"A":[26],"process":[27],"flow":[28],"introduced":[30],"to":[31,94,171,185],"facilitate":[32],"collecting,":[33],"analyzing,":[34],"and":[35,41,69,190],"classifying":[36],"cyberattack":[37],"patterns.":[38],"Log":[39],"management":[40],"analytics":[42],"are":[43,58,176],"performed":[44],"with":[45],"Elastic":[47],"Stack":[48],"formerly":[50],"known":[51],"as":[52,178],"ELK.":[53],"data":[55],"logs":[56],"(cowire.log)":[57],"periodically":[59],"collected":[60],"from":[61],"Honeypot,":[62],"then":[63],"they":[64],"will":[65,114,139],"be":[66],"filtered,":[67],"formatted,":[68],"inspected":[70],"through":[71],"execution":[73],"shell":[75],"scripts.":[76],"To":[77],"detect":[78],"suspicious":[79,132,153],"commands,":[80],"set":[82],"rules":[84],"containing":[85],"groups":[86,175],"commands":[88,92],"defined.":[90],"These":[91],"seem":[93],"cause":[95],"organization's":[97,187],"assets":[98],"vulnerable":[99],"harmful.":[101],"If":[102],"command":[104,109,173],"found":[106],"matching":[107],"risk":[110,174],"group,":[111],"system":[113],"analyze":[115],"its":[117],"attack":[118],"pattern":[119],"by":[120],"querying":[121],"VirusTotal":[122,124],"database.":[123],"free":[127],"Sandboxing":[128],"service":[129],"analyzing":[131],"files":[133,168],"URLs":[135,166],"online.":[136],"API":[138],"return":[140],"analysis":[141],"reports":[142],"all":[143],"antivirus":[145],"application":[146],"engines":[147],"that":[148,169],"have":[149],"previously":[150],"scanned":[151],"file":[154],"URL.":[156],"experimental":[158],"result":[159],"this":[161],"work":[162],"reported":[163],"86%":[164],"belong":[170],"considered":[177],"threats.":[179],"analytic":[181],"results":[182],"would":[183],"contribute":[184],"security":[188,192],"policies":[189],"proactive":[191],"operations":[193],"development":[194],"afterwards.":[195]},"counts_by_year":[{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}