{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,24]],"date-time":"2025-03-24T07:48:02Z","timestamp":1742802482495},"reference-count":50,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2017,2,1]],"date-time":"2017-02-01T00:00:00Z","timestamp":1485907200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Information Sciences"],"published-print":{"date-parts":[[2017,2]]},"DOI":"10.1016\/j.ins.2016.09.041","type":"journal-article","created":{"date-parts":[[2016,9,22]],"date-time":"2016-09-22T03:20:16Z","timestamp":1474514416000},"page":"211-228","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":88,"special_numbering":"C","title":["Defending unknown attacks on cyber-physical systems by semi-supervised approach and available unlabeled data"],"prefix":"10.1016","volume":"379","author":[{"given":"Shamsul","family":"Huda","sequence":"first","affiliation":[]},{"given":"Suruz","family":"Miah","sequence":"additional","affiliation":[]},{"given":"Mohammad","family":"Mehedi Hassan","sequence":"additional","affiliation":[]},{"given":"Rafiqul","family":"Islam","sequence":"additional","affiliation":[]},{"given":"John","family":"Yearwood","sequence":"additional","affiliation":[]},{"given":"Majed","family":"Alrubaian","sequence":"additional","affiliation":[]},{"given":"Ahmad","family":"Almogren","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"issue":"1","key":"10.1016\/j.ins.2016.09.041_bib0001","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1007\/BF00153759","article-title":"Instance-based learning algorithms","volume":"6","author":"Aha","year":"1991","journal-title":"Mach. Learn."},{"key":"10.1016\/j.ins.2016.09.041_bib0002","first-page":"130","article-title":"Statistical method of change detection","volume":"XVI","author":"Basseville","year":"2002","journal-title":"Rob. Autom., Unbehauen (Ed.)"},{"key":"10.1016\/j.ins.2016.09.041_bib0003","doi-asserted-by":"crossref","unstructured":"B. Bigi, Using Kullback-Leibler Distance for Text Categorization, edited by F. Sebastiani, Springer-Verlag Berlin Heidelberg, pp. 305\u2013319.","DOI":"10.1007\/3-540-36618-0_22"},{"key":"10.1016\/j.ins.2016.09.041_bib0004","series-title":"IEEE 33rd International Conference on Distributed Computing Systems Workshops (ICDCSW)","first-page":"6","article-title":"Malware similarity identification using call graph based system call subsequence features","author":"Blokhin","year":"2013"},{"key":"10.1016\/j.ins.2016.09.041_bib0005","series-title":"Technical Report","article-title":"CLUSTER: An Unsupervised Algorithm for Modeling Gaussian Mixtures","author":"Bouman","year":"1998"},{"issue":"7","key":"10.1016\/j.ins.2016.09.041_bib0006","doi-asserted-by":"crossref","first-page":"1145","DOI":"10.1016\/S0031-3203(96)00142-2","article-title":"The use of the area under the roc curve in the evaluation of machine learning algorithms","volume":"30","author":"Bradley","year":"1997","journal-title":"Pattern Recognit."},{"issue":"1","key":"10.1016\/j.ins.2016.09.041_bib0007","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1023\/A:1010933404324","article-title":"Random forests","volume":"45","author":"Breiman","year":"2001","journal-title":"Mach. Learn."},{"key":"10.1016\/j.ins.2016.09.041_bib0008","series-title":"Workshop on Future Directions in Cyber-physical Systems Security,DHS","first-page":"1","article-title":"Challenges for securing cyber physical systems","author":"Cardenas","year":"2009"},{"issue":"1","key":"10.1016\/j.ins.2016.09.041_bib0009","doi-asserted-by":"crossref","first-page":"277","DOI":"10.1109\/TII.2012.2198666","article-title":"Review of security issues in industrial networks","volume":"9","author":"Cheminod","year":"2013","journal-title":"IEEE Transactions on Industrial Informatics"},{"key":"10.1016\/j.ins.2016.09.041_bib0010","series-title":"In proc. IEEE 1st International Conference on Cyber-Physical Systems, Networks, and Applications (CPSNA)","first-page":"13","article-title":"Defending malicious attacks in cyber physical systems","author":"Chen","year":"2013"},{"key":"10.1016\/j.ins.2016.09.041_bib0011","series-title":"Proceedings