{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T11:56:07Z","timestamp":1783166167353,"version":"3.54.6"},"publisher-location":"Singapore","reference-count":73,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819624164","type":"print"},{"value":"9789819624171","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-981-96-2417-1_15","type":"book-chapter","created":{"date-parts":[[2025,3,3]],"date-time":"2025-03-03T09:51:32Z","timestamp":1740995492000},"page":"273-294","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["AutoCRAT: Automatic Cumulative Reconstruction of Alert Trees"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3762-6475","authenticated-orcid":false,"given":"Eric","family":"Ficke","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2949-5145","authenticated-orcid":false,"given":"Raymond M.","family":"Bateman","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8034-0942","authenticated-orcid":false,"given":"Shouhuai","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,3,4]]},"reference":[{"key":"15_CR1","unstructured":"Suricata | open source ids \/ ips \/ nsm engine (2018). https:\/\/suricata-ids.org\/download\/"},{"key":"15_CR2","unstructured":"Welcome to the emerging threats rule server (2019). https:\/\/rules.emergingthreats.net\/"},{"issue":"4","key":"15_CR3","doi-asserted-by":"publisher","first-page":"263","DOI":"10.1002\/nem.804","volume":"22","author":"K Alsubhi","year":"2012","unstructured":"Alsubhi, K., Aib, I., Boutaba, R.: Fuzmet: a fuzzy-logic based alert prioritization engine for intrusion detection systems. Int. J. Netw. Manag. 22(4), 263\u2013284 (2012)","journal-title":"Int. J. Netw. Manag."},{"issue":"2","key":"15_CR4","doi-asserted-by":"publisher","first-page":"404","DOI":"10.1109\/TETC.2017.2764885","volume":"8","author":"G Apruzzese","year":"2017","unstructured":"Apruzzese, G., Pierazzi, F., Colajanni, M., Marchetti, M.: Detection and threat prioritization of pivoting attacks in large networks. IEEE Trans. Emerg. Top. Comput. 8(2), 404\u2013415 (2017)","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"issue":"3","key":"15_CR5","doi-asserted-by":"publisher","first-page":"186","DOI":"10.1145\/357830.357849","volume":"3","author":"S Axelsson","year":"2000","unstructured":"Axelsson, S.: The base-rate fallacy and the difficulty of intrusion detection. ACM Trans. Inf. Syst. Secur. (TISSEC) 3(3), 186\u2013205 (2000)","journal-title":"ACM Trans. Inf. Syst. Secur. (TISSEC)"},{"key":"15_CR6","doi-asserted-by":"crossref","unstructured":"Chen, C.M., Guan, D., Huang, Y.Z., Ou, Y.H.: Attack sequence detection in cloud using hidden Markov model. In: 2012 Seventh Asia Joint Conference on Information Security, pp. 100\u2013103. IEEE (2012)","DOI":"10.1109\/AsiaJCIS.2012.24"},{"key":"15_CR7","doi-asserted-by":"crossref","unstructured":"Chen, H., Cho, J., Xu, S.: Quantifying the security effectiveness of firewalls and dmzs. In: Proceedings of the HoTSoS\u20192018, pp. 9:1\u20139:11 (2018)","DOI":"10.1145\/3190619.3190639"},{"key":"15_CR8","doi-asserted-by":"crossref","unstructured":"Chen, Y., Boehm, B., Sheppard, L.: Value driven security threat modeling based on attack path analysis. In: 2007 40th Annual Hawaii International Conference on System Sciences (HICSS\u201907), p. 280a. IEEE (2007)","DOI":"10.1109\/HICSS.2007.601"},{"key":"15_CR9","doi-asserted-by":"crossref","unstructured":"Cho, J., Hurley, P., Xu, S.: Metrics and measurement of trustworthy systems. In: Proceedings of the IEEE MILCOM (2016)","DOI":"10.1109\/MILCOM.2016.7795500"},{"key":"15_CR10","doi-asserted-by":"crossref","unstructured":"Cho, J.H., Xu, S., Hurley, P.M., Mackay, M., Benjamin, T., Beaumont, M.: Stram: measuring the trustworthiness of computer-based systems. ACM Comput. Surv. 51(6), 128:1\u2013128:47 (2019)","DOI":"10.1145\/3277666"},{"key":"15_CR11","unstructured":"Chou, D., Jiang, M.: Data-driven network intrusion detection: a taxonomy of challenges and methods. arXiv preprint arXiv:2009.07352 (2020)"},{"key":"15_CR12","doi-asserted-by":"publisher","first-page":"668","DOI":"10.1016\/j.future.2019.09.005","volume":"111","author":"M Cinque","year":"2020","unstructured":"Cinque, M., Della Corte, R., Pecchia, A.: Contextual filtering and prioritization of computer application logs for security situational awareness. Futur. Gener. Comput. Syst. 111, 668\u2013680 (2020)","journal-title":"Futur. Gener. Comput. Syst."