{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,2]],"date-time":"2024-09-02T12:33:37Z","timestamp":1725280417439},"reference-count":59,"publisher":"Elsevier BV","issue":"4","license":[{"start":{"date-parts":[[2009,10,1]],"date-time":"2009-10-01T00:00:00Z","timestamp":1254355200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information Fusion"],"published-print":{"date-parts":[[2009,10]]},"DOI":"10.1016\/j.inffus.2009.03.001","type":"journal-article","created":{"date-parts":[[2009,3,30]],"date-time":"2009-03-30T20:43:59Z","timestamp":1238445839000},"page":"274-284","source":"Crossref","is-referenced-by-count":44,"title":["Information fusion for computer security: State of the art and open issues"],"prefix":"10.1016","volume":"10","author":[{"given":"Igino","family":"Corona","sequence":"first","affiliation":[]},{"given":"Giorgio","family":"Giacinto","sequence":"additional","affiliation":[]},{"given":"Claudio","family":"Mazzariello","sequence":"additional","affiliation":[]},{"given":"Fabio","family":"Roli","sequence":"additional","affiliation":[]},{"given":"Carlo","family":"Sansone","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.inffus.2009.03.001_bib1","doi-asserted-by":"crossref","unstructured":"G. Androulidakis, V. Chatzigiannakis, S. Papavassiliou, Network anomaly detection and classification via opportunistic sampling, IEEE Network Magazine (January\/February) (2009) (special issue on recent developments in network intrusion detection).","DOI":"10.1109\/MNET.2009.4804318"},{"key":"10.1016\/j.inffus.2009.03.001_bib2","doi-asserted-by":"crossref","unstructured":"P. Barford, D. Plonka, Characteristics of network traffic flow anomalies, in: Proceedings of the First ACM SIGCOMM Workshop on internet Measurement, San Francisco, USA, November 2001.","DOI":"10.1145\/505208.505211"},{"key":"10.1016\/j.inffus.2009.03.001_bib3","doi-asserted-by":"crossref","unstructured":"M. Barreno, B. Nelson, R. Sears, A.D. Joseph, J.D. Tygar, Can machine learning be secure? in: Proceedings of the ACM Symposium on InformAtion, Computer, and Communications Security (ASIACCS\u201906), March 2006.","DOI":"10.1145\/1128817.1128824"},{"issue":"4","key":"10.1016\/j.inffus.2009.03.001_bib4","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1145\/332051.332079","article-title":"Intrusion detection systems and multisensor data fusion","volume":"43","author":"Bass","year":"2000","journal-title":"Communications of the ACM"},{"issue":"1","key":"10.1016\/j.inffus.2009.03.001_bib5","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1016\/j.inffus.2007.03.001","article-title":"Ensemble methods for anomaly detection and distributed intrusion detection in mobile ad-hoc networks","volume":"9","author":"Cabrera","year":"2008","journal-title":"International Journal on Information Fusion"},{"key":"10.1016\/j.inffus.2009.03.001_bib6","series-title":"Proceedings of the 2006 ACM CoNEXT Conference","first-page":"1","article-title":"Reformulating the monitor placement problem: optimal network-wide sampling","author":"Cantieni","year":"2006"},{"issue":"6","key":"10.1016\/j.inffus.2009.03.001_bib7","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1109\/MNET.2002.1081761","article-title":"Internet infrastructure security: a taxonomy","volume":"16","author":"Chakrabarti","year":"2002","journal-title":"IEEE Network Magazine"},{"issue":"2","key":"10.1016\/j.inffus.2009.03.001_bib8","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1007\/s10044-006-0053-7","article-title":"A multi-stage classification system for detecting intrusions in computer networks","volume":"10","author":"Cordella","year":"2007","journal-title":"International Journal on Pattern Analysis and Applications"},{"key":"10.1016\/j.inffus.2009.03.001_bib9","series-title":"Supervised and Unsupervised Ensemble Methods and Their