{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,12]],"date-time":"2026-02-12T16:47:57Z","timestamp":1770914877035,"version":"3.50.1"},"reference-count":318,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2017,2,17]],"date-time":"2017-02-17T00:00:00Z","timestamp":1487289600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"name":"State of Maryland","award":["01140-002"],"award-info":[{"award-number":["01140-002"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Knowl Inf Syst"],"published-print":{"date-parts":[[2017,9]]},"DOI":"10.1007\/s10115-017-1027-3","type":"journal-article","created":{"date-parts":[[2017,2,17]],"date-time":"2017-02-17T10:51:17Z","timestamp":1487328677000},"page":"563-619","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":30,"title":["Contextual information fusion for intrusion detection: a survey and taxonomy"],"prefix":"10.1007","volume":"52","author":[{"given":"Ahmed","family":"Aleroud","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"George","family":"Karabatis","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2017,2,17]]},"reference":[{"key":"1027_CR1","doi-asserted-by":"publisher","unstructured":"Abadeh MS, Habibi J (2007) Computer intrusion detection using an iterative fuzzy rule learning approach. In: IEEE international fuzzy systems conference, Imperial College, London, UK, 23\u201326 July 2007, pp 1\u20136. doi: 10.1109\/FUZZY.2007.4295375","DOI":"10.1109\/FUZZY.2007.4295375"},{"key":"1027_CR2","doi-asserted-by":"publisher","unstructured":"Abdoli F, Kahani M (2009) Ontology-based distributed intrusion detection system. In: 14th international CSI computer conference, Tehran, Iran, 20\u201321 Oct 2009, pp 65\u201370. doi: 10.1109\/CSICC.2009.5349372","DOI":"10.1109\/CSICC.2009.5349372"},{"key":"1027_CR3","doi-asserted-by":"publisher","unstructured":"Abe N, Zadrozny B, Langford J (2006) Outlier detection by active learning. In: Proceedings of the 12th ACM SIGKDD international conference on knowledge discovery and data mining, Philadelphia, PA, USA. 1150459. ACM, pp 504\u2013509. doi: 10.1145\/1150402.1150459","DOI":"10.1145\/1150402.1150459"},{"key":"1027_CR4","unstructured":"Abouzakhar NS, Gani A, Manson G (2003) Bayesian learning networks approach to cybercrime detection. In: Proceedings of the PostGraduate networking conference (PGNET\u201903), Liverpool, UK"},{"issue":"1","key":"1027_CR5","first-page":"60","volume":"2","author":"AO Adetunmbi","year":"2008","unstructured":"Adetunmbi AO, Falaki SO, Adewale OS, Alese BK (2008) Network intrusion detection based on rough set and k-nearest neighbour. Int J Comput ICT Res 2(1):60\u201366","journal-title":"Int J Comput ICT Res"},{"key":"1027_CR6","doi-asserted-by":"publisher","unstructured":"Agrawal R, Imielinski T, Swami A (1993) Mining association rules between sets of items in large databases. In: Proceedings of the ACM SIGMOD international conference on management of data, Washington, D.C., USA, 170072. ACM, pp 207\u2013216. doi: 10.1145\/170035.170072","DOI":"10.1145\/170035.170072"},{"key":"1027_CR7","unstructured":"Agrawal R, Srikant R (1994) Fast algorithms for mining association rules in large databases. Paper presented at the proceedings of the 20th international conference on very large data bases, Santiago de Chile, Chile"},{"key":"1027_CR8","doi-asserted-by":"publisher","unstructured":"Ahmed U, Masood A (2009) Host based intrusion detection using rbf neural networks. In: International conference on emerging technologies (ICET\u201909), Slamabad, Pakistan, 19\u201320 Oct 2009, pp 48\u201351. doi: 10.1109\/ICET.2009.5353204","DOI":"10.1109\/ICET.2009.5353204"},{"key":"1027_CR9","doi-asserted-by":"crossref","unstructured":"Al-Subaie M, Zulkernine M (2006) Efficacy of hidden Markov models over neural networks in anomaly intrusion detection. In: 30th annual international computer software and applications conference (COMPSAC\u201906), Illinois, USA. IEEE, pp 325\u2013332","DOI":"10.1109\/COMPSAC.2006.40"},{"key":"1027_CR10","doi-asserted-by":"publisher","unstructured":"Albayrak S, Muller A, Scheel C, Milosevic D (2005) Combining self-organizing map algorithms for robust and scalable intrusion detection. In: International conference on computational intelligence for modelling, control, and automation, Vienna, Austria, 28\u201330 Nov 2005, vol 2, pp 123\u2013130. doi: 10.1109\/CIMCA.2005.1631456","DOI":"10.1109\/CIMCA.2005.1631456"},{"key":"1027_CR11","doi-asserted-by":"crossref","unstructured":"AlEroud A, Karabatis G (2013a) A contextual anomaly detection approach to discover zero-day attacks. In: ASE international conference on cyber security, Washington, D.C., USA, pp 40\u201345","DOI":"10.1109\/CyberSecurity.2012.12"},{"key":"1027_CR12","doi-asserted-by":"crossref","unstructured":"AlEroud A, Karabatis G (2013b) A contextual anomaly detection approach to discover zero-day attacks. ASE international conference on cyber security, Washington, D.C, USA, pp 386\u2013388","DOI":"10.1109\/CyberSecurity.2012.12"},{"key":"1027_CR13","doi-asserted-by":"crossref","unstructured":"AlEroud A, Karabatis G (2013c) A system for cyber attack detection using contextual semantics. In: 7th international conference on knowledge management in organizations: service and cloud computing, vol 172 (Advances in Intelligent Systems and Computing). Springer, Berlin, pp 431\u2013442","DOI":"10.1007\/978-3-642-30867-3_39"},{"key":"1027_CR14","doi-asserted-by":"publisher","unstructured":"AlEroud A, Karabatis G (2013d) Toward zero-day attack identification using linear data transformation techniques. In: IEEE 7th international conference on software security and reliability (SERE\u201913), Washington, D.C., 18\u201320 June 2013, pp 159\u2013168. doi: 10.1109\/SERE.2013.16","DOI":"10.1109\/SERE.2013.16"},{"key":"1027_CR15","doi-asserted-by":"publisher","unstructured":"Aleroud A, Karabatis G (2014a) Context infusion in semantic link networks to detect cyber-attacks: a flow-based detection approach. In: IEEE international conference on semantic computing (ICSC) LA, California 16\u201318 June 2014, pp 175\u2013182. doi: 10.1109\/ICSC.2014.29","DOI":"10.1109\/ICSC.2014.29"},{"key":"1027_CR16","doi-asserted-by":"crossref","unstructured":"AlEroud A, Karabatis G (2014b) Context infusion in semantic link networks to detect cyber-attacks: a flow-based detection approach. In: Eighth IEEE international conference on semantic computing, Newport Beach, California, USA, IEEE","DOI":"10.1109\/ICSC.2014.29"},{"key":"1027_CR17","doi-asserted-by":"crossref","unstructured":"AlEroud A, Karabatis G (2016) Queryable semantics for the detection of cyber-attacks a flow-based detection approach. IEEE transactions on systems, man, and cybernetics: systems","DOI":"10.1109\/TSMC.2016.2600405"},{"issue":"1","key":"1027_CR18","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1504\/ijics.2014.059791","volume":"6","author":"A AlEroud","year":"2014","unstructured":"AlEroud A, Karabatis G, Sharma P, He P (2014) Context and semantics for detection of cyber attacks. Int J Inf Comput Secur 6(1):63\u201392. doi: 10.1504\/ijics.2014.059791","journal-title":"Int J Inf Comput Secur"},{"key":"1027_CR19","doi-asserted-by":"publisher","unstructured":"Alserhani F, Akhlaq M, Awan IU, Cullen AJ, Mirchandani P (2010) MARS: multi-stage attack recognition system. In: 24th IEEE international conference on advanced information networking and applications (AINA\u201910), Perth, Australia, 20\u201323 April 2010, pp 753\u2013759. doi: 10.1109\/AINA.2010.57","DOI":"10.1109\/AINA.2010.57"},{"key":"1027_CR20","doi-asserted-by":"crossref","unstructured":"Ambwani T (2003) Multi class support vector machine implementation to intrusion detection. In: Proceedings of the international joint conference on neural networks, Portland, vol 3. IEEE, pp 2300\u20132305","DOI":"10.1109\/IJCNN.2003.1223770"},{"key":"1027_CR21","doi-asserted-by":"publisher","unstructured":"An X, Jutla D, Cercone N (2006) Privacy intrusion detection using dynamic Bayesian networks. In: Proceedings of the 8th international conference on electronic commerce, Fredericton, New Brunswick, Canada. 1151493. ACM, pp 208\u2013215. doi: 10.1145\/1151454.1151493","DOI":"10.1145\/1151454.1151493"},{"key":"1027_CR22","doi-asserted-by":"publisher","unstructured":"Angelini M, Prigent N, Santucci G (2015) PERCIVAL: proactive and reactive attack and response assessment for cyber incidents using visual analytics. In: IEEE symposium on visualization for cyber security (VizSec), 25\u201325 Oct 2015, pp 1\u20138. doi: 10.1109\/VIZSEC.2015.7312764","DOI":"10.1109\/VIZSEC.2015.7312764"},{"key":"1027_CR23","doi-asserted-by":"publisher","unstructured":"Apiletti D, Baralis E, Cerquitelli T, D\u2019Elia V (2008) Network digest analysis by means of association rules. In: 4th international IEEE conference on intelligent systems(IS \u201908), Varna, 6\u20138 Sept 2008, vol 2, pp 11\u201332. doi: 10.1109\/is.2008.4670505","DOI":"10.1109\/is.2008.4670505"},{"key":"1027_CR24","doi-asserted-by":"crossref","unstructured":"Arya A, Kumar, S (2014) Information theoretic feature extraction to reduce dimensionality of Genetic Network Programming based intrusion detection model. In: Issues and challenges in intelligent computing techniques (ICICT). IEEE, pp 34\u201337","DOI":"10.1109\/ICICICT.2014.6781248"},{"key":"1027_CR25","doi-asserted-by":"crossref","unstructured":"Atallah M, Szpankowski W, Gwadera R (2004) Detection of significant sets of episodes in event sequences. In: Fourth IEEE international conference on data mining (ICDM\u201904) Brighton, UK. IEEE, pp 3\u201310","DOI":"10.1109\/ICDM.2004.10090"},{"key":"1027_CR26","unstructured":"Axelsson S (2000) Intrusion detection systems: a survey and taxonomy. Accessed (2000)"},{"key":"1027_CR27","doi-asserted-by":"publisher","unstructured":"Ayd MA, Zaim AH, Ceylan K (2009) A hybrid intrusion detection system design for computer network security. Comput Electr Eng 35(3):517\u2013526. doi: 10.1016\/j.compeleceng.2008.12.005","DOI":"10.1016\/j.compeleceng.2008.12.005"},{"issue":"4","key":"1027_CR28","doi-asserted-by":"publisher","first-page":"263","DOI":"10.1504\/ijahuc.2007.014070","volume":"2","author":"M Baldauf","year":"2007","unstructured":"Baldauf M, Dustdar S, Rosenberg F (2007) A survey on context-aware systems. Int J Ad Hoc Ubiquitous Comput 2(4):263\u2013277. doi: 10.1504\/ijahuc.2007.014070","journal-title":"Int J Ad Hoc Ubiquitous Comput"},{"issue":"4","key":"1027_CR29","doi-asserted-by":"publisher","first-page":"15","DOI":"10.1145\/604264.604268","volume":"30","author":"D Barbar","year":"2001","unstructured":"Barbar D, Couto J, Jajodia S, Wu N (2001) ADAM: a testbed for exploring the use of data mining in intrusion detection. SIGMOD Rec 30(4):15\u201324. doi: 10.1145\/604264.604268","journal-title":"SIGMOD Rec"},{"key":"1027_CR30","doi-asserted-by":"crossref","unstructured":"Barbara D, Wu N, Jajodia S (2001) Detecting novel network intrusions using Bayes estimators. In: First SIAM conference on data mining, Chicago IL, Citeseer, pp 1\u201317","DOI":"10.1137\/1.9781611972719.28"},{"key":"1027_CR31","doi-asserted-by":"crossref","unstructured":"Bazire M, Br\u00e9zillon P (2005) Understanding context before using it. In: Proceedings of the 5th international conference on modeling and using context, Paris, France, pp 113\u2013192","DOI":"10.1007\/11508373_3"},{"key":"1027_CR32","unstructured":"Beauquier J, Hu Y (2007) Intrusion detection based on distance combination. In: World Acacemy of Science and Engineering (CESSE\u201907), Venice, Italy"},{"key":"1027_CR33","unstructured":"Bloedorn E, Christiansen AD, Hill W, Skorupka C, Talbot LM, Tivel J (2001) Data mining for network intrusion detection: how to get started. Accessed (2001)"},{"issue":"1","key":"1027_CR34","doi-asserted-by":"crossref","first-page":"245","DOI":"10.1016\/S0004-3702(97)00063-5","volume":"97","author":"AL Blum","year":"1997","unstructured":"Blum AL, Langley P (1997) Selection of relevant features and examples in machine learning. Artif Intell 97(1):245\u2013271","journal-title":"Artif Intell"},{"key":"1027_CR35","doi-asserted-by":"publisher","unstructured":"B\u00f6hmer M, Bauer G, Kr\u00fcge A (2011) Context tags: exploiting user-given contextual cues for disambiguation. In: Proceedings of the 13th international conference on human computer interaction with mobile devices and services, Stockholm, Sweden. ACM, pp 611\u2013616, 2037469. doi: 10.1145\/2037373.2037469","DOI":"10.1145\/2037373.2037469"},{"key":"1027_CR36","doi-asserted-by":"publisher","unstructured":"Bonifacio JM, Jr Cansian AM, de Carvalho A, Moreira ES (1998) Neural networks applied in intrusion detection systems. In: The IEEE international joint conference on neural networks, Anchorage, AK, 4\u20138 May 1998, vol 1, pp 205\u2013210. doi: 10.1109\/IJCNN.1998.682263","DOI":"10.1109\/IJCNN.1998.682263"},{"key":"1027_CR37","doi-asserted-by":"crossref","unstructured":"Boriah S, Chandola V, Kumar V (2008) Similarity measures for categorical data: a comparative evaluation. In: In Proceedings of the eighth SIAM international conference on data mining, Atlanta, Georgia","DOI":"10.1137\/1.9781611972788.22"},{"issue":"5","key":"1027_CR38","doi-asserted-by":"publisher","first-page":"423","DOI":"10.1016\/S0167-4048(03)00511-X","volume":"22","author":"M Botha","year":"2003","unstructured":"Botha M, von Solms R (2003) Utilising fuzzy logic and trend analysis for effective intrusion detection. Comput Secur 22(5):423\u2013434. doi: 10.1016\/S0167-4048(03)00511-X","journal-title":"Comput Secur"},{"issue":"2","key":"1027_CR39","doi-asserted-by":"crossref","first-page":"22","DOI":"10.5121\/ijdms.2011.3202","volume":"3","author":"A