{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,16]],"date-time":"2024-09-16T09:47:54Z","timestamp":1726480074174},"reference-count":40,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2020,10,1]],"date-time":"2020-10-01T00:00:00Z","timestamp":1601510400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"}],"funder":[{"DOI":"10.13039\/100007388","name":"Compagnia di San Paolo","doi-asserted-by":"publisher","award":["PAC02L1_00161"],"id":[{"id":"10.13039\/100007388","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003407","name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100003407","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100007195","name":"Universit\u00e0 degli Studi di Napoli Federico II","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100007195","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Future Generation Computer Systems"],"published-print":{"date-parts":[[2020,10]]},"DOI":"10.1016\/j.future.2019.09.005","type":"journal-article","created":{"date-parts":[[2019,9,16]],"date-time":"2019-09-16T11:02:40Z","timestamp":1568631760000},"page":"668-680","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":17,"special_numbering":"C","title":["Contextual filtering and prioritization of computer application logs for security situational awareness"],"prefix":"10.1016","volume":"111","author":[{"given":"Marcello","family":"Cinque","sequence":"first","affiliation":[]},{"given":"Raffaele","family":"Della Corte","sequence":"additional","affiliation":[]},{"given":"Antonio","family":"Pecchia","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.future.2019.09.005_b1","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2014.06.008","article-title":"Cyber situational awareness \u2013 A systematic review of the literature","volume":"46","author":"Franke","year":"2014","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2019.09.005_b2","series-title":"Proc. Workshop on Visualization for Computer Security","first-page":"19","article-title":"The real work of computer network defense analysts","author":"D\u2019Amico","year":"2007"},{"key":"10.1016\/j.future.2019.09.005_b3","series-title":"Proc. 34th Annual Computer Security Applications Conference","first-page":"124","article-title":"MADE: Security analytics for enterprise threat detection","author":"Oprea","year":"2018"},{"key":"10.1016\/j.future.2019.09.005_b4","article-title":"Empirical analysis and validation of security alerts filtering techniques","author":"Cotroneo","year":"2017","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.future.2019.09.005_b5","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1016\/j.inffus.2013.04.009","article-title":"Providing SIEM systems with self-adaptation","volume":"21","author":"Suarez-Tangil","year":"2015","journal-title":"Inf. Fusion"},{"key":"10.1016\/j.future.2019.09.005_b6","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.cose.2014.12.003","article-title":"Intrusion alert prioritisation and attack detection using post-correlation analysis","volume":"50","author":"Shittu","year":"2015","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2019.09.005_b7","article-title":"Detection and threat prioritization of pivoting attacks in large networks","author":"Apruzzese","year":"2018","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"issue":"5","key":"10.1016\/j.future.2019.09.005_b8","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1109\/MSP.2014.103","article-title":"The operational role of security information and event management systems","volume":"12","author":"Bhatt","year":"2014","journal-title":"IEEE Secur. Privacy"},{"year":"2016","series-title":"Magic quadrant for security information and event management","author":"Kavanagh","key":"10.1016\/j.future.2019.09.005_b9"},{"key":"10.1016\/j.future.2019.09.005_b10","series-title":"Proc. 29th International Symposium on Software Reliability Engineering Workshops","first-page":"95","article-title":"Challenges and directions in security information and event management (SIEM)","author":"Cinque","year":"2018"},{"key":"10.1016\/j.future.2019.09.005_b11","series-title":"Proc. 41st International Conference on Dependable Systems and Networks","first-page":"506","article-title":"Analysis of security data from a large computing