Applications","first-page":"91","article-title":"Intrusion detection in computer systems using multiple classifier systems","author":"Corona","year":"2008"},{"key":"10.1016\/j.inffus.2009.03.001_bib10","doi-asserted-by":"crossref","first-page":"243","DOI":"10.1016\/j.inffus.2003.08.003","article-title":"Intrusion detection","volume":"4","author":"Dasarathy","year":"2003","journal-title":"International Journal on Information Fusion"},{"key":"10.1016\/j.inffus.2009.03.001_bib11","doi-asserted-by":"crossref","first-page":"63","DOI":"10.1145\/846183.846199","article-title":"Results of the KDD99 classifier learning","volume":"1","author":"Elkan","year":"2000","journal-title":"SIGKDD Explorations Journal ACM"},{"key":"10.1016\/j.inffus.2009.03.001_bib12","doi-asserted-by":"crossref","unstructured":"C. Feng, J. Peng, H. Qiao, J.W. Rozenblit, Alert fusion for a computer host based intrusion detection system, in: Proceedings of the 14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems, IEEE, 2007, pp. 433\u2013440.","DOI":"10.1109\/ECBS.2007.17"},{"key":"10.1016\/j.inffus.2009.03.001_bib13","unstructured":"I. Finizio, C. Mazzariello, C. Sansone, A temporal-behavior knowledge space for detecting intrusions in computer networks, in: International Conference on Recent Advances in Soft Computing RASC 2006, Canterbury, UK, July 2006, pp. 10\u201312."},{"key":"10.1016\/j.inffus.2009.03.001_bib14","series-title":"Progress in Pattern Recognition","first-page":"27","article-title":"Information fusion techniques for reliably training intrusion detection systems","author":"Gargiulo","year":"2007"},{"issue":"1","key":"10.1016\/j.inffus.2009.03.001_bib15","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1016\/j.inffus.2006.10.002","article-title":"Intrusion detection in computer networks by a modular ensemble of one-class classifiers","volume":"9","author":"Giacinto","year":"2008","journal-title":"International Journal on Information Fusion"},{"issue":"5","key":"10.1016\/j.inffus.2009.03.001_bib16","doi-asserted-by":"crossref","first-page":"420","DOI":"10.1049\/el:20000374","article-title":"Selection of image classifiers","volume":"36","author":"Giacinto","year":"2000","journal-title":"Electronic Letters"},{"issue":"12","key":"10.1016\/j.inffus.2009.03.001_bib17","doi-asserted-by":"crossref","first-page":"1795","DOI":"10.1016\/S0167-8655(03)00004-7","article-title":"Fusion of multiple classifiers for intrusion detection in computer networks","volume":"24","author":"Giacinto","year":"2003","journal-title":"Pattern Recognition Letters"},{"issue":"3","key":"10.1016\/j.inffus.2009.03.001_bib18","doi-asserted-by":"crossref","first-page":"252","DOI":"10.1109\/TEVC.2002.1011540","article-title":"An artificial immune system architecture for computer security applications","volume":"6","author":"Harmer","year":"2002","journal-title":"IEEE Transactions on Evolutionary Computation"},{"issue":"2","key":"10.1016\/j.inffus.2009.03.001_bib19","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1109\/88.494599","article-title":"Combating computer viruses: IBM\u2019s new computer immune system","volume":"4","author":"Hedberg","year":"2002","journal-title":"Parallel and Distributed Technology: Systems and Applications, IEEE"},{"key":"10.1016\/j.inffus.2009.03.001_bib20","doi-asserted-by":"crossref","unstructured":"B. Hernacki, J. Bennett, J. Hoagland, An Overview of Network Evasion Methods, Information Security Technical Report, vol. 10, Elsevier, 2005, pp. 140\u2013149.","DOI":"10.1016\/j.istr.2005.07.003"},{"issue":"8","key":"10.1016\/j.inffus.2009.03.001_bib21","doi-asserted-by":"crossref","first-page":"2665","DOI":"10.1016\/j.patcog.2008.01.022","article-title":"A \u201cNo Panacea Theorem\u201d for classifier combination","volume":"41","author":"Hu","year":"2008","journal-title":"Pattern Recognition Journal"},{"key":"10.1016\/j.inffus.2009.03.001_bib22","unstructured":"Y. Huang, W. Fan, W. Lee, P.S. Yu, Cross-feature analysis for detecting ad-hoc routing anomalies, in: Proceedings of the 23rd International Conference on Distributed Computing Systems, May 2003, pp. 478\u2013487."