Bouramoul","year":"2011","unstructured":"Bouramoul A, Kholladi MK, Doan BL (2011) Using context to improve the evaluation of information retrieval systems. Int J Database Manag Syst (IJDMS ) 3(2):22\u201339","journal-title":"Int J Database Manag Syst (IJDMS )"},{"key":"1027_CR40","unstructured":"Bouzida Y, Cuppens F, Cuppens-Boulahia N, Gombault S (2004) Intrusion detection using principal component analysis. In: In proceedings of the 7th world multiconference on systemics, cybernetics and informatics, Orlando, USA"},{"key":"1027_CR41","unstructured":"Bridges SM, Vaughn RB (2000) Fuzzy data mining and genetic algorithms applied to intrusion detection. In: In Proceedings of the national information systems security conference (NISSC), Baltimore, MD"},{"key":"1027_CR42","doi-asserted-by":"publisher","unstructured":"Bringas PG (2007) Intensive use of Bayesian belief networks for the unified, flexible and adaptable analysis of misuses and anomalies in network intrusion detection and prevention systems. In: 18th international workshop on database and expert systems applications(DEXA \u201907), Regensburg, Germany, 3\u20137 Sept 2007, pp 365\u2013371. doi: 10.1109\/DEXA.2007.38","DOI":"10.1109\/DEXA.2007.38"},{"issue":"5","key":"1027_CR43","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1109\/98.626984","volume":"4","author":"PJ Brown","year":"1997","unstructured":"Brown PJ, Bovey JD, Chen X (1997) Context-aware applications: from the laboratory to the marketplace. IEEE Pers Commun 4(5):58\u201364","journal-title":"IEEE Pers Commun"},{"issue":"2","key":"1027_CR44","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","volume":"18","author":"AL Buczak","year":"2015","unstructured":"Buczak AL, Guven E (2015) A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun Surv Tutor 18(2):1153\u20131176","journal-title":"IEEE Commun Surv Tutor"},{"key":"1027_CR45","doi-asserted-by":"publisher","unstructured":"Burroughs DJ, Wilson LF, Cybenko GV (2002) Analysis of distributed intrusion detection systems using Bayesian methods. In: 21st IEEE international performance, computing, and communications conference, Austin, Texas, USA, pp 329\u2013334. doi: 10.1109\/IPCCC.2002.995166","DOI":"10.1109\/IPCCC.2002.995166"},{"key":"1027_CR46","unstructured":"Cannady J (1998) Artificial neural networks for misuse detection. In: National information systems security conference, Crystal City Arlington, Virginia, USA, pp 368\u2013381"},{"key":"1027_CR47","unstructured":"Cha BR, Vaidya B, Han S (2005) Anomaly intrusion detection for system call using the soundex algorithm and neural networks. In: 10th IEEE symposium on computers and communications (ISCC\u201905), Cartagena, Spain. IEEE, pp 427\u2013433"},{"issue":"3","key":"1027_CR48","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/1541880.1541882","volume":"41","author":"V Chandola","year":"2009","unstructured":"Chandola V, Banerjee A, Kumar V (2009) Anomaly detection: a survey. ACM Comput Surv 41(3):1\u201358. doi: 10.1145\/1541880.1541882","journal-title":"ACM Comput Surv"},{"key":"1027_CR49","volume-title":"Data mining for cyber security, book chapter in data warehousing and data mining techniques for computer security","author":"V Chandola","year":"2006","unstructured":"Chandola V, Eilertson E, Ertoz L, Simon G, Kumar V (2006) Data mining for cyber security, book chapter in data warehousing and data mining techniques for computer security, 1st edn. Springer, Berlin","edition":"1"},{"key":"1027_CR50","unstructured":"Cheboli D (2010) Anomaly detection of time series. PhD Thesis, University of Minnesota"},{"issue":"4","key":"1027_CR51","doi-asserted-by":"publisher","first-page":"295","DOI":"10.1016\/j.cose.2004.09.008","volume":"24","author":"S Chebrolu","year":"2005","unstructured":"Chebrolu S, Abraham A, Thomas JP (2005) Feature deduction and ensemble design of intrusion detection systems. Comput Secur 24(4):295\u2013307. doi: 10.1016\/j.cose.2004.09.008","journal-title":"Comput Secur"},{"issue":"3","key":"1027_CR52","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1017\/s0269888904000025","volume":"18","author":"H Chen","year":"2003","unstructured":"Chen H, Finin T, Joshi A (2003) An ontology for context-aware pervasive computing environments. Knowl Eng Rev 18(3):197\u2013207. doi: 10.1017\/s0269888904000025","journal-title":"Knowl Eng Rev"},{"issue":"2","key":"1027_CR53","first-page":"413","volume":"4","author":"RC Chen","year":"2008","unstructured":"Chen RC, Chen SP (2008) Intrusion Detection Using a Hybrid Support Vector Machine Based on Entropy and TF-IDF. Int J Innov Comput Inf Control 4(2):413\u2013424","journal-title":"Int J Innov Comput Inf Control"},{"key":"1027_CR54","doi-asserted-by":"crossref","unstructured":"Chen RC, Cheng KF, Chen YH, Hsieh CF (2009) Using rough set and support vector machine for network intrusion detection system. In: First Asian conference on intelligent information and database systems (ACIIDS\u201909), Quang binh, Vietnam. IEEE, pp 465\u2013470","DOI":"10.1109\/ACIIDS.2009.59"},{"key":"1027_CR55","doi-asserted-by":"publisher","unstructured":"Cheng X, Liu B-x, Li K, Yan J (2009) Intrusion detection system based on KNN-MARS. In: WRI world congress on software engineering (WCSE \u201909), Xiamen, China, 19\u201321 May 2009, vol 1, pp 392\u2013396. doi: 10.1109\/WCSE.2009.79","DOI":"10.1109\/WCSE.2009.79"},{"key":"1027_CR56","doi-asserted-by":"publisher","unstructured":"Chimphlee W, Abdullah AH, Noor\u00a0Md\u00a0Sap M, Srinoy S, Chimphlee S (2006) Anomaly-based intrusion detection using fuzzy rough clustering. In: International conference on hybrid information technology (ICHIT \u201906), Jeju Island, Korea, 9\u201311 Nov 2006, vol 1, pp 329\u2013334. doi: 10.1109\/ICHIT.2006.253508","DOI":"10.1109\/ICHIT.2006.253508"},{"key":"1027_CR57","doi-asserted-by":"crossref","unstructured":"Chitta R, Jin R, Jain AK (2012) Efficient kernel clustering using random fourier features. In: IEEE 12th international conference on data mining, IEEE, pp 161\u2013170","DOI":"10.1109\/ICDM.2012.61"},{"key":"1027_CR58","doi-asserted-by":"publisher","unstructured":"Chuanliang C, Yunchao G, Yingjie T (2008) Semi-supervised learning methods for network intrusion detection. In: IEEE international conference on systems, man and cybernetics (SMC\u201908), Seoul, Korea, 12\u201315 Oct 2008, pp 2603\u20132608. doi: 10.1109\/ICSMC.2008.4811688","DOI":"10.1109\/ICSMC.2008.4811688"},{"issue":"3","key":"1027_CR59","doi-asserted-by":"crossref","first-page":"281","DOI":"10.1109\/TEVC.2002.1011541","volume":"6","author":"D Dasgupta","year":"2002","unstructured":"Dasgupta D, Gonz\u00e1lez F (2002) An immunity-based technique to characterize intrusions in computer networks. IEEE Trans Evol Comput 6(3):281\u2013291","journal-title":"IEEE Trans Evol Comput"},{"key":"1027_CR60","doi-asserted-by":"crossref","unstructured":"Dasgupta D, Nino F (2000) A comparison of negative and positive selection algorithms in novel pattern detection. In: IEEE international conference on systems, man, and cybernetics, Nashville, TN, vol 1. IEEE, pp 125\u2013130","DOI":"10.1109\/ICSMC.2000.884976"},{"key":"1027_CR61","doi-asserted-by":"publisher","unstructured":"Dayu Y, Hairong Q (2008) A network intrusion detection method using independent component analysis. In: 19th international conference on pattern recognition (ICPR\u201908), Tampa, Florida, USA, 8\u201311 Dec 2008, pp 1\u20134. doi: 10.1109\/ICPR.2008.4761087","DOI":"10.1109\/ICPR.2008.4761087"},{"key":"1027_CR62","doi-asserted-by":"publisher","unstructured":"de Lima IVM, Degaspari JA, Sobral JBM (2008) Intrusion detection through artificial neural networks. In: IEEE network operations and management symposium (NOMS\u201908), Bahia, Brazil, 7\u201311 April 2008, pp 867\u2013870. doi: 10.1109\/NOMS.2008.4575234","DOI":"10.1109\/NOMS.2008.4575234"},{"key":"1027_CR63","doi-asserted-by":"publisher","unstructured":"Debar H, Becker M, Siboni D (1992) A neural network component for an intrusion detection system. In: IEEE computer society symposium on research in security and privacy, Oakland, California, 4\u20136 May 1992, pp 240\u2013250. doi: 10.1109\/RISP.1992.213257","DOI":"10.1109\/RISP.1992.213257"},{"issue":"8","key":"1027_CR64","doi-asserted-by":"crossref","first-page":"805","DOI":"10.1016\/S1389-1286(98)00017-6","volume":"31","author":"H Debar","year":"1999","unstructured":"Debar H, Dacier M, Wespi A (1999) Towards a taxonomy of intrusion-detection systems. Comput Netw 31(8):805\u2013822","journal-title":"Comput Netw"},{"issue":"7","key":"1027_CR65","doi-asserted-by":"crossref","first-page":"361","DOI":"10.1007\/BF02994844","volume":"55","author":"H Debar","year":"2000","unstructured":"Debar H, Dacier M, Wespi A (2000) A revised taxonomy for intrusion-detection systems. Ann Telecommun 55(7):361\u2013378","journal-title":"Ann Telecommun"},{"issue":"2","key":"1027_CR66","doi-asserted-by":"crossref","first-page":"222","DOI":"10.1109\/TSE.1987.232894","volume":"13","author":"DE Denning","year":"1987","unstructured":"Denning DE (1987) An intrusion-detection model. IEEE Trans Software Eng 13(2):222\u2013232","journal-title":"IEEE Trans Software Eng"},{"issue":"4","key":"1027_CR67","doi-asserted-by":"publisher","first-page":"713","DOI":"10.1016\/j.eswa.2005.05.002","volume":"29","author":"O Depren","year":"2005","unstructured":"Depren O, Topallar M, Anarim E, Ciliz MK (2005) An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks. Expert Syst Appl 29(4):713\u2013722. doi: 10.1016\/j.eswa.2005.05.002","journal-title":"Expert Syst Appl"},{"key":"1027_CR68","doi-asserted-by":"publisher","unstructured":"Desheng F, Shu Z, Ping G (2009) Research on a distributed network intrusion detection system based on association rule mining. In: 1st international conference on information science and engineering (ICISE), Nanjing, 26\u201328 Dec 2009, pp 1816\u20131818. doi: 10.1109\/icise.2009.929","DOI":"10.1109\/icise.2009.929"},{"key":"1027_CR69","unstructured":"Dey AK (2000) Providing architectural support for building context-aware applications. PhD Thesis , Georgia Institute of Technology"},{"key":"1027_CR70","unstructured":"Dharap C (Google Patents, Patent version number: 6,256,633, 2001). Context-based and user-profile driven information retrieval. Google Patents"},{"key":"1027_CR71","doi-asserted-by":"publisher","unstructured":"Dickerson JE, Dickerson JA (2000) Fuzzy network profiling for intrusion detection. In: 19th international conference of the North American on Fuzzy Information Processing Society, Atlanta, Georgia, 2000, pp 301\u2013306. doi: 10.1109\/NAFIPS.2000.877441","DOI":"10.1109\/NAFIPS.2000.877441"},{"key":"1027_CR72","doi-asserted-by":"crossref","unstructured":"Dickerson JE, Juslin J, Koukousoula O, Dickerson JA (2001) Fuzzy intrusion detection. In: IFSA (International Fuzzy Systems Association) world congress and 20th NAFIPS (North American Fuzzy Information Processing Society) international conference, Vancouver, British Columbia, vol 3. IEEEE, pp 1506\u20131510","DOI":"10.1109\/NAFIPS.2001.943772"},{"key":"1027_CR73","doi-asserted-by":"crossref","unstructured":"Ding T, AlEroud A Karabatis G (2015) Multi-granular aggregation of network flows for security analysis. In: IEEE international conference on intelligence and security informatics (ISI). IEEE, pp 173\u2013175","DOI":"10.1109\/ISI.2015.7165965"},{"key":"1027_CR74","doi-asserted-by":"crossref","unstructured":"Ding X, Zhang G, Ke Y, Ma B, Li Z (2008) High efficient intrusion detection methodology with twin support vector machines. In: International symposium on information science and engineering (ISISE\u201908), Shanghai, China, vol 1. IEEE, pp 560\u2013564","DOI":"10.1109\/ISISE.2008.278"},{"key":"1027_CR75","doi-asserted-by":"publisher","unstructured":"Dwen-Ren T, Wen-Pin T, Chi-Fang C (2003) A hybrid intelligent intrusion detection system to recognize novel attacks. In: IEEE 37th Annual international Carnahan conference on security technology, Taipei, Taiwan, 14\u201316 Oct 2003, pp 428\u2013434. doi: 10.1109\/CCST.2003.1297598","DOI":"10.1109\/CCST.2003.1297598"},{"key":"1027_CR76","doi-asserted-by":"publisher","unstructured":"Eiland EE, Liebrock LM (2006) An application of information theory to intrusion detection. In: Fourth IEEE international workshop on information assurance (IWIA\u201906), Egham, Surrey, UK, 13\u201314 April 2006, pp 66\u201381. doi: 10.1109\/IWIA.2006.3","DOI":"10.1109\/IWIA.2006.3"},{"key":"1027_CR77","doi-asserted-by":"publisher","unstructured":"El-Semary A, Edmonds J, Gonzalez-Pino J, Papa M (2006) Applying data mining of fuzzy association rules to network intrusion detection. In: IEEE information assurance workshop, New York, USA, 21\u201323 June 2006, pp 100\u2013107. doi: 10.1109\/iaw.2006.1652083","DOI":"10.1109\/iaw.2006.1652083"},{"key":"1027_CR78","doi-asserted-by":"crossref","unstructured":"Eskin E, Arnold A, Prerau M, Portnoy L, Stolfo S (2002) A geometric framework for unsupervised anomaly detection: detecting intrusions in unlabeled data. In: Proceedings of the conference on applications of data mining in computer security. Kluwer Academics, pp 78\u2013100","DOI":"10.1007\/978-1-4615-0953-0_4"},{"key":"1027_CR79","doi-asserted-by":"crossref","unstructured":"Eskin E, Lee W, Stolfo SJ (2001) Modeling system calls for intrusion detection with dynamic window sizes. In: Proceedings of DARPA information survivability conference & exposition (DISCEX\u201901), Anaheim, California, vol 1. IEEE, pp 165\u2013175","DOI":"10.1109\/DISCEX.2001.932213"},{"issue":"2","key":"1027_CR80","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.comnet.2003.12.016","volume":"45","author":"JM Est\u00e9vez-Tapiador","year":"2004","unstructured":"Est\u00e9vez-Tapiador JM, Garc\u0131a-Teodoro P, D\u0131az-Verdejo JE (2004) Measuring normality in HTTP traffic for anomaly-based intrusion detection. Comput Netw 45(2):175\u2013193. doi: 10.1016\/j.comnet.2003.12.016","journal-title":"Comput Netw"},{"issue":"5","key":"1027_CR81","doi-asserted-by":"crossref","first-page":"507","DOI":"10.1007\/s10115-003-0132-7","volume":"6","author":"W Fan","year":"2004","unstructured":"Fan W, Miller M, Stolfo S, Lee W, Chan P (2004) Using artificial anomalies to detect unknown and known network intrusions. Knowl Inf Syst 6(5):507\u2013527","journal-title":"Knowl Inf Syst"},{"key":"1027_CR82","doi-asserted-by":"publisher","unstructured":"Fangfei W, Qingshan J, Lifei C, Zhiling H (2007) Clustering ensemble based on the fuzzy KNN algorithm. In: Eighth ACIS international conference on software engineering, artificial intelligence, networking, and parallel\/distributed computing (SNPD\u201907), Qingdao, July 30 2007\u2013Aug 1 2007, vol 3, pp 1001\u20131006. doi: 10.1109\/SNPD.2007.504","DOI":"10.1109\/SNPD.2007.504"},{"key":"1027_CR83","doi-asserted-by":"crossref","unstructured":"Fischer F, Mansmann F, Keim DA, Pietzko S, Waldvogel M (2008) Large-scale network monitoring for visual analysis of attacks. In: Visualization for computer security. Springer, pp 111\u2013118","DOI":"10.1007\/978-3-540-85933-8_11"},{"key":"1027_CR84","doi-asserted-by":"crossref","unstructured":"Florez G, Bridges S, Vaughn RB (2002) An improved algorithm for fuzzy data mining for intrusion detection. In: Annual meeting of the North American fuzzy information processing society (NAFIPS\u201902), Ann Arbor, MI. IEEE, pp 457\u2013462","DOI":"10.1109\/NAFIPS.2002.1018103"},{"key":"1027_CR85","doi-asserted-by":"publisher","unstructured":"Fortu O, Moldovan D (2005) Identification of textual contexts. In: Proceedings of the 5th international conference on modeling and using context, Paris, France. 