{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T12:35:29Z","timestamp":1740141329977,"version":"3.37.3"},"reference-count":44,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2020,11,5]],"date-time":"2020-11-05T00:00:00Z","timestamp":1604534400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,11,5]],"date-time":"2020-11-05T00:00:00Z","timestamp":1604534400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Comput Math Organ Theory"],"published-print":{"date-parts":[[2021,6]]},"DOI":"10.1007\/s10588-020-09320-x","type":"journal-article","created":{"date-parts":[[2020,11,5]],"date-time":"2020-11-05T17:03:06Z","timestamp":1604595786000},"page":"161-178","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Detecting botnet signals using process mining"],"prefix":"10.1007","volume":"27","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2275-4957","authenticated-orcid":false,"given":"John W.","family":"Bicknell","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Werner G.","family":"Krebs","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2020,11,5]]},"reference":[{"key":"9320_CR1","unstructured":"Aalst Wvd (2016) Process mining: data science in action, 2nd edn. Springer-Verlag, Berlin Heidelberg. https:\/\/www.springer.com\/gp\/book\/9783662498507"},{"key":"9320_CR2","unstructured":"Alexander L (2015) Social network analysis reveals full scale of Kremlin\u2019s twitter bot campaign. Global voices. https:\/\/globalvoices.org\/2015\/04\/02\/analyzing-kremlin-twitter-bots\/"},{"key":"9320_CR3","doi-asserted-by":"crossref","unstructured":"Alfifi M, Kaghazgaran P, Caverlee J, Morstatter F (2019) A large-scale study of ISIS social media strategy: community size, collective influence, and behavioral impact. In: Proceedings of the international AAAI conference on web and social media 13:58\u201367. https:\/\/www.aaai.org\/ojs\/index.php\/ICWSM\/article\/view\/3209","DOI":"10.1609\/icwsm.v13i01.3209"},{"key":"9320_CR4","unstructured":"Anonymous CHR (2019) Cyber endeavour conference with non-attributional Chatham House rules"},{"key":"9320_CR5","unstructured":"BBC (2018) Targeted pro-Brexit Facebook ads revealed. https:\/\/www.bbc.com\/news\/uk-politics-44966969"},{"key":"9320_CR6","unstructured":"Beskow D, Carley K (2019a) Army must regain initiative in social cyberwar. https:\/\/www.ausa.org\/articles\/army-must-regain-initiative-social-cyberwar"},{"key":"9320_CR7","unstructured":"Beskow D, Carley K (2019b) Social cybersecurity an emerging national security requirement. https:\/\/www.armyupress.army.mil\/Journals\/Military-Review\/English-Edition-Archives\/Mar-Apr-2019\/117-Cybersecurity\/"},{"key":"9320_CR8","doi-asserted-by":"publisher","DOI":"10.1287\/orms.2019.05.01","author":"JW Bicknell","year":"2019","unstructured":"Bicknell JW (2019) Process mining technologies. ORMS Today. https:\/\/doi.org\/10.1287\/orms.2019.05.01","journal-title":"ORMS Today"},{"key":"9320_CR9","doi-asserted-by":"publisher","unstructured":"Bicknell JW, Krebs WG (2019a) FOCAL information warfare defense standard. ResearchGate. https:\/\/doi.org\/10.13140\/RG.2.2.12672.07687. https:\/\/www.researchgate.net\/publication\/333774135_FOCAL_Information_Warfare_Defense_Standard_TM","DOI":"10.13140\/RG.2.2.12672.07687"},{"key":"9320_CR10","unstructured":"WG (2019b) Methods and systems for estimating process capacity. U.S. Patent Application No. 16\/402,071. Washington, DC, U.S. Patent and Trademark Office"},{"key":"9320_CR11","unstructured":"Bicknell JW, Krebs WG (2019c) Methods and systems for inferring behavior and vulnerabilities from process models. U.S. Patent Application No. 16\/440,639. Washington, DC, U.S. Patent and Trademark Office"},{"key":"9320_CR13","doi-asserted-by":"publisher","DOI":"10.13140\/RG.2.2.23584.94722\/1","author":"JW Bicknell","year":"2019","unstructured":"Bicknell JW, Krebs WG (2019d) Process mining: the missing piece in information warfare. ResearchGate. https:\/\/doi.org\/10.13140\/RG.2.2.23584.94722\/1","journal-title":"ResearchGate"},{"key":"9320_CR12","unstructured":"Bicknell JW, Krebs WG (in press) Process mining organization email data and national security implications. Unifying themes in complex systems X: In: Proceedings of the tenth international conference on complex systems. Springer Proceedings in Complexity. Springer"},{"key":"9320_CR14","unstructured":"Bott G (2000) Scorched Earth: Propaganda. https:\/\/www.amazon.com\/Scorched-Earth-Propaganda-Unavailable\/dp\/B01DEFZUMA"},{"key":"9320_CR15","doi-asserted-by":"crossref","unstructured":"Chotikul D (1986) The Soviet theory of reflexive control in historical and psychocultural perspective: preliminary study. PhD thesis, Naval Postgraduate School, Monterey, California. http:\/\/nsarchive.gwu.edu\/dc.html?doc=3901091-Diane-Chotikul-The-Soviet-Theory-of-Reflexive","DOI":"10.21236\/ADA170613"},{"key":"9320_CR16","unstructured":"Contributors W (2019a) Attribution (marketing). https:\/\/en.wikipedia.org\/w\/index.php?title=Attribution_(marketing)&oldid=894868564, page Version ID: 894868564"},{"key":"9320_CR17","unstructured":"Contributors W (2019b) PyPy. https:\/\/en.wikipedia.org\/w\/index.php?title=PyPy&oldid=928795613, page Version ID: 928795613"},{"key":"9320_CR18","unstructured":"DoD (2019) Early detection of information campaigns by adversarial state and non-state actors. https:\/\/www.sbir.gov\/sbirsearch\/detail\/1606357"},{"key":"9320_CR19","volume-title":"I seem to be a verb: environment and man\u2019s future","author":"RB Fuller","year":"1970","unstructured":"Fuller RB (1970) I seem to be a verb: environment and man\u2019s future, 1st edn. Bantam Books, New York","edition":"1"},{"key":"9320_CR20","unstructured":"Giles K (2019) \u201cHybrid Threats\u201d: what can we learn from Russia? https:\/\/www.baks.bund.de\/en\/working-papers\/2019\/hybrid-threats-what-can-we-learn-from-russia"},{"key":"9320_CR21","volume-title":"Market response models: econometric and time series analysis","author":"DM Hanssens","year":"2003","unstructured":"Hanssens DM, Parsons LJ, Schultz RL (2003) Market response models: econometric and time series analysis, 2nd edn. Springer, Boston, MA","edition":"2"},{"key":"9320_CR22","volume-title":"Why information grows: the evolution of order, from atoms to economies","author":"C Hidalgo","year":"2015","unstructured":"Hidalgo C (2015) Why information grows: the evolution of order, from atoms to economies. Basic Books, New York"},{"key":"9320_CR23","unstructured":"Huang E (2019) Why China isn\u2019t as skillful at disinformation as Russia. https:\/\/qz.com\/1699144\/why-chinas-social-media-propaganda-isnt-as-good-as-russias\/"},{"key":"9320_CR24","unstructured":"HyperspaceChallenge (2019) Large data aggregation from small satellites to determine patterns of life modifications. https:\/\/hyperspacechallenge.com\/large-data-aggregation-from-small-satellites-to-determine-pattern-of-life-modifications\/"},{"key":"9320_CR25","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/IEEESTD.2016.7740858","volume":"1849\u20132016","author":"IEEE","year":"2016","unstructured":"IEEE (2016) IEEE standard for eXtensible event stream (XES) for achieving interoperability in event logs and event streams. IEEE Std 1849\u20132016:1\u201350. https:\/\/doi.org\/10.1109\/IEEESTD.2016.7740858","journal-title":"IEEE Std"},{"key":"9320_CR26","unstructured":"Iyengar R (2018) WhatsApp has been linked to lynchings in India. Facebook is trying to contain the crisis. https:\/\/www.cnn.com\/2018\/09\/30\/tech\/facebook-whatsapp-india-misinformation\/index.html"},{"key":"9320_CR27","first-page":"81","volume-title":"Protecting the Australian homeland","author":"C Kopp","year":"2005","unstructured":"Kopp C (2005) Classical deception techniques and perception management vs. the four strategies of information warfare. In: Pye G, Warren M (eds) Protecting the Australian homeland. School of Information Systems, Deakin University, Geelong, VIC, pp 81\u201389"},{"key":"9320_CR28","unstructured":"MacFarquhar N (2018) Inside the Russian Troll Factory: Zombies and a Breakneck Pace. The New York Times https:\/\/www.nytimes.com\/2018\/02\/18\/world\/europe\/russia-troll-factory.html"},{"key":"9320_CR29","unstructured":"McLaughlin T (2018) How Facebook\u2019s Rise Fueled Chaos and Confusion in Myanmar. Wired. https:\/\/www.wired.com\/story\/how-facebooks-rise-fueled-chaos-and-confusion-in-myanmar\/"},{"key":"9320_CR30","unstructured":"Mueller RS (2019) Report On The Investigation Into Russian Interference In The 2016 Presidential Election. Tech. rep., U.S. Department of Justice. https:\/\/www.hsdl.org\/?abstract&did=824221"},{"key":"9320_CR31","doi-asserted-by":"publisher","DOI":"10.1201\/b16625","volume-title":"Reflexion and control: mathematical models","author":"DA Novikov","year":"2014","unstructured":"Novikov DA, Chkhartishvili AG (2014) Reflexion and control: mathematical