organization","author":"Sharma","year":"2011"},{"issue":"1","key":"10.1016\/j.future.2019.09.005_b12","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1016\/j.cose.2009.07.008","article-title":"Reducing false positives in intrusion detection systems","volume":"29","author":"Spathoulas","year":"2010","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2019.09.005_b13","series-title":"Proc. 13th International Conference on Networks","article-title":"False positives reduction via intrusion alert quality framework","author":"Bakar","year":"2005"},{"key":"10.1016\/j.future.2019.09.005_b14","series-title":"Proc. 8th International Conference on Knowledge Discovery and Data Mining","first-page":"366","article-title":"Mining intrusion detection alarms for actionable knowledge","author":"Julisch","year":"2002"},{"issue":"3","key":"10.1016\/j.future.2019.09.005_b15","first-page":"93","article-title":"Using large scale distributed computing to unveil advanced persistent threats","volume":"1","author":"Giura","year":"2012","journal-title":"Sci.J."},{"key":"10.1016\/j.future.2019.09.005_b16","series-title":"Proc. Globecom Workshops","first-page":"194","article-title":"Massive distributed and parallel log analysis for organizational security","author":"Shu","year":"2013"},{"key":"10.1016\/j.future.2019.09.005_b17","series-title":"Proc. 29th Annual Computer Security Applications Conference","first-page":"199","article-title":"Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks","author":"Yen","year":"2013"},{"key":"10.1016\/j.future.2019.09.005_b18","series-title":"Proc. Trustcom\/BigDataSE\/ISPA","first-page":"238","article-title":"Big data analytics for detecting host misbehavior in large logs","author":"Gonalves","year":"2015"},{"key":"10.1016\/j.future.2019.09.005_b19","doi-asserted-by":"crossref","unstructured":"D. Hadiosmanovic, D. Bolzoni, P. Hartel, S. Etalle, MELISSA: towards automated detection of undesirable user actions in critical infrastructures, in: Proc. 7th European Conference on Computer Network Defense, 2011, pp. 41\u201348.","DOI":"10.1109\/EC2ND.2011.10"},{"issue":"4","key":"10.1016\/j.future.2019.09.005_b20","doi-asserted-by":"crossref","first-page":"853","DOI":"10.1109\/TSMCA.2010.2048028","article-title":"Cybersecurity for critical infrastructures: Attack and defense modeling","volume":"40","author":"Ten","year":"2010","journal-title":"IEEE Trans. Syst. Man Cybern. A"},{"key":"10.1016\/j.future.2019.09.005_b21","series-title":"Proc. 6th International Conference on Cyber Conflict","first-page":"157","article-title":"Situational awareness and information collection from critical infrastructure","author":"Timonen","year":"2014"},{"key":"10.1016\/j.future.2019.09.005_b22","series-title":"Proc. 5th Annual Conference on Communication Networks and Services Research","first-page":"345","article-title":"Using neuro-fuzzy approach to reduce false positive alerts","author":"Alshammari","year":"2007"},{"key":"10.1016\/j.future.2019.09.005_b23","series-title":"Proc. 7th International Symposium on Recent Advances in Intrusion Detection","first-page":"102","article-title":"Using adaptive alert classification to reduce false positives in intrusion detection","author":"Pietraszek","year":"2004"},{"key":"10.1016\/j.future.2019.09.005_b24","doi-asserted-by":"crossref","first-page":"375","DOI":"10.1016\/j.future.2015.09.009","article-title":"Automated root cause identification of security alerts: Evaluation in a SaaS Cloud","volume":"56","author":"Cotroneo","year":"2016","journal-title":"Future Gener. Comput. Syst."},{"issue":"3","key":"10.1016\/j.future.2019.09.005_b25","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1109\/TDSC.2004.21","article-title":"Comprehensive approach to intrusion detection alert correlation","volume":"1","author":"Valeur","year":"2004","journal-title":"IEEE Trans. Dependable Secure Comput."},{"issue":"1","key":"10.1016\/j.future.2019.09.005_b26","first-page":"88","article-title":"A novel data mining-based method for alert reduction and analysis","volume":"5","author":"Fu","year":"2010","journal-title":"J. Netw."},{"issue":"4","key":"10.1016\/j.future.2019.09.005_b27","doi-asserted-by":"crossref","first-page":"263","DOI":"10.1002\/nem.804","article-title":"FuzMet: A Fuzzy-logic based alert prioritization engine for intrusion detection systems","volume":"22","author":"Alsubhi","year":"2012","journal-title":"Int.J. Net. Manag."