{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T03:20:22Z","timestamp":1740108022394,"version":"3.37.3"},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"11","license":[{"start":{"date-parts":[[2018,7,5]],"date-time":"2018-07-05T00:00:00Z","timestamp":1530748800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Neural Comput & Applic"],"published-print":{"date-parts":[[2019,11]]},"DOI":"10.1007\/s00521-018-3550-x","type":"journal-article","created":{"date-parts":[[2018,7,5]],"date-time":"2018-07-05T00:46:20Z","timestamp":1530751580000},"page":"7755-7767","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Of daemons and men: reducing false positive rate in intrusion detection systems with file system footprint analysis"],"prefix":"10.1007","volume":"31","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4793-4228","authenticated-orcid":false,"given":"George","family":"Mamalakis","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christos","family":"Diou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andreas L.","family":"Symeonidis","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Leonidas","family":"Georgiadis","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2018,7,5]]},"reference":[{"issue":"1","key":"3550_CR1","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1109\/TSMCC.2008.2007248","volume":"39","author":"S Budalakoti","year":"2009","unstructured":"Budalakoti S, Srivastava AN, Otey ME (2009) Anomaly detection and diagnosis algorithms for discrete symbol sequences with applications to airline safety. IEEE Trans Syst Man Cybern Part C Appl Rev 39(1):101\u2013113","journal-title":"IEEE Trans Syst Man Cybern Part C Appl Rev"},{"key":"3550_CR2","unstructured":"Chandola V (2009) Anomaly detection for symbolic sequences and time series data. PhD thesis, University of Minnesota"},{"issue":"5","key":"3550_CR3","doi-asserted-by":"publisher","first-page":"823","DOI":"10.1109\/TKDE.2010.235","volume":"24","author":"V Chandola","year":"2012","unstructured":"Chandola V, Banerjee A, Kumar V (2012) Anomaly detection for discrete sequences: a survey. IEEE Trans Knowl Data Eng 24(5):823\u2013839","journal-title":"IEEE Trans Knowl Data Eng"},{"issue":"10","key":"3550_CR4","doi-asserted-by":"publisher","first-page":"2617","DOI":"10.1016\/j.cor.2004.03.019","volume":"32","author":"W Chen","year":"2005","unstructured":"Chen W, Hsu S, Shen H (2005) Application of SVM and ANN for intrusion detection. Comput Oper Res 32(10):2617\u20132634","journal-title":"Comput Oper Res"},{"issue":"2","key":"3550_CR5","doi-asserted-by":"publisher","first-page":"2042","DOI":"10.1016\/j.asoc.2010.07.002","volume":"11","author":"E Corchado","year":"2011","unstructured":"Corchado E, Herrero \u00c1 (2011) Neural visualization of network traffic data for intrusion detection. Appl Soft Comput 11(2):2042\u20132056","journal-title":"Appl Soft Comput"},{"key":"3550_CR6","doi-asserted-by":"publisher","first-page":"222","DOI":"10.1109\/TSE.1987.232894","volume":"2","author":"D Denning","year":"1987","unstructured":"Denning D (1987) An intrusion\u2013detection model. IEEE Trans Softw Eng 2:222\u2013232","journal-title":"IEEE Trans Softw Eng"},{"key":"3550_CR7","doi-asserted-by":"crossref","unstructured":"Forrest S, Hofmeyr S, Somayaji A, Longstaff T (1996) A sense of self for unix processes. In: 1996 IEEE symposium on security and privacy, 1996. Proceedings. IEEE, pp 120\u2013128","DOI":"10.1109\/SECPRI.1996.502675"},{"key":"3550_CR8","doi-asserted-by":"crossref","unstructured":"Forrest S, Perelson A, Allen L, Cherukuri R (1994) Self-nonself discrimination in a computer. In: 1994 IEEE computer society symposium on research in security and privacy, 1994. Proceedings. IEEE, pp 202\u2013212","DOI":"10.1109\/RISP.1994.296580"},{"issue":"1","key":"3550_CR9","first-page":"95","volume":"5","author":"P Gogoi","year":"2010","unstructured":"Gogoi P, Borah B, Bhattacharyya DK (2010) Anomaly detection analysis of intrusion data using supervised and unsupervised approach. J Converg Inf Technol 5(1):95\u2013110","journal-title":"J Converg Inf Technol"},{"issue":"6","key":"3550_CR10","doi-asserted-by":"publisher","first-page":"1219","DOI":"10.1016\/j.jnca.2009.05.004","volume":"32","author":"XD Hoang","year":"2009","unstructured":"Hoang XD, Hu J, Bertok P (2009) A program-based anomaly intrusion detection