models. CRC Press, Boca Raton. https:\/\/doi.org\/10.1201\/b16625"},{"key":"9320_CR32","doi-asserted-by":"crossref","unstructured":"Paul C, Matthews M (2016) The Russian \u201cFirehose of Falsehood\u201d Propaganda Model: Why It Might Work and Options to Counter It. Tech. rep., RAND Corporation, Santa Monica, CA, https:\/\/www.rand.org\/pubs\/perspectives\/PE198.html","DOI":"10.7249\/PE198"},{"issue":"11","key":"9320_CR33","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1063\/1.3071090","volume":"25","author":"I Prigogine","year":"1972","unstructured":"Prigogine I, Nicolis G, Babloyantz A (1972) Thermodynamics of evolution. Physics Today 25(11):23\u201328. https:\/\/doi.org\/10.1063\/1.3071090","journal-title":"Physics Today"},{"key":"9320_CR34","unstructured":"Seddon M (2014) Documents Show How Russia\u2019s Troll Army Hit America. https:\/\/www.buzzfeednews.com\/article\/maxseddon\/documents-show-how-russias-troll-army-hit-america"},{"key":"9320_CR35","unstructured":"Singer PW, Brooking ET (2018) LikeWar: The Weaponization of Social Media. Eamon Dolan\/Houghton Mifflin Harcourt"},{"issue":"1","key":"9320_CR36","doi-asserted-by":"publisher","first-page":"149","DOI":"10.1080\/0022250X.1996.9990178","volume":"21","author":"TAB Snijders","year":"1996","unstructured":"Snijders TAB (1996) Stochastic actor-oriented models for network change. J Math Sociol 21(1):149\u2013172. https:\/\/doi.org\/10.1080\/0022250X.1996.9990178","journal-title":"J Math Sociol"},{"issue":"1","key":"9320_CR37","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1016\/j.socnet.2009.02.004","volume":"32","author":"TAB Snijders","year":"2010","unstructured":"Snijders TAB, van de Bunt GG, Steglich CEG (2010) Introduction to stochastic actor-based models for network dynamics. Soc Netw 32(1):44\u201360. https:\/\/doi.org\/10.1016\/j.socnet.2009.02.004","journal-title":"Soc Netw"},{"key":"9320_CR38","unstructured":"Soshnikov A (2015) The capital of political trolling. https:\/\/mr-7.ru\/articles\/112478\/"},{"key":"9320_CR39","unstructured":"Spruds A (2015) Internet Trolling as a hybrid warfare tool: the case of Latvia. Tech. rep., NATO Strategic Communications Center of Excellence, Riga, Latvia. https:\/\/www.stratcomcoe.org\/internet-trolling-hybrid-warfare-tool-case-latvia-0"},{"key":"9320_CR40","unstructured":"Sviridova A (2019) Vectors of the development of military strategy. Red Star. http:\/\/redstar.ru\/vektory-razvitiya-voennoj-strategii\/"},{"issue":"2","key":"9320_CR41","doi-asserted-by":"publisher","first-page":"237","DOI":"10.1080\/13518040490450529","volume":"17","author":"T Thomas","year":"2004","unstructured":"Thomas T (2004) Russia\u2019s reflexive control theory and the military. J Slavic Mil Stud 17(2):237\u2013256. https:\/\/doi.org\/10.1080\/13518040490450529","journal-title":"J Slavic Mil Stud"},{"key":"9320_CR42","unstructured":"Waltzman R (2017) SASC testimony: the weaponization of information. https:\/\/www.rand.org\/pubs\/testimonies\/CT473.html"},{"key":"9320_CR43","volume-title":"Process and reality","author":"AN Whitehead","year":"1979","unstructured":"Whitehead AN (1979) Process and reality, 2nd edn. Free Press, New York","edition":"2"},{"key":"9320_CR44","volume-title":"Red team: how to succeed by thinking like the enemy","author":"M Zenko","year":"2015","unstructured":"Zenko M (2015) Red team: how to succeed by thinking like the enemy, 1st edn. Basic Books, New York","edition":"1"}],"container-title":["Computational and Mathematical Organization Theory"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10588-020-09320-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10588-020-09320-x\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10588-020-09320-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,11,26]],"date-time":"2022-11-26T21:42:38Z","timestamp":1669498958000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10588-020-09320-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,11,5]]},"references-count":44,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2021,6]]}},"alternative-id":["9320"],"URL":"https:\/\/doi.org\/10.1007\/s10588-020-09320-x","relation":{},"ISSN":["1381-298X","1572-9346"],"issn-type":[{"type":"print","value":"1381-298X"},{"type":"electronic","value":"1572-9346"}],"subject":[],"published":{"date-parts":[[2020,11,5]]},"assertion":[{"value":"5 November 2020","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}