},{"key":"15_CR13","doi-asserted-by":"publisher","first-page":"474","DOI":"10.1016\/j.cose.2017.11.021","volume":"73","author":"SC De Alvarenga","year":"2018","unstructured":"De Alvarenga, S.C., Barbon, S., Jr., Miani, R.S., Cukier, M., Zarpel\u00e3o, B.B.: Process mining and hierarchical clustering to help intrusion alert visualization. Comput. Secur. 73, 474\u2013491 (2018)","journal-title":"Comput. Secur."},{"issue":"12","key":"15_CR14","first-page":"2965","volume":"13","author":"P Du","year":"2018","unstructured":"Du, P., Sun, Z., Chen, H., Cho, J.H., Xu, S.: Statistical estimation of malware detection metrics in the absence of ground truth. IEEE T-IFS 13(12), 2965\u20132980 (2018)","journal-title":"IEEE T-IFS"},{"key":"15_CR15","first-page":"2186","volume":"16","author":"Z Fang","year":"2021","unstructured":"Fang, Z., Xu, M., Xu, S., Hu, T.: A framework for predicting data breach risk: leveraging dependence to cope with sparsity. IEEE T-IFS 16, 2186\u20132201 (2021)","journal-title":"IEEE T-IFS"},{"key":"15_CR16","doi-asserted-by":"crossref","unstructured":"Fernandez, G.C., Xu, S.: A case study on using deep learning for network intrusion detection. In: 2019 IEEE Military Communications Conference (MILCOM\u20192019), pp.\u00a01\u20136 (2018)","DOI":"10.1109\/MILCOM47813.2019.9020824"},{"key":"15_CR17","doi-asserted-by":"crossref","unstructured":"Ficke, E., Bateman, R.M., Xu, S.: Reducing intrusion alert trees to aid visualization. In: Yuan, X., Bai, G., Alcaraz, C., Majumdar, S. (eds.) Network and System Security - 16th International Conference, NSS 2022, Denarau Island, Fiji, 9\u201312 December 2022, Proceedings. LNCS, vol. 13787, pp. 140\u2013154. Springer (2022)","DOI":"10.1007\/978-3-031-23020-2_8"},{"key":"15_CR18","doi-asserted-by":"crossref","unstructured":"Ficke, E., Schweitzer, K.M., Bateman, R.M., Xu, S.: Analyzing root causes of intrusion detection false-negatives: methodology and case study. In: Proceedings of the IEEE MILCOM\u20192019 (2019)","DOI":"10.1109\/MILCOM47813.2019.9020860"},{"key":"15_CR19","doi-asserted-by":"crossref","unstructured":"Ficke, E., Xu, S.: Apin: automatic attack path identification in computer networks. In: IEEE ISI 2020 (2020)","DOI":"10.1109\/ISI49825.2020.9280547"},{"key":"15_CR20","unstructured":"FireEye: The numbers game: How many alerts is too many to handle? (2015). https:\/\/www.trellix.com\/advanced-research-center\/"},{"key":"15_CR21","doi-asserted-by":"publisher","unstructured":"Frigault, M., Wang, L.: Measuring network security using bayesian network-based attack graphs. In: 2008 32nd Annual IEEE International Computer Software and Applications Conference, pp. 698\u2013703, July 2008. https:\/\/doi.org\/10.1109\/COMPSAC.2008.88","DOI":"10.1109\/COMPSAC.2008.88"},{"key":"15_CR22","doi-asserted-by":"crossref","unstructured":"Haas, S., Fischer, M.: GAC: graph-based alert correlation for the detection of distributed multi-step attacks. In: Proceedings of the 33rd Annual ACM Symposium on Applied Computing, pp. 979\u2013988 (2018)","DOI":"10.1145\/3167132.3167239"},{"key":"15_CR23","doi-asserted-by":"crossref","unstructured":"Han, Y., Lu, W., Xu, S.: Characterizing the power of moving target defense via cyber epidemic dynamics. In: HotSoS, pp. 1\u201312 (2014)","DOI":"10.1145\/2600176.2600180"},{"issue":"3","key":"15_CR24","first-page":"2517","volume":"8","author":"Y Han","year":"2021","unstructured":"Han, Y., Lu, W., Xu, S.: