{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T13:23:49Z","timestamp":1784985829584,"version":"3.55.0"},"reference-count":200,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2020]]},"DOI":"10.1109\/access.2020.3045514","type":"journal-article","created":{"date-parts":[[2020,12,17]],"date-time":"2020-12-17T20:44:37Z","timestamp":1608237877000},"page":"227756-227779","source":"Crossref","is-referenced-by-count":169,"title":["Security Operations Center: A Systematic Study and Open Challenges"],"prefix":"10.1109","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1119-4715","authenticated-orcid":false,"given":"Manfred","family":"Vielberth","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0023-6051","authenticated-orcid":false,"given":"Fabian","family":"Bohm","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8982-8805","authenticated-orcid":false,"given":"Ines","family":"Fichtinger","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1338-9003","authenticated-orcid":false,"given":"Gunther","family":"Pernul","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52581-1_10"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2015.7249240"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1109\/SNPD.2017.8022709"},{"key":"ref174","author":"marty","year":"2009","journal-title":"Applied Security Visualization"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2011.144"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-24273-1"},{"key":"ref175","first-page":"35","article-title":"Human-as-a-security-sensor for harvesting threat intelligence","volume":"2","author":"vielberth","year":"2019","journal-title":"Cybersecurity"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2012.09.004"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2016.2616285"},{"key":"ref168","article-title":"Data presentation in security operations centres: Exploring the potential for sonification to enhance existing practice","volume":"6","author":"axon","year":"2020","journal-title":"Cybersecurity"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2966760"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/FiCloudW.2017.68"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/eStream.2019.8732173"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.4108\/eai.18-7-2019.2287841"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(16)30049-6"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecPODS.2019.8885237"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSA.2015.7166125"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/WSCNIS.2015.7368297"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1201\/1086.1065898X\/45782.14.6.20060101\/91856.6"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-19501-4_5"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-37629-3_8"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-04834-1_11"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPS.2008.4536562"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/TEM.2020.2979832"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1111\/risa.12864"},{"key":"ref183","first-page":"52","article-title":"Practice within Fujitsu of security operations center: Operation and security dashboard","volume":"52","author":"sadamatsu","year":"2016","journal-title":"FUJITSU Sci Tech J"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1145\/3196884"},{"key":"ref189","article-title":"Audit of NASA’s security operations center","year":"2018"},{"key":"ref188","article-title":"Common and best practices for security operations centers: Results of the 2019 SOC survey","author":"crowley","year":"2019"},{"key":"ref187","author":"gaudin","year":"2018","journal-title":"Guidelines for Building and Operating a Secured Security Operations Center (SOC)"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecurity49315.2020.9138872"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1088\/1757-899X\/569\/5\/052086"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1002\/9781119055228.ch6"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-56538-5_37"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1177\/1548512919874129"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.28945\/479"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CASON.2011.6085959"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.17705\/1CAIS.03743"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63940-6_40"},{"key":"ref23","first-page":"1","article-title":"Integrating a security operations centre with an Organization’s existing procedures, policies and information technology systems","author":"mutemwa","year":"2018","journal-title":"Proc Int Conf Intell Innov Comput Appl (ICONIC)"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2019.100312"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/W-FiCloud.2016.42"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/3CA.2010.5533775"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/NITC.2017.8285644"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523670"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1145\/3349341.3349365"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.3390\/app10093277"},{"key":"ref155","first-page":"889","article-title":"Network security management based on data fusion technology","author":"yi","year":"2006","journal-title":"Proc 7th Int Conf Comput -Aided Ind Des Conceptual Des"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274710"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOMW.2010.5700211"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/TAAI.2010.27"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-06608-0_1"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/CIS.2008.163"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/CISW.2007.4425455"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2015.14"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1051\/epjconf\/201921403029"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.22323\/1.293.0025"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3309194.3309196"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/WETICE.2019.00035"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/1413140.1413160"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/EISIC.2016.049"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2010.5484769"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2017.8254427"},{"key":"ref40","first-page":"403","article-title":"Managing security of grid architecture with a grid security operation center","author":"bourgeois","year":"2009","journal-title":"Proc Int Conf Secur Cryptogr"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.03.004"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2931557"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.14722\/usec.2018.23024"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-23585-1_6"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2012.6415565"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-69659-1_24"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/AsiaJCIS.2018.00010"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1109\/3DCVE.2018.8637109"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24591-9_9"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-47238-6_18"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.03.004"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/THS.2012.6459894"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-60585-2_21"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSA.2017.8073399"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354239"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1002\/dac.2323"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1093\/itnow\/bwaa015"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2018.8709231"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1109\/CYBConf.2017.7985754"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(11)70005-8"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCSN.2011.6013727"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ISTEL.2016.7881927"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2016.05.005"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2012.07.002"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-012-0754-1"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICMA.2006.257690"},{"key":"ref43","first-page":"48","article-title":"Evaluation of the intrusion detection capabilities and performance of a security operation center","author":"ganame","year":"2006","journal-title":"Proc Int Conf Secur Cryptogr"},{"key":"ref73","first-page":"1","article-title":"A security information and event management pattern","author":"vielberth","year":"2018","journal-title":"Proc 12th Latin Amer Conf Pattern Lang Prog (SLPLoP)"},{"key":"ref72","article-title":"How to manage a security operations center","author":"robb","year":"2019"},{"key":"ref71","article-title":"Defining computer security incident response teams","author":"ruefle","year":"2007"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1108\/13673270110384419"},{"key":"ref76","article-title":"Choosing a soc service model: The key considerations","author":"security","year":"2018"},{"key":"ref77","author":"muniz","year":"2015","journal-title":"Security Operations Center Building Operating and Maintaining your