2136862. Springer, pp 169\u2013182. doi: 10.1007\/11508373_13","DOI":"10.1007\/11508373_13"},{"key":"1027_CR86","doi-asserted-by":"crossref","unstructured":"Gao B, Ma HY, Yang YH (2002) HMMS (Hidden Markov Models) based on anomaly intrusion detection method. In: International conference on machine learning and cybernetics, Beijing, vol 1. IEEE, pp 381\u2013385","DOI":"10.1109\/ICMLC.2002.1176779"},{"key":"1027_CR87","doi-asserted-by":"crossref","unstructured":"Gao M, Tian J, Xia M (2009) Intrusion detection method based on classify support vector machine. In: Second international conference on intelligent computation technology and automation (ICICTA\u201909), Zhangjiajie, China, vol 2. IEEE, pp 391\u2013394","DOI":"10.1109\/ICICTA.2009.330"},{"key":"1027_CR88","doi-asserted-by":"publisher","unstructured":"Giseop N, Ilkyeun R (2009) An efficient and reliable DDoS attack detection using a fast entropy computation method. In: 9th international symposium on communications and information technology (ISCIT\u201909), Icheon, South Korea, 28\u201330 Sept 2009, pp 1223\u20131228. doi: 10.1109\/ISCIT.2009.5341118","DOI":"10.1109\/ISCIT.2009.5341118"},{"key":"1027_CR89","unstructured":"Gomez J, Dasgupta D (2002) Evolving fuzzy classifiers for intrusion detection. In: Proceedings of the IEEE workshop on information assurance, West Point, NY, vol 6. IEEE Computer Press, New York, vol 3, pp 321\u2013323"},{"key":"1027_CR90","doi-asserted-by":"crossref","unstructured":"G\u00f3mez J, Gonz\u00e1lez F, Dasgupta D (2003) An immuno-fuzzy approach to anomaly detection. In: The 12th IEEE international conference on fuzzy systems(FUZZ\u201903), St. Louis, MO, USA, vol 2. IEEE, pp 1219\u20131224","DOI":"10.1109\/FUZZ.2003.1206605"},{"key":"1027_CR91","doi-asserted-by":"crossref","unstructured":"Granitzer M, Kroll M, Seifert C, Rath AS, Weber N, Dietzel O, et\u00a0al (2008) Analysis of machine learning techniques for context extraction. In: Third international conference on digital information management (ICDIM\u201908), London, UK. IEEE, pp 233\u2013240","DOI":"10.1109\/ICDIM.2008.4746809"},{"key":"1027_CR92","unstructured":"Gray D, Kraus R (2012, Available: https:\/\/www.necam.com\/docs\/?id=36eda3e2-ec01-4117-a7cc-3483db8422e7 ). Contextual security provides actionable intelligence. Accessed 2012, Available: https:\/\/www.necam.com\/docs\/?id=36eda3e2-ec01-4117-a7cc-3483db8422e7"},{"key":"1027_CR93","volume-title":"Signal detection theory and psychophysics","author":"DM Green","year":"1966","unstructured":"Green DM, Swets JA (1966) Signal detection theory and psychophysics, vol 1974. Wiley, New, York"},{"issue":"2","key":"1027_CR94","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1207\/s15327051hci16234_09","volume":"16","author":"S Greenberg","year":"2001","unstructured":"Greenberg S (2001) Context as a dynamic construct. Hum Comput Interact 16(2):257\u2013268. doi: 10.1207\/s15327051hci16234_09","journal-title":"Hum Comput Interact"},{"key":"1027_CR95","unstructured":"Grobelnik M, Mladenic D, Leban G, Stajner T (2011) Context and semantics for knowledge management: technologies for personal productivity: machine learning techniques for understanding context and process (1st ed). Springer, Berlin, pp 127\u2013145"},{"key":"1027_CR96","doi-asserted-by":"crossref","unstructured":"Gross T, Specht M (2001) Awareness in context-aware information systems. In: Mensch & computer conference, Germany, vol 1. Citeseer, pp 173\u2013182","DOI":"10.1007\/978-3-322-80108-1_19"},{"issue":"2","key":"1027_CR97","doi-asserted-by":"publisher","first-page":"199","DOI":"10.1006\/knac.1993.1008","volume":"5","author":"TR Gruber","year":"1993","unstructured":"Gruber TR (1993) A translation approach to portable ontology specifications. Knowl Acquis 5(2):199\u2013220. doi: 10.1006\/knac.1993.1008","journal-title":"Knowl Acquis"},{"key":"1027_CR98","unstructured":"Gruschke B (1998) Integrated event management: event correlation using dependency graphs. In: Proceedings of the 9th IFIP\/IEEE international workshop on distributed systems: operations & management (DSOM 98), Newark, DE, USA, pp 130\u2013141"},{"key":"1027_CR99","doi-asserted-by":"crossref","unstructured":"Gu G, Fogla P, Dagon D, Lee W, Skori\u0107 B (2006) Measuring intrusion detection capability: an information-theoretic approach. In: Proceedings of the ACM symposium on information, computer and communications security, Taipei, Taiwan. ACM, pp 90\u2013101","DOI":"10.1145\/1128817.1128834"},{"key":"1027_CR100","doi-asserted-by":"publisher","unstructured":"Guan Y, Ghorbani AA, Belacel N (2003) Y-means: a clustering method for intrusion detection. In: IEEE Canadian conference on electrical and computer engineering, Canada; Montreal, 4\u20137 May 2003, vol 2, pp 1083\u20131086. doi: 10.1109\/CCECE.2003.1226084","DOI":"10.1109\/CCECE.2003.1226084"},{"key":"1027_CR101","doi-asserted-by":"publisher","unstructured":"Gujral S, Ortiz E, Syrmos VL (2009) An unsupervised method for intrusion detection using spectral clustering. In: IEEE symposium on computational intelligence in cyber security (CICS \u201909), Nashville, TN, USA, March 30 2009\u2013April 2 2009, pp 99\u2013106. doi: 10.1109\/CICYBS.2009.4925096","DOI":"10.1109\/CICYBS.2009.4925096"},{"key":"1027_CR102","doi-asserted-by":"publisher","first-page":"255","DOI":"10.1016\/j.cose.2013.08.003","volume":"39","author":"C Guo","year":"2013","unstructured":"Guo C, Zhou Y-J, Ping Y, Luo S-S, Lai Y-P, Zhang Z-K (2013) Efficient intrusion detection using representative instances. Comput Secur 39:255\u2013267. doi: 10.1016\/j.cose.2013.08.003","journal-title":"Comput Secur"},{"key":"1027_CR103","doi-asserted-by":"crossref","unstructured":"Haijun X, Fang P, Ling W, Hongwei L (2007) Ad hoc-based feature selection and support vector machine classifier for intrusion detection. In: IEEE international conference on grey systems and intelligent services, (GSIS07), Macau, China. IEEE, pp 1117\u20131121","DOI":"10.1109\/GSIS.2007.4443446"},{"key":"1027_CR104","unstructured":"Hall MA (1999) Correlation-based feature selection for machine learning. PhD thesis, the University of Waikato"},{"issue":"7","key":"1027_CR105","first-page":"606","volume":"14","author":"LR Halme","year":"1995","unstructured":"Halme LR (1995) AIN\u2019T misbehaving-A taxonomy of anti-intrusion techniques. Comput Secur 14(7):606\u2013606","journal-title":"Comput Secur"},{"issue":"2","key":"1027_CR106","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/335191.335372","volume":"29","author":"J Han","year":"2000","unstructured":"Han J, Pei J, Yin Y (2000) Mining frequent patterns without candidate generation. SIGMOD Rec 29(2):1\u201312. doi: 10.1145\/335191.335372","journal-title":"SIGMOD Rec"},{"issue":"3","key":"1027_CR107","doi-asserted-by":"crossref","first-page":"559","DOI":"10.1109\/TSMCB.2005.860136","volume":"36","author":"SJ Han","year":"2005","unstructured":"Han SJ, Cho SB (2005) Evolutionary neural networks for anomaly detection based on the behavior of a program. IEEE Trans Syst Man Cybern B Cybern 36(3):559\u2013570","journal-title":"IEEE Trans Syst Man Cybern B Cybern"},{"key":"1027_CR108","doi-asserted-by":"crossref","unstructured":"Han W, Xiong W, Xiao Y, Ellabidy M, Vasilakos AV, Xiong N (2012) A class of non-statistical traffic anomaly detection in complex network systems. In: 32nd international conference on distributed computing systems workshops (ICDCSW), Macau, China. IEEE, pp 6400\u20136406","DOI":"10.1109\/ICDCSW.2012.7"},{"key":"1027_CR109","doi-asserted-by":"publisher","unstructured":"Handra SI, Ciocarlie H (2011) Anomaly detection in data mining. Hybrid approach between filtering-and-refinement and DBSCAN. In: 6th IEEE international symposium on applied computational intelligence and informatics (SACI), Timisoara, Romania, 19\u201321 May 2011, pp 75\u201383. doi: 10.1109\/SACI.2011.5872976","DOI":"10.1109\/SACI.2011.5872976"},{"key":"1027_CR110","doi-asserted-by":"publisher","unstructured":"Hassanzadeh A, Sadeghian B (2008) Intrusion detection with data correlation relation graph. In: Third international conference on availability, reliability and security (ARES\u201908), Washington, DC, USA, 4\u20137 March 2008, pp 982\u2013989. doi: 10.1109\/ARES.2008.119","DOI":"10.1109\/ARES.2008.119"},{"key":"1027_CR111","doi-asserted-by":"crossref","unstructured":"Hawkins S, He H, Williams G, Baxter R (2002) Outlier detection using replicator neural networks. In: 4th international conference on data warehousing and knowledge discovery, Aix-en-Provence, France, pp 113\u2013123","DOI":"10.1007\/3-540-46145-0_17"},{"key":"1027_CR112","doi-asserted-by":"crossref","unstructured":"Hayes MA, Capretz MA (2014) Contextual anomaly detection in big sensor data. In: 2014 IEEE international congress on big data. IEEE, pp 64\u201371","DOI":"10.1109\/BigData.Congress.2014.19"},{"key":"1027_CR113","doi-asserted-by":"crossref","unstructured":"Hellemons L, Hendriks L, Hofstede R, Sperotto A, Sadre R, Pras A (2012) SSHCure: a flow-based SSH intrusion detection system. In: Sadre R, Novotn\u00fd J, \u010celeda P, Waldburger M, Stiller B (eds) Dependable networks and services, vol 7279 (Lecture Notes in Computer Science), Springer, Berlin, pp 86\u201397","DOI":"10.1007\/978-3-642-30633-4_11"},{"key":"1027_CR114","unstructured":"Heller K, Svore K, Keromytis AD, Stolfo S (2003) One class support vector machines for detecting anomalous windows registry accesses. In: Workshop on data mining for computer security (DMSEC), Melbourne, FL, pp 2\u20139"},{"key":"1027_CR115","doi-asserted-by":"crossref","unstructured":"Hendry GR, Yang SJ (2008) Intrusion signature creation via clustering anomalies. In: Proceeding of SPIE, Bellingham, WA, pp 69730\u201369731","DOI":"10.1117\/12.775886"},{"issue":"1","key":"1027_CR116","doi-asserted-by":"crossref","first-page":"66","DOI":"10.1109\/TCYB.2013.2247592","volume":"44","author":"W Hu","year":"2014","unstructured":"Hu W, Gao J, Wang Y, Wu O, Maybank S (2014) Online Adaboost-based parameterized methods for dynamic distributed network intrusion detection. IEEE Trans Cybern 44(1):66\u201382","journal-title":"IEEE Trans Cybern"},{"key":"1027_CR117","unstructured":"Hu W, Liao Y, Vemuri VR (2003) Robust anomaly detection using support vector machines. In: Proceedings of the international conference on machine learning, Washington, DC USA, pp 282\u2013289"},{"key":"1027_CR118","unstructured":"Hunt EB, Marin J, Stone PJ (1966) Experiments in induction, 1st ed. The University of Michigan, Academic Press, Michigan"},{"key":"1027_CR119","doi-asserted-by":"publisher","unstructured":"Hussein M, Zulkernine M (2006) UMLINTR: A UML profile for specifying intrusions. In: Proceedings of the 13th annual IEEE international symposium and workshop on engineering of computer based systems, Potsdam, Germany. 