},{"issue":"1","key":"10.1016\/j.inffus.2009.03.001_bib23","doi-asserted-by":"crossref","first-page":"90","DOI":"10.1109\/34.368145","article-title":"A method of combining multiple experts for the recognition of unconstrained handwritten numerals","volume":"17","author":"Huang","year":"1995","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"10.1016\/j.inffus.2009.03.001_bib24","doi-asserted-by":"crossref","unstructured":"A. Karygiannis, E. Antonakakis, A. Apostolopoulos, Host-based network monitoring tools for MANETs, in: Proceedings of the Third ACM International Workshop on Performance Evaluation of Wireless Ad Hoc, Sensor and Ubiquitous Networks, Terromolinos, Spain, October 2006.","DOI":"10.1145\/1163610.1163637"},{"issue":"3","key":"10.1016\/j.inffus.2009.03.001_bib25","doi-asserted-by":"crossref","first-page":"226","DOI":"10.1109\/34.667881","article-title":"On combining classifiers","volume":"20","author":"Kittler","year":"1998","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence Journal"},{"key":"10.1016\/j.inffus.2009.03.001_bib26","doi-asserted-by":"crossref","unstructured":"B.M. Kowalski, D.K. Bertolino, S. Basagni, Hack Boston: monitoring wireless security awareness in an urban setting, in: Proceedings of the Canadian Conference on Electrical and Computer Engineering, May 2006, pp. 1308\u20131311.","DOI":"10.1109\/CCECE.2006.277319"},{"key":"10.1016\/j.inffus.2009.03.001_bib27","first-page":"114","article-title":"Decentralized event correlation for intrusion detection","volume":"vol. 2288","author":"Krugel","year":"2001"},{"key":"10.1016\/j.inffus.2009.03.001_bib28","series-title":"Combining Pattern Classifiers: Methods and Algorithms","author":"Kuncheva","year":"2004"},{"issue":"2","key":"10.1016\/j.inffus.2009.03.001_bib29","doi-asserted-by":"crossref","first-page":"299","DOI":"10.1016\/S0031-3203(99)00223-X","article-title":"Decision templates for multiple classifier fusion","volume":"34","author":"Kuncheva","year":"2001","journal-title":"Pattern Recognition Journal"},{"key":"10.1016\/j.inffus.2009.03.001_bib30","series-title":"Assessing Network Security","author":"Lam","year":"2004"},{"key":"10.1016\/j.inffus.2009.03.001_bib31","unstructured":"W. Lee, A Data Mining Framework for Constructing Features and Models for Intrusion Detection Systems, Doctoral Thesis, Columbia University, 1999."},{"issue":"4","key":"10.1016\/j.inffus.2009.03.001_bib32","doi-asserted-by":"crossref","first-page":"227","DOI":"10.1145\/382912.382914","article-title":"A framework for constructing features and models for intrusion detection systems","volume":"3","author":"Lee","year":"2000","journal-title":"ACM Transactions on Information Systems Security"},{"key":"10.1016\/j.inffus.2009.03.001_bib33","unstructured":"R. Lemos, FBI \u201chack\u201d raises global security concerns, CNET News.com, (accessed 29.04.08)."},{"key":"10.1016\/j.inffus.2009.03.001_bib34","doi-asserted-by":"crossref","unstructured":"Z. Li, Z. Lei, L. Wang, D. Li, Assessing attack threat by the probability of following attacks, in: Proceedings of the International Conference on Networking, Architecture, and Storage, IEEE, 2007, pp. 91\u2013100.","DOI":"10.1109\/NAS.2007.15"},{"issue":"4","key":"10.1016\/j.inffus.2009.03.001_bib35","doi-asserted-by":"crossref","first-page":"262","DOI":"10.1145\/382912.382923","article-title":"Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory","volume":"3","author":"McHugh","year":"2000","journal-title":"ACM Transactions on Information System Security Journal"},{"issue":"3","key":"10.1016\/j.inffus.2009.03.001_bib36","doi-asserted-by":"crossref","first-page":"26","DOI":"10.1109\/65.283931","article-title":"Network intrusion detection","volume":"8","author":"Mukherjee","year":"1994","journal-title":"IEEE Network Magazine"},{"key":"10.1016\/j.inffus.2009.03.001_bib37","unstructured":"D. Mutz, C. Kruegel, W. Robertson, G. Vigna, R.A. Kemmerer, Reverse engineering of network signatures, in: Proceedings of the AusCERT Asia Pacific Information Technology Security Conference, Gold Coast, Australia, 2005."