{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T10:52:08Z","timestamp":1784631128683,"version":"3.55.0"},"reference-count":192,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100006769","name":"grant of Russian Science Foundation","doi-asserted-by":"publisher","award":["#21-71-20078 in SPC RAS"],"award-info":[{"award-number":["#21-71-20078 in SPC RAS"]}],"id":[{"id":"10.13039\/501100006769","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/access.2022.3168976","type":"journal-article","created":{"date-parts":[[2022,4,20]],"date-time":"2022-04-20T19:33:32Z","timestamp":1650483212000},"page":"43387-43420","source":"Crossref","is-referenced-by-count":50,"title":["Systematic Literature Review of Security Event Correlation Methods"],"prefix":"10.1109","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6859-7120","authenticated-orcid":false,"given":"Igor","family":"Kotenko","sequence":"first","affiliation":[{"name":"St. Petersburg Federal Research Center of the Russian Academy of Sciences (SPC RAS), St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS), St. Petersburg, Russia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Diana","family":"Gaifulina","sequence":"additional","affiliation":[{"name":"St. Petersburg Federal Research Center of the Russian Academy of Sciences (SPC RAS), St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS), St. Petersburg, Russia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Igor","family":"Zelichenok","sequence":"additional","affiliation":[{"name":"St. Petersburg Federal Research Center of the Russian Academy of Sciences (SPC RAS), St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS), St. Petersburg, Russia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1","article-title":"Survey of event correlation techniques for attack detection in early warning systems","author":"Limmer","year":"2008"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2010.12.004"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1080\/02564602.2014.906864"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-03584-0_14"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.10.022"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3184898"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2871866"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.03.001"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.3390\/electronics9101722"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-016-0273-3"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4766"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3344382"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/s12083-017-0630-0"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2019.105124"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.3390\/s21144759"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-65726-0_4"},{"key":"ref17","first-page":"1","article-title":"Procedures for performing systematic reviews","volume":"33","author":"Kitchenham","year":"2004"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14236\/ewic\/EASE2008.8"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CSNT.2012.212"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-31328-9_8"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICORIS.2019.8874899"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICCKE.2013.6682843"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1039"},{"issue":"34","key":"ref24","first-page":"226","article-title":"A density-based algorithm for discovering clusters in large spatial databases with noise","volume-title":"Proc. KDD","volume":"96","author":"Ester"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/IACC.2016.38"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2013.146"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICNIDC.2012.6418807"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICNDC.2010.53"},{"issue":"4","key":"ref29","first-page":"2865","article-title":"Application of type-2 fuzzy logic to rule-based intrusion alert correlation detection","volume":"8","author":"Huang","year":"2012","journal-title":"Int. J. Innov. Comput. Inf. Control"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2016.7792462"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICCSN.2010.65"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijar.2007.03.004"},{"key":"ref33","first-page":"1","article-title":"A hierarchical approach for detecting system intrusions through event correlation","volume-title":"Proc. Int. Conf. Commun., Netw., Inf. Secur.","author":"Rice"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2010.5683648"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.5815\/ijcnis.2013.11.02"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2014.2358834"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/PDP2018.2018.00080"},{"key":"ref38","first-page":"1","article-title":"An improved framework for intrusion alert correlation","volume-title":"Proc. World Congr. Eng.","volume":"1","author":"Elshoush"},{"key":"ref39","first-page":"25","article-title":"A risk index model for security incident prioritisation","volume-title":"Proc. 9th Austral. Inf. Secur. Manage. Conf.","author":"Anuar"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.3166\/jancl.20.7-37"},{"issue":"2","key":"ref41","first-page":"142","article-title":"Automatic multi-step attack pattern discovering","volume":"10","author":"Wang","year":"2010","journal-title":"Int. J. Netw. Secur."