{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,27]],"date-time":"2026-05-27T13:50:29Z","timestamp":1779889829000,"version":"3.53.1"},"reference-count":26,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2019,3,1]],"date-time":"2019-03-01T00:00:00Z","timestamp":1551398400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2019,3,1]],"date-time":"2019-03-01T00:00:00Z","timestamp":1551398400000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2019,3,1]],"date-time":"2019-03-01T00:00:00Z","timestamp":1551398400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2019,3,1]],"date-time":"2019-03-01T00:00:00Z","timestamp":1551398400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000183","name":"Army Research Office","doi-asserted-by":"publisher","award":["W911NF-15-1-0576"],"award-info":[{"award-number":["W911NF-15-1-0576"]}],"id":[{"id":"10.13039\/100000183","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000183","name":"Army Research Office","doi-asserted-by":"publisher","award":["W911NF-13-1-0421 (MURI)"],"award-info":[{"award-number":["W911NF-13-1-0421 (MURI)"]}],"id":[{"id":"10.13039\/100000183","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1422594"],"award-info":[{"award-number":["CNS-1422594"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002499","name":"International University of Korea","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002499","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Systems Journal"],"published-print":{"date-parts":[[2019,3]]},"DOI":"10.1109\/jsyst.2018.2828832","type":"journal-article","created":{"date-parts":[[2018,5,18]],"date-time":"2018-05-18T19:00:00Z","timestamp":1526670000000},"page":"603-614","source":"Crossref","is-referenced-by-count":28,"title":["Learning From Experts\u2019 Experience: Toward Automated Cyber Security Data Triage"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2547-941X","authenticated-orcid":false,"given":"Chen","family":"Zhong","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"John","family":"Yen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5091-8464","authenticated-orcid":false,"given":"Peng","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Robert F.","family":"Erbacher","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref10","article-title":"Siem best practices: Correlation rule and engine debugging","year":"2014"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/BigDataSecurity-HPSC-IDS.2016.41"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1518\/001872095779049543"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CogSIMA.2012.6188392"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CogSIMA.2014.6816567"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2013.6578832"},{"key":"ref16","first-page":"33","article-title":"Results and lessons learned from a user study of display effectiveness with experienced cyber security network analysts","author":"garneau","year":"0","journal-title":"Proc Learn Authoritative Sec Exp Results Workshop"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1057\/ivs.2010.5"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2746194.2746203"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/586143.586144"},{"key":"ref4","article-title":"The total cost of handling too many alerts vs. managing risk","year":"0"},{"key":"ref3","article-title":"The state of malware detection and prevention","author":"institute","year":"0"},{"key":"ref6","first-page":"272","article-title":"Integrating IDs alert correlation and os-level dependency tracking","author":"zhai","year":"0","journal-title":"Proc IEEE Intell Secur Inform"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/1501434.1501479"},{"key":"ref8","author":"nathans","year":"2014","journal-title":"Designing and Building Security Operations Center"},{"key":"ref7","article-title":"Building a successful security operations center","year":"0"},{"key":"ref2","first-page":"119","article-title":"Cognitive process","author":"yen","year":"0","journal-title":"Cyber Defense and Situational Awareness"},{"key":"ref9","author":"miller","year":"2010","journal-title":"Security Information and Event Management (SIEM) Implementation"},{"key":"ref1","first-page":"19","article-title":"The real work of computer network defense analysts","author":"d\u2019amico","year":"0","journal-title":"Proc VizSEC 2007"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2002.1004372"},{"key":"ref22","first-page":"94","article-title":"Correlation of intrusion symptoms: An application of chronicles","volume":"3","author":"morin","year":"0","journal-title":"Proc RAID"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/366173.366187"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/COGSIMA.2015.7108193"},{"key":"ref23","first-page":"128","article-title":"Studying analysts’ data triage operations in cyber defense situational analysis","author":"zhong","year":"0","journal-title":"Proc Theory Models Cyber Situation Awareness"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/S0305-0483(98)00049-8"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2012.6400529"}],"container-title":["IEEE Systems Journal"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielaam\/4267003\/8649702\/8360965-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/4267003\/8649702\/08360965.pdf?arnumber=8360965","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,13]],"date-time":"2022-07-13T21:08:45Z","timestamp":1657746525000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8360965\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,3]]},"references-count":26,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/jsyst.2018.2828832","relation":{},"ISSN":["1932-8184","1937-9234","2373-7816"],"issn-type":[{"value":"1932-8184","type":"print"},{"value":"1937-9234","type":"electronic"},{"value":"2373-7816","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,3]]}}}