{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T03:16:56Z","timestamp":1780543016050,"version":"3.54.1"},"publisher-location":"Berlin, Heidelberg","reference-count":27,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642372995","type":"print"},{"value":"9783642373008","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013]]},"DOI":"10.1007\/978-3-642-37300-8_14","type":"book-chapter","created":{"date-parts":[[2013,3,13]],"date-time":"2013-03-13T04:53:59Z","timestamp":1363150439000},"page":"232-241","source":"Crossref","is-referenced-by-count":7,"title":["Shedding Light on Log Correlation in Network Forensics Analysis"],"prefix":"10.1007","author":[{"given":"Elias","family":"Raftopoulos","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Matthias","family":"Egli","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xenofontas","family":"Dimitropoulos","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"14_CR1","unstructured":"Cuppens, F., Mi\u00e8ge, A.: Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy (2002)"},{"key":"14_CR2","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"85","DOI":"10.1007\/3-540-45474-8_6","volume-title":"Recent Advances in Intrusion Detection","author":"H. Debar","year":"2001","unstructured":"Debar, H., Wespi, A.: Aggregation and Correlation of Intrusion-Detection Alerts. In: Lee, W., M\u00e9, L., Wespi, A. (eds.) RAID 2001. LNCS, vol.\u00a02212, pp. 85\u2013103. Springer, Heidelberg (2001)"},{"key":"14_CR3","unstructured":"Advanced automated threat analysis system, \n                    \n                      http:\/\/www.threatexpert.com"},{"key":"14_CR4","unstructured":"AlienVault, \n                    \n                      http:\/\/www.alienvault.com\/"},{"key":"14_CR5","unstructured":"Anonymous postmasters early warning system, \n                    \n                      http:\/\/www.apews.org"},{"key":"14_CR6","unstructured":"Cooperative Network Security Community, \n                    \n                      http:\/\/www.dshield.org"},{"key":"14_CR7","unstructured":"Emerging Threats web page, \n                    \n                      http:\/\/www.emergingthreats.net"},{"key":"14_CR8","unstructured":"GFI Languard, \n                    \n                      http:\/\/www.gfi.com\/network-security-vulnerability-scanner"},{"key":"14_CR9","unstructured":"IBM Tivoli SCM, \n                    \n                      http:\/\/www-01.ibm.com\/software\/tivoli\/"},{"key":"14_CR10","unstructured":"Shadowserver Foundation web page, \n                    \n                      http:\/\/www.shadowserver.org"},{"key":"14_CR11","unstructured":"The Nessus vulnerability scanner, \n                    \n                      http:\/\/www.tenable.com\/products\/nessus"},{"key":"14_CR12","unstructured":"The Open Vulnerability Assessment System, \n                    \n                      http:\/\/www.openvas.org"},{"key":"14_CR13","unstructured":"The Urlblacklist web page, \n                    \n                      http:\/\/www.urlblacklist.org"},{"key":"14_CR14","doi-asserted-by":"publisher","first-page":"131","DOI":"10.1023\/A:1007465528199","volume":"29","author":"N. Friedman","year":"1997","unstructured":"Friedman, N., Geiger, D., Goldszmidt, M.: Bayesian network classifiers. Mach. Learn.\u00a029, 131\u2013163 (1997)","journal-title":"Mach. Learn."},{"key":"14_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1007\/978-3-540-45248-5_6","volume-title":"Recent Advances in Intrusion Detection","author":"B. Morin","year":"2003","unstructured":"Morin, B., Debar, H.: Correlation of Intrusion Symptoms: An Application of Chronicles. In: Vigna, G., Kruegel, C., Jonsson, E. (eds.) RAID 2003. LNCS, vol.\u00a02820, pp. 94\u2013112. Springer, Heidelberg (2003)"},{"key":"14_CR16","doi-asserted-by":"crossref","unstructured":"Ning, P., Cui, Y., Reeves, D.S.: Constructing attack scenarios through correlation of intrusion alerts. In: Proceedings of the 9th CCS ACM Conference (2002)","DOI":"10.1145\/586110.586144"},{"key":"14_CR17","unstructured":"Platt, J.C.: Sequential minimal optimization: A fast algorithm for training support vector machines (1998)"},{"key":"14_CR18","unstructured":"Qin, X.: A probabilistic-based framework for infosec alert correlation. PhD thesis, Atlanta, GA, USA (2005) AAI3183248"},{"key":"14_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1007\/978-3-540-45248-5_5","volume-title":"Recent Advances in Intrusion Detection","author":"X. Qin","year":"2003","unstructured":"Qin, X., Lee, W.: Statistical Causality Analysis of INFOSEC Alert Data. In: Vigna, G., Kruegel, C., Jonsson, E. (eds.) RAID 2003. LNCS, vol.\u00a02820, pp. 73\u201393. Springer, Heidelberg (2003)"},{"key":"14_CR20","first-page":"81","volume":"1","author":"J.R. Quinlan","year":"1986","unstructured":"Quinlan, J.R.: Induction of decision trees. Mach. Learn.\u00a01, 81\u2013106 (1986)","journal-title":"Mach. Learn."},{"key":"14_CR21","doi-asserted-by":"crossref","unstructured":"Raftopoulos, E., Dimitropoulos, X.: Detecting, validating and characterizing computer infections in the wild. In: Proceedings of IMC 2011, NY, USA (2011)","DOI":"10.1145\/2068816.2068820"},{"key":"14_CR22","doi-asserted-by":"crossref","unstructured":"Raftopoulos, E., Dimitropoulos, X.: Technical report: Shedding light on data correlation during network forensics analysis. TIK Technical Report 346, ETH Zurich (2012)","DOI":"10.1007\/978-3-642-37300-8_14"},{"key":"14_CR23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"153","DOI":"10.1007\/978-3-642-14215-4_9","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"H. Ren","year":"2010","unstructured":"Ren, H., Stakhanova, N., Ghorbani, A.A.: An Online Adaptive Approach to Alert Correlation. In: Kreibich, C., Jahnke, M. (eds.) DIMVA 2010. LNCS, vol.\u00a06201, pp. 153\u2013172. Springer, Heidelberg (2010)"},{"key":"14_CR24","doi-asserted-by":"crossref","unstructured":"Sadoddin, R., Ghorbani, A.: Alert correlation survey: framework and techniques. In: Proceedings of PST 2006, pp. 37:1\u201337:10. ACM, New York (2006)","DOI":"10.1145\/1501434.1501479"},{"key":"14_CR25","unstructured":"A free lightweight network IDS for UNIX and Windows, \n                    \n                      http:\/\/www.snort.org"},{"key":"14_CR26","doi-asserted-by":"crossref","unstructured":"Trestian, I., Ranjan, S., Kuzmanovi, A., Nucci, A.: Unconstrained endpoint profiling (googling the internet). SIGCOMM Comput. Commun. Rev. (2008)","DOI":"10.1145\/1402958.1402991"},{"key":"14_CR27","unstructured":"Witten, I.H., Frank, E.: Data Mining: Practical machine learning tools and techniques, 2nd edn. Morgan Kaufmann (2005)"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-37300-8_14","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,11]],"date-time":"2019-05-11T14:44:01Z","timestamp":1557585841000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-37300-8_14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013]]},"ISBN":["9783642372995","9783642373008"],"references-count":27,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-37300-8_14","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2013]]}}}