},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2011.110809"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/1947940.1948047"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/3029638"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCIIS.2010.37"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-36084-0_12"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-05302-8_10"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CBD.2013.27"},{"issue":"79","key":"ref49","first-page":"1","article-title":"SWRL: A semantic web rule language combining OWL and RuleML","volume":"21","author":"Horrocks","year":"2004","journal-title":"W C Member Submission"},{"key":"ref50","first-page":"1","article-title":"SQWRL: A query language for OWL","volume-title":"Proc. OWLED","volume":"529","author":"O\u2019Connor"},{"issue":"10","key":"ref51","first-page":"1","article-title":"OWL web ontology language overview","volume":"10","author":"McGuinness","year":"2004","journal-title":"W C Recommendation"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CSCloud.2015.26"},{"key":"ref53","first-page":"86","article-title":"EDL: A basis for distributed system debugging tools","volume-title":"Proc. Hawaii Int. Conf. Syst. Sci.","author":"Bates"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SSCI.2016.7850076"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2010.120"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2946261"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.18517\/ijaseit.9.2.7591"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006328"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.05.032"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2011.6016716"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/SOSE.2014.53"},{"issue":"1","key":"ref62","first-page":"113","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume":"1","author":"Hutchins","year":"2011","journal-title":"Lead. Inf. Warfare Secur. Res."},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ICCSIT.2010.5563843"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-16644-0_19"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.5296\/npa.v2i3.420"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CCP.2011.43"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/WICOM.2010.5601285"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/PIC.2010.5687402"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2010.57"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/SIECPC.2013.6550973"},{"issue":"10","key":"ref71","first-page":"24","article-title":"Detection of Botnet multi-stage attack by using alert correlation model","volume":"2","author":"Alnas","year":"2013","journal-title":"Int. J. Eng. Sci."},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2013.08.002"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.09.006"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.04.030"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3021499"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101661"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2020.102522"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/366173.366187"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70567-3_22"},{"key":"ref81","volume-title":"Introduction to Graph Theory","author":"Trudeau","year":"2013"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2019.100219"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-21323-6_8"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/367766.368168"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/321105.321107"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICCSNT.2012.6525959"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.12.003"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/SSCI.2016.7849902"},{"key":"ref89","first-page":"487","article-title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data","volume-title":"Proc. 26th USENIX Secur. Symp. (USENIX Secur.)","author":"Hossain"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1177\/1548512917706043"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2017.12.003"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/3154273.3154311"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1111\/j.1469-8137.1912.tb05611.x"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.5753\/sbsi.2016.5977"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-26001-8_1"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/ISCISC.2012.6408197"},{"key":"ref97","first-page":"1","article-title":"A cyber attack modeling and impact assessment framework","volume-title":"Proc. 5th Int. Conf. Cyber Conflict (CYCON)","author":"Kotenko"},{"key":"ref98","first-page":"35","article-title":"An anomaly event correlation engine: Identifying root causes, bottlenecks, and black swans in IT environments","volume":"2","author":"Marvasti","year":"2013","journal-title":"VMware Tech. J."},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ISIAS.2014.7064615"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.4433"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/WETICE.2019.00019"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2961517"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2011.34"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/IranianCEE.2012.6292441"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14215-4_9"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/ASIAJCIS.2013.14"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/ISTEL.2012.6483132"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1002\/sec.786"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/ISCISC.2015.7387905"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.3390\/info11120560"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/CSS.2011.6058565"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1145\/2179298.2179369"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/DASC.2014.19"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC\/SmartCity\/DSS.2019.00291"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/5787102"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33469-6_37"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/AIMS.2014.64"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/EMS.2014.90"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/DASC.2014.12"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2017.2751478"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1967.1054010"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1155\/2014\/374260"},{"issue":"4","key":"ref123","first-page":"10","article-title":"Hidden Markov models and the baum-welch algorithm","volume":"53","author":"Welch","year":"2003","journal-title":"IEEE Inf. Theory Soc. Newslett."