{"id":"https://openalex.org/W7155094235","doi":"https://doi.org/10.48550/arxiv.2604.18066","title":"Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining","display_name":"Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining","publication_year":2026,"publication_date":"2026-04-20","ids":{"openalex":"https://openalex.org/W7155094235","doi":"https://doi.org/10.48550/arxiv.2604.18066"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.18066","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.18066","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.18066","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101694358","display_name":"Francesco Vitale","orcid":"https://orcid.org/0000-0003-2325-0056"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vitale, Francesco","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065049824","display_name":"Francesco Grimaldi","orcid":"https://orcid.org/0000-0003-2286-5091"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Grimaldi, Francesco","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068111307","display_name":"Massimiliano Rak","orcid":"https://orcid.org/0000-0001-6708-4032"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rak, Massimiliano","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5045567395","display_name":"Nicola Mazzocca","orcid":"https://orcid.org/0000-0002-0401-9687"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mazzocca, Nicola","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5889000296592712,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5889000296592712,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.0786999985575676,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.033799998462200165,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7621999979019165},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.6223000288009644},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5940999984741211},{"id":"https://openalex.org/keywords/alarm","display_name":"ALARM","score":0.4799000024795532},{"id":"https://openalex.org/keywords/trustworthiness","display_name":"Trustworthiness","score":0.4512999951839447},{"id":"https://openalex.org/keywords/false-alarm","display_name":"False alarm","score":0.4417000114917755},{"id":"https://openalex.org/keywords/visibility","display_name":"Visibility","score":0.3928999900817871},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.3752000033855438}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7621999979019165},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6880000233650208},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.6223000288009644},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5940999984741211},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5335999727249146},{"id":"https://openalex.org/C2779119184","wikidata":"https://www.wikidata.org/wiki/Q294350","display_name":"ALARM","level":2,"score":0.4799000024795532},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.4512999951839447},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.4417000114917755},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.3928999900817871},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.3752000033855438},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.375},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.32519999146461487},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.3140000104904175},{"id":"https://openalex.org/C124670913","wikidata":"https://www.wikidata.org/wiki/Q2608526","display_name":"Process mining","level":5,"score":0.3131999969482422},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3127000033855438},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.31040000915527344},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.28870001435279846},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.28850001096725464},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.2815999984741211},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27549999952316284},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.27489998936653137},{"id":"https://openalex.org/C149490388","wikidata":"https://www.wikidata.org/wiki/Q1718507","display_name":"Sequential Pattern Mining","level":2,"score":0.2741999924182892},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.2703000009059906}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.18066","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.18066","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.18066","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.18066","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.6416468024253845,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Anomaly-based":[0],"Intrusion":[1],"Detection":[2],"Systems":[3],"(IDSs)":[4],"ensure":[5],"protection":[6],"against":[7],"malicious":[8],"attacks":[9],"on":[10],"networked":[11],"systems.":[12],"While":[13],"deep":[14],"learning-based":[15],"IDSs":[16,67],"achieve":[17],"effective":[18],"performance,":[19],"their":[20],"limited":[21],"trustworthiness":[22],"due":[23],"to":[24,64,97,103,129,133,139],"black-box":[25],"architectures":[26],"remains":[27],"a":[28,57],"critical":[29,81],"constraint.":[30],"Despite":[31],"existing":[32],"explainable":[33],"techniques":[34,63],"offering":[35],"insight":[36],"into":[37,86],"the":[38,101,104,118,156],"alarms":[39,135],"raised":[40],"by":[41,68,92,114],"IDSs,":[42],"they":[43],"lack":[44],"process-based":[45,70],"explanations":[46,75],"grounded":[47],"in":[48],"packet-level":[49],"sequencing":[50],"analysis.":[51],"In":[52],"this":[53],"paper,":[54],"we":[55],"propose":[56],"method":[58,79,102,126],"that":[59,124],"employs":[60],"process":[61],"mining":[62],"enhance":[65],"anomaly-based":[66],"providing":[69,150],"alarm":[71],"severity":[72,154],"ratings":[73],"and":[74,83,142],"for":[76,155],"alerts.":[77],"Our":[78],"prioritizes":[80],"alerts":[82],"maintains":[84],"visibility":[85],"network":[87],"behavior,":[88],"while":[89,136,149],"minimizing":[90],"disruption":[91],"allowing":[93],"misclassified":[94],"benign":[95],"traffic":[96,112],"pass.":[98],"We":[99],"apply":[100],"publicly":[105],"available":[106],"USB-IDS-TC":[107],"dataset,":[108],"which":[109],"includes":[110],"anomalous":[111],"affected":[113],"different":[115,151],"variants":[116],"of":[117,153],"Slowloris":[119],"DoS":[120],"attack.":[121],"Results":[122],"show":[123],"our":[125],"is":[127],"able":[128],"discriminate":[130],"between":[131],"low-":[132],"very-high-severity":[134],"preserving":[137],"up":[138],"99.94%":[140],"recall":[141],"99.99%":[143],"precision,":[144],"effectively":[145],"discarding":[146],"false":[147],"positives":[148],"degrees":[152],"true":[157],"positives.":[158]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-04-22T00:00:00"}