1126211: IEEE Computer Society, pp. 279\u2013288. doi: 10.1109\/ecbs.2006.70","DOI":"10.1109\/ecbs.2006.70"},{"key":"1027_CR120","doi-asserted-by":"publisher","unstructured":"Ide T, Kashima H (2004) Eigenspace-based anomaly detection in computer systems. In: Proceedings of the tenth ACM SIGKDD international conference on knowledge discovery and data mining, Seattle, WA, USA. 1014102: ACM, pp 440\u2013449. doi: 10.1145\/1014052.1014102","DOI":"10.1145\/1014052.1014102"},{"key":"1027_CR121","doi-asserted-by":"publisher","unstructured":"Idris NB, Shanmugam B (2005) Artificial intelligence techniques applied to intrusion detection. In: EEE India conference Indicon (INDICON\u201905), Chennai, India, 11\u201313 Dec 2005, pp 52\u201355. doi: 10.1109\/INDCON.2005.1590122","DOI":"10.1109\/INDCON.2005.1590122"},{"key":"1027_CR122","doi-asserted-by":"publisher","unstructured":"Ippoliti D, Xiaobo Z (2010) An adaptive growing hierarchical self organizing map for network intrusion detection. In: Proceedings of 19th international conference on computer communications and networks (ICCCN\u201910), Zurich, Switzerland, 2\u20135 Aug 2010, pp 1\u20137. doi: 10.1109\/ICCCN.2010.5560165","DOI":"10.1109\/ICCCN.2010.5560165"},{"key":"1027_CR123","doi-asserted-by":"publisher","unstructured":"Jadidi Z, Muthukkumarasamy V, Sithirasenan E, Sheikhan M (2013) Flow-based anomaly detection using neural network optimized with GSA algorithm. In: Distributed computing systems workshops (ICDCSW), 2013 IEEE 33rd international conference on, 8\u201311 July 2013, pp 76\u201381. doi: 10.1109\/ICDCSW.2013.40","DOI":"10.1109\/ICDCSW.2013.40"},{"key":"1027_CR124","doi-asserted-by":"publisher","unstructured":"Jakobson G (2003) The technology and practice of integrated multiagent event correlation systems. In: International conference on integration of knowledge intensive multi-agent systems, Boston MA, USA, 30 Sept\u20134 Oct 2003, pp 568\u2013573. doi: 10.1109\/KIMAS.2003.1245102","DOI":"10.1109\/KIMAS.2003.1245102"},{"key":"1027_CR125","doi-asserted-by":"publisher","unstructured":"Jha S, Tan K, Maxion RA (2001) Markov chains, classifiers, and intrusion detection. In: Proceedings. 14th IEEE Computer Security Foundations., Nova Scotia, Canada, 2001, pp 206\u2013219. doi: 10.1109\/CSFW.2001.930147","DOI":"10.1109\/CSFW.2001.930147"},{"key":"1027_CR126","doi-asserted-by":"publisher","unstructured":"Ji-Qing X, Feng-Hua L, Xian-Lun T (2005) A novel intrusion detection method based on clonal selection clustering algorithm. In: Proceedings of international conference on machine learning and cybernetics, Guangzhou, China, 18\u201321 Aug 2005, vol 6, pp 3905\u20133910. doi: 10.1109\/ICMLC.2005.1527620","DOI":"10.1109\/ICMLC.2005.1527620"},{"key":"1027_CR127","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1016\/j.jnca.2015.12.004","volume":"62","author":"S-Y Ji","year":"2016","unstructured":"Ji S-Y, Jeong B-K, Choi S, Jeong DH (2016) A multi-level intrusion detection method for abnormal network behaviors. J Netw Comput Appl 62:9\u201317","journal-title":"J Netw Comput Appl"},{"key":"1027_CR128","doi-asserted-by":"publisher","unstructured":"Jianxiong L, Bridges SM, Vaughn RB Jr (2001) Fuzzy frequent episodes for real-time intrusion detection. In: The 10th IEEE international conference on fuzzy systems, Melbourne, VIC, 2001, vol 1, pp 368\u2013371. doi: 10.1109\/FUZZ.2001.1007325","DOI":"10.1109\/FUZZ.2001.1007325"},{"key":"1027_CR129","doi-asserted-by":"publisher","unstructured":"Jie L, Zhi-tang L (2007) Using network attack graph to predict the future attacks. In: Second international conference on communications and networking in China (CHINACOM \u201907), Xi\u2019an, China, 22\u201324 Aug 2007, pp 403\u2013407. doi: 10.1109\/CHINACOM.2007.4469413","DOI":"10.1109\/CHINACOM.2007.4469413"},{"key":"1027_CR130","doi-asserted-by":"crossref","unstructured":"Jing-xin W, Zhi-ying W, Kui D (2004) A network intrusion detection system based on the artificial neural networks. In: Proceedings of the 3rd international conference on information security, Shanghai, China. ACM, pp 166\u2013170","DOI":"10.1145\/1046290.1046324"},{"key":"1027_CR131","doi-asserted-by":"publisher","unstructured":"Jing Z, Hongjuan W, Yushu L (2011) Intrusion detection using evolving fuzzy classifiers. In: 6th IEEE joint international information technology and artificial intelligence conference (ITAIC\u201911), Chongqing, 20\u201322 Aug 2011, vol 1, pp 119\u2013122. doi: 10.1109\/ITAIC.2011.6030165","DOI":"10.1109\/ITAIC.2011.6030165"},{"key":"1027_CR132","unstructured":"Jirapummin C, Wattanapongsakorn N, Kanthamanon P (2002) Hybrid neural networks for intrusion detection system. In: International conference on multimedia technology (ICMT), Wuhan, China, pp 928\u2013931"},{"key":"1027_CR133","volume-title":"Applied multivariate statistical analysis","author":"RA Johnson","year":"1992","unstructured":"Johnson RA, Wichern DW (1992) Applied multivariate statistical analysis, vol 4, 3rd edn. Prentice Hall, Englewood Cliffs","edition":"3"},{"key":"1027_CR134","unstructured":"Jones AK, Sielken RS (2000) Computer system intrusion detection. A survey Accessed (2000)"},{"key":"1027_CR135","unstructured":"Jou YF, Gong F, Sargor C, Wu SF, Cleaveland WR (1997) Architecture design of a scalable intrusion detection system for the emerging network infrastructure. Accessed (1997)"},{"key":"1027_CR136","doi-asserted-by":"publisher","unstructured":"Juan W, Feng-Li Z, Jing J, Wei C (2010) Alert analysis and threat evaluation in network situation awareness. In: 2010 international conference on communications, circuits and systems (ICCCAS\u201910), Chengdu, China, 28\u201330 July 2010, pp 278\u2013281. doi: 10.1109\/ICCCAS.2010.5582005","DOI":"10.1109\/ICCCAS.2010.5582005"},{"key":"1027_CR137","doi-asserted-by":"publisher","unstructured":"Jun L, Manikopoulos C (2003) Early statistical anomaly intrusion detection of DoS attacks using MIB traffic parameters. In: IEEE systems, man and cybernetics society information assurance workshop, West Point, New York, USA, 18\u201320 June 2003, pp 53\u201359. doi: 10.1109\/SMCSIA.2003.1232401","DOI":"10.1109\/SMCSIA.2003.1232401"},{"key":"1027_CR138","doi-asserted-by":"publisher","unstructured":"Jun M, Guanzhong D, Zhong X (2009) Network anomaly detection using dissimilarity-based one-class SVM classifier. In: International conference on parallel processing workshops (ICPPW \u201909), Kaohsiung, 22\u201325 Sept 2009, pp 409\u2013414. doi: 10.1109\/ICPPW.2009.6","DOI":"10.1109\/ICPPW.2009.6"},{"key":"1027_CR139","doi-asserted-by":"publisher","unstructured":"Kim G, Lee S, Kim S (2014) A novel hybrid intrusion detection method integrating anomaly detection with misuse detection. Expert Syst Appl 41(4, Part 2):1690\u20131700. doi: 10.1016\/j.eswa.2013.08.066","DOI":"10.1016\/j.eswa.2013.08.066"},{"issue":"2","key":"1027_CR140","doi-asserted-by":"publisher","first-page":"110","DOI":"10.1109\/TNSM.2009.090604","volume":"6","author":"A Kind","year":"2009","unstructured":"Kind A, Stoecklin MP, Dimitropoulos X (2009) Histogram-based Traffic Anomaly Detection. IEEE Trans Netw Serv Manag 6(2):110\u2013121. doi: 10.1109\/TNSM.2009.090604","journal-title":"IEEE Trans Netw Serv Manag"},{"key":"1027_CR141","doi-asserted-by":"crossref","unstructured":"Kohavi R, John GH (1995) Automatic parameter selection by minimizing estimated error. In: Proceedings of the twelfth annual international conference on machine learning, Tahoe City, California, USA. Citeseer, pp 304\u2013312)","DOI":"10.1016\/B978-1-55860-377-6.50045-1"},{"key":"1027_CR142","doi-asserted-by":"publisher","unstructured":"Kruegel C, Mutz D, Robertson W, Valeur F (2003) Bayesian event classification for intrusion detection. In: 19th annual computer security applications conference, Las Vegas, NV, USA, 8\u201312 Dec 2003, pp 14\u201323. doi: 10.1109\/CSAC.2003.1254306","DOI":"10.1109\/CSAC.2003.1254306"},{"key":"1027_CR143","unstructured":"Kruegel C, Valeur F, Vigna G (2004) Intrusion detection and correlation: challenges and solutions, vol 14). Springer, Berlin"},{"key":"1027_CR144","doi-asserted-by":"publisher","unstructured":"Kuang L, Zulkernine M (2008) An anomaly intrusion detection method using the CSI-KNN algorithm. In: Proceedings of the 2008 ACM symposium on applied computing, Fortaleza, Ceara, Brazil. 1363897: ACM, pp 921\u2013926. doi: 10.1145\/1363686.1363897","DOI":"10.1145\/1363686.1363897"},{"key":"1027_CR145","doi-asserted-by":"publisher","unstructured":"Kulsoom A, Lee C, Conti G, Copeland JA (2005) Visualizing network data for intrusion detection. In: Proceedings from the sixth annual IEEE SMC information assurance workshop (IAW \u201905), West Point, NY, 15\u201317 June 2005, pp 100\u2013108. doi: 10.1109\/IAW.2005.1495940","DOI":"10.1109\/IAW.2005.1495940"},{"key":"1027_CR146","doi-asserted-by":"crossref","unstructured":"Kumar P, Rao M, Krishna P, Bapi R (2005a) Using sub-sequence information with K-NN for classification of sequential data. In: Distributed computing and internet technology, Bhubaneswar, India, pp 1\u201311","DOI":"10.1007\/11604655_60"},{"key":"1027_CR147","doi-asserted-by":"crossref","unstructured":"Kumar P, Rao M, Krishna P, Bapi R (2005b) Using sub-sequence information with kNN for classification of sequential data. In: Distributed computing and internet technology, Bhubaneswar, India, pp 1\u201311","DOI":"10.1007\/11604655_60"},{"key":"1027_CR148","doi-asserted-by":"publisher","unstructured":"Kun-Lun L, Hou-Kuan H, Sheng-Feng T, Wei X (2003) Improving one-class SVM for anomaly detection. In: International conference on machine learning and cybernetics, Xi\u2019an, China, 2\u20135 Nov 2003, vol 5, pp 3077\u20133081, vol 3075. doi: 10.1109\/ICMLC.2003.1260106","DOI":"10.1109\/ICMLC.2003.1260106"},{"issue":"1\u20132","key":"1027_CR149","doi-asserted-by":"crossref","first-page":"218","DOI":"10.1007\/BF03219975","volume":"61","author":"K Labib","year":"2006","unstructured":"Labib K, Vemuri VR (2006) An application of principal component analysis to the detection and visualization of computer network attacks. Annales des t\u00e9l\u00e9communications 61(1\u20132):218\u2013234","journal-title":"Annales des t\u00e9l\u00e9communications"},{"key":"1027_CR150","doi-asserted-by":"crossref","unstructured":"Lakhina A, Crovella M, Diot C (2005) Mining anomalies using traffic feature distributions. In: Proceedings of the conference on applications, technologies, architectures, and protocols for computer communications (SIGCOMM \u201905), Philadelphia, PA, USA, vol 35. ACM, pp 217\u2013228, vol 4","DOI":"10.1145\/1080091.1080118"},{"key":"1027_CR151","doi-asserted-by":"crossref","unstructured":"Lazarevic A, Ertoz L, Kumar V, Ozgur A, Srivastava J (2003) A Comparative study of anomaly detection schemes in network intrusion detection. In: Proceedings of the third SIAM international conference on data mining, San Francisco, CA, USA, vol 3, pp 25\u201336. Society for Industrial & Applied","DOI":"10.1137\/1.9781611972733.3"},{"issue":"4","key":"1027_CR152","doi-asserted-by":"crossref","first-page":"294","DOI":"10.1109\/3468.935046","volume":"31","author":"SC Lee","year":"2001","unstructured":"Lee SC, Heinbuch DV (2001) Training a neural-network based intrusion detector to recognize novel attacks. IEEE Trans Syst Man Cybern Syst Hum 31(4):294\u2013299","journal-title":"IEEE Trans Syst Man Cybern Syst Hum"},{"key":"1027_CR153","unstructured":"Lee W, Stolfo SJ (1998a) Data mining approaches for intrusion detection. In: Proceedings of the 7th conference on USENIX security symposium, San Antonio, Texas, pp 6\u201312. 1267555: USENIX Association"},{"key":"1027_CR154","unstructured":"Lee W, Stolfo SJ (1998b) Data mining approaches for intrusion detection. In: Usenix security"},{"issue":"4","key":"1027_CR155","doi-asserted-by":"crossref","first-page":"227","DOI":"10.1145\/382912.382914","volume":"3","author":"W Lee","year":"2000","unstructured":"Lee W, Stolfo SJ (2000) A framework for constructing features and models for intrusion detection systems. ACM Trans Inf Syst Secur (TISSEC) 3(4):227\u2013261","journal-title":"ACM Trans Inf Syst Secur (TISSEC)"},{"issue":"6","key":"1027_CR156","doi-asserted-by":"crossref","first-page":"533","DOI":"10.1023\/A:1006624031083","volume":"14","author":"W Lee","year":"2000","unstructured":"Lee W, Stolfo SJ, Mok KW (2000) Adaptive intrusion detection: a data mining approach. Artif Intell Rev 14(6):533\u2013567","journal-title":"Artif Intell Rev"},{"key":"1027_CR157","doi-asserted-by":"publisher","unstructured":"Lei JZ, Ghorbani A (2004) Network intrusion detection using an improved competitive learning neural network. In: Second annual conference on communication networks and services research, Fredericton, N.B., Canada, 19\u201321 May 2004, pp 190\u2013197. doi: 10.1109\/DNSR.2004.1344728","DOI":"10.1109\/DNSR.2004.1344728"},{"key":"1027_CR158","unstructured":"Leung K, Leckie C (2005) Unsupervised anomaly detection in network intrusion detection using clusters. In: Proceedings of the twenty-eighth Australasian conference on computer science, Newcastle, NSW, Australia. Australian Computer Society, Inc, pp 333\u2013342"},{"issue":"1","key":"1027_CR159","first-page":"799","volume":"6","author":"H Li","year":"2003","unstructured":"Li H, Guan XH, Zan X, Han CZ (2003) Network intrusion detection based on support vector machine. J Comput Res Dev 6(1):799\u2013807","journal-title":"J Comput Res Dev"},{"issue":"1","key":"1027_CR160","doi-asserted-by":"publisher","first-page":"112","DOI":"10.1016\/j.dss.2004.06.0l6","volume":"41","author":"X-B Li","year":"2005","unstructured":"Li X-B (2005) A scalable decision tree system and its application in pattern recognition and intrusion detection. Decis Support Syst 41(1):112\u2013130. doi: 10.1016\/j.dss.2004.06.0l6","journal-title":"Decis Support Syst"},{"key":"1027_CR161","doi-asserted-by":"publisher","unstructured":"Li Xy, Gao Gh, Sun Jx (2010) A new intrusion detection method based on improved DBSCAN. In: WASE international conference on information engineering (ICIE), Beidaihe, 14\u201315 Aug 2010, vol 2, pp 117\u2013120. doi: 10.1109\/ICIE.2010.123","DOI":"10.1109\/ICIE.2010.123"},{"key":"1027_CR162","doi-asserted-by":"publisher","unstructured":"Li Y, Fang B, Guo L, Chen Y (2007) Network anomaly detection based on TCM-KNN algorithm. In: Proceedings of the 2nd ACM symposium on information, computer and communications security, Singapore. 