{"id":"https://openalex.org/W4304147676","doi":"https://doi.org/10.1145/3567675","title":"AMiner: A Modular Log Data Analysis Pipeline for Anomaly-based Intrusion Detection","display_name":"AMiner: A Modular Log Data Analysis Pipeline for Anomaly-based Intrusion Detection","publication_year":2022,"publication_date":"2022-10-10","ids":{"openalex":"https://openalex.org/W4304147676","doi":"https://doi.org/10.1145/3567675"},"language":"en","primary_location":{"id":"doi:10.1145/3567675","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3567675","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3567675","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3567675","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5072210863","display_name":"Max Landauer","orcid":"https://orcid.org/0000-0003-3813-3151"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Max Landauer","raw_affiliation_strings":["Austrian Institute of Technology, Giefinggasse, Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0003-3813-3151","affiliations":[{"raw_affiliation_string":"Austrian Institute of Technology, Giefinggasse, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029942543","display_name":"Markus Wurzenberger","orcid":"https://orcid.org/0000-0003-3259-6972"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Markus Wurzenberger","raw_affiliation_strings":["Austrian Institute of Technology, Giefinggasse, Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0003-3259-6972","affiliations":[{"raw_affiliation_string":"Austrian Institute of Technology, Giefinggasse, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088439816","display_name":"Florian Skopik","orcid":"https://orcid.org/0000-0002-1922-7892"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Florian Skopik","raw_affiliation_strings":["Austrian Institute of Technology, Giefinggasse, Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0002-1922-7892","affiliations":[{"raw_affiliation_string":"Austrian Institute of Technology, Giefinggasse, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090203198","display_name":"Wolfgang Hotwagner","orcid":"https://orcid.org/0000-0002-2127-4997"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Wolfgang Hotwagner","raw_affiliation_strings":["Austrian Institute of Technology, Giefinggasse, Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0002-2127-4997","affiliations":[{"raw_affiliation_string":"Austrian Institute of Technology, Giefinggasse, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5064406425","display_name":"Georg H\u00f6ld","orcid":"https://orcid.org/0000-0001-5350-8543"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Georg H\u00f6ld","raw_affiliation_strings":["Austrian Institute of Technology, Giefinggasse, Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0001-5350-8543","affiliations":[{"raw_affiliation_string":"Austrian Institute of Technology, Giefinggasse, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I132118926"],"apc_list":null,"apc_paid":null,"fwci":1.8116,"has_fulltext":true,"cited_by_count":17,"citation_normalized_percentile":{"value":0.8499747,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"4","issue":"1","first_page":"1","last_page":"16"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7645281553268433},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7310088872909546},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6970962285995483},{"id":"https://openalex.org/keywords/toolbox","display_name":"Toolbox","score":0.567017138004303},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.5646030306816101},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5487443208694458},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5394324660301208},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.5188504457473755},{"id":"https://openalex.org/keywords/parsing","display_name":"Parsing","score":0.5060858130455017},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.4922460615634918},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.425079345703125},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.42287465929985046},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4196026623249054},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.384981244802475},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.21034497022628784},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.20125523209571838},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.14753252267837524}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7645281553268433},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7310088872909546},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6970962285995483},{"id":"https://openalex.org/C2777655017","wikidata":"https://www.wikidata.org/wiki/Q1501161","display_name":"Toolbox","level":2,"score":0.567017138004303},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.5646030306816101},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5487443208694458},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5394324660301208},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.5188504457473755},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.5060858130455017},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.4922460615634918},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