{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,4]],"date-time":"2026-10-04T18:13:11Z","timestamp":1791137591104,"version":"4.1.0"},"publisher-location":"Cham","reference-count":24,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319005591","type":"print"},{"value":"9783319005607","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013]]},"DOI":"10.1007\/978-3-319-00560-7_17","type":"book-chapter","created":{"date-parts":[[2013,4,30]],"date-time":"2013-04-30T22:47:48Z","timestamp":1367362068000},"page":"125-134","source":"Crossref","is-referenced-by-count":2,"title":["A New Approach for QCL-Based Alert Correlation Process"],"prefix":"10.1007","author":[{"given":"Lydia","family":"Bouzar-Benlabiod","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Salem","family":"Benferhat","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thouraya","family":"Bouabana-Tebibel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"17_CR1","unstructured":"Anderson, J.: Computer security threat monitoring and surveillance. Technical report. James P. Anderson Company, Fort Washington, Pennsylvania (April 1980)"},{"key":"17_CR2","unstructured":"Axelsson, S.: Intrusion Detection Systems: A Survey and Taxonomy. Technical Report No 99-15, Dept. of Computer Engineering, Chalmers University of Technology, Sweden (March 2000)"},{"issue":"4","key":"17_CR3","first-page":"571","volume":"34","author":"S. Manganaris","year":"2000","unstructured":"Manganaris, S., Christensen, M., Zerkle, D., Hermiz, K.: A Data Mining Analysis of RTID Alarms. Recent Advances in Intrusion Detection Systems\u00a034(4), 571\u2013577 (2000)","journal-title":"Recent Advances in Intrusion Detection Systems"},{"key":"17_CR4","unstructured":"Chifflier, P., Tricaud, S.: Intrusion Detection Systems Correlation: a Weapon of Mass Investigation, CanSecWest, Vancouver (March 2008)"},{"key":"17_CR5","doi-asserted-by":"crossref","unstructured":"Cuppens, F.: Managing alerts in a multi-intrusion detection environment. In: Proc. 17th Computer Security Applications Conference, pp. 22\u201331 (December 2001)","DOI":"10.1109\/ACSAC.2001.991518"},{"issue":"4","key":"17_CR6","doi-asserted-by":"publisher","first-page":"443","DOI":"10.1145\/950191.950192","volume":"6","author":"K. Julisch","year":"2003","unstructured":"Julisch, K.: Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security (TISSEC)\u00a06(4), 443\u2013471 (2003)","journal-title":"ACM Transactions on Information and System Security (TISSEC)"},{"key":"17_CR7","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"54","DOI":"10.1007\/3-540-45474-8_4","volume-title":"Recent Advances in Intrusion Detection","author":"A. Valdes","year":"2001","unstructured":"Valdes, A., Skinner, K.: Probabilistic alert correlation. In: Lee, W., M\u00e9, L., Wespi, A. (eds.) RAID 2001. LNCS, vol.\u00a02212, pp. 54\u201368. Springer, Heidelberg (2001)"},{"issue":"1-2","key":"17_CR8","doi-asserted-by":"crossref","first-page":"71","DOI":"10.3233\/JCS-2002-101-204","volume":"10","author":"S.T. Eckmann","year":"2002","unstructured":"Eckmann, S.T., Vigna, G., Kemmerer, R.A.: STATL: an attack language for state-based intrusion Detection. Journal of Computer Security\u00a010(1-2), 71\u2013103 (2002)","journal-title":"Journal of Computer Security"},{"key":"17_CR9","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1007\/978-3-540-45248-5_6","volume-title":"Recent Advances in Intrusion Detection","author":"B. Morin","year":"2003","unstructured":"Morin, B., Debar, H.: Correlation of intrusion symptoms: An application of chronicles. In: Vigna, G., Kruegel, C., Jonsson, E. (eds.) RAID 2003. LNCS, vol.\u00a02820, pp. 94\u2013112. Springer, Heidelberg (2003)"},{"key":"17_CR10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1007\/3-540-39945-3_13","volume-title":"Recent Advances in Intrusion Detection","author":"F. Cuppens","year":"2000","unstructured":"Cuppens, F., Ortalo, R.: LAMBDA: A language to model a database for detection of attacks. In: Debar, H., M\u00e9, L., Wu, S.F. (eds.) RAID 2000. LNCS, vol.\u00a01907, pp. 197\u2013216. Springer, Heidelberg (2000)"},{"key":"17_CR11","doi-asserted-by":"crossref","unstructured":"Cuppens, F., Miege, A.: Alert Correlation in a Cooperative Intrusion Detection Framework. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, p. 202 ( May 2002)","DOI":"10.1109\/SECPRI.2002.1004372"},{"key":"17_CR12","first-page":"245","volume-title":"CCS 2002 : Proceedings of the 9th ACM Conference on Computer and Communications Security","author":"P. Ning","year":"2002","unstructured":"Ning, P., Cui, Y., Reeves, S.: Constructing attack scenarios through correlation of intrusion alerts. In: CCS 2002: Proceedings of the 9th ACM Conference on Computer and Communications Security, pp. 245\u2013254. ACM, New York (2002)"},{"key":"17_CR13","doi-asserted-by":"publisher","first-page":"31","DOI":"10.1145\/366173.366187","volume-title":"NSPW 2000 : Proceedings of the 2000 Workshop on New Security Paradigms","author":"S.J. Templeton","year":"2000","unstructured":"Templeton, S.J., Levitt, K.: A requires\/provides model for computer attacks. In: NSPW 2000: Proceedings of the 2000 Workshop on New Security Paradigms, pp. 31\u201338. ACM, New York (2000)"},{"key":"17_CR14","doi-asserted-by":"crossref","unstructured":"Benferhat, S., Kenaza, T., Mokhtari, A.: A Naive Bayes Approach for Detecting Coordinated Attacks. In: COMPSAC 2008, pp. 704\u2013709 (July-August 2008)","DOI":"10.1109\/COMPSAC.2008.213"},{"issue":"15","key":"17_CR15","doi-asserted-by":"publisher","first-page":"1889","DOI":"10.1016\/j.fss.2008.02.014","volume":"159","author":"S. Benferhat","year":"2008","unstructured":"Benferhat, S., Sedki, K.: Two alternatives for handling preferences in qualitative choice logic. Fuzzy Sets and Systems Journal (FSS 2008)\u00a0159(15), 1889\u20131912 (2008)","journal-title":"Fuzzy Sets and Systems Journal (FSS 2008)"},{"issue":"1-2","key":"17_CR16","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1016\/j.artint.2004.04.006","volume":"157","author":"G. Brewka","year":"2004","unstructured":"Brewka, G., Benferhat, S., Le Berre, D.: Qualitative Choice Logic. Artificial Intelligence Journal (AIJ)\u00a0157(1-2), 203\u2013237 (2004)","journal-title":"Artificial Intelligence Journal (AIJ)"},{"key":"17_CR17","doi-asserted-by":"crossref","unstructured":"Cuppens, F.: Managing Alerts in a Multi-Intrusion Detection Environment. In: Proceedings of Recent Advances in Intrusion Detection, Davis, CA, USA, pp. 22\u201331 (October 2001)","DOI":"10.1109\/ACSAC.2001.991518"},{"key":"17_CR18","doi-asserted-by":"crossref","unstructured":"Debar, H., Wespi, A.: Aggregation and Correlation of Intrusion-Detection Alerts. In: Proceedings of Recent Advances in Intrusion Detection, Davis, CA, USA, pp. 85\u2013103 (October 2001)","DOI":"10.1007\/3-540-45474-8_6"},{"key":"17_CR19","unstructured":"Qin, X., Lee, W.: Attack Plan Recognition and Prediction Using Causal Networks. In: ACSAC 2004, pp. 370\u2013379 (2004)"},{"key":"17_CR20","doi-asserted-by":"crossref","unstructured":"Geib, C., Goldman, R.: Plan Recognition in Intrusion Detection Systems. In: Proceeding of DARPA Information Survivability Conference and Exposition (DISCEX), vol.\u00a01, pp. 46\u201355 (June 2001)","DOI":"10.1109\/DISCEX.2001.932191"},{"key":"17_CR21","doi-asserted-by":"crossref","unstructured":"Debar, H., Curry, D., Feinstein, B.: The Intrusion Detection Message Exchange Format (IDMEF), Network Working Group, Request for Comments (RFC): 4765, Category: Experimental, SecureWorks, Inc. (March 2007)","DOI":"10.17487\/rfc4765"},{"key":"17_CR22","unstructured":"Ranum, M.J.: False Positives: A Users Guide to Making Sense of IDS Alarms, ICSA Labs IDSC, white paper (2003)"},{"key":"17_CR23","doi-asserted-by":"crossref","unstructured":"Alsubhi, K., Al-Shaer, E., Boutaba, R.: Alert Prioritization in Intrusion Detection Systems. In: The 11th IEEE\/IFIP Network Operations and Management Symposium (NOMS 2008), pp. 33\u201340 (April 2008)","DOI":"10.1109\/NOMS.2008.4575114"},{"key":"17_CR24","unstructured":"Tabia, K., Benferhat, S., Leray, P., Me, L.: Alert correlation in intrusion detection: Combining AI-based approaches for exploiting security operators knowledge and preferences. In: Association for the Advancement of Artificial Intelligence (2011)"}],"container-title":["Studies in Computational Intelligence","Modeling Approaches and Algorithms for Advanced Computer Applications"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-00560-7_17","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,30]],"date-time":"2025-04-30T07:41:54Z","timestamp":1745998914000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-00560-7_17"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013]]},"ISBN":["9783319005591","9783319005607"],"references-count":24,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-00560-7_17","relation":{},"ISSN":["1860-949X","1860-9503"],"issn-type":[{"value":"1860-949X","type":"print"},{"value":"1860-9503","type":"electronic"}],"subject":[],"published":{"date-parts":[[2013]]}}}