Preventive and reactive cyber defense dynamics with ergodic time-dependent parameters is globally attractive. IEEE TNSE 8(3), 2517\u20132532 (2021)","journal-title":"IEEE TNSE"},{"key":"15_CR25","unstructured":"Hossain, M.N., et al.: $$\\{$$SLEUTH$$\\}$$: real-time attack scenario reconstruction from $$\\{$$COTS$$\\}$$ audit data. In: 26th $$\\{$$USENIX$$\\}$$ Security Symposium ($$\\{$$USENIX$$\\}$$ Security 17), pp. 487\u2013504 (2017)"},{"key":"15_CR26","doi-asserted-by":"crossref","unstructured":"Howard, M., Pincus, J., Wing, J.M.: Measuring relative attack surfaces. In: Computer security in the 21st century, pp. 109\u2013137. Springer (2005)","DOI":"10.1007\/0-387-24006-3_8"},{"issue":"16","key":"15_CR27","doi-asserted-by":"publisher","first-page":"21693","DOI":"10.1007\/s11042-017-5602-0","volume":"77","author":"H Hu","year":"2018","unstructured":"Hu, H., Zhang, H., Yang, Y.: Security risk situation quantification method based on threat prediction for multimedia communication network. Multimed. Tools Appl. 77(16), 21693\u201321723 (2018). https:\/\/doi.org\/10.1007\/s11042-017-5602-0","journal-title":"Multimed. Tools Appl."},{"key":"15_CR28","unstructured":"Hutchins, E.M., Cloppert, M.J., Amin, R.M.: Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. In: 2011 International Conference on Information Warfare and Security (2011)"},{"issue":"1","key":"15_CR29","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-019-0038-7","volume":"2","author":"A Khraisat","year":"2019","unstructured":"Khraisat, A., Gondal, I., Vamplew, P., Kamruzzaman, J.: Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity 2(1), 1\u201322 (2019). https:\/\/doi.org\/10.1186\/s42400-019-0038-7","journal-title":"Cybersecurity"},{"key":"15_CR30","doi-asserted-by":"publisher","first-page":"752","DOI":"10.1016\/j.future.2017.09.032","volume":"82","author":"S Lee","year":"2018","unstructured":"Lee, S., Kim, S., Choi, K., Shon, T.: Game theory-based security vulnerability quantification for social internet of things. Futur. Gener. Comput. Syst. 82, 752\u2013760 (2018)","journal-title":"Futur. Gener. Comput. Syst."},{"key":"15_CR31","unstructured":"Leitold, F., Arrott, A., Hadarics, K.: Quantifying cyber-threat vulnerability by combining threat intelligence, it infrastructure weakness, and user susceptibility. In: 24th Annual EICAR Conference, Nuremberg, Germany (2016)"},{"issue":"1","key":"15_CR32","first-page":"28","volume":"8","author":"X Li","year":"2011","unstructured":"Li, X., Parker, P., Xu, S.: A stochastic model for quantitative security analyses of networked systems. IEEE TDSC 8(1), 28\u201343 (2011)","journal-title":"IEEE TDSC"},{"issue":"3","key":"15_CR33","doi-asserted-by":"publisher","first-page":"1098","DOI":"10.1109\/TNET.2019.2912847","volume":"27","author":"Z Lin","year":"2019","unstructured":"Lin, Z., Lu, W., Xu, S.: Unified preventive and reactive cyber defense dynamics is still globally convergent. IEEE\/ACM ToN 27(3), 1098\u20131111 (2019)","journal-title":"IEEE\/ACM ToN"},{"issue":"3","key":"15_CR34","doi-asserted-by":"publisher","first-page":"210","DOI":"10.1109\/JPROC.2024.3379855","volume":"112","author":"T Longtchi","year":"2024","unstructured":"Longtchi, T., Rodriguez, R.M., Al-Shawaf, L., Atyabi, A., Xu, S.: Internet-based social engineering psychology, attacks, and defenses: a survey. Proc. IEEE 112(3), 210\u2013246 (2024)","journal-title":"Proc. IEEE"},{"key":"15_CR35","doi-asserted-by":"crossref","unstructured":"Longtchi, T., Xu, S.: Characterizing the evolution of psychological factors exploited by malicious emails. In: Proceedings of International Conference on Science of Cyber Security (SciSec\u20192024) (2024)","DOI":"10.1007\/978-981-96-2417-1_9"},{"key":"15_CR36","doi-asserted-by":"crossref","unstructured":"Longtchi, T., Xu, S.: Characterizing the evolution of psychological tactics and techniques exploited by malicious emails. In: