{"id":"https://openalex.org/W4391754923","doi":"https://doi.org/10.3390/network4010004","title":"A Hierarchical Security Event Correlation Model for Real-Time Threat Detection and Response","display_name":"A Hierarchical Security Event Correlation Model for Real-Time Threat Detection and Response","publication_year":2024,"publication_date":"2024-02-11","ids":{"openalex":"https://openalex.org/W4391754923","doi":"https://doi.org/10.3390/network4010004"},"language":"en","primary_location":{"id":"doi:10.3390/network4010004","is_oa":true,"landing_page_url":"https://doi.org/10.3390/network4010004","pdf_url":"https://www.mdpi.com/2673-8732/4/1/4/pdf?version=1707641534","source":{"id":"https://openalex.org/S4210214347","display_name":"Network","issn_l":"2673-8732","issn":["2673-8732"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Network","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2673-8732/4/1/4/pdf?version=1707641534","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5090753664","display_name":"Herbert Maosa","orcid":null},"institutions":[{"id":"https://openalex.org/I126193024","display_name":"London Metropolitan University","ror":"https://ror.org/00ae33288","country_code":"GB","type":"education","lineage":["https://openalex.org/I126193024"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Herbert Maosa","raw_affiliation_strings":["Cyber Security Research Centre, London Metropolitan University, London N7 8DB, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Research Centre, London Metropolitan University, London N7 8DB, UK","institution_ids":["https://openalex.org/I126193024"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014413828","display_name":"Karim Ouazzane","orcid":"https://orcid.org/0000-0002-7129-5809"},"institutions":[{"id":"https://openalex.org/I126193024","display_name":"London Metropolitan University","ror":"https://ror.org/00ae33288","country_code":"GB","type":"education","lineage":["https://openalex.org/I126193024"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Karim Ouazzane","raw_affiliation_strings":["Cyber Security Research Centre, London Metropolitan University, London N7 8DB, UK"],"raw_orcid":"https://orcid.org/0000-0002-7129-5809","affiliations":[{"raw_affiliation_string":"Cyber Security Research Centre, London Metropolitan University, London N7 8DB, UK","institution_ids":["https://openalex.org/I126193024"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101549630","display_name":"Mohamed Chahine Ghanem","orcid":"https://orcid.org/0000-0002-7067-7848"},"institutions":[{"id":"https://openalex.org/I126193024","display_name":"London Metropolitan University","ror":"https://ror.org/00ae33288","country_code":"GB","type":"education","lineage":["https://openalex.org/I126193024"]},{"id":"https://openalex.org/I146655781","display_name":"University of Liverpool","ror":"https://ror.org/04xs57h96","country_code":"GB","type":"education","lineage":["https://openalex.org/I146655781"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Mohamed Chahine Ghanem","raw_affiliation_strings":["Cyber Security Research Centre, London Metropolitan University, London N7 8DB, UK","Department of Computer Science, University of Liverpool, Liverpool L69 3BX, UK"],"raw_orcid":"https://orcid.org/0000-0002-7067-7848","affiliations":[{"raw_affiliation_string":"Cyber Security Research Centre, London Metropolitan University, London N7 8DB, UK","institution_ids":["https://openalex.org/I126193024"]},{"raw_affiliation_string":"Department of Computer Science, University of Liverpool, Liverpool L69 3BX, UK","institution_ids":["https://openalex.org/I146655781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5101549630"],"corresponding_institution_ids":["https://openalex.org/I126193024","https://openalex.org/I146655781"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1114},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1114},"fwci":1.7342,"has_fulltext":true,"cited_by_count":8,"citation_normalized_percentile":{"value":0.83677665,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":"4","issue":"1","first_page":"68","last_page":"90"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.8131897449493408},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7880735993385315},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.7234159708023071},{"id":"https://openalex.org/keywords/correlation","display_name":"Correlation","score":0.685440719127655},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6688160300254822},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5642178058624268},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.45651718974113464},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.2918729782104492}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.8131897449493408},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7880735993385315},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.7234159708023071},{"id":"https://openalex.org/C117220453","wikidata":"https://www.wikidata.org/wiki/Q5172842","display_name":"Correlation","level":2,"score":0.685440719127655},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6688160300254822},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5642178058624268},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.45651718974113464},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2918729782104492},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.3390/network4010004","is_oa":true,"landing_page_url":"https://doi.org/10.3390/network4010004","pdf_url":"https://www.mdpi.com/2673-8732/4/1/4/pdf?version=1707641534","source":{"id":"https://openalex.org/S4210214347","display_name":"Network","issn_l":"2673-8732","issn":["2673-8732"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Network","raw_type":"journal-article"},{"id":"pmh:oai:repository.londonmet.ac.uk:9143","is_oa":true,"landing_page_url":null,"pdf_url":"https://repository.londonmet.ac.uk/9143/7/network-04-00004.pdf","source":{"id":"https://openalex.org/S4306400140","display_name":"London