{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T06:07:57Z","timestamp":1757311677907,"version":"3.40.3"},"publisher-location":"Cham","reference-count":28,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783031230196"},{"type":"electronic","value":"9783031230202"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-23020-2_8","type":"book-chapter","created":{"date-parts":[[2022,12,6]],"date-time":"2022-12-06T07:03:04Z","timestamp":1670310184000},"page":"140-154","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Reducing Intrusion Alert Trees to\u00a0Aid Visualization"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3762-6475","authenticated-orcid":false,"given":"Eric","family":"Ficke","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2949-5145","authenticated-orcid":false,"given":"Raymond M.","family":"Bateman","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8034-0942","authenticated-orcid":false,"given":"Shouhuai","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,12,7]]},"reference":[{"key":"8_CR1","doi-asserted-by":"crossref","unstructured":"Angelini, M., Prigent, N., Santucci, G.: PERCIVAL: proactive and reactive attack and response assessment for cyber incidents using visual analytics. In: 2015 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 1\u20138. IEEE (2015)","DOI":"10.1109\/VIZSEC.2015.7312764"},{"key":"8_CR2","series-title":"Mathematics and Visualization","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1007\/978-3-642-18638-7_5","volume-title":"Graph Drawing Software","author":"D Auber","year":"2004","unstructured":"Auber, D.: Tulip\u2014a huge graph visualization framework. In: J\u00fcnger, M., Mutzel, P. (eds.) Graph Drawing Software. Mathematics and Visualization, pp. 105\u2013126. Springer, Heidelberg (2004). https:\/\/doi.org\/10.1007\/978-3-642-18638-7_5"},{"issue":"2","key":"8_CR3","first-page":"47","volume":"21","author":"V Batagelj","year":"1998","unstructured":"Batagelj, V., Mrvar, A.: Pajek-program for large network analysis. Connections 21(2), 47\u201357 (1998)","journal-title":"Connections"},{"issue":"1\u20133","key":"8_CR4","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1016\/S0166-218X(97)00125-X","volume":"82","author":"A Brandst\u00e4dt","year":"1998","unstructured":"Brandst\u00e4dt, A., Chepoi, V.D., Dragan, F.F.: The algorithmic use of hypertree structure and maximum neighbourhood orderings. Discret. Appl. Math. 82(1\u20133), 43\u201377 (1998)","journal-title":"Discret. Appl. Math."},{"key":"8_CR5","doi-asserted-by":"crossref","unstructured":"Chen, Y., Boehm, B., Sheppard, L.: Value driven security threat modeling based on attack path analysis. In: 2007 40th Annual Hawaii International Conference on System Sciences (HICSS 2007), pp. 280a\u2013280a. IEEE (2007)","DOI":"10.1109\/HICSS.2007.601"},{"key":"8_CR6","unstructured":"Cisco: Snort - network intrusion detection & prevention system, March 2018. http:\/\/www.snort.org\/downloads"},{"key":"8_CR7","doi-asserted-by":"crossref","unstructured":"Cuppens, F., Mi\u00e8ge, A.: Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, SP 2002, p. 202 (2002)","DOI":"10.1109\/SECPRI.2002.1004372"},{"key":"8_CR8","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"483","DOI":"10.1007\/3-540-45848-4_57","volume-title":"Graph Drawing","author":"J Ellson","year":"2002","unstructured":"Ellson, J., Gansner, E., Koutsofios, L., North, S.C., Woodhull, G.: Graphviz\u2014open source graph drawing tools. In: Mutzel, P., J\u00fcnger, M., Leipert, S. (eds.) GD 2001. LNCS, vol. 2265, pp. 483\u2013484. Springer, Heidelberg (2002). https:\/\/doi.org\/10.1007\/3-540-45848-4_57"},{"key":"8_CR9","doi-asserted-by":"crossref","unstructured":"Ficke, E., Xu, S.: APIN: automatic attack path identification in computer networks. In: IEEE ISI 2020 (2020)","DOI":"10.1109\/ISI49825.2020.9280547"},{"issue":"1","key":"8_CR10","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.jda.2005.01.001","volume":"4","author":"AV Gerbessiotis","year":"2006","unstructured":"Gerbessiotis, A.V.: An architecture independent study of parallel segment trees. J. Discrete Algorithms 4(1), 1\u201324 (2006)","journal-title":"J. Discrete Algorithms"},{"issue":"1","key":"8_CR11","doi-asserted-by":"publisher","first-page":"204","DOI":"10.1109\/TVCG.2018.2865029","volume":"25","author":"JR Goodall","year":"2019","unstructured":"Goodall, J.R., et al.: Situ: identifying and explaining suspicious behavior in networks. IEEE Trans. Vis. Comput. Graph. 