Proceedings of International Conference on Science of Cyber Security (SciSec\u20192024) (2024)","DOI":"10.1007\/978-981-96-2417-1_6"},{"key":"15_CR37","unstructured":"Mandiant: Apt1 report (2013). https:\/\/www.fireeye.com\/content\/dam\/fireeyewww\/services\/pdfs\/mandiant-apt1-report.pdf"},{"key":"15_CR38","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108340","volume":"198","author":"B Mao","year":"2021","unstructured":"Mao, B., Liu, J., Lai, Y., Sun, M.: MIF: a multi-step attack scenario reconstruction and attack chains extraction method based on multi-information fusion. Comput. Netw. 198, 108340 (2021)","journal-title":"Comput. Netw."},{"issue":"12","key":"15_CR39","doi-asserted-by":"publisher","first-page":"3217","DOI":"10.1109\/TIFS.2019.2912551","volume":"14","author":"J Mireles","year":"2019","unstructured":"Mireles, J., Ficke, E., Cho, J., Hurley, P., Xu, S.: Metrics towards measuring cyber agility. IEEE Trans. Inf. Forensics Secur. 14(12), 3217\u20133232 (2019)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"15_CR40","doi-asserted-by":"crossref","unstructured":"Ning, P., Cui, Y., Reeves, D.S.: Constructing attack scenarios through correlation of intrusion alerts. In: Proceedings of the 9th ACM Conference on Computer and Communications Security, pp. 245\u2013254 (2002)","DOI":"10.1145\/586110.586144"},{"key":"15_CR41","doi-asserted-by":"crossref","unstructured":"Ning, P., Xu, D.: Learning attack strategies from intrusion alerts. In: Proceedings of the 10th ACM Conference on Computer and Communications Security, pp. 200\u2013209 (2003)","DOI":"10.1145\/948109.948137"},{"key":"15_CR42","doi-asserted-by":"crossref","unstructured":"Ou, X., Boyer, W.F., McQueen, M.A.: A scalable approach to attack graph generation. In: Proceedings of the 13th ACM Conference on Computer and Communications Security, pp. 336\u2013345 (2006)","DOI":"10.1145\/1180405.1180446"},{"key":"15_CR43","doi-asserted-by":"crossref","unstructured":"Pendleton, M., Garcia-Lebron, R., Cho, J.H., Xu, S.: A survey on systems security metrics. ACM Comput. Surv. 49(4), 62:1\u201362:35 (2016)","DOI":"10.1145\/3005714"},{"issue":"14","key":"15_CR44","doi-asserted-by":"publisher","first-page":"2534","DOI":"10.1080\/02664763.2016.1257590","volume":"44","author":"C Peng","year":"2017","unstructured":"Peng, C., Xu, M., Xu, S., Hu, T.: Modeling and predicting extreme cyber attack rates via marked point processes. J. Appl. Stat. 44(14), 2534\u20132563 (2017)","journal-title":"J. Appl. Stat."},{"key":"15_CR45","unstructured":"Peng, C., Xu, M., Xu, S., Hu, T.: Modeling multivariate cybersecurity risks. J. Appl. Stat. 1\u201323 (2018)"},{"key":"15_CR46","doi-asserted-by":"crossref","unstructured":"Phillips, C., Swiler, L.P.: A graph-based system for network-vulnerability analysis. In: Proceedings of the 1998 Workshop on New Security Paradigms, pp. 71\u201379 (1998)","DOI":"10.1145\/310889.310919"},{"key":"15_CR47","doi-asserted-by":"crossref","unstructured":"Pritom, M., Xu, S.: Supporting law-enforcement to cope with blacklisted websites: framework and case study. In: IEEE CNS\u20192022 (2022)","DOI":"10.1109\/CNS56114.2022.9947260"},{"issue":"3","key":"15_CR48","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3184898","volume":"51","author":"AA Ramaki","year":"2018","unstructured":"Ramaki, A.A., Rasoolzadegan, A., Bafghi, A.G.: A systematic mapping study on intrusion alert analysis in intrusion detection systems. ACM Comput. Surv. (CSUR) 51(3), 1\u201341 (2018)","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"15_CR49","doi-asserted-by":"crossref","unstructured":"Rodriguez, R.M., Xu, S.: Cyber social engineering kill chain. In: Proceedings of International Conference on Science of Cyber Security (SciSec\u20192022), pp. 487\u2013504 (2022)","DOI":"10.1007\/978-3-031-17551-0_32"},{"key":"15_CR50","doi-asserted-by":"crossref","unstructured":"Security, I.: Cost of a data breach