{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T17:36:34Z","timestamp":1778693794771,"version":"3.51.4"},"publisher-location":"Berlin, Heidelberg","reference-count":18,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642236433","type":"print"},{"value":"9783642236440","type":"electronic"}],"license":[{"start":{"date-parts":[[2011,1,1]],"date-time":"2011-01-01T00:00:00Z","timestamp":1293840000000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2011]]},"DOI":"10.1007\/978-3-642-23644-0_10","type":"book-chapter","created":{"date-parts":[[2012,2,11]],"date-time":"2012-02-11T05:06:20Z","timestamp":1328936780000},"page":"181-200","source":"Crossref","is-referenced-by-count":67,"title":["Modeling User Search Behavior for Masquerade Detection"],"prefix":"10.1007","author":[{"given":"Malek Ben","family":"Salem","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Salvatore J.","family":"Stolfo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"10_CR1","unstructured":"Ben-Salem, M.: RUU dataset: http:\/\/www1.cs.columbia.edu\/ids\/RUU\/data\/"},{"key":"10_CR2","series-title":"LNICST","doi-asserted-by":"publisher","first-page":"51","DOI":"10.1007\/978-3-642-05284-2_4","volume-title":"Security and Privacy in Communication Networks","author":"B.M. Bowen","year":"2009","unstructured":"Bowen, B.M., Hershkop, S., Keromytis, A.D., Stolfo, S.J.: Baiting inside attackers using decoy documents. In: Chen, Y., Dimitriou, T.D., Zhou, J. (eds.) SecureComm 2009. LNICST, vol.\u00a019, pp. 51\u201370. Springer, Heidelberg (2009)"},{"key":"10_CR3","unstructured":"Chang, C.-C., and Lin, C.-J.: Libsvm: a library for support vector machines (2001), http:\/\/www.csie.ntu.edu.tw\/~cjlin\/papers\/libsvm.pdf"},{"key":"10_CR4","doi-asserted-by":"crossref","unstructured":"Coull, S. E., Branch, J., Szymanski, B., and Breimer, E. Intrusion detection: A bioinformatics approach. In: Proceedings of the 19th Annual Computer Security Applications Conference, pp. 24\u201333 (2001)","DOI":"10.1109\/CSAC.2003.1254307"},{"issue":"8","key":"10_CR5","doi-asserted-by":"publisher","first-page":"4116","DOI":"10.1016\/j.csda.2008.01.022","volume":"52","author":"S.E. Coull","year":"2008","unstructured":"Coull, S.E., Szymanski, B.K.: Sequence alignment for masquerade detection. Computational Statistics and Data Analysis\u00a052(8), 4116\u20134131 (2008)","journal-title":"Computational Statistics and Data Analysis"},{"key":"10_CR6","first-page":"5","volume-title":"Working Notes of the Joint Workshop on Predicting the Future: AI Approaches to Time Series Analysis, 15th National Conference on Artificial Intelligence\/15th International Conference on Machine Learning","author":"B.D. Davison","year":"1998","unstructured":"Davison, B.D., Hirsh, H.: Predicting sequences of user actions. In: Working Notes of the Joint Workshop on Predicting the Future: AI Approaches to Time Series Analysis, 15th National Conference on Artificial Intelligence\/15th International Conference on Machine Learning, pp. 5\u201312. AAAI Press, Menlo Park (1998)"},{"key":"10_CR7","volume-title":"Design and analysis : a researcher\u2019s handbook","author":"G. Keppel","year":"2004","unstructured":"Keppel, G.: Design and analysis: a researcher\u2019s handbook. Pearson Prentice Hall, London (2004)"},{"key":"10_CR8","first-page":"43","volume-title":"AAAI Workshop: AI Approaches to Fraud Detection and Risk Management","author":"T. Lane","year":"1997","unstructured":"Lane, T., Brodley, C.E.: Sequence matching and learning in anomaly detection for computer security. In: AAAI Workshop: AI Approaches to Fraud Detection and Risk Management, pp. 43\u201349. AAAI Press, Menlo Park (1997)"},{"key":"10_CR9","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"146","DOI":"10.1007\/978-3-540-74320-0_8","volume-title":"Recent Advances in Intrusion Detection","author":"M.A. Maloof","year":"2007","unstructured":"Maloof, M.A., Stephens, G.D.: elicit: A system for detecting insiders who violate need-to-know. