{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T05:48:12Z","timestamp":1778305692941,"version":"3.51.4"},"reference-count":27,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"DOI":"10.1109\/csac.2003.1254330","type":"proceedings-article","created":{"date-parts":[[2004,7,8]],"date-time":"2004-07-08T16:05:44Z","timestamp":1089302744000},"page":"255-264","source":"Crossref","is-referenced-by-count":46,"title":["Log correlation for intrusion detection: a proof of concept"],"prefix":"10.1109","author":[{"given":"C.","family":"Abad","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"J.","family":"Taylor","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"C.","family":"Sengul","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"W.","family":"Yurcik","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"family":"Yuanyuan Zhou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"K.","family":"Rowe","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref10","article-title":"Api spying techniques for windows 9x, nt, and 2000, Apr. 2000","author":"kaplan","year":"2003"},{"key":"ref11","article-title":"A database of computer attacks for the evaluation of intrusion detection systems","author":"kendall","year":"1998"},{"key":"ref12","first-page":"89","article-title":"Experiences with tripwire: Using integrity checkers for intrusion detection","author":"kim","year":"1994","journal-title":"Proc of the 3rd Annual System Administration Networking and Security Conference (SANS III)"},{"key":"ref13","article-title":"Data and network integrity - technology to invoke trust in it - the tripwire solution","author":"kodology","year":"2001","journal-title":"An IDC White Paper"},{"key":"ref14","article-title":"Data mining approaches for intrusion detection","author":"lee","year":"1998","journal-title":"Proceedings of the 7th USENIX Security Symposium(SECURITY-98)"},{"key":"ref15","article-title":"A data mining framework for building intrusion detection models","author":"lee","year":"1999","journal-title":"Proc of the IEEE Symposium on Security and Privacy"},{"key":"ref16","year":"2003","journal-title":"Netforensics Security information management"},{"key":"ref17","year":"2003","journal-title":"neuSECURE Centralized security operations and threat management software Aug 2003"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/586143.586144"},{"key":"ref19","article-title":"An achilles' heel in signature-based ids: Squealing false positives in SNORT","author":"patton","year":"2001","journal-title":"Proc of the 4th Intl Symposium on Recent Advances in Intrusion Detection (RAID '2001)"},{"key":"ref4","article-title":"Correlation in an intrusion detection process","author":"cuppens","year":"2002","journal-title":"SEcurité des Communications sur Internet (SECI '02)"},{"key":"ref27","article-title":"Security event correlation: Where are we now, 2001","author":"walker","year":"2003","journal-title":"netIQ whitepaper"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/B978-1-55860-377-6.50023-2"},{"key":"ref6","first-page":"222","article-title":"An intrusion-detection model, IEEE Trans. on Software Engineering","volume":"13","author":"denning","year":"1987","journal-title":"Special Issue on Service Overlay Networks"},{"key":"ref5","doi-asserted-by":"crossref","DOI":"10.1007\/3-540-45474-8_6","article-title":"Aggregation and correlation of intrusion-detection alerts","author":"debar","year":"2001","journal-title":"Proc of the 4th Intl Symposium on Recent Advances in Intrusion Detection (RAID '2001)"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1996.502675"},{"key":"ref7","article-title":"The DoS project's “trinoo” distributed denial of service attack tool, Oct. 1999","author":"dittrich","year":"2003"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/604264.604269"},{"key":"ref9","year":"2003","journal-title":"IBM Tivoli intrusion manager Jun 2003"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/604264.604268"},{"key":"ref20","doi-asserted-by":"crossref","first-page":"95","DOI":"10.1007\/3-540-36084-0_6","article-title":"A mission-impact-based approach to infosec alarm correlation","author":"porras","year":"2002","journal-title":"Proc of the 5th Intl Symposium on Recent Advances in Intrusion Detection (RAID '2002)"},{"key":"ref22","article-title":"Yaha virus lingers into the new year","author":"rohde","year":"2003","journal-title":"IDG News Service"},{"key":"ref21","article-title":"Insertion, evasion, and denial of service: Eluding network intrusion detection","author":"ptacek","year":"1998","journal-title":"Technical Report"},{"key":"ref24","article-title":"Intrusion detection systems and log correlation","author":"silvestro","year":"2002"},{"key":"ref23","year":"2003","journal-title":"Sans portal May 2003"},{"key":"ref26","author":"spitzner","year":"2001","journal-title":"Know Your Enemy Revealing the Security Tools Tactics and Motives of the Blackhat Community chapter 6"},{"key":"ref25","year":"2003","journal-title":"Snort The open source network intrusion detection system Sep 2003"}],"event":{"name":"19th Annual Computer Security Applications Conference, 2003.","location":"Las Vegas, Nevada, USA"},"container-title":["19th Annual Computer Security Applications Conference, 2003. Proceedings."],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/8882\/28060\/01254330.pdf?arnumber=1254330","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,16]],"date-time":"2017-06-16T04:39:27Z","timestamp":1497587967000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/1254330\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[null]]},"references-count":27,"URL":"https:\/\/doi.org\/10.1109\/csac.2003.1254330","relation":{},"subject":[]}}