{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,15]],"date-time":"2025-06-15T04:01:53Z","timestamp":1749960113150,"version":"3.41.0"},"publisher-location":"Cham","reference-count":30,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031945731","type":"print"},{"value":"9783031945717","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-94571-7_12","type":"book-chapter","created":{"date-parts":[[2025,6,14]],"date-time":"2025-06-14T08:22:17Z","timestamp":1749889337000},"page":"205-222","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["ThreatTrace: Cyber-Attack Detection Through Trace Abstraction and\u00a0Soft Clustering"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9763-1399","authenticated-orcid":false,"given":"Andrzej","family":"Janusz","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-6102-3440","authenticated-orcid":false,"given":"Savandi","family":"Kalukapuge","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7205-8821","authenticated-orcid":false,"given":"Moe Thandar","family":"Wynn","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,6,15]]},"reference":[{"key":"12_CR1","doi-asserted-by":"crossref","unstructured":"van\u00a0der Aalst, W.M.P.: Process Mining \u2013 Data Science in Action, Second Edition. Springer (2016)","DOI":"10.1007\/978-3-662-49851-4"},{"key":"12_CR2","doi-asserted-by":"crossref","unstructured":"Adamczyk, B., et\u00a0al.: Dataset generation framework for evaluation of IoT Linux host-based intrusion detection systems. In: 2022 IEEE International Conference on Big Data (Big Data), pp. 6179\u20136187 (2022)","DOI":"10.1109\/BigData55660.2022.10020442"},{"issue":"1","key":"12_CR3","doi-asserted-by":"publisher","DOI":"10.1002\/ett.4150","volume":"32","author":"Z Ahmad","year":"2021","unstructured":"Ahmad, Z., Khan, A.S., Shiang, C.W., Abdullah, J., Ahmad, F.: Network intrusion detection system: a systematic study of machine learning and deep learning approaches. Trans. Emerging Telecommun. Technol. 32(1), e4150 (2021). https:\/\/doi.org\/10.1002\/ett.4150","journal-title":"Trans. Emerging Telecommun. Technol."},{"issue":"1","key":"12_CR4","doi-asserted-by":"publisher","first-page":"368","DOI":"10.1109\/TNSM.2021.3091783","volume":"19","author":"G Apruzzese","year":"2022","unstructured":"Apruzzese, G., Andreolini, M., Marchetti, M., Venturi, A., Colajanni, M.: Deep reinforcement adversarial learning against botnet evasion attacks. IEEE Trans. Netw. Serv. Manage. 19(1), 368\u2013384 (2022). https:\/\/doi.org\/10.1109\/TNSM.2021.3091783","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"12_CR5","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1007\/s10207-018-0415-3","volume":"18","author":"ML Bernardi","year":"2019","unstructured":"Bernardi, M.L., Cimitile, M., Distante, D., Martinelli, F., Mercaldo, F.: Dynamic malware detection and phylogeny analysis using process mining. Int. J. Inf. Secur. 18, 257\u2013284 (2019)","journal-title":"Int. J. Inf. Secur."},{"key":"12_CR6","series-title":"Studies in Computational Intelligence","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1007\/978-3-030-35480-0_5","volume-title":"Advances in Spatio-Temporal Segmentation of Visual Data","author":"Y Bodyanskiy","year":"2020","unstructured":"Bodyanskiy, Y., Boiko, O.: Online fuzzy clustering of data streams. In: Mashtalir, V., Ruban, I., Levashenko, V. (eds.) Advances in Spatio-Temporal Segmentation of Visual Data. SCI, vol. 876, pp. 211\u2013241. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-35480-0_5"},{"key":"12_CR7","doi-asserted-by":"publisher","unstructured":"Chen, T., Guestrin, C.: Xgboost: a scalable tree boosting system. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD 2016, pp. 785-794. Association for Computing Machinery (2016). https:\/\/doi.org\/10.1145\/2939672.2939785","DOI":"10.1145\/2939672.2939785"},{"issue":"1","key":"12_CR8","doi-asserted-by":"publisher","first-page":"333","DOI":"10.1090\/S0002-9939-07-09020-X","volume":"136","author":"P Clement","year":"2008","unstructured":"Clement, P., Desch, W.: An elementary proof of the triangle inequality for the wasserstein metric. Proc. Am. Math. Soc. 136(1), 333\u2013339 (2008). https:\/\/doi.org\/10.1090\/S0002-9939-07-09020-X","journal-title":"Proc. Am. Math. Soc."},{"key":"12_CR9","doi-asserted-by":"crossref","unstructured":"Czerwi\u0144ski, M., et\u00a0al.: Cybersecurity threat detection in the behavior of IoT devices: analysis of data mining competition results. In: FedCSIS 2023. ACSIS, vol.