},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/5.18626"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.3390\/make1010017"},{"key":"ref126","first-page":"1","article-title":"Multi-stage attack detection using layered hidden Markov model intrusion detection system","volume-title":"Proc. Int. Found. Telemetering","author":"Zegeye"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2948623"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.2307\/2984875"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcss.2011.12.025"},{"key":"ref130","first-page":"51","article-title":"Estimation of hidden Markov models parameters using differential evolution","volume-title":"Proc. Conv. Commun., Interact. Social Intell.","volume":"1","author":"S\u00e1"},{"key":"ref131","first-page":"33.1","article-title":"A method of moments for mixture models and hidden Markov models","volume-title":"Proc. Conf. Learn. Theory","author":"Anandkumar"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.03.014"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2012.07.057"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.5220\/0007404004610470"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40173-2_38"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2001.914830"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/IAEAC.2015.7428739"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/IMCEC.2016.7867441"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1197\/jamia.M2716"},{"issue":"4","key":"ref140","first-page":"73","article-title":"Framework and models for multistep attack detection","volume":"5","author":"Marchetti","year":"2011","journal-title":"Int. J. Secur. Appl."},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1483"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/CSCI46756.2018.00025"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076787"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/ICTAI.2012.68"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2012.04.001"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/UCC.2014.32"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2015.09.009"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC-SmartCity-DSS.2016.0211"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2017.8004902"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2017.12.001"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23141-4_10"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243811"},{"key":"ref154","article-title":"Bidirectional RNN-based few-shot training for detecting multi-stage attack","author":"Zhao","year":"2019","journal-title":"arXiv:1905.03454"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102203"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1016\/j.array.2021.100067"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.10.006"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1756"},{"issue":"3","key":"ref159","first-page":"190","article-title":"Using artificial immune system and fuzzy logic for alert correlation","volume":"15","author":"Bateni","year":"2013","journal-title":"Int. J. Netw. Secur."},{"issue":"2","key":"ref160","first-page":"34","article-title":"Integration of PSO and K-means clustering algorithm for structural-based alert correlation model","volume":"7","author":"Hua","year":"2017","journal-title":"Int. J. Innov. Comput."},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1007\/s11721-007-0002-0"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/5576504"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2007.4408853"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2982057"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1145\/3269206.3272013"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2014.05.029"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-45237-0_60"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.06.055"},{"key":"ref169","article-title":"Event correlation and forecasting over multivariate streaming sensor data","author":"Papataxiarhis","year":"2018","journal-title":"arXiv:1803.05636"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/ISPA-BDCloud-SustainCom-SocialCom48970.2019.00143"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1007\/s00607-016-0500-2"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1016\/j.promfg.2019.06.197"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.02.001"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom\/BigDataSE.2018.00110"},{"key":"ref175","volume-title":"DARPA 1999 Dataset"},{"key":"ref176","volume-title":"DARPA 2000 Dataset"},{"key":"ref177","volume-title":"DARPACGP Dataset"},{"key":"ref178","volume-title":"DEFCON Dataset"},{"key":"ref179","volume-title":"The 2008 UCSB International Capture the Flag (iCTF)"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-35694-5_2"},{"key":"ref181","volume-title":"Capture Files From Mid-Atlantic CCDC"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.12.012"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"ref184","article-title":"Insider threat test dataset","author":"Lindauer","year":"2020"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1145\/586110.586144"},{"key":"ref187","volume-title":"KDD Cup 1999 Data"},{"key":"ref188","volume-title":"NSA Datasets","year":"2021"},{"key":"ref189","volume-title":"Contagio Malware Dump","year":"2021"},{"key":"ref190","volume-title":"LBNL Dataset"},{"key":"ref191","volume-title":"Capture Files From 4SICS Geek Lounge"},{"key":"ref192","article-title":"Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation","author":"Powers","year":"2020","journal-title":"arXiv:2010.16061"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9668973\/09760432.pdf?arnumber=9760432","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,22]],"date-time":"2024-01-22T20:58:31Z","timestamp":1705957111000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9760432\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":192,"URL":"https:\/\/doi.org\/10.1109\/access.2022.3168976","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}