of the 4th ACM workshop on Recurring malcode, ACM,","first-page":"73","article-title":"Using engine signature to detect metamorphic malware,2006","author":"Chouchane","year":"2006"},{"key":"10.1016\/j.ins.2016.09.041_bib0012","series-title":"The 12th conference on USENIX Security Symposium, Washington, DC, USA","first-page":"12","article-title":"Static analysis of executables to detect malicious patterns","author":"Christodorescu","year":"2003"},{"key":"10.1016\/j.ins.2016.09.041_bib0013","series-title":"An Introduction to Support Vector Machines and Other Kernel-based Learning Methods.","author":"Cristianini","year":"2000"},{"issue":"6","key":"10.1016\/j.ins.2016.09.041_bib0014","doi-asserted-by":"crossref","first-page":"1482","DOI":"10.1109\/TII.2015.2495147","article-title":"Robust and secure time-synchronization against sybil attacks for sensor networks","volume":"11","author":"Dong","year":"2015","journal-title":"IEEE Trans. Ind. Inf."},{"key":"10.1016\/j.ins.2016.09.041_bib0015","series-title":"Technical Report","article-title":"The Internet of Things: How the Next Evolution of the Internet is Changing Everything.","author":"Evans","year":"2011"},{"key":"10.1016\/j.ins.2016.09.041_bib0016","series-title":"IEEE 39th Annual in Computer Software and Applications Conference (COMPSAC)","first-page":"255","article-title":"Malware detection systems based on api log data mining","volume":"3","author":"Fan","year":"2015"},{"key":"10.1016\/j.ins.2016.09.041_bib0017","doi-asserted-by":"crossref","first-page":"861","DOI":"10.1016\/j.patrec.2005.10.010","article-title":"An introduction to roc analysis","volume":"27","author":"Fawcett","year":"2006","journal-title":"Pattern Recognit. Lett."},{"key":"10.1016\/j.ins.2016.09.041_bib0018","series-title":"Procedia Computer Science, 4th International Conference on Eco-friendly Computing and Communication Systems","first-page":"238","article-title":"Online monitoring of a cyber physical system against control aware cyber attacks","volume":"70","author":"Gawanda","year":"2015"},{"issue":"5","key":"10.1016\/j.ins.2016.09.041_bib0019","doi-asserted-by":"crossref","first-page":"576","DOI":"10.1109\/91.873580","article-title":"Generalized fuzzy c-means clustering strategies using l norm distances","volume":"8","author":"Hathaway","year":"2000","journal-title":"IEEE Trans. Fuzzy Syst."},{"key":"10.1016\/j.ins.2016.09.041_bib0020","doi-asserted-by":"crossref","first-page":"251","DOI":"10.1007\/s11416-008-0086-0","article-title":"Behavioral detection of malware: From a survey towards an established taxonomy","author":"Jacob","year":"2008","journal-title":"J. Comput. Virol.,"},{"key":"10.1016\/j.ins.2016.09.041_bib0021","series-title":"In Proceeding of the IEEE International Conference on Information and Automation Shenzhen, China","first-page":"890","article-title":"A feature selection method for malware detection","author":"Jiang","year":"2011"},{"key":"10.1016\/j.ins.2016.09.041_bib0022","series-title":"In Proc. of the Eleventh conference on Uncertainty in artificial intelligence Pages","first-page":"338","article-title":"Estimating continuous distributions in bayesian classifiers","author":"John","year":"1995"},{"key":"10.1016\/j.ins.2016.09.041_bib0023","series-title":"Technical Report","article-title":"Securing the future of German manufacturing industry: Recommendations for implementing the strategic initiative INDUSTRIE 4.0.","author":"Kagermann","year":"2013"},{"issue":"5","key":"10.1016\/j.ins.2016.09.041_bib0024","doi-asserted-by":"crossref","first-page":"1144","DOI":"10.1109\/TC.2012.269","article-title":"Efficiently securing systems from code reuse attacks","volume":"63","author":"Kayaalp","year":"2014","journal-title":"IEEE Trans. Comput."},{"key":"10.1016\/j.ins.2016.09.041_bib0025","first-page":"2721","article-title":"Learning to detect and classify malicious executables in the wild","volume":"7","author":"Kolter","year":"2006","journal-title":"J. Mach. Learn. Res."