{"id":"https://openalex.org/W4395002507","doi":"https://doi.org/10.3390/s24082636","title":"Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection","display_name":"Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection","publication_year":2024,"publication_date":"2024-04-20","ids":{"openalex":"https://openalex.org/W4395002507","doi":"https://doi.org/10.3390/s24082636","pmid":"https://pubmed.ncbi.nlm.nih.gov/38676253"},"language":"en","primary_location":{"id":"doi:10.3390/s24082636","is_oa":true,"landing_page_url":"https://doi.org/10.3390/s24082636","pdf_url":"https://www.mdpi.com/1424-8220/24/8/2636/pdf?version=1713605233","source":{"id":"https://openalex.org/S101949793","display_name":"Sensors","issn_l":"1424-8220","issn":["1424-8220"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Sensors","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1424-8220/24/8/2636/pdf?version=1713605233","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064558200","display_name":"Adrian Komadina","orcid":"https://orcid.org/0000-0003-1243-7149"},"institutions":[{"id":"https://openalex.org/I181343428","display_name":"University of Zagreb","ror":"https://ror.org/00mv6sv71","country_code":"HR","type":"education","lineage":["https://openalex.org/I181343428"]}],"countries":["HR"],"is_corresponding":true,"raw_author_name":"Adrian Komadina","raw_affiliation_strings":["Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia"],"raw_orcid":"https://orcid.org/0000-0003-1243-7149","affiliations":[{"raw_affiliation_string":"Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia","institution_ids":["https://openalex.org/I181343428"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103132847","display_name":"Ivan Kova\u010devi\u0107","orcid":"https://orcid.org/0000-0003-1090-9018"},"institutions":[{"id":"https://openalex.org/I181343428","display_name":"University of Zagreb","ror":"https://ror.org/00mv6sv71","country_code":"HR","type":"education","lineage":["https://openalex.org/I181343428"]}],"countries":["HR"],"is_corresponding":false,"raw_author_name":"Ivan Kova\u010devi\u0107","raw_affiliation_strings":["Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia"],"raw_orcid":"https://orcid.org/0000-0003-1090-9018","affiliations":[{"raw_affiliation_string":"Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia","institution_ids":["https://openalex.org/I181343428"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017512952","display_name":"Bruno \u0160tengl","orcid":"https://orcid.org/0009-0009-9785-2069"},"institutions":[{"id":"https://openalex.org/I181343428","display_name":"University of Zagreb","ror":"https://ror.org/00mv6sv71","country_code":"HR","type":"education","lineage":["https://openalex.org/I181343428"]}],"countries":["HR"],"is_corresponding":false,"raw_author_name":"Bruno \u0160tengl","raw_affiliation_strings":["Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia"],"raw_orcid":"https://orcid.org/0009-0009-9785-2069","affiliations":[{"raw_affiliation_string":"Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia","institution_ids":["https://openalex.org/I181343428"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5023734196","display_name":"Stjepan Gro\u0161","orcid":"https://orcid.org/0000-0001-6619-2859"},"institutions":[{"id":"https://openalex.org/I181343428","display_name":"University of Zagreb","ror":"https://ror.org/00mv6sv71","country_code":"HR","type":"education","lineage":["https://openalex.org/I181343428"]}],"countries":["HR"],"is_corresponding":false,"raw_author_name":"Stjepan Gro\u0161","raw_affiliation_strings":["Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia"],"raw_orcid":"https://orcid.org/0000-0001-6619-2859","affiliations":[{"raw_affiliation_string":"Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia","institution_ids":["https://openalex.org/I181343428"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5064558200"],"corresponding_institution_ids":["https://openalex.org/I181343428"],"apc_list":{"value":2400,"currency":"CHF","value_usd":2673},"apc_paid":{"value":2400,"currency":"CHF","value_usd":2673},"fwci":1.5175,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.81883249,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"24","issue":"8","first_page":"2636","last_page":"2636"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7811281681060791},{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.7235558032989502},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6586748361587524},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.6499775052070618},{"id":"https://openalex.org/keywords/firewall","display_name":"Firewall (physics)","score":0.6075230836868286},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5986472368240356},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5846023559570312},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.44396695494651794},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.41165751218795776},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.09966370463371277},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.07571443915367126}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7811281681060791},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.7235558032989502},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6586748361587524},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.6499775052070618},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.6075230836868286},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5986472368240356},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5846023559570312},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.44396695494651794},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.41165751218795776},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.09966370463371277},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.07571443915367126},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C183915046","wikidata":"https://www.wikidata.org/wiki/Q1316152","display_name":"Charged black hole","level":4,"score":0.0},{"id":"https://openalex.org/C104062141","wikidata":"https://www.wikidata.org/wiki/Q2601295","display_name":"Extremal black hole","level":3,"score":0.0},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.3390/s24082636","is_oa":true,"landing_page_url":"https://doi.org/10.3390/s24082636","pdf_url":"https://www.mdpi.com/1424-8220/24/8/2636/pdf?version=1713605233","source":{"id":"https://openalex.org/S101949793","display_name":"Sensors","issn_l":"1424-8220","issn":["1424-8220"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Sensors","raw_type":"journal-article"},{"id":"pmid:38676253","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/38676253","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Sensors (Basel, Switzerland)","raw_type":null},{"id":"pmh:oai:pubmedcentral.nih.gov:11054483","is_oa":true,"landing_page_url":"https://www.ncbi.nlm.nih.gov/pmc/articles/11054483","pdf_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC11054483/pdf/sensors-24-02636.pdf","source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Sensors (Basel)","raw_type":"Text"},{"id":"pmh:oai:doaj.org/article:2e46536213214e9ca727c4072058894b","is_oa":false,"landing_page_url":"https://doaj.org/article/2e46536213214e9ca727c4072058894b","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Sensors, Vol 24, Iss 8, p 2636 (2024)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/s24082636","is_oa":true,"landing_page_url":"https://doi.org/10.3390/s24082636","pdf_url":"https://www.mdpi.com/1424-8220/24/8/2636/pdf?version=1713605233","source":{"id":"https://openalex.org/S101949793","display_name":"Sensors","issn_l":"1424-8220","issn":["1424-8220"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Sensors","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4395002507.pdf"},"referenced_works_count":102,"referenced_works":["https://openalex.org/W27721215","https://openalex.org/W148963669","https://openalex.org/W187043655","https://openalex.org/W317957491","https://openalex.org/W1242748811","https://openalex.org/W1516135399","https://openalex.org/W1608271640","https://openalex.org/W1963868908","https://openalex.org/W1966716734","https://openalex.org/W1968684660","https://openalex.org/W2007087405","https://openalex.org/W2019014808","https://openalex.org/W2031163547","https://openalex.org/W2043178675","https://openalex.org/W2046608104","https://openalex.org/W2049058890","https://openalex.org/W2056081083","https://openalex.org/W2065494076","https://openalex.org/W2069051541","https://openalex.org/W2089647250","https://openalex.org/W2092834372","https://openalex.org/W2094695746","https://openalex.org/W2105642232","https://openalex.org/W2108513376","https://openalex.org/W2110784166","https://openalex.org/W2113060550","https://openalex.org/W2132870739","https://openalex.org/W2141200504","https://openalex.org/W2141254179","https://openalex.org/W2150772902","https://openalex.org/W2156204309","https://openalex.org/W2158262405","https://openalex.org/W2263741877","https://openalex.org/W2291057794","https://openalex.org/W2296509296","https://openalex.org/W2296719434","https://openalex.org/W2336788611","https://openalex.org/W2401501243","https://openalex.org/W2487770199","https://openalex.org/W2560021099","https://openalex.org/W2585052423","https://openalex.org/W2597441556","https://openalex.org/W2601474892","https://openalex.org/W2615133144","https://openalex.org/W2755038437","https://openalex.org/W2755464334","https://openalex.org/W2766183090","https://openalex.org/W2770942607","https://openalex.org/W2789828921","https://openalex.org/W2797283471","https://openalex.org/W2885391676","https://openalex.org/W2887132990","https://openalex.org/W2888728157","https://openalex.org/W2899653275","https://openalex.org/W2911200746","https://openalex.org/W2914740624","https://openalex.org/W2919221886","https://openalex.org/W2940498460","https://openalex.org/W2940734441","https://openalex.org/W2952780781","https://openalex.org/W2963307331","https://openalex.org/W2963445059","https://openalex.org/W2963887617","https://openalex.org/W2966559104","https://openalex.org/W3012375038","https://openalex.org/W3014071235","https://openalex.org/W3035344630","https://openalex.org/W3082263548","https://openalex.org/W3083140882","https://openalex.org/W3093103057","https://openalex.org/W3111734087","https://openalex.org/W3119524937","https://openalex.org/W3128465814","https://openalex.org/W3133235094","https://openalex.org/W3160599825","https://openalex.org/W3164952570","https://openalex.org/W3171200908","https://openalex.org/W3187878879","https://openalex.org/W3194394634","https://openalex.org/W3195219267","https://openalex.org/W3198411072","https://openalex.org/W4224218212","https://openalex.org/W4226060502","https://openalex.org/W4230765542","https://openalex.org/W4232744020","https://openalex.org/W4245906277","https://openalex.org/W4254182148","https://openalex.org/W4282580746","https://openalex.org/W4368353239","https://openalex.org/W4385668098","https://openalex.org/W6605096470","https://openalex.org/W6696927340","https://openalex.org/W6703470281","https://openalex.org/W6713357761","https://openalex.org/W6748503732","https://openalex.org/W6751494907","https://openalex.org/W6754841127","https://openalex.org/W6756013834","https://openalex.org/W6757844995","https://openalex.org/W6761676681","https://openalex.org/W6779326027","https://openalex.org/W6782263699"],"related_works":["https://openalex.org/W2883256816","https://openalex.org/W2171408034","https://openalex.org/W3003320923","https://openalex.org/W2106140982","https://openalex.org/W4285233543","https://openalex.org/W2357071520","https://openalex.org/W4230838436","https://openalex.org/W2366078844","https://openalex.org/W2373857385","https://openalex.org/W2353277512"],"abstract_inverted_index":{"Detecting":[0],"anomalies":[1,65],"in":[2,137,174],"large":[3,54],"networks":[4],"is":[5,91],"a":[6,53,60,78,169],"major":[7],"challenge.":[8],"Nowadays,":[9],"many":[10],"studies":[11],"rely":[12],"on":[13,27,48],"machine":[14,37],"learning":[15,38,111,133,158],"techniques":[16],"to":[17,34,40,105,165],"solve":[18],"this":[19,24],"problem.":[20],"However,":[21],"much":[22],"of":[23,156],"research":[25],"depends":[26],"synthetic":[28],"or":[29,81],"limited":[30],"datasets":[31],"and":[32,58,93,109,124,168],"tends":[33],"use":[35,155,173],"specialized":[36],"methods":[39,134,159],"achieve":[41],"good":[42],"detection":[43],"results.":[44],"This":[45],"study":[46],"focuses":[47],"analyzing":[49],"firewall":[50,151],"logs":[51,97,104],"from":[52],"industrial":[55],"control":[56],"network":[57,73],"presents":[59],"novel":[61],"method":[62,90],"for":[63,77,172],"generating":[64],"that":[66,87,94,131,143],"simulate":[67],"real":[68,175],"attacker":[69],"actions":[70],"within":[71],"the":[72,75,88,95,139,154],"without":[74],"need":[76],"dedicated":[79],"testbed":[80],"installed":[82],"security":[83],"controls.":[84],"To":[85],"demonstrate":[86],"proposed":[89],"feasible":[92],"constructed":[96],"behave":[98],"as":[99],"one":[100],"would":[101],"expect":[102],"real-world":[103],"behave,":[106],"different":[107,116],"supervised":[108,157],"unsupervised":[110,132,166],"models":[112],"were":[113],"compared":[114,164],"using":[115],"feature":[117,119],"subsets,":[118],"construction":[120],"methods,":[121,123],"scaling":[122],"aggregation":[125],"levels.":[126],"The":[127],"experimental":[128],"results":[129],"show":[130],"have":[135],"difficulty":[136],"detecting":[138],"injected":[140],"anomalies,":[141],"suggesting":[142],"they":[144],"can":[145],"be":[146],"seamlessly":[147],"integrated":[148],"into":[149],"existing":[150],"logs.":[152],"Conversely,":[153],"showed":[160],"significantly":[161],"better":[162,170],"performance":[163],"approaches":[167],"suitability":[171],"systems.":[176]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}