{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,5]],"date-time":"2024-09-05T15:12:31Z","timestamp":1725549151658},"reference-count":16,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012,8]]},"DOI":"10.1109\/issa.2012.6320435","type":"proceedings-article","created":{"date-parts":[[2013,5,15]],"date-time":"2013-05-15T21:02:08Z","timestamp":1368651728000},"page":"1-7","source":"Crossref","is-referenced-by-count":0,"title":["A model for partially asynchronous observation of malicious behavior"],"prefix":"10.1109","author":[{"given":"Mark M.","family":"Seeger","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Stephen D.","family":"Wolthusen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"15","doi-asserted-by":"publisher","DOI":"10.1109\/ISSA.2010.5588311"},{"journal-title":"Probabilistic Reasoning in Intelligent Systems Networks of Plausible Inference","year":"1988","author":"pearl","key":"16"},{"key":"13","first-page":"55","article-title":"Using Observations of Invariant Behavior to Detect Malicious Agency in Distributed Environments","author":"mcevoy","year":"2008","journal-title":"IMF 2008"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.1109\/ICONS.2010.34"},{"key":"11","doi-asserted-by":"publisher","DOI":"10.1109\/IEEC.2009.56"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23822-2_23"},{"journal-title":"Happened before Is the Wrong Model for Potential Causality","year":"1998","author":"tarafdar","key":"3"},{"key":"2","doi-asserted-by":"publisher","DOI":"10.1145\/359545.359563"},{"key":"1","doi-asserted-by":"publisher","DOI":"10.1145\/506378.506423"},{"key":"10","first-page":"806","article-title":"Recognizing Malicious Intention in an Intrusion Detection Process","author":"m","year":"2002","journal-title":"HIS 2002"},{"key":"7","doi-asserted-by":"publisher","DOI":"10.1145\/586143.586144"},{"key":"6","article-title":"Enriching intrusion alerts through multi-host causality","author":"king","year":"2005","journal-title":"NDSS 2005"},{"journal-title":"cms Causality Based Intrusion Detection System","year":"2004","author":"king","key":"5"},{"key":"4","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2007.11"},{"key":"9","first-page":"157","article-title":"Enhanced Correlation in an Intrusion Detection Process","author":"a","year":"2003","journal-title":"MMM-ACNS 2003"},{"key":"8","first-page":"202","article-title":"Alert Correlation in a Cooperative Intrusion Detection F ramework","author":"cuppens","year":"2002","journal-title":"SP 2002"}],"event":{"name":"2012 Information Security for South Africa (ISSA)","start":{"date-parts":[[2012,8,15]]},"location":"Johannesburg, Gauteng, South Africa","end":{"date-parts":[[2012,8,17]]}},"container-title":["2012 Information Security for South Africa"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/6305018\/6320423\/06320435.pdf?arnumber=6320435","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,3,21]],"date-time":"2017-03-21T23:23:48Z","timestamp":1490138628000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6320435\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,8]]},"references-count":16,"URL":"https:\/\/doi.org\/10.1109\/issa.2012.6320435","relation":{},"subject":[],"published":{"date-parts":[[2012,8]]}}}