report 2021 (July 2021). https:\/\/www.ibm.com\/downloads\/cas\/OJDVQGRY","DOI":"10.1016\/S1361-3723(21)00082-8"},{"key":"15_CR51","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: ICISSP, pp. 108\u2013116 (2018)","DOI":"10.5220\/0006639801080116"},{"key":"15_CR52","unstructured":"Strom, B.: Att &ck 101: cyber threat intelligence (2018). https:\/\/www.mitre.org\/capabilities\/cybersecurity\/overview\/cybersecurity-blog\/attck-101"},{"key":"15_CR53","doi-asserted-by":"crossref","unstructured":"Sun, Z., Xu, M., Schweitzer, K., Bateman, R., Kott, A., Xu, S.: Cyber attacks against enterprise networks: characterization, modeling and forecasting. In: Proceedings of the SciSec\u20192023 (2023)","DOI":"10.1007\/978-3-031-45933-7_4"},{"key":"15_CR54","doi-asserted-by":"publisher","first-page":"636","DOI":"10.1016\/j.procs.2020.03.330","volume":"167","author":"A Thakkar","year":"2020","unstructured":"Thakkar, A., Lohiya, R.: A review of the advancement in intrusion detection datasets. Procedia Comput. Sci. 167, 636\u2013645 (2020)","journal-title":"Procedia Comput. Sci."},{"key":"15_CR55","doi-asserted-by":"crossref","unstructured":"Vasilomanolakis, E., Cordero, C.G., Milanov, N., M\u00fchlh\u00e4user, M.: Towards the creation of synthetic, yet realistic, intrusion detection datasets. In: NOMS 2016-2016 IEEE\/IFIP Network Operations and Management Symposium, pp. 1209\u20131214. IEEE (2016)","DOI":"10.1109\/NOMS.2016.7502989"},{"key":"15_CR56","doi-asserted-by":"crossref","unstructured":"Wang, X., Gong, X., Yu, L., Liu, J.: Maac: novel alert correlation method to detect multi-step attack. In: 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 726\u2013733. IEEE (2021)","DOI":"10.1109\/TrustCom53373.2021.00106"},{"key":"15_CR57","doi-asserted-by":"crossref","unstructured":"Xu, L., Zhan, Z., Xu, S., Ye, K.: An evasion and counter-evasion study in malicious websites detection. In: IEEE CNS, pp. 265\u2013273 (2014)","DOI":"10.1109\/CNS.2014.6997494"},{"key":"15_CR58","doi-asserted-by":"crossref","unstructured":"Xu, L., Zhan, Z., Xu, S., Ye, K.: Cross-layer detection of malicious websites. In: ACM CODASPY\u201913, pp. 141\u2013152 (2013)","DOI":"10.1145\/2435349.2435366"},{"issue":"4","key":"15_CR59","doi-asserted-by":"publisher","first-page":"508","DOI":"10.1080\/00401706.2016.1256841","volume":"59","author":"M Xu","year":"2017","unstructured":"Xu, M., Hua, L., Xu, S.: A vine copula model for predicting the effectiveness of cyber defense early-warning. Technometrics 59(4), 508\u2013520 (2017)","journal-title":"Technometrics"},{"issue":"11","key":"15_CR60","first-page":"2856","volume":"13","author":"M Xu","year":"2018","unstructured":"Xu, M., Schweitzer, K.M., Bateman, R.M., Xu, S.: Modeling and predicting cyber hacking breaches. IEEE T-IFS 13(11), 2856\u20132871 (2018)","journal-title":"IEEE T-IFS"},{"issue":"3","key":"15_CR61","doi-asserted-by":"publisher","first-page":"288","DOI":"10.1080\/15427951.2012.654480","volume":"8","author":"M Xu","year":"2012","unstructured":"Xu, M., Xu, S.: An extended stochastic model for quantitative security analysis of networked systems. Internet Math. 8(3), 288\u2013320 (2012)","journal-title":"Internet Math."},{"key":"15_CR62","doi-asserted-by":"crossref","unstructured":"Xu, S.: The cybersecurity dynamics way of thinking and landscape (invited paper). In: ACM Workshop on Moving Target Defense (2020)","DOI":"10.1145\/3411496.3421225"},{"key":"15_CR63","doi-asserted-by":"crossref","unstructured":"Xu, S., Lu, W., Xu, L.: Push- and pull-based epidemic spreading in networks: thresholds and deeper insights. ACM TAAS 7(3) (2012)","DOI":"10.1145\/2348832.2348835"},{"key":"15_CR64","doi-asserted-by":"crossref","unstructured":"Xu, S., Lu, W., Xu, L., Zhan, Z.: Adaptive epidemic dynamics in networks: thresholds and control. ACM TAAS 8(4) (2014)","DOI":"10.1145\/2555613"},{"issue":"1","key":"15_CR65","doi-asserted-by":"publisher","first-page":"30","DOI":"10.1109\/TDSC.2011.33","volume":"9","author":"S Xu","year":"2012","unstructured":"Xu, S., Lu, W., Zhan, Z.: A stochastic model of multivirus dynamics. IEEE Trans. Dependable Secure Comput. 