{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T17:44:24Z","timestamp":1772819064572,"version":"3.50.1"},"reference-count":30,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2003]]},"DOI":"10.1109\/hicss.2003.1174909","type":"proceedings-article","created":{"date-parts":[[2004,6,22]],"date-time":"2004-06-22T16:27:43Z","timestamp":1087921663000},"page":"10 pp.","source":"Crossref","is-referenced-by-count":72,"title":["Applications of hidden Markov models to detecting multi-stage network attacks"],"prefix":"10.1109","author":[{"given":"D.","family":"Ourston","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"S.","family":"Matzner","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"W.","family":"Stump","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"B.","family":"Hopkins","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref30","article-title":"Theory Refinement with Noisy Data","author":"mooney","year":"1991","journal-title":"Technical Report AI91-153"},{"key":"ref10","doi-asserted-by":"crossref","DOI":"10.1142\/4648","article-title":"Hidden Markov Models: Applications in Computer Vision","volume":"45","author":"bunke","year":"2001","journal-title":"World Scientific Series in Machine Perception and Artificial Intelligence eries"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1111\/1467-9876.00191"},{"key":"ref12","article-title":"Analysis Techniques for Detecting Coordinated Attacks and Probes","author":"green","year":"1999","journal-title":"proceedings of the 1st USENIX Workshop on Intrusion Detection and Network Monitoring"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2001.991518"},{"key":"ref14","author":"bloedorn","year":"2001","journal-title":"Data Mining for Network Intrusion Detection How to get started"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.1999.816048"},{"key":"ref16","author":"degroot","year":"0","journal-title":"Probability and Statistics"},{"key":"ref17","author":"witten","year":"2000","journal-title":"Data Mining Practical Machine Learning Tools and Techniques with Java Implementations"},{"key":"ref18","author":"yoon","year":"0","journal-title":"HmmLib Hidden Markov Model Library in Java"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.3758\/BF03213026"},{"key":"ref28","article-title":"Anomaly Detection over Noisy Data Using Learned Probability Distributions","author":"eskin","year":"2000","journal-title":"Proceedings of the Seventeenth International Conference on Machine Learning (ICML-2000)"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/BF00153759"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010920819831"},{"key":"ref3","first-page":"150","article-title":"Temporal Sequence Learning for Anomaly Detection","author":"lane","year":"1998","journal-title":"5th ACM Conference on Computer & Communications Security San Francisco"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/MASSP.1986.1165342"},{"key":"ref29","article-title":"Using Explanation-Based and Empirical Methods in Theory Revision","author":"ourston","year":"1991"},{"key":"ref5","article-title":"A Data Mining Analysis of RTID Alarms","author":"manganaris","year":"1999","journal-title":"2nd Int Workshop Recent Advances in Intrusion Detection"},{"key":"ref8","author":"huang","year":"1990","journal-title":"Hidden Markov Models for Speech Recognition"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1999.766910"},{"key":"ref2","doi-asserted-by":"crossref","DOI":"10.1007\/3-540-45474-8_4","article-title":"Probabilistic Alert Correlation","author":"valdes","year":"2001","journal-title":"Conf Recent Advance in Intrusion Detection (RAID)"},{"key":"ref9","article-title":"Text Mining Using HMM and PPM","author":"wen","year":"2001"},{"key":"ref1","article-title":"Identifying Coordinated Internet Attacks","author":"ourston","year":"2001","journal-title":"Proceedings of the Second SSGRR Conference Rome Italy"},{"key":"ref20","first-page":"267","author":"manning","year":"0","journal-title":"Foundations of Statistical Natural Language Processing"},{"key":"ref22","article-title":"PNrule: A New Framework for Learning Classifier Models in Data Mining (A CaseStudy in Network Intrusion Detection)","author":"agarwal","year":"2000","journal-title":"Technical Report TR 00-015"},{"key":"ref21","author":"egan","year":"1975","journal-title":"Signal detection theory and ROC analysis Series in Cognition and Perception"},{"key":"ref24","article-title":"Boosted Wrapper Induction","author":"freitag","year":"2000","journal-title":"Proceedings of the Seventeenth National Conference on Artificial Intelligence"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1023\/A:1007601015854"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/375663.375673"},{"key":"ref25","article-title":"Learning from Imbalanced Data Sets: A Comparison of Various Strategies. In: Papers from the AAAI Workshop on Learning from Imbalanced Data Sets","author":"japkowicz","year":"2000","journal-title":"Technical Report WS-00-05"}],"event":{"name":"36th Annual Hawaii International Conference on System Sciences, 2003. Proceedings of the","location":"Big Island, HI, USA","start":{"date-parts":[[2003,1,9]]},"end":{"date-parts":[[2003,1,9]]}},"container-title":["36th Annual Hawaii International Conference on System Sciences, 2003. Proceedings of the"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/8360\/26341\/01174909.pdf?arnumber=1174909","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,16]],"date-time":"2017-06-16T04:15:18Z","timestamp":1497586518000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/1174909\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2003]]},"references-count":30,"URL":"https:\/\/doi.org\/10.1109\/hicss.2003.1174909","relation":{},"subject":[],"published":{"date-parts":[[2003]]}}}