{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,29]],"date-time":"2025-10-29T18:37:27Z","timestamp":1761763047484,"version":"3.41.0"},"reference-count":24,"publisher":"Springer Science and Business Media LLC","issue":"S1","license":[{"start":{"date-parts":[[2017,11,8]],"date-time":"2017-11-08T00:00:00Z","timestamp":1510099200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cluster Comput"],"published-print":{"date-parts":[[2019,1]]},"DOI":"10.1007\/s10586-017-1317-2","type":"journal-article","created":{"date-parts":[[2017,11,8]],"date-time":"2017-11-08T06:16:28Z","timestamp":1510121788000},"page":"1861-1872","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Visualization of security event logs across multiple networks and its application to a CSOC"],"prefix":"10.1007","volume":"22","author":[{"given":"Boyeon","family":"Song","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jangwon","family":"Choi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sang-Soo","family":"Choi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6071-2013","authenticated-orcid":false,"given":"Jungsuk","family":"Song","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2017,11,8]]},"reference":[{"key":"1317_CR1","doi-asserted-by":"crossref","unstructured":"Abdullah, K., Lee, C., Conti, G., Copeland, J.A., Stasko, J.: IDS RainStorm: visualizing IDS alarms. In: IEEE Workshops on Visualization for Computer Security (VizSEC \u201905), pp. 1\u201310. IEEE Computer Society, Washington, DC (2005)","DOI":"10.1109\/VIZSEC.2005.1532060"},{"key":"1317_CR2","doi-asserted-by":"crossref","unstructured":"Bertini, E., Hertzog, P., Lalanne, D.: SpiralView: towards security policies assessment through visual correlation of network resources with evolution of alarms. In: IEEE Symposium on Visual Analytics Science and Technology (VAST \u201907), pp. 139\u2013146. IEEE Computer Society, Washington, DC (2007)","DOI":"10.1109\/VAST.2007.4389007"},{"key":"1317_CR3","doi-asserted-by":"crossref","unstructured":"Blue, R., Dunne, C., Fuchs, A., King, K., Schulman, A.: Visualizing real-time network resource usage. In: Goodall, J.R., Conti, G., Ma, K.L. (eds.) Visualization for Computer Security: 5th International Workshop, VizSec 2008, pp. 119\u2013135. Springer, Berlin (2008)","DOI":"10.1007\/978-3-540-85933-8_12"},{"key":"1317_CR4","doi-asserted-by":"crossref","unstructured":"Boschetti, A., Salgarelli, L., Muelder, C., Ma, K.L.: TVi: A visual querying system for network monitoring and anomaly detection. In: Proceedings of the 8th International Symposium on Visualization for Cyber Security (VizSec \u201911), pp. 1\u201310. ACM, New York (2011)","DOI":"10.1145\/2016904.2016905"},{"key":"1317_CR5","unstructured":"Bruneau, G.: DNS Sinkhole. Reading Room Site. The SANS Institute (2010)"},{"key":"1317_CR6","doi-asserted-by":"crossref","unstructured":"Foresti, S., Agutter, J.: VisAlert: from idea to product. In: Goodall, J.R., Conti, G., Ma, K.L. (eds.) VizSEC 2007: Proceedings of the Workshop on Visualization for Computer Security, pp. 159\u2013174. Springer, Berlin (2008)","DOI":"10.1007\/978-3-540-78243-8_11"},{"key":"1317_CR7","doi-asserted-by":"crossref","unstructured":"Gobel, J., Dewald, A.: Client-Honeypots: Exploring Malicious Websites. R Oldenbourg Verlag GmbH (2011)","DOI":"10.1524\/9783486711516"},{"key":"1317_CR8","doi-asserted-by":"crossref","unstructured":"Inoue, D., Eto, M., Yoshioka, K., Baba, S., Suzuki, K., Nakazato, J., Ohtaka, K., Nakao, K.: nicter: an incident analysis system toward binding network monitoring with malware analysis. In: Information Security Threats Data Collection and Sharing, pp. 58\u201366 (2008)","DOI":"10.1109\/WISTDCS.2008.14"},{"key":"1317_CR9","doi-asserted-by":"crossref","unstructured":"Koike, H., Ohno, K.: SnortView: visualization system of snort logs. In: ACM Workshop on Visualization and Data Mining for Computer Security (VizSEC\/DMSEC \u201904), pp. 143\u2013147. ACM, New York (2004)","DOI":"10.1145\/1029208.1029232"},{"issue":"6","key":"1317_CR10","doi-asserted-by":"publisher","first-page":"25","DOI":"10.1145\/990680.990699","volume":"47","author":"S Lau","year":"2004","unstructured":"Lau, S.: The spinning cube of potential doom. Commun. ACM 47(6), 25\u201326 (2004)","journal-title":"Commun. ACM"},{"key":"1317_CR11","doi-asserted-by":"crossref","unstructured":"McPherson, J., Ma, K.L., Krystosk, P., Bartoletti, T., Christensen, M.: Portvis: a tool for port-based detection of security events. In: ACM Workshop on Visualization and Data Mining for Computer Security (VizSEC\/DMSEC \u201904), pp. 73\u201381. ACM, New York (2004)","DOI":"10.1145\/1029208.1029220"},{"key":"1317_CR12","unstructured":"Moore, D., Shannon, C., Brown, D.J., Voelker, G.M., Savage, S.: Network telescopes: Technical report. Cooperative Association for Internet Data Analysis (CAIDA) (2004)"},{"key":"1317_CR13","unstructured":"Moore, D.: Network telescopes observing small or distant security events. In: 11th USENIX Security Symposium, Invited Talk (2003)"},{"key":"1317_CR14","doi-asserted-by":"crossref","unstructured":"Nunnally, T., Chi, P., Abdullah, K., Uluagac, A.S., Copeland, J.A., Beyah, R.: P3D: A parallel 3d coordinate visualization for advanced network scans. In: 2013 IEEE International Conference on Communications (ICC), pp. 2052\u20132057 (2013)","DOI":"10.1109\/ICC.2013.6654828"},{"key":"1317_CR15","doi-asserted-by":"crossref","unstructured":"Onwubiko, C.: Cyber security operations centre: security monitoring for protecting business and supporting cyber defense strategy. In: 2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), pp. 1\u201310 (2015)","DOI":"10.1109\/CyberSA.2015.7166125"},{"issue":"23\u201324","key":"1317_CR16","first-page":"2435","volume":"31","author":"V Paxson","year":"1999","unstructured":"Paxson, V.: Bro: a system for detecting network intruders in real-time. Comput. Netw. Int. J. Comput. Telecommun. Netw. 31(23\u201324), 2435\u20132463 (1999)","journal-title":"Comput. Netw. Int. J. Comput. Telecommun. Netw."},{"key":"1317_CR17","unstructured":"Schneier, B.: Honeypots and the Honeynet Project (2001). Available at http:\/\/www.cs.rochester.edu\/~brown\/Crypto\/news\/3.txt"},{"key":"1317_CR18","unstructured":"Shiravi, H., Shiravi, A., Ghorbani, A.A.: IDS alert visualization and monitoring through heuristic host selection. In: Soriano, M., Qing, S., L\u00f3pez, J. (eds.) Information and Communications Security: 12th International Conference, ICICS 2010, Barcelona, Spain, December 15\u201317, 2010. Proceedings, pp. 445\u2013458. Springer, Berlin (2010)"},{"issue":"8","key":"1317_CR19","doi-asserted-by":"publisher","first-page":"1313","DOI":"10.1109\/TVCG.2011.144","volume":"18","author":"H Shiravi","year":"2012","unstructured":"Shiravi, H., Shiravi, A., Ghorbani, A.A.: A survey of visualization systems for network security. IEEE Trans. Vis. Comput. Gr. 18(8), 1313\u20131329 (2012)","journal-title":"IEEE Trans. Vis. Comput. Gr."},{"key":"1317_CR20","doi-asserted-by":"crossref","unstructured":"Song, B., Choi, S.S., Choi, J., Song, J.: Visualization of intrusion detection alarms collected from multiple networks. In: Nguyen, P.Q., Zhou, J. (eds.) Information Security\u201420th International Conference, ISC 2017, Security and Cryptology, vol. 10599. Springer International Publishing (2017)","DOI":"10.1007\/978-3-319-69659-1_24"},{"key":"1317_CR21","unstructured":"Spitzner, L.: Honeypots: catching the insider threat. In: 19th Computer Security Applications Conference, pp. 170\u2013179. IEEE (2003)"},{"key":"1317_CR22","unstructured":"Suzuki, K.: Studies on network monitoring systems to reveal suspicious activities. Ph.D. thesis, Graduate School of Informatics, Kyoto University (2011)"},{"key":"1317_CR23","doi-asserted-by":"crossref","unstructured":"Taylor, T., Brooks, S., McHugh, J.: NetBytes Viewer: an entity-based netflow visualization utility for identifying intrusive behavior. In: Goodall, J.R., Conti, G., Ma, K.L. (eds.) VizSEC 2007: Proceedings of the Workshop on Visualization for Computer Security, pp. 101\u2013114. Springer, Berlin (2007)","DOI":"10.1007\/978-3-540-78243-8_7"},{"key":"1317_CR24","unstructured":"Zimmerman, C.: Ten Strategies of a World-Class Cybersecurity Operations Center. MITRE Corporation (2014)"}],"container-title":["Cluster Computing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10586-017-1317-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10586-017-1317-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10586-017-1317-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,26]],"date-time":"2025-06-26T22:35:14Z","timestamp":1750977314000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10586-017-1317-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,11,8]]},"references-count":24,"journal-issue":{"issue":"S1","published-print":{"date-parts":[[2019,1]]}},"alternative-id":["1317"],"URL":"https:\/\/doi.org\/10.1007\/s10586-017-1317-2","relation":{},"ISSN":["1386-7857","1573-7543"],"issn-type":[{"type":"print","value":"1386-7857"},{"type":"electronic","value":"1573-7543"}],"subject":[],"published":{"date-parts":[[2017,11,8]]},"assertion":[{"value":"12 August 2017","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 October 2017","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"31 October 2017","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 November 2017","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}