9(1), 30\u201345 (2012)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"15_CR66","doi-asserted-by":"crossref","unstructured":"Xu, S.: Cybersecurity dynamics: a foundation for the science of cybersecurity. In: Lu, Z., Wang, C. (eds.) Proactive and Dynamic Network Defense, vol.\u00a074, pp. 1\u201331. Springer Nature Switzerland AG (2019)","DOI":"10.1007\/978-3-030-10597-6_1"},{"key":"15_CR67","doi-asserted-by":"crossref","unstructured":"Xu, S.: SARR: a cybersecurity metrics and quantification framework. In: Third International Conference on Science of Cyber Security (SciSec\u20192021), pp. 3\u201317 (2021)","DOI":"10.1007\/978-3-030-89137-4_1"},{"issue":"11","key":"15_CR68","doi-asserted-by":"publisher","first-page":"1775","DOI":"10.1109\/TIFS.2013.2279800","volume":"8","author":"Z Zhan","year":"2013","unstructured":"Zhan, Z., Xu, M., Xu, S.: Characterizing honeypot-captured cyber attacks: statistical framework and case study. IEEE Trans. Inf. Forensics Secur. 8(11), 1775\u20131789 (2013)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"8","key":"15_CR69","doi-asserted-by":"publisher","first-page":"1666","DOI":"10.1109\/TIFS.2015.2422261","volume":"10","author":"Z Zhan","year":"2015","unstructured":"Zhan, Z., Xu, M., Xu, S.: Predicting cyber attack rates with extreme values. IEEE Trans. Inf. Forensics Secur. 10(8), 1666\u20131677 (2015)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"15_CR70","doi-asserted-by":"publisher","first-page":"150540","DOI":"10.1109\/ACCESS.2019.2946261","volume":"7","author":"K Zhang","year":"2019","unstructured":"Zhang, K., Zhao, F., Luo, S., Xin, Y., Zhu, H.: An intrusion action-based ids alert correlation analysis and prediction framework. IEEE Access 7, 150540\u2013150551 (2019)","journal-title":"IEEE Access"},{"key":"15_CR71","doi-asserted-by":"crossref","unstructured":"Zhang, X., Xu, M., Xu, S.: Smart home cyber insurance pricing. In: Proceedings of International Conference on Science of Cyber Security (SciSec\u20192024) (2024)","DOI":"10.1007\/978-981-96-2417-1_17"},{"key":"15_CR72","doi-asserted-by":"crossref","unstructured":"Zheng, R., Lu, W., Xu, S.: Active cyber defense dynamics exhibiting rich phenomena. In: Proceedings of the HotSoS (2015)","DOI":"10.1145\/2746194.2746196"},{"issue":"2","key":"15_CR73","first-page":"156","volume":"5","author":"R Zheng","year":"2018","unstructured":"Zheng, R., Lu, W., Xu, S.: Preventive and reactive cyber defense dynamics is globally stable. IEEE TNSE 5(2), 156\u2013170 (2018)","journal-title":"IEEE TNSE"}],"container-title":["Lecture Notes in Computer Science","Science of Cyber Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-96-2417-1_15","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,6]],"date-time":"2025-09-06T06:55:52Z","timestamp":1757141752000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-96-2417-1_15"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9789819624164","9789819624171"],"references-count":73,"URL":"https:\/\/doi.org\/10.1007\/978-981-96-2417-1_15","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"4 March 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"SciSec","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Science of Cyber Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Copenhagen","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Denmark","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 August 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16 August 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"6","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"scisec2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.scisec.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}