25(1), 204\u2013214 (2019)","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"8_CR12","doi-asserted-by":"crossref","unstructured":"Gu, G., C\u00e1rdenas, A., Lee, W.: Principled reasoning and practical applications of alert fusion in intrusion detection systems. In: Proceedings of ACM Symposium on Information, Computer and Communications Security (ASIACCS 2008), pp. 136\u2013147 (2008)","DOI":"10.1145\/1368310.1368332"},{"key":"8_CR13","doi-asserted-by":"publisher","unstructured":"Harshaw, C.R., Bridges, R.A., Iannacone, M.D., Reed, J.W., Goodall, J.R.: GraphPrints: towards a graph analytic method for network anomaly detection. In: Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016, pp. 15:1\u201315:4. ACM, New York (2016). https:\/\/doi.org\/10.1145\/2897795.2897806","DOI":"10.1145\/2897795.2897806"},{"issue":"1","key":"8_CR14","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1109\/2945.841119","volume":"6","author":"I Herman","year":"2000","unstructured":"Herman, I., Melan\u00e7on, G., Marshall, M.S.: Graph visualization and navigation in information visualization: a survey. IEEE Trans. Visual Comput. Graphics 6(1), 24\u201343 (2000)","journal-title":"IEEE Trans. Visual Comput. Graphics"},{"key":"8_CR15","doi-asserted-by":"crossref","unstructured":"Kerzner, E., et al.: Graffinity: visualizing connectivity in large graphs. In: Computer Graphics Forum, vol. 36, pp. 251\u2013260. Wiley Online Library (2017)","DOI":"10.1111\/cgf.13184"},{"issue":"4","key":"8_CR16","doi-asserted-by":"publisher","first-page":"1638","DOI":"10.1109\/TVCG.2020.2969007","volume":"26","author":"AP Lohfink","year":"2020","unstructured":"Lohfink, A.P., Anton, S.D.D., Schotten, H.D., Leitte, H., Garth, C.: Security in process: visually supported triage analysis in industrial process data. IEEE Trans. Visual Comput. Graphics 26(4), 1638\u20131649 (2020)","journal-title":"IEEE Trans. Visual Comput. Graphics"},{"key":"8_CR17","doi-asserted-by":"crossref","unstructured":"Nadeem, A., Verwer, S., Yang, S.J.: SAGE: intrusion alert-driven attack graph extractor. In: 2021 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 36\u201341. IEEE (2021)","DOI":"10.1109\/VizSec53666.2021.00009"},{"key":"8_CR18","doi-asserted-by":"crossref","unstructured":"Nettleton, D.F.: Information loss evaluation based on fuzzy and crisp clustering of graph statistics. In: 2012 IEEE International Conference on Fuzzy Systems, pp. 1\u20138. IEEE (2012)","DOI":"10.1109\/FUZZ-IEEE.2012.6250774"},{"key":"8_CR19","doi-asserted-by":"crossref","unstructured":"Nettleton, D.F., Torra, V., Dries, A.: The effect of constraints on information loss and risk for clustering and modification based graph anonymization methods. arXiv preprint arXiv:1401.0458 (2014)","DOI":"10.5120\/16712-6870"},{"key":"8_CR20","doi-asserted-by":"crossref","unstructured":"Ning, P., Cui, Y., Reeves, D.S.: Constructing attack scenarios through correlation of intrusion alerts. In: Proceedings of the 9th ACM Conference on Computer and Communications Security, CCS 2002, pp. 245\u2013254 (2002)","DOI":"10.1145\/586110.586144"},{"key":"8_CR21","doi-asserted-by":"crossref","unstructured":"Ning, P., Xu, D.: Learning attack strategies from intrusion alerts. In: Proceedings of the 10th ACM Conference on Computer and Communications Security, CCS 2003, pp. 