scheme using multiple detection engines and fuzzy inference. J Netw Comput Appl 32(6):1219\u20131228","journal-title":"J Netw Comput Appl"},{"issue":"3","key":"3550_CR11","doi-asserted-by":"publisher","first-page":"235","DOI":"10.1016\/0167-4048(93)90110-Q","volume":"12","author":"J Hochberg","year":"1993","unstructured":"Hochberg J, Jackson K, Stallings C, McClary J, DuBois D, Ford J (1993) Nadir: an automated system for detecting network intrusion and misuse. Comput Secur 12(3):235\u2013248","journal-title":"Comput Secur"},{"issue":"3","key":"3550_CR12","doi-asserted-by":"publisher","first-page":"151","DOI":"10.3233\/JCS-980109","volume":"6","author":"S Hofmeyr","year":"1998","unstructured":"Hofmeyr S, Forrest S, Somayaji A (1998) Intrusion detection using sequences of system calls. J Comput Secur 6(3):151\u2013180","journal-title":"J Comput Secur"},{"issue":"1","key":"3550_CR13","doi-asserted-by":"publisher","first-page":"306","DOI":"10.1016\/j.eswa.2010.06.066","volume":"38","author":"SJ Horng","year":"2011","unstructured":"Horng SJ, Su MY, Chen YH, Kao TW, Chen RJ, Lai JL, Perkasa CD (2011) A novel intrusion detection system based on hierarchical clustering and support vector machines. Expert Syst Appl 38(1):306\u2013313","journal-title":"Expert Syst Appl"},{"key":"3550_CR14","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-015-2116-4","author":"S Jamali","year":"2015","unstructured":"Jamali S, Jafarzadeh P (2015) An intelligent intrusion detection system by using hierarchically structured learning automata. Neural Comput Appl. \n                    https:\/\/doi.org\/10.1007\/s00521-015-2116-4","journal-title":"Neural Comput Appl"},{"issue":"4","key":"3550_CR15","doi-asserted-by":"publisher","first-page":"3899","DOI":"10.1016\/j.eswa.2011.06.033","volume":"39","author":"I Kang","year":"2012","unstructured":"Kang I, Jeong M, Kong D (2012) A differentiated one-class classification method with applications to intrusion detection. Expert Syst Appl 39(4):3899\u20133905","journal-title":"Expert Syst Appl"},{"issue":"4","key":"3550_CR16","doi-asserted-by":"publisher","first-page":"371","DOI":"10.1016\/j.ins.2008.10.025","volume":"179","author":"G Kou","year":"2009","unstructured":"Kou G, Peng Y, Chen Z, Shi Y (2009) Multiple criteria mathematical programming for multi-class classification and application in network intrusion detection. Inf Sci 179(4):371\u2013381","journal-title":"Inf Sci"},{"key":"3550_CR17","doi-asserted-by":"publisher","first-page":"132","DOI":"10.1016\/j.inffus.2017.02.004","volume":"37","author":"B Krawczyk","year":"2017","unstructured":"Krawczyk B, Minku LL, Gama J, Stefanowski J, Woniak M (2017) Ensemble learning for data stream analysis: a survey. Inf Fusion 37:132\u2013156. \n                    https:\/\/doi.org\/10.1016\/j.inffus.2017.02.004","journal-title":"Inf Fusion"},{"issue":"7","key":"3550_CR18","doi-asserted-by":"publisher","first-page":"2705","DOI":"10.1007\/s00500-015-1669-6","volume":"20","author":"P Kud\u0142acik","year":"2016","unstructured":"Kud\u0142acik P, Porwik P, Weso\u0142owski T (2016) Fuzzy approach for intrusion detection based on users commands. Soft Comput 20(7):2705\u20132719","journal-title":"Soft Comput"},{"key":"3550_CR19","doi-asserted-by":"crossref","unstructured":"Kumar N, Lolla VN, Keogh EJ, Lonardi S, Ratanamahatana CA (2005) Time-series bitmaps: a practical visualization tool for working with large time series databases. In: SDM. SIAM, pp 531\u2013535","DOI":"10.1137\/1.9781611972757.55"},{"key":"3550_CR20","unstructured":"Kumar S, Spafford E (1994) A pattern matching model for misuse intrusion detection"},{"key":"3550_CR21","unstructured":"Lee W, Stolfo S, Chan P, Eskin E, Fan W, Miller M, Hershkop S, Zhang J (2001) Real time data mining-based intrusion detection. In: DARPA information survivability conference and exposition II, 2001. DISCEX\u201901. Proceedings, vol 1. IEEE, pp 89\u2013100"},{"key":"3550_CR22","unstructured":"Leslie CS, Eskin E, Noble WS (2002) The spectrum kernel: a string kernel for SVM protein classification. In: Pacific symposium on biocomputing, vol 7, pp 566\u2013575"},{"issue":"5","key":"3550_CR23","doi-asserted-by":"publisher","first-page":"439","DOI":"10.1016\/S0167-4048(02)00514-X","volume":"21","author":"Y Liao","year":"2002","unstructured":"Liao Y, Vemuri V (2002) Use of k-nearest