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 146\u2013166. Springer, Heidelberg (2007)"},{"key":"10_CR10","first-page":"219","volume-title":"DSN 2002: Proceedings of the 2002 International Conference on Dependable Systems and Networks","author":"R.A. Maxion","year":"2002","unstructured":"Maxion, R.A., Townsend, T.N.: Masquerade detection using truncated command lines. In: DSN 2002: Proceedings of the 2002 International Conference on Dependable Systems and Networks, pp. 219\u2013228. IEEE Computer Society, Los Alamitos (2002)"},{"issue":"1","key":"10_CR11","doi-asserted-by":"publisher","first-page":"124","DOI":"10.1109\/TR.2004.824828","volume":"53","author":"R.A. Maxion","year":"2004","unstructured":"Maxion, R.A., Townsend, T.N.: Masquerade detection augmented with error analysis. IEEE Transactions on Reliability\u00a053(1), 124\u2013147 (2004)","journal-title":"IEEE Transactions on Reliability"},{"key":"10_CR12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"223","DOI":"10.1007\/978-3-540-30143-1_12","volume-title":"Recent Advances in Intrusion Detection","author":"M. Oka","year":"2004","unstructured":"Oka, M., Oyama, Y., Abe, H., Kato, K.: Anomaly detection using layered networks based on eigen co-occurrence matrix. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol.\u00a03224, pp. 223\u2013237. Springer, Heidelberg (2004)"},{"issue":"7","key":"10_CR13","doi-asserted-by":"publisher","first-page":"1443","DOI":"10.1162\/089976601750264965","volume":"13","author":"B. Sch\u00f6lkopf","year":"2001","unstructured":"Sch\u00f6lkopf, B., Platt, J.C., Shawe-taylor, J., Smola, A.J., Williamson, R.C.: Estimating the support of a high-dimensional distribution. Neural Computation\u00a013(7), 1443\u20131471 (2001)","journal-title":"Neural Computation"},{"key":"10_CR14","unstructured":"Schonlau, M.: Schonlau dataset, http:\/\/www.schonlau.net"},{"key":"10_CR15","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1214\/ss\/998929476","volume":"16","author":"M. Schonlau","year":"2001","unstructured":"Schonlau, M., Dumouchel, W., Ju, W., Karr, A.F., Theus, M., Vardi, Y.: Computer intrusion: Detecting masquerades. Statistical Science\u00a016, 58\u201374 (2001)","journal-title":"Statistical Science"},{"key":"10_CR16","doi-asserted-by":"publisher","first-page":"317","DOI":"10.1145\/312129.312267","volume-title":"Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD 1999)","author":"N.A. Syed","year":"1999","unstructured":"Syed, N.A., Liu, H., Huan, S., Kah, L., Sung, K.: Handling concept drifts in incremental learning with support vector machines. In: Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD 1999), pp. 317\u2013321. ACM Press, New York (1999)"},{"key":"10_CR17","volume-title":"The Nature of Statistical Learning Theory (Information Science and Statistics)","author":"V.N. Vapnik","year":"1999","unstructured":"Vapnik, V.N.: The Nature of Statistical Learning Theory (Information Science and Statistics). Springer, Heidelberg (1999)"},{"key":"10_CR18","unstructured":"Wang, K., and Stolfo, S.\u00a0J. One-class training for masquerade detection. In: Proceedings of the 3rd IEEE Workshop on Data Mining for Computer Security (2003)"}],"container-title":["Lecture Notes in Computer Science","Recent Advances in Intrusion Detection"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-23644-0_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,20]],"date-time":"2025-03-20T13:22:05Z","timestamp":1742476925000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-23644-0_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011]]},"ISBN":["9783642236433","9783642236440"],"references-count":18,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-23644-0_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011]]}}}