1229292: ACM, pp 13\u201319. doi: 10.1145\/1229285.1229292","DOI":"10.1145\/1229285.1229292"},{"issue":"7","key":"1027_CR163","doi-asserted-by":"crossref","first-page":"459","DOI":"10.1016\/j.cose.2007.10.002","volume":"26","author":"Y Li","year":"2007","unstructured":"Li Y, Guo L (2007) An active learning based TCM-KNN algorithm for supervised network intrusion detection. Comput Secur 26(7):459\u2013467","journal-title":"Comput Secur"},{"key":"1027_CR164","doi-asserted-by":"publisher","unstructured":"Liang Y, Wang HQ, Cai HB, He YJ (2008) A novel stochastic modeling method for network security situational awareness. In: 3rd IEEE conference on industrial electronics and applications (ICIEA\u201908), Singapore, 3\u20135 June 2008, pp 2422\u20132426. doi: 10.1109\/ICIEA.2008.4582951","DOI":"10.1109\/ICIEA.2008.4582951"},{"issue":"5","key":"1027_CR165","doi-asserted-by":"crossref","first-page":"439","DOI":"10.1016\/S0167-4048(02)00514-X","volume":"21","author":"Y Liao","year":"2002","unstructured":"Liao Y, Vemuri VR (2002) Use of K-nearest neighbor classifier for intrusion detection. Comput Secur 21(5):439\u2013448","journal-title":"Comput Secur"},{"key":"1027_CR166","doi-asserted-by":"crossref","unstructured":"Lichodzijewski P, Nur\u00a0Zincir-Heywood A, Heywood MI (2002) Host-based intrusion detection using self-organizing maps. In: Proceedings of the international joint conference on neural networks (IJCNN\u201902), Honolulu, Hawaii, vol 2. IEEE, pp 1714\u20131719","DOI":"10.1109\/IJCNN.2002.1007776"},{"issue":"2","key":"1027_CR167","doi-asserted-by":"crossref","first-page":"451","DOI":"10.1016\/S0031-3203(02)00060-2","volume":"36","author":"A Likas","year":"2003","unstructured":"Likas A, Vlassis N, Verbeek JJ (2003) The global k-means clustering algorithm. Pattern Recognit 36(2):451\u2013461","journal-title":"Pattern Recognit"},{"issue":"7\u20139","key":"1027_CR168","doi-asserted-by":"publisher","first-page":"1561","DOI":"10.1016\/j.neucom.2006.10.146","volume":"70","author":"G Liu","year":"2007","unstructured":"Liu G, Yi Z, Yang S (2007) A hierarchical intrusion detection model based on the PCA neural networks. Neurocomputing 70(7\u20139):1561\u20131568. doi: 10.1016\/j.neucom.2006.10.146","journal-title":"Neurocomputing"},{"key":"1027_CR169","doi-asserted-by":"crossref","unstructured":"Liu L, Liu Y (2009) MQPSO based on wavelet neural network for network anomaly detection. In: 5th international conference on wireless communications (WiCom\u201909), Bijing, China. IEEE, pp 1\u20135","DOI":"10.1109\/WICOM.2009.5302833"},{"key":"1027_CR170","doi-asserted-by":"crossref","unstructured":"Livnat Y, Agutter J, Moon S, Erbacher RF, Foresti S (2005) A visualization paradigm for network intrusion detection. In: Proceedings from the sixth annual IEEE SMC information assurance workshop. IEEE, pp 92\u201399","DOI":"10.1109\/IAW.2005.1495939"},{"key":"1027_CR171","doi-asserted-by":"publisher","unstructured":"Lizhong X, Zhiqing S, Gang L (2006) K-means algorithm based on particle swarm optimization algorithm for anomaly intrusion detection. In: The sixth world congress on intelligent control and automation (WCICA\u201906), Dalian, China, vol 2, pp 5854\u20135858. doi: 10.1109\/WCICA.2006.1714200","DOI":"10.1109\/WCICA.2006.1714200"},{"key":"1027_CR172","unstructured":"Lopes CT (2009) Context features and their use in information retrieval. Paper presented at the proceedings of the third BCS-IRSG conference on Future directions in information access, Padua, Italy"},{"key":"1027_CR173","doi-asserted-by":"publisher","unstructured":"Lu H, Chen J, Wei W (2008) Two stratum bayesian network based anomaly detection model for intrusion detection system. In: International symposium on electronic commerce and security, Guangzhou, China 3\u20135:482\u2013487. doi: 10.1109\/ISECS.2008.178","DOI":"10.1109\/ISECS.2008.178"},{"key":"1027_CR174","doi-asserted-by":"publisher","unstructured":"Lu N, Mabu S, Wang T, Hirasawa K (2012) Integrated fuzzy GNP rule mining with distance-based classification for intrusion detection system. In: IEEE international conference on systems, man, and cybernetics (SMC). Seoul, Korea, 14\u201317 Oct 2012, pp 1569\u20131574. doi: 10.1109\/ICSMC.2012.6377960","DOI":"10.1109\/ICSMC.2012.6377960"},{"issue":"8","key":"1027_CR175","doi-asserted-by":"crossref","first-page":"687","DOI":"10.1002\/1098-111X(200008)15:8<687::AID-INT1>3.0.CO;2-X","volume":"15","author":"J Luo","year":"2000","unstructured":"Luo J, Bridges SM (2000) Mining fuzzy association rules and fuzzy frequency episodes for intrusion detection. Int J Intell Syst 15(8):687\u2013703","journal-title":"Int J Intell Syst"},{"key":"1027_CR176","unstructured":"Mehdi MSZ, Bensebti AAaM (2007) A bayesian networks in intrusion detection systems. J Comput Sci 3(5):259\u2013265"},{"key":"1027_CR177","doi-asserted-by":"publisher","unstructured":"Ma J, Perkins S (2003) Time-series novelty detection using one-class support vector machines. In: Proceedings of the international joint conference on neural networks, Portland, 20\u201324 July 2003, vol 3, pp 1741\u20131745, vol 1743. doi: 10.1109\/IJCNN.2003.1223670","DOI":"10.1109\/IJCNN.2003.1223670"},{"key":"1027_CR178","doi-asserted-by":"publisher","unstructured":"Ma Y (2010) The intrusion detection system based on fuzzy association rules mining. In: 2nd international conference on computer engineering and technology (ICCET), Chengdu, China, 16\u201318 April 2010, vol 7, pp V7-667\u2013V667-672). doi: 10.1109\/iccet.2010.5485674","DOI":"10.1109\/iccet.2010.5485674"},{"key":"1027_CR179","doi-asserted-by":"crossref","unstructured":"Mahoney MV, Chan PK (2002) Learning nonstationary models of normal network traffic for detecting novel attacks. Paper presented at the proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, Edmonton, Alberta, Canada","DOI":"10.1145\/775047.775102"},{"key":"1027_CR180","doi-asserted-by":"publisher","unstructured":"Mamei M, Nagpal R (2007) Macro programming through Bayesian networks: distributed inference and anomaly detection. In: Fifth annual IEEE international conference on pervasive computing and communications (PerCom \u201907). White Plains, New York, USA, 19-23 March 2007, pp 87\u201396. doi: 10.1109\/PERCOM.2007.19","DOI":"10.1109\/PERCOM.2007.19"},{"issue":"4","key":"1027_CR181","doi-asserted-by":"crossref","first-page":"571","DOI":"10.1016\/S1389-1286(00)00138-9","volume":"34","author":"S Manganaris","year":"2000","unstructured":"Manganaris S, Christensen M, Zerkle D, Hermiz K (2000) A data mining analysis of RTID alarms. Comput Netw 34(4):571\u2013577","journal-title":"Comput Netw"},{"key":"1027_CR182","doi-asserted-by":"publisher","unstructured":"Martinez CA, Echeverri GI, Sanz AGC (2010) Malware detection based on cloud computing integrating intrusion ontology representation. In: IEEE Latin-American conference on communications (LATINCOM\u201910), Belem, Brazil, 15\u201317 Sept 2010, pp 1\u20136. doi: 10.1109\/LATINCOM.2010.5641013","DOI":"10.1109\/LATINCOM.2010.5641013"},{"key":"1027_CR183","doi-asserted-by":"publisher","unstructured":"Mathew S, Shah C, Upadhyaya S (2005) An alert fusion framework for situation awareness of coordinated multistage attacks. In: Third IEEE international workshop on information assurance, College Park, MD, USA, 23\u201324 March 2005, pp 95\u2013104. doi: 10.1109\/IWIA.2005.3","DOI":"10.1109\/IWIA.2005.3"},{"key":"1027_CR184","doi-asserted-by":"publisher","unstructured":"Meng J, Shang H, Bian L (2009) The application on intrusion detection based on K-means cluster algorithm. In: International forum on information technology and applications(IFITA \u201909), Chengdu, China, 15\u201317 May 2009, vol 1, pp 150\u2013152. doi: 10.1109\/IFITA.2009.34","DOI":"10.1109\/IFITA.2009.34"},{"issue":"1","key":"1027_CR185","first-page":"519","volume":"3","author":"M Middlemiss","year":"2003","unstructured":"Middlemiss M, Dick G (2003) Feature selection of intrusion detection data using a hybrid genetic algorithm\/KNN approach. Design Appl Hybrid Intell Syst 3(1):519\u2013527","journal-title":"Design Appl Hybrid Intell Syst"},{"key":"1027_CR186","doi-asserted-by":"publisher","unstructured":"Min L, Xiaohong L, Shouhe X (2008) An intrusion detection research based on spectral clustering. In: 4th international conference on wireless communications, networking and mobile computing (WiCOM \u201908), Dalian, China, 12\u201314 Oct 2008, pp 1\u20134. doi: 10.1109\/WiCom.2008.1100","DOI":"10.1109\/WiCom.2008.1100"},{"issue":"1","key":"1027_CR187","doi-asserted-by":"publisher","first-page":"226","DOI":"10.1016\/j.adhoc.2012.05.006","volume":"11","author":"A Mitrokotsa","year":"2013","unstructured":"Mitrokotsa A, Dimitrakakis C (2013) Intrusion detection in MANET using classification algorithms: the effects of cost and model selection. Ad Hoc Netw 11(1):226\u2013237. doi: 10.1016\/j.adhoc.2012.05.006","journal-title":"Ad Hoc Netw"},{"key":"1027_CR188","doi-asserted-by":"crossref","unstructured":"Mohajerani M, Moeini A, Kianie M (2003) NFIDS: a neuro-fuzzy intrusion detection system. In: 10th IEEE international conference on electronics, circuits and systems(ICECS\u201903), Sharjah, United Arab Emirates, vol 1. IEEE, pp 348\u2013351","DOI":"10.1109\/ICECS.2003.1302048"},{"key":"1027_CR189","doi-asserted-by":"crossref","unstructured":"Mora FJ, Macia F, Garcia JM, Ramos H (2006) Intrusion detection system based on growing grid neural network. In: IEEE Mediterranean electrotechnical conference(MELECON\u201906), Malaga, Spain. IEEE, pp 839\u2013842","DOI":"10.1109\/MELCON.2006.1653229"},{"key":"1027_CR190","doi-asserted-by":"crossref","unstructured":"Mukkamala S, Janoski G, Sung A (2002) Intrusion detection using neural networks and support vector machines. In: Proceedings of the international joint conference on neural networks( IJCNN\u201902), Honolulu, Hawaii, vol 2. IEEE, pp 1702\u20131707","DOI":"10.1109\/IJCNN.2002.1007774"},{"key":"1027_CR191","unstructured":"Mukkamala S, Sung AH (2002) Identifying key features for intrusion detection using neural networks. In: Proceedings of the 15th international conference on computer communication, Maharashtra, India. 838234: International Council for Computer Communication, pp 1132\u20131138"},{"issue":"2","key":"1027_CR192","doi-asserted-by":"publisher","first-page":"167","DOI":"10.1016\/j.jnca.2004.01.003","volume":"28","author":"S Mukkamala","year":"2005","unstructured":"Mukkamala S, Sung AH, Abraham A (2005) Intrusion detection using an ensemble of intelligent paradigms. J Netw Comput Appl 28(2):167\u2013182. doi: 10.1016\/j.jnca.2004.01.003","journal-title":"J Netw Comput Appl"},{"key":"1027_CR193","doi-asserted-by":"publisher","unstructured":"Mulay SA, Devale PR, Garje GV (2010) Decision tree based support vector machine for intrusion detection. In: International conference on networking and information technology (ICNIT), Manila, Philippines, 11\u201312 June 2010, pp 59\u201363. doi: 10.1109\/icnit.2010.5508557","DOI":"10.1109\/icnit.2010.5508557"},{"key":"1027_CR194","doi-asserted-by":"crossref","unstructured":"Muntean M, Valean H, Miclea L, Incze A (2010) A novel intrusion detection method based on support vector machines. In: 11th international symposium on computational intelligence and informatics (CINTI\u201911), Hungary. IEEE, pp 47\u201352","DOI":"10.1109\/CINTI.2010.5672276"},{"issue":"9","key":"1027_CR195","first-page":"48","volume":"3","author":"N Naveen","year":"2012","unstructured":"Naveen N (2012) Application of relevance vector machines in real time intrusion detection. Int J Adv Comput Sci Appl 3(9):48\u201353","journal-title":"Int J Adv Comput Sci Appl"},{"issue":"1","key":"1027_CR196","doi-asserted-by":"publisher","first-page":"312","DOI":"10.1016\/j.jnca.2010.07.014","volume":"34","author":"W Niu","year":"2011","unstructured":"Niu W, Li G, Zhao Z, Tang H, Shi Z (2011) Multi-granularity context model for dynamic Web service composition. J Netw Comput Appl 34(1):312\u2013326. doi: 10.1016\/j.jnca.2010.07.014","journal-title":"J Netw Comput Appl"},{"key":"1027_CR197","doi-asserted-by":"publisher","unstructured":"Noel S, Jajodia S (2005) Understanding complex network attack graphs through clustered adjacency matrices. In: 21st annual computer security applications conference, AZ, USA, 5\u20139 Dec 2005, pp 159\u2013169. doi: 10.1109\/CSAC.2005.58","DOI":"10.1109\/CSAC.2005.58"},{"key":"1027_CR198","doi-asserted-by":"publisher","unstructured":"Noel S, Robertson E, Jajodia S (2004) Correlating intrusion events and building attack scenarios through attack graph distances. In: 20th annual computer security applications conference, Tucson, AZ, USA, 2004, pp 350\u2013359. doi: 10.1109\/CSAC.2004.11","DOI":"10.1109\/CSAC.2004.11"},{"key":"1027_CR199","doi-asserted-by":"publisher","unstructured":"Noel S, Sushil J, O\u2019Berry B, Jacobs M (2003) Efficient minimum-cost network hardening via exploit dependency graphs. In: Proceedings 19th annual computer security applications conference, Orlando, FL USA, 8\u201312 Dec 2003, pp 86\u201395. doi: 10.1109\/CSAC.2003.1254313","DOI":"10.1109\/CSAC.2003.1254313"},{"issue":"1","key":"1027_CR200","doi-asserted-by":"publisher","first-page":"116","DOI":"10.1109\/TR.2004.823851","volume":"53","author":"Y Nong","year":"2004","unstructured":"Nong Y, Yebin Z, Borror CM (2004) Robustness of the Markov-Chain model for Cyber-Attack Detection. IEEE Trans Reliab 53(1):116\u2013123. doi: 10.1109\/TR.2004.823851","journal-title":"IEEE Trans Reliab"},{"key":"1027_CR201","doi-asserted-by":"publisher","unstructured":"Nwanze N, Summerville D (2008) Detection of anomalous network packets using lightweight stateless payload inspection. In: 33rd IEEE conference on local computer networks (LCN\u201908), Montreal, Que, 14\u201317 Oct 2008, pp 911\u2013918. doi: 10.1109\/LCN.2008.4664303","DOI":"10.1109\/LCN.2008.4664303"},{"key":"1027_CR202","doi-asserted-by":"publisher","unstructured":"Otey M, Parthasarathy S, Ghoting A, Li G, Narravula S, Panda D (2003) Towards NIC-based intrusion detection. In: Proceedings of the ninth ACM SIGKDD international conference on knowledge discovery and data mining, Washington, D.C. 956847: ACM, pp 723\u2013728. doi: 10.1145\/956750.956847","DOI":"10.1145\/956750.956847"},{"key":"1027_CR203","unstructured":"Pan ZS, Chen SC, Hu GB, Zhang DQ (2003) Hybrid neural network and C4. 