.425079345703125},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.42287465929985046},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4196026623249054},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.384981244802475},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.21034497022628784},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.20125523209571838},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.14753252267837524},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3567675","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3567675","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3567675","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3567675","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3567675","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3567675","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.41999998688697815,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G373965828","display_name":null,"funder_award_id":"SI2.835928","funder_id":"https://openalex.org/F4320335998","funder_display_name":"European Defence Industrial Development Programme"},{"id":"https://openalex.org/G5211829629","display_name":null,"funder_award_id":"873980","funder_id":"https://openalex.org/F4320323031","funder_display_name":"\u00d6sterreichische Forschungsf\u00f6rderungsgesellschaft"},{"id":"https://openalex.org/G5963747278","display_name":null,"funder_award_id":"855457","funder_id":"https://openalex.org/F4320323031","funder_display_name":"\u00d6sterreichische Forschungsf\u00f6rderungsgesellschaft"},{"id":"https://openalex.org/G8059167134","display_name":null,"funder_award_id":"850199","funder_id":"https://openalex.org/F4320337619","funder_display_name":"College of International Security Affairs"}],"funders":[{"id":"https://openalex.org/F4320323031","display_name":"\u00d6sterreichische Forschungsf\u00f6rderungsgesellschaft","ror":"https://ror.org/028jc0449"},{"id":"https://openalex.org/F4320335998","display_name":"European Defence Industrial Development Programme","ror":null},{"id":"https://openalex.org/F4320337619","display_name":"College of International Security Affairs","ror":"https://ror.org/01nqk4x38"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4304147676.pdf","grobid_xml":"https://content.openalex.org/works/W4304147676.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W597074816","https://openalex.org/W1655425503","https://openalex.org/W1992705187","https://openalex.org/W2103378897","https://openalex.org/W2278186031","https://openalex.org/W2743596624","https://openalex.org/W2767094836","https://openalex.org/W2890792016","https://openalex.org/W2915771847","https://openalex.org/W2947815220","https://openalex.org/W2958285686","https://openalex.org/W2988790801","https://openalex.org/W3003372411","https://openalex.org/W3021654819","https://openalex.org/W3035436633","https://openalex.org/W3208688400","https://openalex.org/W4220983750","https://openalex.org/W4243065151","https://openalex.org/W7064111672"],"related_works":["https://openalex.org/W2337148208","https://openalex.org/W3004832009","https://openalex.org/W1971929717","https://openalex.org/W3036013726","https://openalex.org/W1724519426","https://openalex.org/W2061466315","https://openalex.org/W2355532322","https://openalex.org/W2368329025","https://openalex.org/W3157271777","https://openalex.org/W1485296229"],"abstract_inverted_index":{"Cyber":[0],"attacks":[1,71],"are":[2],"omnipresent":[3],"and":[4,21,28,41,91,107,132,143],"their":[5],"rapid":[6],"detection":[7,15,52],"is":[8,34,75,86,100],"crucial":[9],"for":[10,18],"system":[11,83,97],"security.":[12],"Signature-based":[13],"intrusion":[14],"monitors":[16],"systems":[17],"attack":[19,39,46],"indicators":[20],"plays":[22],"an":[23,119],"important":[24],"role":[25],"in":[26,72,88,122,147],"recognizing":[27],"preventing":[29],"such":[30],"attacks.":[31],"Unfortunately,":[32],"it":[33,103],"unable":[35],"to":[36,58,78],"detect":[37,59],"new":[38],"vectors":[40],"may":[42],"be":[43],"evaded":[44],"by":[45],"variants.":[47],"As":[48],"a":[49],"solution,":[50],"anomaly":[51,113],"employs":[53],"techniques":[54],"from":[55],"machine":[56],"learning":[57],"suspicious":[60],"log":[61,84,98,129],"events":[62],"without":[63],"relying":[64],"on":[65],"predefined":[66],"signatures.":[67],"While":[68],"visibility":[69],"of":[70,80],"network":[73,81],"traffic":[74],"limited":[76],"due":[77],"encryption":[79],"packets,":[82],"data":[85],"available":[87],"raw":[89],"format":[90],"thus":[92],"allows":[93],"fine-granular":[94],"analysis.":[95],"However,":[96],"processing":[99],"difficult":[101],"as":[102],"involves":[104],"different":[105],"formats":[106],"heterogeneous":[108],"events.":[109],"To":[110],"ease":[111],"log-based":[112],"detection,":[114],"we":[115,137],"present":[116],"the":[117,123,139],"AMiner,":[118],"open-source":[120],"tool":[121],"AECID":[124],"toolbox":[125],"that":[126],"enables":[127],"fast":[128],"parsing,":[130],"analysis,":[131],"alerting.":[133],"In":[134],"this":[135],"article,":[136],"outline":[138],"AMiner\u2019s":[140],"modular":[141],"architecture":[142],"demonstrate":[144],"its":[145],"applicability":[146],"three":[148],"use-cases.":[149]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":7}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}