},{"key":"10.1016\/j.ins.2016.09.041_bib0026","series-title":"In Proc. of 5th International Conference on Computer and Communication Technology","first-page":"141","article-title":"Metamorphic virus detection using feature selection techniques","author":"Kuriakose","year":"2014"},{"key":"10.1016\/j.ins.2016.09.041_bib0027","series-title":"Procedia CIRP, Proceedings of the 47th CIRP Conference on Manufacturing Systems","first-page":"9","article-title":"Cyber-physical production systems: Roots, expectations and r and d challenges","volume":"17","author":"Laszlo","year":"2014"},{"issue":"2","key":"10.1016\/j.ins.2016.09.041_bib0028","doi-asserted-by":"crossref","first-page":"451","DOI":"10.1016\/S0031-3203(02)00060-2","article-title":"The global k-means clustering algorithm","volume":"36","author":"Likas","year":"2003","journal-title":"Pattern Recognit."},{"issue":"1","key":"10.1016\/j.ins.2016.09.041_bib0029","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1109\/TDSC.2014.2312327","article-title":"Behavior rule based intrusion detection for supporting secure medical cyber physical systems","volume":"12","author":"Mitchell","year":"2015","journal-title":"IEEE Trans. Dependable and Secure Comput."},{"key":"10.1016\/j.ins.2016.09.041_bib0030","series-title":"Technical Report","article-title":"Cyber security for Advanced Manufacturing, a White Paper prepared by","author":"National Defense","year":"2014"},{"issue":"12","key":"10.1016\/j.ins.2016.09.041_bib0031","doi-asserted-by":"crossref","first-page":"2591","DOI":"10.1109\/TIFS.2015.2469253","article-title":"Employing program semantics for malware detection","volume":"10","author":"Naval","year":"2015","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.ins.2016.09.041_bib0032","series-title":"In Proceedings of the 2014 ACM symposium on Document engineering(DocEng \u201914),ACM New York, NY, USA","first-page":"107","article-title":"An ensemble approach for text document clustering using wikipedia concepts","author":"Nourashrafeddin","year":"2014"},{"issue":"1","key":"10.1016\/j.ins.2016.09.041_bib0033","doi-asserted-by":"crossref","first-page":"104","DOI":"10.1109\/TII.2014.2367322","article-title":"Detection of integrity attacks in cyber-physical critical infrastructures using ensemble modeling","volume":"11","author":"Ntalampiras","year":"2015","journal-title":"IEEE Trans. Ind. Inf."},{"issue":"1","key":"10.1016\/j.ins.2016.09.041_bib0034","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1109\/TII.2012.2226594","article-title":"Model-driven safety analysis of closed-loop medical systems","volume":"10","author":"Pajic","year":"2014","journal-title":"IEEE Trans. Ind. Inf."},{"key":"10.1016\/j.ins.2016.09.041_bib0035","unstructured":"PandaLabs, Pandalabs annual report 2014, panda security, www.pandasecurity.com, 2014,"},{"issue":"3","key":"10.1016\/j.ins.2016.09.041_bib0036","doi-asserted-by":"crossref","first-page":"500","DOI":"10.1109\/TIFS.2013.2242890","article-title":"Svm training phase reduction using dataset feature filtering for malware detection","volume":"8","author":"Philip O Kane","year":"2013","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.ins.2016.09.041_bib0037","series-title":"International Conference on in Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","first-page":"1","article-title":"Analysis of malware behavior: type classification using machine learning","author":"Pirscoveanu","year":"2015"},{"key":"10.1016\/j.ins.2016.09.041_bib0038","series-title":"International Conference on Advanced Science, Engineering and Information Technology, Kuala Lumpur, Malaysia","first-page":"403","article-title":"Metamorphic virus detection in portable executables using opcodes statistical feature","author":"Rad","year":"2011"},{"key":"10.1016\/j.ins.2016.09.041_bib0039","doi-asserted-by":"crossref","first-page":"72","DOI":"10.1109\/TIFS.2013.2291964","article-title":"Data-centric os kernel malware characterization","volume":"9","author":"Rhee","year":"2014","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"2","key":"10.1016\/j.ins.2016.09.041_bib0040","doi-asserted-by":"crossref","first-page":"438","DOI":"10.1109\/69.991727","article-title":"Efficient c4.5","volume":"14","author":"Ruggieri","year":"2002","journal-title":"IEEE Trans. Knowl. Data Eng."