},{"key":"10.1016\/j.future.2019.09.005_b28","series-title":"Proc. 4th Workshop on Security and Artificial Intelligence","first-page":"59","article-title":"Prioritizing intrusion analysis using dempster-shafer theory","author":"Zomlot","year":"2011"},{"key":"10.1016\/j.future.2019.09.005_b29","series-title":"Proc. Conference on Intelligence and Security Informatics","first-page":"73","article-title":"Effective prioritization of network intrusion alerts to enhance situational awareness","author":"Newcomb","year":"2016"},{"key":"10.1016\/j.future.2019.09.005_b30","series-title":"Proc. 5th International Symposium on Recent Advances in Intrusion Detection","first-page":"95","article-title":"A mission-impact-based approach to INFOSEC alarm correlation","author":"Porras","year":"2002"},{"key":"10.1016\/j.future.2019.09.005_b31","series-title":"Ubiquitous Networking","first-page":"641","article-title":"Risk assessment and alert prioritization for intrusion detection systems","author":"Chakir","year":"2017"},{"issue":"3","key":"10.1016\/j.future.2019.09.005_b32","doi-asserted-by":"crossref","first-page":"259","DOI":"10.1007\/s10922-008-9109-x","article-title":"Optimal IDS sensor placement and alert prioritization using attack graphs","volume":"16","author":"Noel","year":"2008","journal-title":"J. Netw. Syst. Manage."},{"issue":"2","key":"10.1016\/j.future.2019.09.005_b33","doi-asserted-by":"crossref","first-page":"335","DOI":"10.1137\/S0036144598347035","article-title":"Matrices, vector spaces, and information retrieval","volume":"41","author":"Berry","year":"1999","journal-title":"SIAM Rev."},{"issue":"18","key":"10.1016\/j.future.2019.09.005_b34","doi-asserted-by":"crossref","first-page":"5623","DOI":"10.1002\/cpe.3590","article-title":"Entropy-based denial-of-service attack detection in cloud data center","volume":"27","author":"Cao","year":"2015","journal-title":"Concurr. Comput.: Pract. Exper."},{"issue":"3","key":"10.1016\/j.future.2019.09.005_b35","doi-asserted-by":"crossref","first-page":"412","DOI":"10.1109\/TPDS.2010.97","article-title":"Traceback of DDoS attacks using entropy variations","volume":"22","author":"Yu","year":"2011","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"10.1016\/j.future.2019.09.005_b36","doi-asserted-by":"crossref","unstructured":"K.F. Hong, C.C. Chen, Y.T. Chiu, K.S. Chou, Scalable command and control detection in log data through UF-ICF analysis, in: Proc. International Carnahan Conference on Security Technology, 2015, pp. 293\u2013298.","DOI":"10.1109\/CCST.2015.7389699"},{"key":"10.1016\/j.future.2019.09.005_b37","unstructured":"Y. Liao, V.R. Vemuri, Using text categorization techniques for intrusion detection, in: Proc. 11th USENIX Security Symposium, 2002, pp. 51\u201359."},{"key":"10.1016\/j.future.2019.09.005_b38","series-title":"Proc. 47th International Conference on Dependable Systems and Networks","first-page":"379","article-title":"Entropy-based security analytics: measurements from a critical information system","author":"Cinque","year":"2017"},{"year":"1999","series-title":"Cautionary Tales: Stealth Coordinated Attack How To","author":"Ruiu","key":"10.1016\/j.future.2019.09.005_b39"},{"year":"2000","series-title":"Experimentation in Software Engineering: An Introduction","author":"Wohlin","key":"10.1016\/j.future.2019.09.005_b40"}],"container-title":["Future Generation Computer Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X19306454?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X19306454?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2022,11,16]],"date-time":"2022-11-16T10:13:05Z","timestamp":1668593585000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167739X19306454"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10]]},"references-count":40,"alternative-id":["S0167739X19306454"],"URL":"https:\/\/doi.org\/10.1016\/j.future.2019.09.005","relation":{},"ISSN":["0167-739X"],"issn-type":[{"type":"print","value":"0167-739X"}],"subject":[],"published":{"date-parts":[[2020,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Contextual filtering and prioritization of computer application logs for security situational awareness","name":"articletitle","label":"Article Title"},{"value":"Future Generation Computer Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.future.2019.09.005","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2019 Elsevier B.V. All rights reserved.","name":"copyright","label":"Copyright"}]}}