{"id":"https://openalex.org/W2497724396","doi":"https://doi.org/10.1147/jrd.2016.2571580","title":"Closing the loop: Network and in-host monitoring tandem for comprehensive cloud security visibility","display_name":"Closing the loop: Network and in-host monitoring tandem for comprehensive cloud security visibility","publication_year":2016,"publication_date":"2016-07-01","ids":{"openalex":"https://openalex.org/W2497724396","doi":"https://doi.org/10.1147/jrd.2016.2571580","mag":"2497724396"},"language":"en","primary_location":{"id":"doi:10.1147/jrd.2016.2571580","is_oa":false,"landing_page_url":"https://doi.org/10.1147/jrd.2016.2571580","pdf_url":null,"source":{"id":"https://openalex.org/S4210219925","display_name":"IBM Journal of Research and Development","issn_l":"0018-8646","issn":["0018-8646","2151-8556"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320652","host_organization_name":"IBM","host_organization_lineage":["https://openalex.org/P4310320652"],"host_organization_lineage_names":["IBM"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IBM Journal of Research and Development","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073346023","display_name":"Stefan Berger","orcid":"https://orcid.org/0000-0002-0461-2640"},"institutions":[{"id":"https://openalex.org/I4210114115","display_name":"IBM Research - Thomas J. Watson Research Center","ror":"https://ror.org/0265w5591","country_code":"US","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"S. Berger","raw_affiliation_strings":["IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA","institution_ids":["https://openalex.org/I4210114115"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020584849","display_name":"Yaohua Chen","orcid":"https://orcid.org/0000-0003-1778-1790"},"institutions":[{"id":"https://openalex.org/I4210119109","display_name":"Indiana University Bloomington","ror":"https://ror.org/02k40bc56","country_code":"US","type":"education","lineage":["https://openalex.org/I4210119109","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Y. Chen","raw_affiliation_strings":["Indiana University Bloomington, Bloomington, IN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Indiana University Bloomington, Bloomington, IN, USA","institution_ids":["https://openalex.org/I4210119109"]}]},{"author_position":"middle","author":{"id":null,"display_name":"X. Hu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210114115","display_name":"IBM Research - Thomas J. Watson Research Center","ror":"https://ror.org/0265w5591","country_code":"US","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"X. Hu","raw_affiliation_strings":["IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA","institution_ids":["https://openalex.org/I4210114115"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006668000","display_name":"Dimitrios Pendarakis","orcid":null},"institutions":[{"id":"https://openalex.org/I4210114115","display_name":"IBM Research - Thomas J. Watson Research Center","ror":"https://ror.org/0265w5591","country_code":"US","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"D. Pendarakis","raw_affiliation_strings":["IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA","institution_ids":["https://openalex.org/I4210114115"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110258544","display_name":"J. R. Rao","orcid":null},"institutions":[{"id":"https://openalex.org/I4210114115","display_name":"IBM Research - Thomas J. Watson Research Center","ror":"https://ror.org/0265w5591","country_code":"US","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"J. R. Rao","raw_affiliation_strings":["IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA","institution_ids":["https://openalex.org/I4210114115"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015743671","display_name":"Reiner Sailer","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"R. Sailer","raw_affiliation_strings":["Brown Brothers Harriman, Jersey City, NJ, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Brown Brothers Harriman, Jersey City, NJ, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109894761","display_name":"Douglas Lee Schales","orcid":null},"institutions":[{"id":"https://openalex.org/I4210114115","display_name":"IBM Research - Thomas J. Watson Research Center","ror":"https://ror.org/0265w5591","country_code":"US","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"D. L. Schales","raw_affiliation_strings":["IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA","institution_ids":["https://openalex.org/I4210114115"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028670480","display_name":"Marc Ph. Stoecklin","orcid":null},"institutions":[{"id":"https://openalex.org/I4210114115","display_name":"IBM Research - Thomas J. Watson Research Center","ror":"https://ror.org/0265w5591","country_code":"US","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"M. P. Stoecklin","raw_affiliation_strings":["IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research Division, Thomas J. Watson Research Center, Yorktown Heights, NY, USA","institution_ids":["https://openalex.org/I4210114115"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.5666,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.71639806,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"60","issue":"4","first_page":"10:1","last_page":"10:12"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.8782994747161865},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7251282930374146},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.7176868915557861},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5982198119163513},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5792667865753174},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.5275672674179077},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.4882209599018097},{"id":"https://openalex.org/keywords/visibility","display_name":"Visibility","score":0.4402885437011719},{"id":"https://openalex.org/keywords/big-data","display_name":"Big