},{"issue":"3","key":"10.1016\/j.inffus.2009.03.001_bib38","first-page":"55","article-title":"Information fusion for wireless sensor networks: methods, models, and classification","volume":"39","author":"Nakamura","year":"2007","journal-title":"ACM Journal on Computing Surveys"},{"key":"10.1016\/j.inffus.2009.03.001_bib39","unstructured":"National Institute of Standards and Technology, Information Technology Laboratory, Computer Security Division, Standards for Security Categorization of Federal Information and Information Systems, Federal Information Processing Standards Publication 199, 2004, (accessed March 2009)."},{"key":"10.1016\/j.inffus.2009.03.001_bib40","doi-asserted-by":"crossref","first-page":"2745","DOI":"10.1016\/j.comnet.2008.04.022","article-title":"REFACING: an autonomic approach to network security based on multidimensional trustworthiness","volume":"52","author":"Oliviero","year":"2008","journal-title":"Computer Networks Magazine"},{"issue":"4","key":"10.1016\/j.inffus.2009.03.001_bib41","doi-asserted-by":"crossref","first-page":"429","DOI":"10.1016\/j.engappai.2006.01.003","article-title":"Alarm clustering for intrusion detection systems in computer networks","volume":"19","author":"Perdisci","year":"2006","journal-title":"Engineering Applications of Artificial Intelligence"},{"issue":"4","key":"10.1016\/j.inffus.2009.03.001_bib42","doi-asserted-by":"crossref","first-page":"68","DOI":"10.1109\/MSECP.2003.1219074","article-title":"Wireless security\u2019s future","volume":"1","author":"Potter","year":"2003","journal-title":"IEEE Security and Privacy"},{"issue":"6","key":"10.1016\/j.inffus.2009.03.001_bib43","doi-asserted-by":"crossref","first-page":"353","DOI":"10.1007\/s00779-003-0251-x","article-title":"An infrastructure for context-awareness based on first order logic","volume":"7","author":"Ranganathan","year":"2003","journal-title":"Personal and Ubiquitous Computing Journal"},{"key":"10.1016\/j.inffus.2009.03.001_bib44","volume":"vol. 2","author":"Romagnoli","year":"2000"},{"issue":"1","key":"10.1016\/j.inffus.2009.03.001_bib45","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1016\/S0167-9473(03)00177-4","article-title":"A Bayesian paradigm for designing intrusion detection systems","volume":"45","author":"Scott","year":"2004","journal-title":"Computational Statistics and Data Analysis Journal"},{"key":"10.1016\/j.inffus.2009.03.001_bib46","series-title":"A Mathematical Theory of Evidence","author":"Shafer","year":"1976"},{"key":"10.1016\/j.inffus.2009.03.001_bib47","doi-asserted-by":"crossref","unstructured":"V. Shmatikov, M.H. Wang, Security against probe-response attacks in collaborative intrusion, in: Detection Workshop on Large Scale Attack Defense, ACM, 2007, pp. 129\u2013136.","DOI":"10.1145\/1352664.1352673"},{"key":"10.1016\/j.inffus.2009.03.001_bib48","doi-asserted-by":"crossref","unstructured":"C. Siaterlis, B.S. Maglaris, Towards multisensor data fusion for DoS detection, in: Proceedings of the 2004 ACM Symposium on Applied Computing, ACM, 2004, pp. 439-446.","DOI":"10.1145\/967900.967992"},{"key":"10.1016\/j.inffus.2009.03.001_bib49","series-title":"Operating Systems Internal Design and Principles","author":"Stallings","year":"2005"},{"key":"10.1016\/j.inffus.2009.03.001_bib50","doi-asserted-by":"crossref","unstructured":"A. Stotz, M. Sudit, INformation Fusion Engine for Real-time Decision-making (INFERD): a perceptual system for cyber attack tracking, in: Proceedings of the 10th IEEE International Conference on Information Fusion, 2007, pp. 1\u20138.","DOI":"10.1109\/ICIF.2007.4408113"},{"key":"10.1016\/j.inffus.2009.03.001_bib51","unstructured":"G. Vigna, Mobile agents: ten reasons for failure, in: Proceedings of the International Conference on Mobile Data Management, 2004, pp. 298\u2013299."