200\u2013209 (2003)","DOI":"10.1145\/948109.948137"},{"key":"8_CR22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"231","DOI":"10.1007\/11555827_14","volume-title":"Computer Security \u2013 ESORICS 2005","author":"I Ray","year":"2005","unstructured":"Ray, I., Poolsapassit, N.: Using attack trees to identify malicious attacks from authorized insiders. In: di Vimercati, S.C., Syverson, P., Gollmann, D. (eds.) ESORICS 2005. LNCS, vol. 3679, pp. 231\u2013246. Springer, Heidelberg (2005). https:\/\/doi.org\/10.1007\/11555827_14"},{"key":"8_CR23","doi-asserted-by":"crossref","unstructured":"Sadoddin, R., Ghorbani, A.: Alert correlation survey: framework and techniques. In: Proceedings of the 2006 International Conference on Privacy, Security and Trust: Bridge the Gap Between PST Technologies and Business Services, pp. 1\u201310 (2006)","DOI":"10.1145\/1501434.1501479"},{"issue":"5","key":"8_CR24","doi-asserted-by":"publisher","first-page":"1289","DOI":"10.1016\/j.comnet.2012.10.022","volume":"57","author":"S Salah","year":"2013","unstructured":"Salah, S., Maci\u00e1-Fern\u00e1ndez, G., D\u00edaz-Verdejo, J.E.: A model-based survey of alert correlation techniques. Comput. Netw. 57(5), 1289\u20131317 (2013)","journal-title":"Comput. Netw."},{"key":"8_CR25","doi-asserted-by":"crossref","unstructured":"Schidler, A., Szeider, S.: Computing optimal hypertree decompositions. In: 2020 Proceedings of the Twenty-Second Workshop on Algorithm Engineering and Experiments (ALENEX), pp. 1\u201311. SIAM (2020)","DOI":"10.1137\/1.9781611976007.1"},{"key":"8_CR26","doi-asserted-by":"crossref","unstructured":"Sethi, A., Wills, G.: Expert-interviews led analysis of EEVi-a model for effective visualization in cyber-security. In: 2017 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 1\u20138. IEEE (2017)","DOI":"10.1109\/VIZSEC.2017.8062195"},{"key":"8_CR27","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: ICISSP, pp. 108\u2013116 (2018)","DOI":"10.5220\/0006639801080116"},{"issue":"3","key":"8_CR28","doi-asserted-by":"publisher","first-page":"146","DOI":"10.1109\/TDSC.2004.21","volume":"1","author":"F Valeur","year":"2004","unstructured":"Valeur, F., Vigna, G., Kruegel, C., Kemmerer, R.A.: A comprehensive approach to intrusion detection alert correlation. IEEE Trans. Dependable Secur. Comput. 1(3), 146\u2013169 (2004)","journal-title":"IEEE Trans. Dependable Secur. Comput."}],"container-title":["Lecture Notes in Computer Science","Network and System Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-23020-2_8","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,9]],"date-time":"2024-10-09T23:41:39Z","timestamp":1728517299000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-23020-2_8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031230196","9783031230202"],"references-count":28,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-23020-2_8","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"7 December 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"NSS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Network and System Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Denarau Island","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Fiji","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2022","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"9 December 2022","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12 December 2022","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"nss2022","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/nsclab.org\/nss2022\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Easy chair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"83","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"23","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"18","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"28% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}