5 for misuse detection. In: International conference on machine learning and cybernetics, Xi\u2019an, China, vol 4. IEEE, pp 2463\u20132467"},{"issue":"12","key":"1027_CR204","first-page":"259","volume":"7","author":"M Panda","year":"2007","unstructured":"Panda M, Patra MR (2007) Network intrusion detection using Na\u00efve Bayes. IJCSNS Int J Comput Sci Netw Secur 7(12):259\u2013263","journal-title":"IJCSNS Int J Comput Sci Netw Secur"},{"key":"1027_CR205","doi-asserted-by":"publisher","unstructured":"Patcha A, Park JM (2005) Detecting denial-of-service attacks with incomplete audit data. In: Proceedings of 14th international conference on computer communications and networks ( ICCCN\u201905), Washington, DC, USA, 17\u201319 Oct 2005, pp 263\u2013268. doi: 10.1109\/ICCCN.2005.1523864","DOI":"10.1109\/ICCCN.2005.1523864"},{"issue":"1","key":"1027_CR206","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1016\/j.jnca.2005.06.003","volume":"30","author":"S Peddabachigari","year":"2007","unstructured":"Peddabachigari S, Abraham A, Grosan C, Thomas J (2007) Modeling intrusion detection system using hybrid intelligent systems. J Netw Comput Appl 30(1):114\u2013132","journal-title":"J Netw Comput Appl"},{"key":"1027_CR207","first-page":"18","volume":"2","author":"S Peddabachigari","year":"2004","unstructured":"Peddabachigari S, Abraham A, Thomas J (2004) Intrusion detection systems using decision trees and support vector machines. Int J Appl Sci Comput 2:18\u2013134","journal-title":"Int J Appl Sci Comput"},{"key":"1027_CR208","doi-asserted-by":"publisher","unstructured":"Peng T, Chen X, Liu H, Chen K (2010) Data reduction for network forensics using manifold learning. In: 2nd international workshop on database technology and applications (DBTA), Wuhan, Hubei, China, 27\u201328 Nov 2010, pp 1\u20135. doi: 10.1109\/DBTA.2010.5659004","DOI":"10.1109\/DBTA.2010.5659004"},{"key":"1027_CR209","unstructured":"Pensa RG, Leschi C, Besson J, Boulicaut JF (2004) Assessment of discretization techniques for relevant pattern discovery from gene expression data. In: Proceedings of ACM BIOKDD, Seattle, Washington, USA, vol 4, pp 24\u201330"},{"issue":"1","key":"1027_CR210","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1145\/1007730.1007738","volume":"6","author":"C Phua","year":"2004","unstructured":"Phua C, Alahakoon D, Lee V (2004) Minority report in Fraud detection: classification of Skewed Data. ACM SIGKDD Explor Newsl 6(1):50\u201359","journal-title":"ACM SIGKDD Explor Newsl"},{"key":"1027_CR211","unstructured":"Portnoy L (2001) Intrusion detection with unlabeled data using clustering, Accessed (2001)"},{"key":"1027_CR212","unstructured":"Powell D, Stroud R (2001) Malicious-and accidental-fault tolerance for internet applications conceptual model and architecture. Accessed (2001)"},{"issue":"13","key":"1027_CR213","doi-asserted-by":"publisher","first-page":"663","DOI":"10.1049\/el:20020467","volume":"38","author":"Y Qiao","year":"2002","unstructured":"Qiao Y, Xin XW, Bin Y, Ge S (2002) Anomaly intrusion detection method based on HMM. Electron Lett 38(13):663\u2013664. doi: 10.1049\/el:20020467","journal-title":"Electron Lett"},{"key":"1027_CR214","volume-title":"Frequent episode rules for intrusive anomaly detection with internet datamining","author":"M Qin","year":"2004","unstructured":"Qin M, Hwang K (2004) Frequent episode rules for intrusive anomaly detection with internet datamining. In: USENIX security symposium, San Diego, CA"},{"key":"1027_CR215","unstructured":"Qin X (2005) A probabilistic-based framework for Infosec alert correlation, PhD thesis. Georgia Institute of Technology"},{"key":"1027_CR216","doi-asserted-by":"publisher","unstructured":"Qin X, Lee W (2004) Attack plan recognition and prediction using causal networks. In: 20th annual computer security applications conference, Tucson, AZ, USA, 6\u201310 Dec 2004, pp 370\u2013379. doi: 10.1109\/CSAC.2004.7","DOI":"10.1109\/CSAC.2004.7"},{"key":"1027_CR217","unstructured":"Qishi W, Ferebee D, Yunyue L, Dasgupta D (2009) An integrated cyber security monitoring system using correlation-based techniques. In: IEEE international conference on system of systems engineering, Albuquerque, NM, May 30 2009\u2013June 3 2009, pp 1\u20136"},{"key":"1027_CR218","unstructured":"Qiu H, Eklund N, Hu X, Yan W, Iyer N (2008) Anomaly detection using data clustering and neural networks. In: IEEE international joint conference on neural networks, Hong Kong, China. IEEE, pp 3627\u20133633"},{"key":"1027_CR219","doi-asserted-by":"crossref","unstructured":"Ranganathan A, Campbell RH (2003) A middleware for context-aware agents in ubiquitous computing environments. In: Proceedings of the ACM\/IFIP\/USENIX international conference on middleware, Rio de Janeiro, Brazil. 1515926: Springer, New York, pp 143\u2013161","DOI":"10.1007\/3-540-44892-6_8"},{"key":"1027_CR220","doi-asserted-by":"crossref","unstructured":"Reichle R, Wagner M, Khan MU, Geihs K, Lorenzo J, Valla M, et\u00a0al. (2008) A comprehensive context modeling framework for pervasive computing systems. In: Proceedings of the 8th IFIP WG 6.1 international conference on distributed applications and interoperable systems, Oslo, Norway. 1789105: Springer, pp 281\u2013295","DOI":"10.1007\/978-3-540-68642-2_23"},{"key":"1027_CR221","doi-asserted-by":"crossref","unstructured":"Ren P, Gao Y, Li Z, Chen Y, Watson B (2005) IDGraphs: intrusion detection and analysis using histographs. In: IEEE workshop on visualization for computer security, 2005 (VizSEC 05). IEEE, pp 39\u201346","DOI":"10.1109\/VIZSEC.2005.1532064"},{"key":"1027_CR222","doi-asserted-by":"publisher","unstructured":"Ritchey R, O\u2019Berry B, Noel S (2002) Representing TCP\/IP connectivity for topological analysis of network security. In: Proceedings of the 18th annual computer security applications conference, Las Vegas, Nevada, 2002, pp 25\u201331. doi: 10.1109\/CSAC.2002.1176275","DOI":"10.1109\/CSAC.2002.1176275"},{"key":"1027_CR223","unstructured":"Roesch M Snort intrusion detection system. http:\/\/www.snort.org . Accessed 22 Dec 2013"},{"key":"1027_CR224","doi-asserted-by":"publisher","unstructured":"Roschke S, Feng C, Meinel C (2010) Using vulnerability information and attack graphs for intrusion detection. In: Sixth international conference on information assurance and security (IAS), GA, USA, 23\u201325 Aug 2010, pp 68\u201373. doi: 10.1109\/ISIAS.2010.5604041","DOI":"10.1109\/ISIAS.2010.5604041"},{"key":"1027_CR225","doi-asserted-by":"crossref","unstructured":"Rui Z, Yongquan Y, Mingjun C (2009) An intrusion detection algorithm model based on extension clustering support vector machine. In: International conference on artificial intelligence and computational intelligence (AICI\u201909), Shanghai, China, vol 1. IEEE, pp 15\u201318","DOI":"10.1109\/AICI.2009.143"},{"key":"1027_CR226","unstructured":"Ryan J, Lin MJ, Miikkulainen R (1998) Intrusion detection with neural networks. In: Proceedings of advances in neural information processing systems, Denver, Colorado, USA. Morgan Kaufmann Publishers, pp 943\u2013949"},{"key":"1027_CR227","doi-asserted-by":"publisher","unstructured":"Saad S, Traore I (2010) Method ontology for intelligent network forensics analysis. In: Eighth annual international conference on privacy security and trust (PST\u201910), Ottawa, Ontario, Canada, 17\u201319 Aug 2010, pp 7\u201314. doi: 10.1109\/PST.2010.5593235","DOI":"10.1109\/PST.2010.5593235"},{"issue":"6\u20137","key":"1027_CR228","doi-asserted-by":"crossref","first-page":"505","DOI":"10.1080\/01969722.2013.803903","volume":"44","author":"R S\u00e1nchez","year":"2013","unstructured":"S\u00e1nchez R, Herrero \u00c1, Corchado E (2013) Visualization and clustering for SNMP intrusion detection. Cybern Syst 44(6\u20137):505\u2013532","journal-title":"Cybern Syst"},{"key":"1027_CR229","doi-asserted-by":"publisher","unstructured":"Sang-Hyun O, Jin-Suk K, Yung-Cheol B, Gyung-Leen P, Sang-Yong B (2005) Intrusion detection based on clustering a data stream. In: Third ACIS international conference on software engineering research, management and applications, Michigan, USA, 11\u201313 Aug 2005, pp 220\u2013227. doi: 10.1109\/SERA.2005.49","DOI":"10.1109\/SERA.2005.49"},{"key":"1027_CR230","doi-asserted-by":"publisher","unstructured":"Sang JH, Cho SB (2003) Combining multiple host-based detectors using decision tree. In: Gedeon T, Fung L (eds) Proceedings of 16th Australian conferenceon artificial intelligence, Perth, Australia, 2003\/01\/01 (vol 2903, Lecture Notes in Computer Science). Springer Berlin, pp 208\u2013220. doi: 10.1007\/978-3-540-24581-0_18","DOI":"10.1007\/978-3-540-24581-0_18"},{"issue":"2","key":"1027_CR231","doi-asserted-by":"publisher","first-page":"302","DOI":"10.1109\/TSMCB.2005.843274","volume":"35","author":"ST Sarasamma","year":"2005","unstructured":"Sarasamma ST, Zhu QA, Huff J (2005) Hierarchical Kohonenen net for anomaly detection in network security. IEEE Trans Syst Man Cybern B Cybern 35(2):302\u2013312. doi: 10.1109\/TSMCB.2005.843274","journal-title":"IEEE Trans Syst Man Cybern B Cybern"},{"issue":"7","key":"1027_CR232","doi-asserted-by":"publisher","first-page":"1443","DOI":"10.1162\/089976601750264965","volume":"13","author":"JC Sch\u00f6lkopflkopf Platt","year":"2001","unstructured":"Sch\u00f6lkopflkopf Platt JC, Shawe-Taylor JC, Smola AJ, Williamson RC (2001) Estimating the support of a high-dimensional distribution. Neural Comput 13(7):1443\u20131471. doi: 10.1162\/089976601750264965","journal-title":"Neural Comput"},{"issue":"1","key":"1027_CR233","doi-asserted-by":"publisher","first-page":"209","DOI":"10.1007\/s10844-011-0151-x","volume":"38","author":"C Schifanella","year":"2012","unstructured":"Schifanella C, Sapino ML, Sel K, Candan U (2012) On context-aware co-clustering with metadata support. J Intell Inf Syst 38(1):209\u2013239. doi: 10.1007\/s10844-011-0151-x","journal-title":"J Intell Inf Syst"},{"key":"1027_CR234","doi-asserted-by":"crossref","unstructured":"Schilit B, Adams N, Want R (1994) Context-aware computing applications. In:First workshop on mobile computing systems and applications (WMCSA\u201994). Santa Cruz, CA, USA. IEEE, pp 85\u201390","DOI":"10.1109\/WMCSA.1994.16"},{"issue":"6","key":"1027_CR235","doi-asserted-by":"publisher","first-page":"893","DOI":"10.1016\/S0097-8493(99)00120-X","volume":"23","author":"A Schmidt","year":"1999","unstructured":"Schmidt A, Beigl M, Gellersen H-W (1999) There is more to context than location. Comput Graph 23(6):893\u2013901. doi: 10.1016\/S0097-8493(99)00120-X","journal-title":"Comput Graph"},{"issue":"1","key":"1027_CR236","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1016\/S0167-9473(03)00177-4","volume":"45","author":"SL Scott","year":"2004","unstructured":"Scott SL (2004) A Bayesian paradigm for designing intrusion detection systems. Comput Stat Data Anal 45(1):69\u201383. doi: 10.1016\/S0167-9473(03)00177-4","journal-title":"Comput Stat Data Anal"},{"key":"1027_CR237","unstructured":"Sebyala AA, Olukemi T, Sacks L (2002) Active platform security through intrusion detection using Naive Bayesian network for anomaly detection. In: The London communications symposium. Citeseer, London"},{"key":"1027_CR238","doi-asserted-by":"publisher","unstructured":"Sekeh MA, bin\u00a0Maarof MA (2009) Fuzzy intrusion detection system via data mining technique with sequences of system calls. In: Fifth international conference on information assurance and security (IAS \u201909), Xi\u2019An, China, 18\u201320 Aug 2009, vol 1, pp 154\u2013157. doi: 10.1109\/IAS.2009.32","DOI":"10.1109\/IAS.2009.32"},{"key":"1027_CR239","doi-asserted-by":"publisher","unstructured":"Shah H, Undercoffer J, Joshi A (2003) Fuzzy clustering for intrusion detection. In: The 12th IEEE international conference on fuzzy systems (FUZZ \u201903), St Louis, MO, USA, 25\u201328 May 2003, vol 2, pp 1274\u20131278. doi: 10.1109\/FUZZ.2003.1206614","DOI":"10.1109\/FUZZ.2003.1206614"},{"key":"1027_CR240","unstructured":"Sharma SK, Pandey P, Tiwari SK, Sisodia MS (2012) An improved network intrusion detection technique based on K-means clustering via Naive Bayes classification. In: International conference on advances in engineering, science and management (ICAESM), EGS Pillay Engineering College, Nagapattinam, 30\u201331 March 2012, pp 417\u2013422"},{"key":"1027_CR241","unstructured":"Shaw DG (2011) Reducing false-positives and false-negatives in security event data using context. https:\/\/www.nasa.gov\/ppt\/583349main_2011_Present_NASA_IT_Summit_Shaw_Reducing_False_Positives_(2).ppt . Accessed 2011"},{"issue":"3","key":"1027_CR242","doi-asserted-by":"publisher","first-page":"345","DOI":"10.1109\/TKDE.2007.44","volume":"19","author":"RG Shekhar","year":"2007","unstructured":"Shekhar RG, Vir VP, Kiran SB (2007) K-Means+ID3: a novel method for supervised anomaly detection by Cascading K-Means clustering and ID3 decision tree learning methods. IEEE Trans Knowl Data Eng 19(3):345\u2013354. doi: 10.1109\/TKDE.2007.44","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"1027_CR243","doi-asserted-by":"publisher","first-page":"273","DOI":"10.1109\/SECPRI.2002.1004377","volume":"2002","author":"O Sheyner","year":"2002","unstructured":"Sheyner O, Haines J, Jha