\u00a035 (2023)","DOI":"10.15439\/2023F3089"},{"issue":"3","key":"12_CR10","doi-asserted-by":"publisher","first-page":"837","DOI":"10.2307\/2531595","volume":"44","author":"ER DeLong","year":"1988","unstructured":"DeLong, E.R., DeLong, D.M., Clarke-Pearson, D.L.: Comparing the areas under two or more correlated receiver operating characteristic curves: a nonparametric approach. Biometrics 44(3), 837\u2013845 (1988)","journal-title":"Biometrics"},{"key":"12_CR11","doi-asserted-by":"publisher","first-page":"129","DOI":"10.1016\/j.dss.2017.04.003","volume":"100","author":"J Evermann","year":"2017","unstructured":"Evermann, J., Rehse, J.R., Fettke, P.: Predicting process behavior using deep learning. Decis. Support Syst. 100, 129\u2013140 (2017)","journal-title":"Decis. Support Syst."},{"key":"12_CR12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"533","DOI":"10.1007\/978-3-319-07881-6_36","volume-title":"Advanced Information Systems Engineering","author":"F Folino","year":"2014","unstructured":"Folino, F., Guarascio, M., Pontieri, L.: Mining predictive process models out of low-level multidimensional logs. In: Jarke, M., et al. (eds.) CAiSE 2014. LNCS, vol. 8484, pp. 533\u2013547. Springer, Cham (2014). https:\/\/doi.org\/10.1007\/978-3-319-07881-6_36"},{"key":"12_CR13","doi-asserted-by":"publisher","unstructured":"G\u00f3mez, J.R., et\u00a0al.: An automatic complex event processing rules generation system for the recognition of real-time IoT attack patterns. Eng. Appl. Artif. Intell. 123(Part B), 106344 (2023). https:\/\/doi.org\/10.1016\/J.ENGAPPAI.2023.106344","DOI":"10.1016\/J.ENGAPPAI.2023.106344"},{"key":"12_CR14","doi-asserted-by":"publisher","unstructured":"Hashemi, S.E., Gholian-Jouybari, F., Hajiaghaei-Keshteli, M.: A fuzzy c-means algorithm for optimizing data clustering. Expert Syst. Appl. 227(C) (2023). https:\/\/doi.org\/10.1016\/j.eswa.2023.120377","DOI":"10.1016\/j.eswa.2023.120377"},{"key":"12_CR15","doi-asserted-by":"publisher","unstructured":"Janusz, A., Ka\u0142u\u017ca, D., Ch\u0105dzy\u0144ska-Krasowska, A., Konarski, B., Holland, J., \u015al\u0119zak, D.: IEEE BigData 2019 Cup: Suspicious Network Event Recognition. In: 2019 IEEE International Conference on Big Data (IEEE BigData), Los Angeles, CA, USA, 9-12 December 2019. pp. 5881\u20135887. IEEE (2019). https:\/\/doi.org\/10.1109\/BIGDATA47090.2019.9005668","DOI":"10.1109\/BIGDATA47090.2019.9005668"},{"key":"12_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"305","DOI":"10.1007\/978-3-319-98648-7_18","volume-title":"Business Process Management","author":"P De Koninck","year":"2018","unstructured":"De Koninck, P., vanden Broucke, S., De Weerdt, J.: act2vec, trace2vec, log2vec, and\u00a0model2vec: representation learning for business processes. In: Weske, M., Montali, M., Weber, I., vom Brocke, J. (eds.) BPM 2018. LNCS, vol. 11080, pp. 305\u2013321. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-98648-7_18"},{"key":"12_CR17","doi-asserted-by":"publisher","unstructured":"Mac\u00e1k, M., Daubner, L., Sani, M.F., Buhnova, B.: Cybersecurity analysis via process mining: A systematic literature review. In: ADMA. LNCS, vol. 13087, pp. 393\u2013407. Springer (2021). https:\/\/doi.org\/10.1007\/978-3-030-95405-5_28","DOI":"10.1007\/978-3-030-95405-5_28"},{"key":"12_CR18","unstructured":"Mannhardt, F., Tax, N.: Unsupervised event abstraction using pattern abstraction and local process models. In: Joint Proceedings of the Radar tracks at the 18th International Working Conference on Business Process Modeling, Development and Support (BPMDS), and the 22nd International Working Conference on Evaluation and Modeling Methods for Systems Analysis and Development (EMMSAD), and the 8th International Workshop on Enterprise Modeling and Information Systems Architectures (EMISA) co-located with the 29th International Conference on Advanced Information Systems Engineering 2017 (CAiSE 2017), Essen, Germany, 12-13 June 2017. CEUR Workshop Proceedings, vol.\u00a01859, pp. 55\u201363. CEUR-WS.org (2017). https:\/\/ceur-ws.org\/Vol-1859\/bpmds-06-paper.pdf"},{"key":"12_CR19","unstructured":"McInnes, L., Healy, J., Melville, J.: Umap: uniform manifold approximation and projection for dimension reduction (2020). https:\/\/arxiv.org\/abs\/1802.03426"},{"key":"12_CR20","unstructured":"Mikolov, T., et\u00a0al.: Distributed representations of words and phrases and their compositionality. In: NIPS 2013, vol. 2. Curran Associates Inc., USA (2013)"},{"key":"12_CR21","doi-asserted-by":"crossref","unstructured":"Pennington, J., Socher, R., Manning, C.D.: Glove: global vectors for word representation. In: EMNLP, pp. 1532\u20131543 (2014)","DOI":"10.3115\/v1\/D14-1162"},{"key":"12_CR22","doi-asserted-by":"publisher","unstructured":"Tay, J.K., Narasimhan, B., Hastie, T.: Elastic net regularization paths for all generalized linear models. J. Statist. Softw. 