SOC"},{"key":"ref74","first-page":"87","article-title":"Socaas: Security operations center as a service for cloud computing environments","volume":"3","author":"alruwaili","year":"2014","journal-title":"International Journal of Cloud Computing and Services Science"},{"key":"ref75","article-title":"Ten strategies of a world-class cybersecurity operations center","author":"zimmerman","year":"2014"},{"key":"ref78","year":"2018","journal-title":"Outsourced Soc Vs Internal Soc How to Choose"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1007\/s38314-019-0050-4"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.22323\/1.351.0010"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(02)05013-4"},{"key":"ref61","first-page":"225","article-title":"Security operations center: A framework for automated triage, containment and escalation","volume":"11","author":"danquah","year":"2020","journal-title":"J Inf Secur"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ISSA.2013.6641054"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(09)70130-7"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/FiCloud.2016.26"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/SACI.2018.8440963"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-018-0407-3"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.4108\/eai.8-4-2019.157413"},{"key":"ref69","article-title":"Sans 2018 security operations center survey","author":"crowley","year":"2018"},{"key":"ref197","article-title":"Metrics for operational security control","author":"cambra","year":"2004"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2015.50"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.02.003"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1002\/9780470087923.hhs440"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1145\/2914795"},{"key":"ref195","article-title":"Key performance indicators (KPIS) for security operations and incident response: Identifying which KPIS should be set, monitored and measured","author":"moran","year":"2019"},{"key":"ref196","first-page":"35","article-title":"There’sa SMART way to write management’s goals and objectives","volume":"70","author":"doran","year":"1981","journal-title":"Manage Rev"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/NCS.2018.00007"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-04834-1_12"},{"key":"ref190","year":"2013","journal-title":"Strategy Considerations for Building a Security Operations Center Optimize Your Security Intelligence to Better Safeguard Your Business From Threats"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/2808128.2808136"},{"key":"ref191","author":"jansen","year":"2010","journal-title":"Directions in Security Metrics Research"},{"key":"ref92","first-page":"347","article-title":"A human capital model for mitigating security analyst burnout","author":"sundaramurthy","year":"2015","journal-title":"Proc Symp Usable Privacy Secur"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1145\/1314257.1314266"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2886465"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/s11761-018-0235-3"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2018.2809506"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05171-6_14"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-23210-8_108"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/COGSIMA.2019.8724159"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2018.2828832"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30719-6_9"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2019.10251"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-21290-2_32"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-16837-7_13"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/3341161.3343519"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1080\/23742917.2019.1698178"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-61152-5_6"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/BigDataSecurity-HPSC-IDS.2016.41"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.02.011"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.5220\/0006557702330240"},{"key":"ref101","article-title":"Security operations center roles and responsibilities","author":"cassetto","year":"2019"},{"key":"ref100","article-title":"How to build a security operations center","author":"vault","year":"2017"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.21785\/icad2019.014"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.4324\/9780203088869"},{"key":"ref125","article-title":"Guide to computer security log management: Recommendations of the national institute of standards and technology","author":"kent","year":"2006"},{"key":"ref124","article-title":"Computer security incident handling guide: Special publication 800-61 revision 2","author":"cichonski","year":"2012"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2018.8587334"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-3818-1_23"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.23919\/CYCON.2018.8405028"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1093\/comjnl\/bxz111"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.01.039"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.23919\/ICITST.2017.8356352"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2009.5335529"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.11.016"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1145\/2808769.2808773"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.3390\/bdcc3010006"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-34637-9_15"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/UKSim.2018.00018"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2017.8004902"},{"key":"ref141","article-title":"A deep belief network based machine learning system for risky host detection","author":"feng","year":"2017","journal-title":"arXiv 1801 00025"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2942809"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-26834-3_11"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2015.270"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/BigDataCongress.2015.86"},{"key":"ref1","year":"2018","journal-title":"The Cost of Cybercrime"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19896-0_7"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2018.8622083"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70560-4_12"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41485-5_1"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/ITIME.2009.5236294"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/ICICTA.2011.584"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.103"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2005.1594841"},{"key":"ref102","year":"2019","journal-title":"Strategies for Building and Growing Strong Cybersecurity Teams Cybersecurity Workforce Study"},{"key":"ref111","article-title":"How do information security workers use host data? A summary of interviews with security analysts","author":"bridges","year":"2018","journal-title":"arXiv 1812 02867v1"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-017-1317-2"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-017-4853-0"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-03638-6_14"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-12143-3_12"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00560-3_24"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2018.2865029"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2663887.2663904"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2017.52"},{"key":"ref16","article-title":"An anthropological study of security operations centers to improve operational efficiency","author":"sundaramurthy","year":"2017"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/ISSC49989.2020.9180198"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/s10111-016-0374-2"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1145\/3305268"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1111\/1467-8551.00375"},{"key":"ref19","first-page":"13","article-title":"Analyzing the past to prepare for the future: Writing a literature review","volume":"26","author":"webster","year":"2002","journal-title":"MIS Quart"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2976076"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/ISNCC.2017.8072035"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/GIOTS49054.2020.9119680"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2016.7792462"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/GrC.2007.117"},{"key":"ref120","article-title":"Isms role in the improvement of digital forensics related process in soc’s","author":"khyavi","year":"2015","journal-title":"arXiv 2006 08255"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-41579-2_9"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58923-3_11"},{"key":"ref123","year":"2016"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/8948470\/09296846.pdf?arnumber=9296846","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T19:55:38Z","timestamp":1639770938000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9296846\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020]]},"references-count":200,"URL":"https:\/\/doi.org\/10.1109\/access.2020.3045514","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020]]}}}