},{"issue":"2","key":"10.1016\/j.ins.2016.09.041_bib0041","doi-asserted-by":"crossref","first-page":"196","DOI":"10.1109\/TIFS.2013.2291066","article-title":"Growing grapes in your computer to defend against malware","volume":"9","author":"Shan","year":"2014","journal-title":"IEEE Trans. Inf. Forensics Secur.,"},{"key":"10.1016\/j.ins.2016.09.041_bib0042","first-page":"61","article-title":"Malware detection module using machine learning algorithms to assist in centralized security in enterprise networks","volume":"4","author":"Singhal","year":"2012","journal-title":"Int. J. Netw. Secur. Appl. (IJNSA)"},{"key":"10.1016\/j.ins.2016.09.041_bib0043","doi-asserted-by":"crossref","unstructured":"J. Slay, M. Miller, Lessons learned from the maroochy water breach, vol. 253, Springer Boston, pp. 73\u201382.","DOI":"10.1007\/978-0-387-75462-8_6"},{"issue":"6","key":"10.1016\/j.ins.2016.09.041_bib0044","doi-asserted-by":"crossref","first-page":"813","DOI":"10.1109\/TC.2011.46","article-title":"A native apis protection mechanism in the kernel mode against malicious code","volume":"60","author":"Sun","year":"2011","journal-title":"IEEE Trans. Comput."},{"key":"10.1016\/j.ins.2016.09.041_bib0045","unstructured":"Symantec, Internet security threat report 2014, vol 19, 2014, symantec corporation, www.symantec.com, 2014."},{"issue":"2","key":"10.1016\/j.ins.2016.09.041_bib0046","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1109\/TPDS.2013.146","article-title":"A system for denial-of-service attack detection based on multivariate correlation analysis","volume":"25","author":"Tan","year":"2014","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"10.1016\/j.ins.2016.09.041_bib0047","series-title":"Technical Report","article-title":"Cyber incidents involving control systems","author":"Turk","year":"2005"},{"issue":"2","key":"10.1016\/j.ins.2016.09.041_bib0048","doi-asserted-by":"crossref","first-page":"1337","DOI":"10.1109\/TII.2014.2304633","article-title":"Cyber-physical system security with deceptive virtual hosts for industrialcontrol networks","volume":"10","author":"Vollmer","year":"2014","journal-title":"IEEE Trans. Ind. Inf."},{"key":"10.1016\/j.ins.2016.09.041_bib0049","series-title":"In proc IEEE\/ACM International Conference on Cyber, Physical and Social Computing","first-page":"733","article-title":"Security issues and challenges for cyber physical system","author":"Wang","year":"2010"},{"key":"10.1016\/j.ins.2016.09.041_bib0050","doi-asserted-by":"crossref","first-page":"298","DOI":"10.1109\/TSMCC.2009.2037978","article-title":"Cimds: Adapting postprocessing techniques of associative classification for malware detection","volume":"40","author":"Ye","year":"2010","journal-title":"IEEE Trans. Syst., Man, Cybern., Part C"}],"container-title":["Information Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0020025516309380?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0020025516309380?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2019,11,1]],"date-time":"2019-11-01T05:29:11Z","timestamp":1572586151000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0020025516309380"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,2]]},"references-count":50,"alternative-id":["S0020025516309380"],"URL":"https:\/\/doi.org\/10.1016\/j.ins.2016.09.041","relation":{},"ISSN":["0020-0255"],"issn-type":[{"value":"0020-0255","type":"print"}],"subject":[],"published":{"date-parts":[[2017,2]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Defending unknown attacks on cyber-physical systems by semi-supervised approach and available unlabeled data","name":"articletitle","label":"Article Title"},{"value":"Information Sciences","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.ins.2016.09.041","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2016 Elsevier Inc. All rights reserved.","name":"copyright","label":"Copyright"}]}}