Met Repository (London Metropolitan University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I126193024","host_organization_name":"London Metropolitan University","host_organization_lineage":["https://openalex.org/I126193024"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article"},{"id":"pmh:oai:doaj.org/article:0f195bca2e99412eb56de88e6fc01caf","is_oa":false,"landing_page_url":"https://doaj.org/article/0f195bca2e99412eb56de88e6fc01caf","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Network, Vol 4, Iss 1, Pp 68-90 (2024)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/network4010004","is_oa":true,"landing_page_url":"https://doi.org/10.3390/network4010004","pdf_url":"https://www.mdpi.com/2673-8732/4/1/4/pdf?version=1707641534","source":{"id":"https://openalex.org/S4210214347","display_name":"Network","issn_l":"2673-8732","issn":["2673-8732"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Network","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6700000166893005,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4391754923.pdf"},"referenced_works_count":38,"referenced_works":["https://openalex.org/W351141490","https://openalex.org/W1523270504","https://openalex.org/W1661413208","https://openalex.org/W1674877186","https://openalex.org/W1976326990","https://openalex.org/W1987553702","https://openalex.org/W1998198345","https://openalex.org/W2040153696","https://openalex.org/W2042932500","https://openalex.org/W2068803497","https://openalex.org/W2086787243","https://openalex.org/W2113108516","https://openalex.org/W2115482638","https://openalex.org/W2122269808","https://openalex.org/W2122950928","https://openalex.org/W2129391529","https://openalex.org/W2152449272","https://openalex.org/W2153233077","https://openalex.org/W2160429376","https://openalex.org/W2163277533","https://openalex.org/W2164928285","https://openalex.org/W2171447919","https://openalex.org/W2246402135","https://openalex.org/W2278053035","https://openalex.org/W2486751446","https://openalex.org/W2547552946","https://openalex.org/W2791514401","https://openalex.org/W2910315044","https://openalex.org/W2938891776","https://openalex.org/W2958285686","https://openalex.org/W3011203842","https://openalex.org/W3013549383","https://openalex.org/W3104803508","https://openalex.org/W3119101352","https://openalex.org/W4206614401","https://openalex.org/W4312430101","https://openalex.org/W4389575922","https://openalex.org/W7025163190"],"related_works":["https://openalex.org/W2357468538","https://openalex.org/W1577110157","https://openalex.org/W2355007334","https://openalex.org/W4298130764","https://openalex.org/W2390009783","https://openalex.org/W2804364458","https://openalex.org/W2364419519","https://openalex.org/W2360767377","https://openalex.org/W2017948608","https://openalex.org/W2360951146"],"abstract_inverted_index":{"An":[0],"intrusion":[1,58,137,230],"detection":[2,7,138,231],"system":[3],"(IDS)":[4],"perform":[5],"postcompromise":[6],"of":[8,29,57,91,100,113,132,212,223],"security":[9,38,101],"breaches":[10],"whenever":[11],"preventive":[12],"measures":[13],"such":[14],"as":[15,187,220],"firewalls":[16],"do":[17],"not":[18,170],"avert":[19],"an":[20,136,167,236],"attack.":[21],"However,":[22,69],"these":[23],"systems":[24,79,95],"raise":[25],"a":[26,51,88,120,179,221],"vast":[27],"number":[28,56,131],"alerts":[30,59,62,133,186],"that":[31,53,63,126],"must":[32],"be":[33],"analyzed":[34],"and":[35,46,80,115,161,201,210],"triaged":[36],"by":[37,60,118,135,143,172],"analysts.":[39],"This":[40,140],"process":[41,181],"is":[42,50,72,141,188,205,218],"largely":[43],"manual,":[44],"tedious,":[45],"time-consuming.":[47],"Alert":[48],"correlation":[49,71,117,124,163,180,200,209,234],"technique":[52],"reduces":[54],"the":[55,70,75,83,98,109,130,145,148,156,189,192,208],"aggregating":[61],"are":[64],"similar":[65],"in":[66,191,246],"some":[67],"way.":[68],"performed":[73],"outside":[74],"IDS":[76,84,149],"through":[77,240],"third-party":[78,94],"tools,":[81],"after":[82],"has":[85],"already":[86],"generated":[87],"high":[89],"volume":[90],"alerts.":[92],"These":[93],"add":[96],"to":[97,128,165,207],"complexity":[99],"operations.":[102],"In":[103],"this":[104],"paper,":[105],"we":[106,177],"build":[107],"on":[108,228],"highly":[110],"researched":[111],"area":[112],"alert":[114],"event":[116,123,214],"developing":[119],"novel":[121],"hierarchical":[122],"model":[125,154,217],"promises":[127],"reduce":[129],"issued":[134],"system.":[139],"achieved":[142],"correlating":[144],"events":[146,183],"before":[147],"classifies":[150],"them.":[151],"The":[152,216,233],"proposed":[153],"takes":[155],"best":[157],"features":[158],"from":[159],"similarity":[160],"graph-based":[162],"techniques":[164],"deliver":[166],"ensemble":[168],"capability":[169],"possible":[171],"either":[173],"approach":[174],"separately.":[175],"Further,":[176],"propose":[178],"for":[182],"rather":[184],"than":[185],"case":[190],"current":[193],"art.":[194],"We":[195],"further":[196],"develop":[197],"our":[198],"own":[199],"clustering":[202,211],"algorithm":[203],"which":[204],"tailor-made":[206],"network":[213],"data.":[215],"implemented":[219],"proof":[222],"concept":[224],"with":[225],"experiments":[226],"run":[227],"standard":[229],"sets.":[232],"achieves":[235],"87%":[237],"data":[238],"reduction":[239],"aggregation,":[241],"producing":[242],"nearly":[243],"21,000":[244],"clusters":[245],"about":[247],"30":[248],"s.":[249]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}