S, Lippmann R, Wing JM (2002) Automated Generation and Analysis of Attack Graphs. In: IEEE symposium on security and privacy, Oakland, California, USA 2002:273\u2013284. doi: 10.1109\/SECPRI.2002.1004377","journal-title":"In: IEEE symposium on security and privacy, Oakland, California, USA"},{"key":"1027_CR244","doi-asserted-by":"publisher","unstructured":"Shokri R, Oroumchian F, Yazdani N (2005) CLUSID: a clustering scheme for intrusion detection improved by information theory. In: 13th IEEE international conference on networks, 16\u201318 Nov 2005, pp 553\u2013558. doi: 10.1109\/ICON.2005.1635546","DOI":"10.1109\/ICON.2005.1635546"},{"issue":"18","key":"1027_CR245","doi-asserted-by":"crossref","first-page":"3799","DOI":"10.1016\/j.ins.2007.03.025","volume":"177","author":"T Shon","year":"2007","unstructured":"Shon T, Moon J (2007) A hybrid machine learning approach to network anomaly detection. Inf Sci 177(18):3799\u20133821","journal-title":"Inf Sci"},{"key":"1027_CR246","doi-asserted-by":"crossref","unstructured":"Shun J, Malki HA (2008) Network intrusion detection system using neural networks. In: Fourth international conference on natural computation (ICNC\u201908), Jinan, China, vol. 5. IEEE, pp 242\u2013246","DOI":"10.1109\/ICNC.2008.900"},{"key":"1027_CR247","unstructured":"Shyu ML, Chen SC, Sarinnapakorn K, Chang LW (2003) A novel anomaly detection scheme based on principal component classifier. In: Third IEEE international conference on data mining (ICDM\u201903), Melbourne, Florida, USA, pp 172\u2013179"},{"key":"1027_CR248","doi-asserted-by":"publisher","unstructured":"Sinclair C, Pierce L, Matzner S (1999) An application of machine learning to network intrusion detection. In: 15th annual computer security applications conference (ACSAC \u201999), Phoenix, AZ, USA, pp 371\u2013377. doi: 10.1109\/csac.1999.816048","DOI":"10.1109\/csac.1999.816048"},{"issue":"1","key":"1027_CR249","doi-asserted-by":"publisher","first-page":"129","DOI":"10.1016\/j.eswa.2011.06.013","volume":"39","author":"S Sindhu","year":"2012","unstructured":"Sindhu S, Geetha S, Kannan A (2012) Decision tree based light weight intrusion detection using a wrapper approach. Expert Syst Appl 39(1):129\u2013141. doi: 10.1016\/j.eswa.2011.06.013","journal-title":"Expert Syst Appl"},{"key":"1027_CR250","doi-asserted-by":"publisher","unstructured":"Siraj MM, Maarof MA, Hashim SZM (2009) Intelligent clustering with PCA and unsupervised learning algorithm in intrusion alert correlation. In: Fifth international conference on information assurance and security ( IAS \u201909), Xi\u2019an, China, 18\u201320 Aug 2009, vol 1, pp 679\u2013682. doi: 10.1109\/IAS.2009.261","DOI":"10.1109\/IAS.2009.261"},{"key":"1027_CR251","doi-asserted-by":"publisher","unstructured":"Song J, Takakura H, Kwon Y (2008) A generalized feature extraction scheme to detect 0-Day attacks via IDS alerts. In: Proceedings of the 2008 international symposium on applications and the internet, Urku, Finland, 1442004. IEEE Computer Society, pp 55\u201361. doi: 10.1109\/saint.2008.85","DOI":"10.1109\/saint.2008.85"},{"key":"1027_CR252","doi-asserted-by":"crossref","unstructured":"Song S, Ling L, Manikopoulo C (2006) Flow-based statistical aggregation schemes for network anomaly detection. In: Proceedings of the IEEE international conference on networking, sensing and control (ICNSC\u201906), Hainan, China. IEEE, pp 786\u2013791","DOI":"10.1109\/ICNSC.2006.1673246"},{"key":"1027_CR253","doi-asserted-by":"publisher","unstructured":"Song X, Wu M, Jermaine C, Ranka S (2007) Conditional anomaly detection. IEEE Trans Knowl Data Eng 19(5):631\u2013645. doi: 10.1109\/tkde.2007.1009","DOI":"10.1109\/tkde.2007.1009"},{"key":"1027_CR254","doi-asserted-by":"publisher","unstructured":"Sperotto A, Sadre R, Vliet F, Pras A (2009) A labeled data set for flow-based intrusion detection. In: Nunzi G, Scoglio C, Li X (eds) 9th IEEE international workshop on IP operations and management ((IPOM\u201909), Venice, Italy, 2009\/01\/01, vol 5843. Lecture Notes in Computer Science, pp 39\u201350. doi: 10.1007\/978-3-642-04968-2_4","DOI":"10.1007\/978-3-642-04968-2_4"},{"key":"1027_CR255","doi-asserted-by":"crossref","unstructured":"Sperotto A, Schaffrath G, Sadre R, Morariu C, Pras A, Stiller B An overview of IP flow-based intrusion detection. IEEE Commun Surv Tutor 12(3):343\u2013356","DOI":"10.1109\/SURV.2010.032210.00054"},{"issue":"3","key":"1027_CR256","doi-asserted-by":"publisher","first-page":"343","DOI":"10.1109\/SURV.2010.032210.00054","volume":"12","author":"A Sperotto","year":"2010","unstructured":"Sperotto A, Schaffrath G, Sadre R, Morariu C, Pras A, Stiller B (2010) An overview of IP flow-based intrusion detection. Commun Surv Tutor IEEE 12(3):343\u2013356. doi: 10.1109\/SURV.2010.032210.00054","journal-title":"Commun Surv Tutor IEEE"},{"key":"1027_CR257","doi-asserted-by":"crossref","unstructured":"Stein G, Chen B, Wu AS, Hua KA (2005) Decision tree classifier for network intrusion detection with GA-based feature selection. In: Proceedings of the 43rd annual Southeast Regional Conference, Kennesaw, GA, USA. ACM, pp 136\u2013141","DOI":"10.1145\/1167253.1167288"},{"issue":"1","key":"1027_CR258","first-page":"211","volume":"6","author":"I Steinwart","year":"2006","unstructured":"Steinwart I, Hush D, Scovel C (2006) A classification framework for anomaly detection. J Mach Learn Res 6(1):211\u2013232","journal-title":"J Mach Learn Res"},{"key":"1027_CR259","unstructured":"Tabia K, Benferhat S, Leray P, M\u00e9 L (2011) Alert correlation in intrusion detection: combining AI-based approaches for exploiting security operators\u2019 knowledge and preferences. In: Security and artificial intelligence (SecArt)"},{"issue":"4","key":"1027_CR260","doi-asserted-by":"crossref","first-page":"482","DOI":"10.1109\/TKDE.2006.1599387","volume":"18","author":"J-I Takeuchi","year":"2006","unstructured":"Takeuchi J-I, Yamanishi K (2006) A unifying framework for detecting outliers and change points from time series. IEEE Trans Knowl Data Eng 18(4):482\u2013492","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"1027_CR261","doi-asserted-by":"crossref","unstructured":"Tang P, Jiang R, Zhao M (2010) Feature selection and design of intrusion detection system based on K-means and triangle area support vector machine. In: Second international conference on future networks (ICFN\u201910), Hainan, China. IEEE, pp 144\u2013148","DOI":"10.1109\/ICFN.2010.42"},{"key":"1027_CR262","doi-asserted-by":"publisher","unstructured":"Tao L, Ai-ling Q, Yuan-bin H, Xin-tan C (2008a) Method for anomaly detection based on classifier with time function. In: IEEE international conference on industrial technology (ICIT\u201908). Chengdu, China, 21\u201324 April 2008, pp 1\u20134. doi: 10.1109\/ICIT.2008.4608512","DOI":"10.1109\/ICIT.2008.4608512"},{"key":"1027_CR263","doi-asserted-by":"publisher","unstructured":"Tao L, Ailing Q, Yuanbin H, Xintan C (2008b) Method for network anomaly detection based on bayesian statistical model with time slicing. In: 7th world congress on intelligent control and automation (WCICA\u201908), Chongqing, China, 25\u201327 June 2008, pp 3359\u20133362. doi: 10.1109\/WCICA.2008.4593458","DOI":"10.1109\/WCICA.2008.4593458"},{"key":"1027_CR264","doi-asserted-by":"publisher","unstructured":"Te-Shun C, Yen KK (2007) Fuzzy belief k-nearest neighbors anomaly detection of user to root and remote to local attacks. In: IEEE SMC information assurance and security workshop (IAW \u201907), West Point, New York, 20\u201322 June 2007, pp 207\u2013213. doi: 10.1109\/IAW.2007.381934","DOI":"10.1109\/IAW.2007.381934"},{"key":"1027_CR265","doi-asserted-by":"publisher","unstructured":"Te-Shun C, Yen KK, Pissinou N, Makki K (2007) Fuzzy belief reasoning for intrusion detection design. In: Third international conference on intelligent information hiding and multimedia signal processing ( IIHMSP\u201907), Kaohsiung, Taiwan, 26\u201328 Nov 2007, pp 621\u2013624. doi: 10.1109\/IIHMSP.2007.4457786","DOI":"10.1109\/IIHMSP.2007.4457786"},{"issue":"8","key":"1027_CR266","doi-asserted-by":"crossref","first-page":"2191","DOI":"10.1109\/TSP.2003.814797","volume":"51","author":"M Thottan","year":"2003","unstructured":"Thottan M, Ji C (2003) Anomaly detection in IP networks. IEEE Trans Signal Process 51(8):2191\u20132204","journal-title":"IEEE Trans Signal Process"},{"key":"1027_CR267","doi-asserted-by":"publisher","unstructured":"Tombini E, Debar H, Me L, Ducasse M (2004) A serial combination of anomaly and misuse IDSs applied to HTTP traffic. In: Proceedings of the 20th annual computer security applications conference, Tucson, Arizona, USA. 1038335: IEEE Computer Society, pp 428\u2013437. doi: 10.1109\/csac.2004.4","DOI":"10.1109\/csac.2004.4"},{"issue":"10","key":"1027_CR268","doi-asserted-by":"crossref","first-page":"11994","DOI":"10.1016\/j.eswa.2009.05.029","volume":"36","author":"CF Tsai","year":"2009","unstructured":"Tsai CF, Hsu YF, Lin CY, Lin WY (2009) Intrusion detection by machine learning: a review. Expert Syst Appl 36(10):11994\u201312000","journal-title":"Expert Syst Appl"},{"key":"1027_CR269","doi-asserted-by":"publisher","unstructured":"Tylman W (2008a) Anomaly-based intrusion detection using bayesian networks. In: Third international conference on dependability of computer systems (DepCos-RELCOMEX \u201908), Szklarska Poreba, Poland, 26\u201328 June 2008, pp 211\u2013218. doi: 10.1109\/DepCoS-RELCOMEX.2008.52","DOI":"10.1109\/DepCoS-RELCOMEX.2008.52"},{"key":"1027_CR270","doi-asserted-by":"crossref","unstructured":"Tylman W (2008b) Misuse-based intrusion detection using bayesian networks. In: International conference on dependability of computer systems, Zklarska Poreba, Poland, pp 203\u2013210","DOI":"10.1109\/DepCoS-RELCOMEX.2008.48"},{"key":"1027_CR271","doi-asserted-by":"publisher","unstructured":"Ukil A (2010) Application of Kolmogorov complexity in anomaly detection. In: 16th Asia-Pacific conference on communications (APCC), Auckland, New Zealand, Oct 31 2010\u2013Nov 3 2010, pp 141\u2013146. doi: 10.1109\/APCC.2010.5679753","DOI":"10.1109\/APCC.2010.5679753"},{"key":"1027_CR272","volume-title":"The nature of statistical learning theory","author":"V Vapnik","year":"1999","unstructured":"Vapnik V (1999) The nature of statistical learning theory, 2nd edn. Springer, New York","edition":"2"},{"issue":"4","key":"1027_CR273","doi-asserted-by":"crossref","first-page":"312","DOI":"10.1016\/j.inffus.2009.01.003","volume":"10","author":"J Viinikka","year":"2009","unstructured":"Viinikka J, Debar H, M\u00e9 L, Lehikoinen A, Tarvainen M (2009) Processing intrusion detection alert aggregates with time series modeling. Inf Fusion 10(4):312\u2013324","journal-title":"Inf Fusion"},{"key":"1027_CR274","doi-asserted-by":"publisher","unstructured":"Voelker GM, Bershad BN (1994) Mobisaic: an information system for a mobile wireless computing environment. In: Workshop on mobile computing systems and applications, California, USA, pp 185\u2013190. doi: 10.1109\/mcsa.1994.513481","DOI":"10.1109\/mcsa.1994.513481"},{"key":"1027_CR275","doi-asserted-by":"publisher","unstructured":"Vorobiev A, Jun H (2006) Security attack ontology for Web services. In: Second international conference on semantics, knowledge and grid (SKG \u201906), Guangxi, China, 1\u20133 Nov 2006, pp 42\u201348. doi: 10.1109\/SKG.2006.85","DOI":"10.1109\/SKG.2006.85"},{"key":"1027_CR276","doi-asserted-by":"crossref","unstructured":"Wagner D, Soto P (2002) Mimicry attacks on host-based intrusion detection systems. In: Proceedings of the 9th ACM conference on computer and communications security, Berlin, German. ACM, pp 255\u2013264","DOI":"10.1145\/586110.586145"},{"key":"1027_CR277","doi-asserted-by":"publisher","unstructured":"Wan L, Shengfeng T (2009) Preprocessor of intrusion alerts correlation based on ontology. In: WRI international conference on communications and mobile computing (CMC \u201909), Yunnan, China, 6\u20138 Jan 2009, pp 460\u2013464. doi: 10.1109\/CMC.2009.63","DOI":"10.1109\/CMC.2009.63"},{"issue":"9","key":"1027_CR278","doi-asserted-by":"publisher","first-page":"6225","DOI":"10.1016\/j.eswa.2010.02.102","volume":"37","author":"G Wang","year":"2010","unstructured":"Wang G, Hao J, Ma J, Huang L (2010) A new approach to intrusion detection using artificial neural networks and fuzzy clustering. Expert Syst Appl 37(9):6225\u20136232. doi: 10.1016\/j.eswa.2010.02.102","journal-title":"Expert Syst Appl"},{"key":"1027_CR279","doi-asserted-by":"crossref","unstructured":"Wang K, Stolfo S (2004) Anomalous payload-based network intrusion detection. In: Recent advances in intrusion detection, Sophia Antipolis, France. Springer, pp 203\u2013222","DOI":"10.1007\/978-3-540-30143-1_11"},{"key":"1027_CR280","doi-asserted-by":"crossref","unstructured":"Wang W, Battiti R (2006) Identifying intrusions in computer networks with principal component analysis. In: The first international conference on availability, reliability and security, Vienna, Austria. IEEE, pp 8\u201315","DOI":"10.1109\/ARES.2006.73"},{"key":"1027_CR281","doi-asserted-by":"crossref","unstructured":"Wang W, Guan X, Zhang X (2004) A novel intrusion detection method based on principle component analysis in computer security. In: IEEE international symposium on neural networks in computer security, Dalian, China. IEEE, pp 88\u201389","DOI":"10.1007\/978-3-540-28648-6_105"},{"key":"1027_CR282","doi-asserted-by":"publisher","unstructured":"Wang X, He F (2006) Improving intrusion detection performance using rough set theory and association rule mining. In: International conference on hybrid information technology (ICHIT \u201906), Jeju Island, Korea, 9\u201311 Nov. 2006, vol 