},{"key":"10.1016\/j.inffus.2009.03.001_bib52","unstructured":"M. Wanli, D. Tran, D. Sharma, A study on the feature selection of network traffic for intrusion detection purpose, in: Proceedings of the IEEE International Conference on Intelligence and Security Informatics, 17\u201320 June 2008, pp. 245\u2013247."},{"key":"10.1016\/j.inffus.2009.03.001_bib53","unstructured":"D. Xu, P. Ning, Correlation analysis of intrusion alerts, in: Roberto Di Pietro, Luigi V. Mancini (Eds.), Intrusion Detection Systems, Series on Advances in Information Security, vol. 38, 2008, pp. 65\u201392."},{"key":"10.1016\/j.inffus.2009.03.001_bib54","doi-asserted-by":"crossref","first-page":"418","DOI":"10.1109\/21.155943","article-title":"Methods for combining multiple classifiers and their applications to handwriting recognition","volume":"22","author":"Xu","year":"1992","journal-title":"IEEE Transactions on Systems Man and Cybernetics"},{"key":"10.1016\/j.inffus.2009.03.001_bib55","doi-asserted-by":"crossref","unstructured":"D. Yu, D. Frincke, Alert confidence fusion in intrusion detection systems with extended Dempster\u2013Shafer theory, in: Proceedings of the 43rd Annual Southeast Regional Conference, vol. 2, ACM, 2005, pp. 142\u2013147.","DOI":"10.1145\/1167253.1167289"},{"issue":"6","key":"10.1016\/j.inffus.2009.03.001_bib56","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.patrec.2004.09.045","article-title":"Intrusion detection using hierarchical neural networks","volume":"26","author":"Zhang","year":"2005","journal-title":"Pattern Recognition Letters Journal"},{"issue":"2","key":"10.1016\/j.inffus.2009.03.001_bib57","doi-asserted-by":"crossref","first-page":"467","DOI":"10.1109\/TSMCB.2005.859081","article-title":"Active and dynamic information fusion for multisensor systems with dynamic bayesian networks","volume":"36","author":"Zhang","year":"2006","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics Part B"},{"key":"10.1016\/j.inffus.2009.03.001_bib58","doi-asserted-by":"crossref","unstructured":"C.V. Zhou, S. Karunasekera, C. Leckie, Evaluation of a decentralized architecture for large scale collaborative intrusion detection, in: Proceedings of the 10th IFIP\/IEEE International Symposium on Integrated Network Management, IEEE, 2007, pp. 80\u201389.","DOI":"10.1109\/INM.2007.374772"},{"key":"10.1016\/j.inffus.2009.03.001_bib59","doi-asserted-by":"crossref","unstructured":"C.V. Zhou, C. Leckie, S. Karunasekera, T. Peng, A self-healing, self-protecting collaborative intrusion detection architecture to trace-back fast-flux phishing domains, in: IEEE Network Operations and Management Symposium Workshop, 7\u201311 April 2008, pp. 321\u2013327.","DOI":"10.1109\/NOMSW.2007.50"}],"container-title":["Information Fusion"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S156625350900030X?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S156625350900030X?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2019,5,19]],"date-time":"2019-05-19T05:36:29Z","timestamp":1558244189000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S156625350900030X"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,10]]},"references-count":59,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2009,10]]}},"alternative-id":["S156625350900030X"],"URL":"https:\/\/doi.org\/10.1016\/j.inffus.2009.03.001","relation":{},"ISSN":["1566-2535"],"issn-type":[{"value":"1566-2535","type":"print"}],"subject":[],"published":{"date-parts":[[2009,10]]}}}