{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,26]],"date-time":"2025-03-26T13:46:57Z","timestamp":1742996817688,"version":"3.40.3"},"publisher-location":"Cham","reference-count":25,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030715892"},{"type":"electronic","value":"9783030715908"}],"license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"DOI":"10.1007\/978-3-030-71590-8_12","type":"book-chapter","created":{"date-parts":[[2021,3,6]],"date-time":"2021-03-06T15:02:33Z","timestamp":1615042953000},"page":"199-219","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Distributed Framework for APT Attack Analysis"],"prefix":"10.1007","author":[{"given":"Yulu","family":"Qi","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rong","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Aiping","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yan","family":"Jia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2021,3,7]]},"reference":[{"key":"12_CR1","unstructured":"Grey, D.F.: Knowledge mapping: a practical overview. SWS J., March 1999"},{"key":"12_CR2","first-page":"1041","volume":"7","author":"L Shan","year":"2004","unstructured":"Shan, L.: Overview of researches on ontology. J. Comput. Res. Dev. 7, 1041\u20131052 (2004)","journal-title":"J. Comput. Res. Dev."},{"issue":"1\u20132","key":"12_CR3","doi-asserted-by":"publisher","first-page":"161","DOI":"10.1016\/S0169-023X(97)00056-6","volume":"25","author":"R Studer","year":"1998","unstructured":"Studer, R., Benjamins, V.R., Fensel, D.: Knowledge engineering: principles and methods. Data Knowl. Eng. 25(1\u20132), 161\u2013197 (1998)","journal-title":"Data Knowl. Eng."},{"key":"12_CR4","unstructured":"P\u00e9rez, A.G., Benjamins, V.R.: Overview of knowledge sharing and reuse components: ontologies and problem-solving methods. In: Proceedings of the IJCAI-99 workshop on Ontologies and Problem-Solving methods (KRR5), pp. 1\u201315. Stockholm, Sweden (1999)"},{"key":"12_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"139","DOI":"10.1007\/3-540-63438-X_8","volume-title":"Information Extraction A Multidisciplinary Approach to an Emerging Information Technology","author":"N Guarino","year":"1997","unstructured":"Guarino, N.: Semantic matching: formal ontological distinctions for information organization, extraction, and integration. In: Pazienza, M.T. (ed.) SCIE 1997. LNCS, vol. 1299, pp. 139\u2013170. Springer, Heidelberg (1997). https:\/\/doi.org\/10.1007\/3-540-63438-X_8"},{"key":"12_CR6","first-page":"21","volume":"12","author":"W Tong","year":"2018","unstructured":"Tong, W., Zhong-Liang, A.I., Xian-Guo, S.: Knowledge graph construction of threat intelligence based on deep learning. Comput. Mod. 12, 21 (2018)","journal-title":"Comput. Mod."},{"key":"12_CR7","doi-asserted-by":"publisher","first-page":"57","DOI":"10.1016\/j.ins.2013.02.036","volume":"256","author":"N Feng","year":"2014","unstructured":"Feng, N., Wang, H.J., Li, M.: A security risk analysis model for information systems: causal relationships of risk factors and vulnerability propagation analysis. Inf. Sci. 256, 57\u201373 (2014)","journal-title":"Inf. Sci."},{"key":"12_CR8","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"523","DOI":"10.1007\/978-3-319-69471-9_41","volume-title":"Cyberspace Safety and Security","author":"W Wang","year":"2017","unstructured":"Wang, W., Jiang, R., Jia, Y., Li, A., Chen, Y.: KGBIAC: knowledge graph based intelligent alert correlation framework. In: Wen, S., Wu, W., Castiglione, A. (eds.) CSS 2017. LNCS, vol. 10581, pp. 523\u2013530. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-69471-9_41"},{"key":"12_CR9","unstructured":"An-Kang, U., Yuan-Bo, G., Tai-Ming, Z., Tong, W.: Survey on network security event correlation analysis methods and tools. Computer Science (2017)"},{"issue":"2","key":"12_CR10","first-page":"117","volume":"10","author":"SA Mastani","year":"2014","unstructured":"Mastani, S.A.: Reduced merge$$\\_$$fsm pattern matching algorithm for network intrusion detection. Int. J. Recent Trends Eng. Technol. 10(2), 117 (2014)","journal-title":"Int. J. Recent Trends Eng. Technol."},{"issue":"1","key":"12_CR11","doi-asserted-by":"publisher","first-page":"17","DOI":"10.1016\/0004-3702(82)90020-0","volume":"19","author":"C Forgy","year":"1982","unstructured":"Forgy, C.: Rete: a fast algorithm for the many patterns\/many objects match problem. Artif. Intell. 19(1), 17\u201337 (1982)","journal-title":"Artif. Intell."},{"key":"12_CR12","unstructured":"Liu, D., Gu, T., Xue, J.