2, pp 114\u2013119. doi: 10.1109\/ichit.2006.253599","DOI":"10.1109\/ichit.2006.253599"},{"key":"1027_CR283","doi-asserted-by":"publisher","unstructured":"Wei W, Daniels TE (2005) Building evidence graphs for network forensics analysis. In: 21st Annual computer security applications conference, AZ, USA, 5\u20139 Dec 2005, p 11, 266. doi: 10.1109\/CSAC.2005.14","DOI":"10.1109\/CSAC.2005.14"},{"issue":"1","key":"1027_CR284","doi-asserted-by":"crossref","first-page":"70","DOI":"10.1109\/COMST.2014.2336610","volume":"17","author":"DJ Weller-Fahy","year":"2015","unstructured":"Weller-Fahy DJ, Borghetti BJ, Sodemann AA (2015) A survey of distance and similarity measures used within network intrusion anomaly detection. IEEE Commun Surv Tutor 17(1):70\u201391","journal-title":"IEEE Commun Surv Tutor"},{"key":"1027_CR285","doi-asserted-by":"publisher","unstructured":"Wenge R, Kecheng L, Lin L (2008) Association rule based context modeling for web service discovery. In: 10th IEEE conference on e-commerce technology, Washington, DC, 21\u201324 July 2008, pp 299\u2013304. doi: 10.1109\/CECandEEE.2008.137","DOI":"10.1109\/CECandEEE.2008.137"},{"key":"1027_CR286","doi-asserted-by":"publisher","first-page":"120","DOI":"10.1109\/secpri.1999.766909","volume":"1999","author":"L Wenke","year":"1999","unstructured":"Wenke L, Stolfo SJ, Mok KW (1999) A data mining framework for building intrusion detection models. In: Proceedings of the IEEE symposium on security and privacy, Oakland, California 1999:120\u2013132. doi: 10.1109\/secpri.1999.766909","journal-title":"In: Proceedings of the IEEE symposium on security and privacy, Oakland, California"},{"key":"1027_CR287","doi-asserted-by":"publisher","unstructured":"Wentao F, Bouguila N, Ziou D (2011) Unsupervised anomaly intrusion detection via localized Bayesian feature selection. In: IEEE 11th international conference on data mining (ICDM\u201911), Vancouver, Canada, 11\u201314 Dec 2011, pp 1032\u20131037. doi: 10.1109\/ICDM.2011.152","DOI":"10.1109\/ICDM.2011.152"},{"key":"1027_CR288","doi-asserted-by":"crossref","unstructured":"White RW, Bailey P, Chen L (2009) Predicting user interests from contextual information. In: Proceedings of the 32nd international ACM SIGIR conference on research and development in information retrieval. ACM, pp 363\u2013370","DOI":"10.1145\/1571941.1572005"},{"key":"1027_CR289","doi-asserted-by":"crossref","unstructured":"Williams G, Baxter R, He H, Hawkins S, Gu L (2002) A comparative study of RNN for outlier detection in data mining. In: Proceedings of IEEE international conference on data mining (ICDM\u201902), Maebashi City, Japan. IEEE, pp 709\u2013712","DOI":"10.1109\/ICDM.2002.1184035"},{"key":"1027_CR290","doi-asserted-by":"crossref","unstructured":"Winter P, Hermann E, Zeilinger M (2011) Inductive intrusion detection in flow-based network data using one-class support vector machines. In: 4th IFIP international conference on new technologies, mobility and security (NTMS \u201911), Paris, France. IEEE, pp 1\u20135","DOI":"10.1109\/NTMS.2011.5720582"},{"key":"1027_CR291","doi-asserted-by":"crossref","unstructured":"Wu N, Zhang J (2003) Factor analysis based anomaly detection. In: IEEE systems, man and cybernetics society information assurance workshop, West Point, New York, USA. IEEE, pp 108\u2013115","DOI":"10.1109\/SMCSIA.2003.1232408"},{"key":"1027_CR292","doi-asserted-by":"publisher","unstructured":"Wuling R, Jinzhu C, Xianjie W (2009) Application of network intrusion detection based on fuzzy C-means clustering algorithm. In: Third international symposium on intelligent information technology application (IITA\u201909), Nanchang, China, 21\u201322 Nov 2009, vol 3, pp 19\u201322. doi: 10.1109\/IITA.2009.269","DOI":"10.1109\/IITA.2009.269"},{"key":"1027_CR293","doi-asserted-by":"crossref","unstructured":"Xiao L, Chen Y, Chang CK (2014) Bayesian model averaging of Bayesian network classifiers for intrusion detection. In: 9th IEEE international workshop on security, trust, and privacy for software applications\u201d, pp 21\u201315","DOI":"10.1109\/COMPSACW.2014.25"},{"key":"1027_CR294","doi-asserted-by":"publisher","unstructured":"Xiaolin W, Chou PA, Xiaohui X (2000) Minimum conditional entropy context quantization. In: IEEE international symposium on information theory, Sorrento, Italy, 2000, p 43. doi: 10.1109\/isit.2000.866333","DOI":"10.1109\/isit.2000.866333"},{"key":"1027_CR295","doi-asserted-by":"publisher","unstructured":"Xiaorong C, Shanshan W (2010) A real-time hybrid intrusion detection system based on principle component analysis and self organizing maps. In: Sixth international conference on natural computation (ICNC\u201910), Shandong, China, 10\u201312 Aug 2010, vol 3, pp 1182\u20131185. doi: 10.1109\/ICNC.2010.5583654","DOI":"10.1109\/ICNC.2010.5583654"},{"key":"1027_CR296","unstructured":"Xie P, Li JH, Ou X, Liu P, Levy R (2010) Using Bayesian networks for cyber security analysis. In: IEEE\/IFIP international conference on dependable systems and networks (DSN), Chicago, IL, pp 211\u2013220"},{"issue":"1","key":"1027_CR297","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1145\/333135.333138","volume":"18","author":"J Xu","year":"2000","unstructured":"Xu J, Croft WB (2000) Improving the effectiveness of information retrieval with local context analysis. ACM Trans Inf Syst (TOIS) 18(1):79\u2013112","journal-title":"ACM Trans Inf Syst (TOIS)"},{"issue":"1","key":"1027_CR298","doi-asserted-by":"crossref","first-page":"745","DOI":"10.1613\/jair.3050","volume":"39","author":"J Xu","year":"2010","unstructured":"Xu J, Shelton CR (2010) Intrusion detection using continuous time bayesian networks. J Artif Intell Res 39(1):745\u2013774","journal-title":"J Artif Intell Res"},{"key":"1027_CR299","doi-asserted-by":"publisher","unstructured":"Xuedou Y (2009) Research on active defence technology with host intrusion based on K-nearest neighbor algorithm of kernel. In: Fifth international conference on information assurance and security (IAS\u201909), Xi\u2019an, China, 18\u201320 Aug 2009, vol 1, pp 411\u2013414. doi: 10.1109\/IAS.2009.255","DOI":"10.1109\/IAS.2009.255"},{"key":"1027_CR300","doi-asserted-by":"publisher","unstructured":"Ye C, Wei N, Wang T, Zhang Q, Zhu X (2009a) The research on the application of association rules mining algorithm in network intrusion detection. In: First international workshop on education technology and computer science (ETCS \u201909), Wuhan, China, 7\u20138 March 2009, vol 2, pp 849\u2013852. doi: 10.1109\/etcs.2009.451","DOI":"10.1109\/etcs.2009.451"},{"key":"1027_CR301","doi-asserted-by":"publisher","unstructured":"Ye C, Zhang Q, Zhou J, Wei N, Zhu X, Wang T (2009b) Improvement of association rules mining algorithm in wireless network intrusion detection. In: International conference on computational intelligence and natural computing, Wuhan, China, 6\u20137 June 2009, vol 2, pp 413\u2013416. doi: 10.1109\/cinc.2009.19","DOI":"10.1109\/cinc.2009.19"},{"key":"1027_CR302","doi-asserted-by":"publisher","unstructured":"Ye D, Huiqiang W, Yonggang P (2004) A hidden markov models-based anomaly intrusion detection method. In: Fifth world congress on intelligent control and automation (WCICA\u201904), Hangzhou, China, 15\u201319 June 2004, vol 5, pp 4348\u20134351. doi: 10.1109\/WCICA.2004.1342334","DOI":"10.1109\/WCICA.2004.1342334"},{"key":"1027_CR303","doi-asserted-by":"publisher","unstructured":"Ye D, Tong W (2008) An anomaly intrusion detection method based on shell commands. In: IEEE international symposium on knowledge acquisition and modeling workshop(KAM\u201908), Wuhan, China, 21\u201322 Dec 2008, pp 798\u2013801. doi: 10.1109\/KAMW.2008.4810611","DOI":"10.1109\/KAMW.2008.4810611"},{"issue":"1","key":"1027_CR304","doi-asserted-by":"crossref","first-page":"229","DOI":"10.1016\/S0031-3203(02)00026-2","volume":"36","author":"DY Yeung","year":"2003","unstructured":"Yeung DY, Ding Y (2003) Host-based intrusion detection using dynamic and static behavioral models. Pattern Recognit 36(1):229\u2013243","journal-title":"Pattern Recognit"},{"key":"1027_CR305","doi-asserted-by":"publisher","unstructured":"Yoshida K (2003) Entropy based Intrusion Detection. In: IEEE Pacific RIM Conference on Communications, Computers and Signal Processing (PACRIM\u201903), Victoria, B.C., Canada, 28\u201330 Aug 2003, vol 2, pp 840\u2013843. doi: 10.1109\/PACRIM.2003.1235912","DOI":"10.1109\/PACRIM.2003.1235912"},{"key":"1027_CR306","unstructured":"Yu Y, Wei Y, Fu-Xiang G, Ge Y (2006) Anomaly Intrusion Detection Approach Using Hybrid MLP\/CNN Neural Network. In: Kong H (ed) Sixth international conference on intelligent systems design and applications (ISDA\u201906), Wroclaw, Poland. IEEE, pp 1095\u20131102"},{"key":"1027_CR307","doi-asserted-by":"publisher","unstructured":"Yun Y, Guyu H, Shize G, Jun L (2010) Imbalanced classification algorithm in Botnet detection. In: First international conference on pervasive computing signal processing and applications (PCSPA\u201910), Gj\u00f8vik, Norway, 17\u201319 Sept 2010, pp 116\u2013119. doi: 10.1109\/PCSPA.2010.37","DOI":"10.1109\/PCSPA.2010.37"},{"key":"1027_CR308","doi-asserted-by":"crossref","unstructured":"Zanero S, Savaresi SM (2004) Unsupervised learning techniques for an intrusion detection system. In: Proceedings of the 2004 ACM symposium on applied computing.ACM, pp 412\u2013419","DOI":"10.1145\/967900.967988"},{"key":"1027_CR309","doi-asserted-by":"crossref","unstructured":"Zhang J, Zulkernine M (2006) A hybrid network intrusion detection technique using random forests. In: The first international conference on availability, reliability and security (ARES\u201906), Vienna University of Technology, Austria. IEEE, pp 262\u2013269","DOI":"10.1109\/ARES.2006.7"},{"key":"1027_CR310","unstructured":"Zhang Z, Li J, Manikopoulos C, Jorgenson J, Ucles J (2001) HIDE: a hierarchical network intrusion detection system using statistical preprocessing and neural network classification. In: IEEE workshop on information assurance and security, West Point, NY, pp 85\u201390"},{"key":"1027_CR311","doi-asserted-by":"crossref","unstructured":"Zhang Z, Shen H (2004) Online training of SVMs for real-time intrusion detection. In: 18th international conference on advanced information networking and applications(AINA\u201904), Fukuoka, Japan, vol 1. IEEE, pp 568\u2013573","DOI":"10.1109\/AINA.2004.1283970"},{"issue":"12","key":"1027_CR312","doi-asserted-by":"crossref","first-page":"1428","DOI":"10.1016\/j.comcom.2005.01.014","volume":"28","author":"Z Zhang","year":"2005","unstructured":"Zhang Z, Shen H (2005) Application of online-training SVMs for real-time intrusion detection with different considerations. Comput Commun 28(12):1428\u20131442","journal-title":"Comput Commun"},{"key":"1027_CR313","doi-asserted-by":"crossref","unstructured":"Zhao W, Ma H, He Q (2009) Parallel k-means clustering based on mapreduce. In: IEEE international conference on cloud computing. Springer, pp 674\u2013679","DOI":"10.1007\/978-3-642-10665-1_71"},{"key":"1027_CR314","doi-asserted-by":"crossref","unstructured":"Zheng K, Qian X, Zhou Y, Jia L (2009) Intrusion detection using ISOMAP and support vector machine. In: International conference on artificial intelligence and computational intelligence (AICI\u201909), Shanghai, China, vol 3. IEEE, pp 235\u2013239","DOI":"10.1109\/AICI.2009.242"},{"key":"1027_CR315","doi-asserted-by":"crossref","unstructured":"Zhong LL, Ming ZY, Bin ZY (2010) Network intrusion detection method by least squares support vector machine classifier. In: 3rd IEEE international conference on computer science and information technology (ICCSIT\u201910), Beijing, China, vol 2. IEEE, pp 295\u2013297","DOI":"10.1109\/ICCSIT.2010.5564569"},{"key":"1027_CR316","doi-asserted-by":"crossref","unstructured":"Zhou H, Meng X, Zhang L (2007) Application of support vector machine and genetic algorithms to network intrusion detection. In: International conference on wireless communications, networking and mobile computing (WiCom 07), Shanghai, China. IEEE, pp 2267\u20132269","DOI":"10.1109\/WICOM.2007.565"},{"key":"1027_CR317","doi-asserted-by":"publisher","unstructured":"Zhou M, Huang H, Wang Q (2012) A graph-based clustering algorithm for anomaly intrusion detection. In: 7th international conference on computer science & education (ICCSE\u201912), Melbourne, Australia, 14\u201317 July 2012, pp 1311\u20131314. doi: 10.1109\/ICCSE.2012.6295306","DOI":"10.1109\/ICCSE.2012.6295306"},{"key":"1027_CR318","doi-asserted-by":"crossref","unstructured":"Zimmermann A, Lorenz A, Oppermann R (2007) An operational definition of context. In: Proceedings of the 6th international and interdisciplinary conference on modeling and using context (Context\u201907), Roskilde University, Denmark, pp 558\u2013571","DOI":"10.1007\/978-3-540-74255-5_42"}],"container-title":["Knowledge and Information Systems"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10115-017-1027-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10115-017-1027-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10115-017-1027-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,24]],"date-time":"2022-07-24T10:45:20Z","timestamp":1658659520000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10115-017-1027-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,2,17]]},"references-count":318,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2017,9]]}},"alternative-id":["1027"],"URL":"https:\/\/doi.org\/10.1007\/s10115-017-1027-3","relation":{},"ISSN":["0219-1377","0219-3116"],"issn-type":[{"value":"0219-1377","type":"print"},{"value":"0219-3116","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,2,17]]}}}