neighbor classifier for intrusion detection. Comput Secur 21(5):439\u2013448","journal-title":"Comput Secur"},{"key":"3550_CR24","doi-asserted-by":"crossref","unstructured":"Lindqvist U, Porras P (2001) Expert-BSM: a host-based intrusion detection solution for Sun Solaris. In: Computer security applications conference, 2001. ACSAC 2001. Proceedings 17th annual. IEEE, pp 240\u2013251","DOI":"10.1109\/ACSAC.2001.991540"},{"key":"3550_CR25","unstructured":"Lippmann R, Fried D, Graf I, Haines J, Kendall K, McClung D, Weber D, Webster S, Wyschogrod D, Cunningham R et al (2000) Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation. In: DARPA information survivability conference and exposition, 2000. DISCEX\u201900. Proceedings, vol 2. IEEE, pp 12\u201326"},{"issue":"4","key":"3550_CR26","doi-asserted-by":"publisher","first-page":"579","DOI":"10.1016\/S1389-1286(00)00139-0","volume":"34","author":"R Lippmann","year":"2000","unstructured":"Lippmann R, Haines J, Fried D, Korba J, Das K (2000) The 1999 DARPA off-line intrusion detection evaluation. Comput Netw 34(4):579\u2013595","journal-title":"Comput Netw"},{"key":"3550_CR27","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.asoc.2014.07.026","volume":"25","author":"G Mamalakis","year":"2014","unstructured":"Mamalakis G, Diou C, Symeonidis A, Georgiadis L (2014) Of daemons and men: a file system approach towards intrusion detection. Appl Soft Comput 25:1\u201314","journal-title":"Appl Soft Comput"},{"key":"3550_CR28","doi-asserted-by":"crossref","unstructured":"Mamalakis G, Diou C, Symeonidis AL (2015) Analysing behaviours for intrusion detection. In: 2015 IEEE international conference on communication workshop (ICCW). IEEE, pp 2645\u20132651","DOI":"10.1109\/ICCW.2015.7247578"},{"key":"3550_CR29","unstructured":"McLachlan G, Basford K (1988) Mixture models: inference and applications to clustering. Marcel Dekker, New York"},{"issue":"3","key":"3550_CR30","doi-asserted-by":"publisher","first-page":"557","DOI":"10.1007\/s00500-016-2278-8","volume":"21","author":"MA Medina-P\u00e9rez","year":"2017","unstructured":"Medina-P\u00e9rez MA, Monroy R, Cami\u00f1a JB, Garc\u00eda-Borroto M (2017) Bagging-TPMiner: a classifier ensemble for masquerader detection based on typical objects. Soft Comput 21(3):557\u2013569","journal-title":"Soft Comput"},{"issue":"1","key":"3550_CR31","doi-asserted-by":"publisher","first-page":"61","DOI":"10.1145\/1127345.1127348","volume":"9","author":"D Mutz","year":"2006","unstructured":"Mutz D, Valeur F, Vigna G, Kruegel C (2006) Anomalous system call detection. ACM Trans Inf Syst Secur (TISSEC) 9(1):61\u201393","journal-title":"ACM Trans Inf Syst Secur (TISSEC)"},{"key":"3550_CR32","volume-title":"Introduction to data mining","author":"T Pang-Ning","year":"2006","unstructured":"Pang-Ning T, Steinbach M, Kumar V et al (2006) Introduction to data mining. Addison Wesley, Boston"},{"issue":"2","key":"3550_CR33","doi-asserted-by":"publisher","first-page":"137","DOI":"10.1109\/TDSC.2007.1003","volume":"4","author":"S Peisert","year":"2007","unstructured":"Peisert S, Bishop M, Karin S, Marzullo K (2007) Analysis of computer intrusions using sequences of function calls. IEEE Trans Dependable Secure Comput 4(2):137\u2013150","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"3550_CR34","doi-asserted-by":"crossref","unstructured":"Pietraszek T (2004) Using adaptive alert classification to reduce false positives in intrusion detection. In: Recent advances in intrusion detection. Springer, pp 102\u2013124","DOI":"10.1007\/978-3-540-30143-1_6"},{"key":"3550_CR35","unstructured":"Porras P, Neumann P (1997) Emerald: event monitoring enabling response to anomalous live disturbances. In: Proceedings of the 20th national information systems security conference, pp 353\u2013365"},{"key":"3550_CR36","doi-asserted-by":"crossref","unstructured":"Ramaswamy S, Rastogi R, Shim K (2000) Efficient algorithms for mining outliers from large data sets. In: ACM SIGMOD record, vol 29. ACM, pp 427\u2013438","DOI":"10.1145\/335191.335437"},{"key":"3550_CR37","first-page":"229","volume":"99","author":"M Roesch","year":"1999","unstructured":"Roesch M et al (1999) Snort: lightweight intrusion detection for networks. LISA 99:229\u2013238","journal-title":"LISA"},{"issue":"1","key":"3550_CR38","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1016\/j.cose.2009.07.008","volume":"29","author":"G