-P.: Rule engine based on improvement rete algorithm. In: The 2010 International Conference on Apperceiving Computing and Intelligence Analysis Proceeding, pp. 346\u2013349 IEEE (2010)"},{"key":"12_CR13","unstructured":"Esmaili, M., Balachandran, B., Safavi-Naini, R., Pieprzyk, J.: Case-based reasoning for intrusion detection. In: 12th Annual Computer Security Applications Conference (ACSAC 1996), 9\u201313 December 1996, San Diego, CA, USA, pp. 214\u2013223. IEEE Computer Society (1996)"},{"issue":"1","key":"12_CR14","first-page":"36","volume":"34","author":"C Bo","year":"2005","unstructured":"Bo, C., Ling, Y.U., Jun-Mo, X.: An application of simulated annealing algorithm in model-based reasoning intrusion detection. J. Univ. Electron. Sci. Technol. China 34(1), 36\u201339 (2005)","journal-title":"J. Univ. Electron. Sci. Technol. China"},{"key":"12_CR15","unstructured":"Rubin, D.E., Mital, V., Beckman, B.C., Katzenberger, G.S.: Dependency graph in data-driven model, 8 January 2013. US Patent 8,352,397"},{"key":"12_CR16","unstructured":"Hansen, S.E., Atkins, E.T.: Automated system monitoring and notification with swatch. In: Proceedings of the 7th Conference on Systems Administration (LISA 1993), Monterey, California, USA, 1\u20135 November 1993. USENIX (1993)"},{"key":"12_CR17","unstructured":"Rouillard, J.P.: Real-time log file analysis using the simple event correlator (SEC). In: Damon, L. (ed.) Proceedings of the 18th Conference on Systems Administration (LISA 2004), Atlanta, USA, 14\u201319 November 2004, pp. 133\u2013150. USENIX (2004"},{"key":"12_CR18","first-page":"75","volume":"14531305","author":"J Timofte","year":"2008","unstructured":"Timofte, J., et al.: Intrusion detection using open source tools. Inform. Economica J. ISSN 14531305, 75\u201379 (2008)","journal-title":"Inform. Economica J. ISSN"},{"key":"12_CR19","unstructured":"Nguyen, G., Fischer, M., Strufe, T.: Ossim: a generic simulation framework for overlay streaming. In: Bruzzone, A.G., Kropf, P.G., Riley, L.A., Davoudpour, M., Solis, A.O. (eds.) 2013 Summer Simulation Multiconference, SummerSim 2013, Toronto, Canada, 07\u201310 July 2013, p. 30. Society for Computer Simulation International\/ACM DL (2013)"},{"key":"12_CR20","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1007\/978-3-642-34176-2_2","volume-title":"Applications of Graph Transformations with Industrial Relevance","author":"M Proctor","year":"2012","unstructured":"Proctor, M.: Drools: a rule engine for complex event processing. In: Sch\u00fcrr, A., Varr\u00f3, D., Varr\u00f3, G. (eds.) AGTIVE 2011. LNCS, vol. 7233, p. 2. Springer, Heidelberg (2012). https:\/\/doi.org\/10.1007\/978-3-642-34176-2_2"},{"key":"12_CR21","unstructured":"EsperTech. Esper. http:\/\/www.espertech.com"},{"key":"12_CR22","doi-asserted-by":"crossref","unstructured":"Ning, P., Cui, Y., Reeves, D.S.: Constructing attack scenarios through correlation of intrusion alerts. In: Atluri, V. (ed.) Proceedings of the 9th ACM Conference on Computer and Communications Security, CCS 2002, Washington, DC, USA, 18\u201322 November 2002, pp. 245\u2013254. ACM (2002)","DOI":"10.1145\/586110.586144"},{"issue":"6","key":"12_CR23","first-page":"1538","volume":"36","author":"J Zhang","year":"2016","unstructured":"Zhang, J., Li, X., Wang, H.: Real-time alert correlation approach based on attack planning graph. J Comput. Appl. 36(6), 1538\u20131543 (2016)","journal-title":"J Comput. Appl."},{"issue":"1","key":"12_CR24","doi-asserted-by":"publisher","first-page":"53","DOI":"10.1016\/j.eng.2018.01.004","volume":"4","author":"Y Jia","year":"2018","unstructured":"Jia, Y., Qi, Y., Shang, H., Jiang, R., Li, A.: A practical approach to constructing a knowledge graph for cybersecurity. Engineering 4(1), 53\u201360 (2018). Cybersecurity","journal-title":"Engineering"},{"key":"12_CR25","unstructured":"Gupta, S., Dutt, N., Gupta, R., Nicolau, A.: Spark: a high-level synthesis framework for applying parallelizing compiler transformations. In: 2003 16th International Conference on VLSI Design, Proceedings, pp. 461\u2013466 (2003)"}],"container-title":["Lecture Notes in Computer Science","MDATA: A New Knowledge Representation Model"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-71590-8_12","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,3,6]],"date-time":"2021-03-06T15:06:41Z","timestamp":1615043201000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-71590-8_12"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"ISBN":["9783030715892","9783030715908"],"references-count":25,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-71590-8_12","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2021]]},"assertion":[{"value":"7 March 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}}]}}