106(1), 1\u201331 (2023). https:\/\/doi.org\/10.18637\/jss.v106.i01","DOI":"10.18637\/jss.v106.i01"},{"key":"12_CR23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"401","DOI":"10.1007\/978-3-319-45348-4_23","volume-title":"Business Process Management","author":"I Teinemaa","year":"2016","unstructured":"Teinemaa, I., Dumas, M., Maggi, F.M., Di Francescomarino, C.: Predictive business process monitoring with structured and unstructured data. In: La Rosa, M., Loos, P., Pastor, O. (eds.) BPM 2016. LNCS, vol. 9850, pp. 401\u2013417. Springer, Cham (2016). https:\/\/doi.org\/10.1007\/978-3-319-45348-4_23"},{"key":"12_CR24","doi-asserted-by":"publisher","first-page":"315","DOI":"10.1016\/j.ins.2014.09.057","volume":"294","author":"B V\u00e1zquez-Barreiros","year":"2015","unstructured":"V\u00e1zquez-Barreiros, B., et al.: Prodigen: mining complete, precise and minimal structure process models with a genetic algorithm. Inf. Sci. 294, 315\u2013333 (2015)","journal-title":"Inf. Sci."},{"key":"12_CR25","doi-asserted-by":"crossref","unstructured":"Wang, C., Nulty, P., Lillis, D.: A comparative study on word embeddings in deep learning for text classification. In: NLPIR, pp. 37-46. Association for Computing Machinery (2021)","DOI":"10.1145\/3443279.3443304"},{"key":"12_CR26","doi-asserted-by":"publisher","unstructured":"Wang, Y.A., Chen, Y.N.: What do position embeddings learn? an empirical study of pre-trained language model positional encoding. In: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 6840\u20136849. Association for Computational Linguistics (Nov 2020). https:\/\/doi.org\/10.18653\/v1\/2020.emnlp-main.555","DOI":"10.18653\/v1\/2020.emnlp-main.555"},{"issue":"3","key":"12_CR27","doi-asserted-by":"publisher","first-page":"645","DOI":"10.1109\/TNN.2005.845141","volume":"16","author":"R Xu","year":"2005","unstructured":"Xu, R., Wunsch, D.: Survey of clustering algorithms. IEEE Trans. Neural Netw. 16(3), 645\u2013678 (2005)","journal-title":"IEEE Trans. Neural Netw."},{"issue":"1\/2","key":"12_CR28","doi-asserted-by":"publisher","first-page":"31","DOI":"10.1023\/A:1007652502315","volume":"42","author":"MJ Zaki","year":"2001","unstructured":"Zaki, M.J.: SPADE: an efficient algorithm for mining frequent sequences. Mach. Learn. 42(1\/2), 31\u201360 (2001)","journal-title":"Mach. Learn."},{"key":"12_CR29","doi-asserted-by":"publisher","first-page":"719","DOI":"10.1007\/s41066-020-00226-2","volume":"6","author":"S van Zelst","year":"2021","unstructured":"van Zelst, S., et al.: Event abstraction in process mining: literature review and taxonomy. Granular Comput. 6, 719\u2013736 (2021)","journal-title":"Granular Comput."},{"key":"12_CR30","doi-asserted-by":"publisher","first-page":"15","DOI":"10.1007\/978-3-031-50423-5_2","volume-title":"Tools and Methods of Program Analysis","author":"Y Zhong","year":"2024","unstructured":"Zhong, Y., Goulermas, J.Y., Lisitsa, A.: Process mining algorithm for online intrusion detection system. In: Yavorskiy, R., Cavalli, A.R., Kalenkova, A. (eds.) Tools and Methods of Program Analysis, pp. 15\u201325. Springer Nature Switzerland, Cham (2024)"}],"container-title":["Lecture Notes in Computer Science","Advanced Information Systems Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-94571-7_12","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,14]],"date-time":"2025-06-14T08:22:25Z","timestamp":1749889345000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-94571-7_12"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031945731","9783031945717"],"references-count":30,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-94571-7_12","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"15 June 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"CAiSE","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Advanced Information Systems Engineering","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Vienna","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Austria","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 June 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20 June 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"37","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"caise2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/conferences.big.tuwien.ac.at\/caise2025\/index.php","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}