Spathoulas","year":"2010","unstructured":"Spathoulas G, Katsikas S (2010) Reducing false positives in intrusion detection systems. Comput Secur 29(1):35\u201344","journal-title":"Comput Secur"},{"key":"3550_CR39","doi-asserted-by":"crossref","unstructured":"Stolfo S, Hershkop S, Bui L, Ferster R, Wang K (2005) Anomaly detection in computer security and an application to file system accesses. In: Foundations of intelligent systems, pp 14\u201328","DOI":"10.1007\/11425274_2"},{"issue":"4","key":"3550_CR40","doi-asserted-by":"publisher","first-page":"659","DOI":"10.3233\/JCS-2005-13403","volume":"13","author":"SJ Stolfo","year":"2005","unstructured":"Stolfo SJ, Apap F, Eskin E, Heller K, Hershkop S, Honig A, Svore K (2005) A comparative evaluation of two algorithms for windows registry anomaly detection. J Comput Secur 13(4):659\u2013693","journal-title":"J Comput Secur"},{"issue":"1","key":"3550_CR41","doi-asserted-by":"publisher","first-page":"222","DOI":"10.1016\/j.patcog.2009.05.017","volume":"43","author":"CF Tsai","year":"2010","unstructured":"Tsai CF, Lin CY (2010) A triangle area based nearest neighbors approach to intrusion detection. Pattern Recognit 43(1):222\u2013229","journal-title":"Pattern Recognit"},{"key":"3550_CR42","doi-asserted-by":"crossref","unstructured":"Wagner D, Soto P (2002) Mimicry attacks on host-based intrusion detection systems. In: Proceedings of the 9th ACM conference on computer and communications security. ACM, pp 255\u2013264","DOI":"10.1145\/586110.586145"},{"issue":"7","key":"3550_CR43","doi-asserted-by":"publisher","first-page":"539","DOI":"10.1016\/j.cose.2006.05.005","volume":"25","author":"W Wang","year":"2006","unstructured":"Wang W, Guan X, Zhang X, Yang L (2006) Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data. Comput Secur 25(7):539\u2013550","journal-title":"Comput Secur"},{"key":"3550_CR44","doi-asserted-by":"crossref","unstructured":"Warrender C, Forrest S, Pearlmutter B (1999) Detecting intrusions using system calls: alternative data models. In: Proceedings of the 1999 IEEE symposium on security and privacy, 1999. IEEE, pp 133\u2013145","DOI":"10.1109\/SECPRI.1999.766910"},{"issue":"1","key":"3550_CR45","doi-asserted-by":"publisher","first-page":"745","DOI":"10.1613\/jair.3050","volume":"39","author":"J Xu","year":"2010","unstructured":"Xu J, Shelton C (2010) Intrusion detection using continuous time Bayesian networks. J Artif Intell Res 39(1):745\u2013774","journal-title":"J Artif Intell Res"},{"issue":"1","key":"3550_CR46","doi-asserted-by":"publisher","first-page":"229","DOI":"10.1016\/S0031-3203(02)00026-2","volume":"36","author":"D Yeung","year":"2003","unstructured":"Yeung D, Ding Y (2003) Host-based intrusion detection using dynamic and static behavioral models. Pattern Recognit 36(1):229\u2013243","journal-title":"Pattern Recognit"},{"issue":"12","key":"3550_CR47","doi-asserted-by":"publisher","first-page":"1428","DOI":"10.1016\/j.comcom.2005.01.014","volume":"28","author":"Z Zhang","year":"2005","unstructured":"Zhang Z, Shen H (2005) Application of online-training SVMs for real-time intrusion detection with different considerations. Comput Commun 28(12):1428\u20131442","journal-title":"Comput Commun"}],"container-title":["Neural Computing and Applications"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-018-3550-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s00521-018-3550-x\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-018-3550-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,10,24]],"date-time":"2019-10-24T16:33:20Z","timestamp":1571934800000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s00521-018-3550-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,7,5]]},"references-count":47,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2019,11]]}},"alternative-id":["3550"],"URL":"https:\/\/doi.org\/10.1007\/s00521-018-3550-x","relation":{},"ISSN":["0941-0643","1433-3058"],"issn-type":[{"type":"print","value":"0941-0643"},{"type":"electronic","value":"1433-3058"}],"subject":[],"published":{"date-parts":[[2018,7,5]]},"assertion":[{"value":"28 February 2017","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 May 2018","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 July 2018","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}