{"id":"https://openalex.org/W4398186405","doi":"https://doi.org/10.1145/3605098.3635981","title":"Finding Harmony in the Noise: Blending Security Alerts for Attack Detection","display_name":"Finding Harmony in the Noise: Blending Security Alerts for Attack Detection","publication_year":2024,"publication_date":"2024-04-08","ids":{"openalex":"https://openalex.org/W4398186405","doi":"https://doi.org/10.1145/3605098.3635981"},"language":"en","primary_location":{"id":"doi:10.1145/3605098.3635981","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605098.3635981","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605098.3635981","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3605098.3635981","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089910300","display_name":"T. Roelofs","orcid":"https://orcid.org/0009-0004-6152-4374"},"institutions":[{"id":"https://openalex.org/I4210148881","display_name":"ING Bank","ror":"https://ror.org/059et9981","country_code":"NL","type":"other","lineage":["https://openalex.org/I4210148881"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Tom-Martijn Roelofs","raw_affiliation_strings":["ING Bank, Amsterdam, Netherlands"],"raw_orcid":"https://orcid.org/0009-0004-6152-4374","affiliations":[{"raw_affiliation_string":"ING Bank, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I4210148881"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089240717","display_name":"Eduardo B\u00e1rbaro","orcid":"https://orcid.org/0000-0001-7878-2514"},"institutions":[{"id":"https://openalex.org/I4210148881","display_name":"ING Bank","ror":"https://ror.org/059et9981","country_code":"NL","type":"other","lineage":["https://openalex.org/I4210148881"]},{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Eduardo Barbaro","raw_affiliation_strings":["ING Bank, Amsterdam, Netherlands","TU Delft, Delft, Netherlands","ING Bank, Amsterdam, Netherlands TU Delft, Delft, Netherlands"],"raw_orcid":"https://orcid.org/0000-0001-7878-2514","affiliations":[{"raw_affiliation_string":"ING Bank, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I4210148881"]},{"raw_affiliation_string":"TU Delft, Delft, Netherlands","institution_ids":["https://openalex.org/I98358874"]},{"raw_affiliation_string":"ING Bank, Amsterdam, Netherlands TU Delft, Delft, Netherlands","institution_ids":["https://openalex.org/I4210148881","https://openalex.org/I98358874"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098737788","display_name":"Svetlana Pekarskikh","orcid":"https://orcid.org/0009-0002-4651-5854"},"institutions":[{"id":"https://openalex.org/I4210148881","display_name":"ING Bank","ror":"https://ror.org/059et9981","country_code":"NL","type":"other","lineage":["https://openalex.org/I4210148881"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Svetlana Pekarskikh","raw_affiliation_strings":["ING Bank, Amsterdam, Netherlands"],"raw_orcid":"https://orcid.org/0009-0002-4651-5854","affiliations":[{"raw_affiliation_string":"ING Bank, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I4210148881"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098737789","display_name":"Katarzyna Orzechowska","orcid":"https://orcid.org/0009-0009-0741-4592"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Katarzyna Orzechowska","raw_affiliation_strings":["ING Bank, Katowice, Poland"],"raw_orcid":"https://orcid.org/0009-0009-0741-4592","affiliations":[{"raw_affiliation_string":"ING Bank, Katowice, Poland","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098737790","display_name":"Marta Kwapie\u0144","orcid":"https://orcid.org/0009-0002-4202-5057"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Marta Kwapie\u0144","raw_affiliation_strings":["ING Bank, Katowice, Poland"],"raw_orcid":"https://orcid.org/0009-0002-4202-5057","affiliations":[{"raw_affiliation_string":"ING Bank, Katowice, Poland","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098737791","display_name":"Jakub Tyrlik","orcid":"https://orcid.org/0009-0002-3010-2000"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jakub Tyrlik","raw_affiliation_strings":["ING Bank, Katowice, Poland"],"raw_orcid":"https://orcid.org/0009-0002-3010-2000","affiliations":[{"raw_affiliation_string":"ING Bank, Katowice, Poland","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057097206","display_name":"Dinu Smadu","orcid":"https://orcid.org/0009-0004-6572-9131"},"institutions":[{"id":"https://openalex.org/I4210148881","display_name":"ING Bank","ror":"https://ror.org/059et9981","country_code":"NL","type":"other","lineage":["https://openalex.org/I4210148881"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Dinu Smadu","raw_affiliation_strings":["ING Bank, Amsterdam, Netherlands"],"raw_orcid":"https://orcid.org/0009-0004-6572-9131","affiliations":[{"raw_affiliation_string":"ING Bank, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I4210148881"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012946294","display_name":"Michel van Eeten","orcid":"https://orcid.org/0000-0002-0338-2812"},"institutions":[{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Michel Van Eeten","raw_affiliation_strings":["TU Delft, Delft, Netherlands"],"raw_orcid":"https://orcid.org/0000-0002-0338-2812","affiliations":[{"raw_affiliation_string":"TU Delft, Delft, Netherlands","institution_ids":["https://openalex.org/I98358874"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000936454","display_name":"Yury Zhauniarovich","orcid":"https://orcid.org/0000-0001-9116-0728"},"institutions":[{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Yury Zhauniarovich","raw_affiliation_strings":["TU Delft, Delft, Netherlands"],"raw_orcid":"https://orcid.org/0000-0001-9116-0728","affiliations":[{"raw_affiliation_string":"TU Delft, Delft, Netherlands","institution_ids":["https://openalex.org/I98358874"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.351,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.92796729,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1385","last_page":"1394"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6933736205101013},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6049597263336182},{"id":"https://openalex.org/keywords/harmony","display_name":"Harmony (color)","score":0.555553674697876},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.47719964385032654},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.14862477779388428}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6933736205101013},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6049597263336182},{"id":"https://openalex.org/C2776453491","wikidata":"https://www.wikidata.org/wiki/Q5659234","display_name":"Harmony (color)","level":2,"score":0.555553674697876},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.47719964385032654},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.14862477779388428},{"id":"https://openalex.org/C153349607","wikidata":"https://www.wikidata.org/wiki/Q36649","display_name":"Visual arts","level":1,"score":0.0},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.0},{"id":"https://openalex.org/C142362112","wikidata":"https://www.wikidata.org/wiki/Q735","display_name":"Art","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3605098.3635981","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605098.3635981","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605098.3635981","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3605098.3635981","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605098.3635981","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605098.3635981","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.44999998807907104,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4398186405.pdf"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W292952644","https://openalex.org/W1521858400","https://openalex.org/W1678356000","https://openalex.org/W2084413241","https://openalex.org/W2109553965","https://openalex.org/W2111877895","https://openalex.org/W2118978333","https://openalex.org/W2127665210","https://openalex.org/W2155926039","https://openalex.org/W2342408547","https://openalex.org/W2620760558","https://openalex.org/W2792581684","https://openalex.org/W2797893620","https://openalex.org/W2800788706","https://openalex.org/W2914874661","https://openalex.org/W2926701059","https://openalex.org/W2946893466","https://openalex.org/W2962874122","https://openalex.org/W2963518686","https://openalex.org/W2974504164","https://openalex.org/W2983525363","https://openalex.org/W2999179616","https://openalex.org/W2999309192","https://openalex.org/W3011249019","https://openalex.org/W3043844898","https://openalex.org/W3088668959","https://openalex.org/W3096062596","https://openalex.org/W3150880484","https://openalex.org/W3170571736","https://openalex.org/W3179245071","https://openalex.org/W3196325333","https://openalex.org/W3206325220","https://openalex.org/W4220983750","https://openalex.org/W4221018331","https://openalex.org/W4225596160","https://openalex.org/W4229848917","https://openalex.org/W4251879866","https://openalex.org/W4292979862","https://openalex.org/W4301329292","https://openalex.org/W4376479183"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2748952813","https://openalex.org/W4321448422","https://openalex.org/W2382969832","https://openalex.org/W2348535019","https://openalex.org/W963778612","https://openalex.org/W2376836472","https://openalex.org/W2379879936","https://openalex.org/W2388675254","https://openalex.org/W620586615"],"abstract_inverted_index":{"Large-":[0],"and":[1,23,30,38,55],"medium-sized":[2],"organizations":[3],"employ":[4],"various":[5],"security":[6,43,69,95,185],"systems":[7,70,186],"to":[8,35,49,63,106,198,226],"protect":[9],"their":[10],"assets.":[11],"These":[12],"systems,":[13],"often":[14,41],"developed":[15],"by":[16,40,52,80,101],"different":[17,21,94,184],"vendors,":[18],"focus":[19],"on":[20,162,179,217],"threats":[22],"usually":[24],"work":[25,46],"independently.":[26],"They":[27],"generate":[28,107],"separate":[29],"voluminous":[31],"alerts":[32,154],"that":[33,146],"have":[34],"be":[36],"monitored":[37],"analyzed":[39],"overburdened":[42],"analysts.":[44],"Prior":[45],"has":[47,223],"tried":[48],"support":[50],"analysts":[51,139,202],"better":[53],"correlating":[54],"prioritizing":[56],"alerts.":[57],"In":[58],"this":[59],"work,":[60],"we":[61,113],"propose":[62],"combine":[64],"the":[65,82,121,128,132,151,177,183,188,218,227],"wisdom":[66],"of":[67,126,131,153,176,190],"individual":[68],"using":[71,102,127],"an":[72,212],"Integration":[73],"Layer":[74],"(IL).":[75],"We":[76,98,144],"validated":[77],"our":[78,115,147,191,199,221],"idea":[79],"deploying":[81],"IL":[83],"in":[84,141],"a":[85,206],"large":[86],"global":[87],"organization":[88],"(50,000+":[89],"employees)":[90],"running":[91],"four":[92],"very":[93,159],"detection":[96,165],"systems.":[97],"did":[99],"so":[100],"end-to-end":[103],"red-team":[104],"exercises":[105],"real":[108],"attack":[109,164,213],"data.":[110],"For":[111],"training,":[112],"labeled":[114],"dataset":[116],"with":[117],"evaluations":[118],"directly":[119],"from":[120,182],"incident":[122],"response":[123],"team":[124],"instead":[125],"escalated":[129],"decisions":[130],"first/second":[133],"tier":[134],"Security":[135],"Operation":[136],"Center":[137],"(SOC)":[138],"as":[140,211],"prior":[142],"works.":[143],"showed":[145],"approach":[148,222],"considerably":[149],"reduces":[150],"number":[152],"requiring":[155],"investigation":[156],"while":[157],"maintaining":[158],"high":[160],"performance":[161],"multi-step":[163],"-":[166],"Matthews":[167],"correlation":[168],"coefficient":[169],"(MCC)":[170],"reaches":[171],"0.998.":[172],"The":[173,194],"substantial":[174],"dependence":[175],"model":[178],"features":[180],"derived":[181],"supports":[187],"viability":[189],"integration":[192],"methodology.":[193],"explainability":[195],"layer":[196],"added":[197,225],"system":[200],"gives":[201],"insights":[203],"into":[204],"why":[205],"particular":[207],"case":[208],"is":[209],"marked":[210],"or":[214],"non-attack.":[215],"Based":[216],"test":[219],"results,":[220],"been":[224],"production":[228],"setup.":[229]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}