data","score":0.4372144639492035},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4299425780773163},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4222645163536072},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.25466984510421753},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.12550219893455505}],"concepts":[{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.8782994747161865},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7251282930374146},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7176868915557861},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5982198119163513},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5792667865753174},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.5275672674179077},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.4882209599018097},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.4402885437011719},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.4372144639492035},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4299425780773163},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4222645163536072},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.25466984510421753},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.12550219893455505},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1147/jrd.2016.2571580","is_oa":false,"landing_page_url":"https://doi.org/10.1147/jrd.2016.2571580","pdf_url":null,"source":{"id":"https://openalex.org/S4210219925","display_name":"IBM Journal of Research and Development","issn_l":"0018-8646","issn":["0018-8646","2151-8556"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320652","host_organization_name":"IBM","host_organization_lineage":["https://openalex.org/P4310320652"],"host_organization_lineage_names":["IBM"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IBM Journal of Research and Development","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/8","display_name":"Decent work and economic growth","score":0.6000000238418579}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https://openalex.org/W1941427975","https://openalex.org/W1963669090","https://openalex.org/W1970394296","https://openalex.org/W1980501414","https://openalex.org/W1983559153","https://openalex.org/W2082623495","https://openalex.org/W2087359098","https://openalex.org/W2123941465","https://openalex.org/W2124808847","https://openalex.org/W2131646073","https://openalex.org/W2169685348","https://openalex.org/W2202153817","https://openalex.org/W3201324407"],"related_works":["https://openalex.org/W2392812199","https://openalex.org/W4200176076","https://openalex.org/W598185802","https://openalex.org/W2097492617","https://openalex.org/W2355516524","https://openalex.org/W2361471170","https://openalex.org/W2025616642","https://openalex.org/W2753240997","https://openalex.org/W1954972543","https://openalex.org/W1764168690"],"abstract_inverted_index":{"Cloud":[0],"computing":[1,55,94],"has":[2],"not":[3],"only":[4],"become":[5],"attractive":[6],"for":[7,13],"organizations":[8],"and":[9,41,147,161],"end-users":[10],"but":[11,85,111],"also":[12],"attackers":[14],"that":[15],"use":[16],"cloud":[17,26,54,93,185],"environments":[18,56],"to":[19,75,90,141,151],"exploit":[20],"the":[21,82,113,119,159,164],"offered":[22],"economies":[23],"of":[24,29,33,105,116,163,168,171],"scale\u2014a":[25],"environment":[27],"consists":[28],"a":[30,49,108,124,127,169,172,182],"large":[31],"set":[32],"systems":[34],"with":[35,67],"an":[36,59],"excellent":[37],"network":[38,64,71,83],"connectivity":[39],"setup":[40],"similar":[42],"configurations.":[43],"In":[44,96],"this":[45],"paper,":[46],"we":[47],"propose":[48],"comprehensive":[50],"approach":[51,130],"towards":[52],"monitoring":[53,65,72,101],"by":[57,166],"building":[58],"awareness":[60],"framework":[61,165],"combining":[62,131],"passive":[63],"principles":[66],"in-host":[68,98],"monitoring.":[69],"Passive":[70],"is":[73],"able":[74],"detect":[76,142],"suspicious":[77],"activities":[78],"from":[79],"observations":[80],"on":[81,92,133,181],"layer":[84],"cannot":[86],"provide":[87,148],"any":[88],"attribution":[89],"processes":[91],"instances.":[95],"contrast,":[97],"auditing":[99],"subsystem":[100],"provides":[102],"fine-grained":[103],"information":[104],"events":[106,117],"within":[107],"given":[109],"instance":[110],"misses":[112],"higher-level":[114],"perspective":[115],"across":[118],"environment.":[120,186],"We":[121,157],"have":[122],"devised":[123],"system":[125],"using":[126],"big":[128],"data":[129],"analytics":[132,137],"both":[134],"levels.":[135],"The":[136],"complement":[138],"each":[139],"other":[140],"advanced":[143,174],"cyber":[144],"security":[145,152],"attacks":[146],"contextual":[149],"links":[150],"analysts":[153],"investigating":[154],"these":[155],"attacks.":[156],"demonstrate":[158],"utility":[160],"efficacy":[162],"means":[167],"study":[170],"sophisticated":[173],"persistent":[175],"threat":[176],"style":[177],"internal":[178],"spear-phishing":[179],"attack":[180],"large-scale":[183],"productive":[184]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2016,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}