{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T04:25:41Z","timestamp":1780460741068,"version":"3.54.1"},"reference-count":74,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Cloud Comput."],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1109\/tcc.2025.3598060","type":"journal-article","created":{"date-parts":[[2025,8,12]],"date-time":"2025-08-12T18:03:24Z","timestamp":1755021804000},"page":"1161-1176","source":"Crossref","is-referenced-by-count":4,"title":["Observability and Incident Response in Managed Serverless Environments Using Ontology-Based Log Monitoring"],"prefix":"10.1109","volume":"13","author":[{"given":"Lavi","family":"Ben-Shimol","sequence":"first","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8502-2035","authenticated-orcid":false,"given":"Edita","family":"Grolman","sequence":"additional","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0918-0146","authenticated-orcid":false,"given":"Aviad","family":"Elyashar","sequence":"additional","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-5027-8988","authenticated-orcid":false,"given":"Inbar","family":"Maimon","sequence":"additional","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dudu","family":"Mimran","sequence":"additional","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2909-8676","authenticated-orcid":false,"given":"Oleg","family":"Brodt","sequence":"additional","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Martin","family":"Strassmann","sequence":"additional","affiliation":[{"name":"Deutsche Telekom AG, Bonn, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Heiko","family":"Lehmann","sequence":"additional","affiliation":[{"name":"Deutsche Telekom AG, Bonn, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9641-128X","authenticated-orcid":false,"given":"Yuval","family":"Elovici","sequence":"additional","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0630-4059","authenticated-orcid":false,"given":"Asaf","family":"Shabtai","sequence":"additional","affiliation":[{"name":"Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Beer-Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2018.12.013"},{"key":"ref2","article-title":"Serverless architecture market by service type (Automation and integration, monitoring, API management, security, analytics, and design and consulting), Deployment model, organization size, vertical, and region - global forecast to 2025","year":"2020"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102580"},{"key":"ref4","first-page":"726","article-title":"What is serverless?","year":"2022"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3113940"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3368454"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3510611"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-022-00347-w"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.005.2100335"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380173"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3276488"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427665"},{"key":"ref13","article-title":"Guarding serverless applications with SecLambda","author":"Jegan","year":"2020"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463567"},{"key":"ref15","article-title":"Static call graph construction in AWS Lambda serverless applications","volume-title":"Proc. 11th USENIX Workshop Hot Topics Cloud Comput.","author":"Obetz","year":"2019"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3027321"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CLOUD53861.2021.00014"},{"key":"ref18","article-title":"11 Strategies of a world-class cybersecurity operations center","author":"Knerler","year":"2022"},{"key":"ref19","doi-asserted-by":"crossref","DOI":"10.17487\/rfc2350","article-title":"Expectations for computer security incident response","author":"Brownlee","year":"1998"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.6028\/nist.sp.800-207"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.3390\/s23218724"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1186\/s41235-018-0120-9"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1504\/IJSSCI.2008.017590"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.2307\/2333282"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/s00009-023-02350-0"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.cam.2023.115463"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2017.305"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.15587\/2706-5448.2021.230174"},{"issue":"10","key":"ref29","first-page":"1","article-title":"Cloud identity and access management\u2013a model proposal","volume":"6","author":"Mohammed","year":"2019","journal-title":"Int. J. Innovations Eng. Res. Technol."},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-191315"},{"key":"ref31","article-title":"Amazon maintains lead in the cloud market","author":"Group","year":"2023"},{"key":"ref32","article-title":"Aws cloudtrail user guide","year":"2023"},{"key":"ref33","first-page":"2021","article-title":"Amazon eventbridge"},{"key":"ref34","article-title":"Amazon api gateway","year":"2021"},{"key":"ref35","first-page":"2021","article-title":"Aws step functions"},{"key":"ref36","article-title":"Denial-of-wallet attacks: How to protect against costly exploits targeting serverless setups","author":"Haworth","year":"2020"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2021.102843"},{"key":"ref38","article-title":"Not saying you should but we\u2019re told it\u2019s possible to land serverless app a \u201940 K\/month bill using a 1,000-node botnet","author":"Claburn","year":"2021"},{"key":"ref39","article-title":"Denial of service","author":"Nsrav","year":"2022"},{"key":"ref40","article-title":"Top threat 9 to cloud computing: Misconfiguration and exploitation of serverless and container workloads","author":"Group","year":"2022"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560629"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-2053-8"},{"key":"ref43","article-title":"2023 cloud security study","year":"2023"},{"key":"ref44","article-title":"Insecure Amazon S3 bucket exposed personal data on 500,000 Ghanaian graduates","year":"2022"},{"key":"ref45","article-title":"Sega Europe left AWS S3 bucket unsecured exposing data and infrastructure to attack","author":"Paganini","year":"2022"},{"key":"ref46","article-title":"Cloud misconfig exposes 3TB of sensitive airport data in Amazon S3 bucket: \u2019lives at stake","author":"Eddy","year":"2022"},{"key":"ref47","article-title":"Cloud incident response","author":"Alliance","year":"9 2021"},{"key":"ref48","article-title":"OWASP serverless top 10 serverless application security vulnerabilities","author":"Project","year":"2021"},{"key":"ref49","article-title":"Why cloud technology is expected to dominate 2021","year":"2021"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1016\/j.artmed.2017.07.002"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.tre.2020.102025"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3559104"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-842X.2011.00622.x"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.2307\/2332613"},{"key":"ref55","article-title":"A case study on the stability of performance tests for serverless applications","volume-title":"J. Syst. Softw.","volume":"189","author":"Eismann","year":"2022"},{"key":"ref56","article-title":"aws-serverless-airline-booking","author":"Lessa","year":"2021"},{"key":"ref57","article-title":"aws-serverless-airline-booking","year":"2021"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CCGrid59990.2024.00057"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104261"},{"key":"ref60","article-title":"Hunting through log data with excel","author":"Institute"},{"key":"ref61","article-title":"Using an elastic stack as a base for logging and evaluation of public displays","volume-title":"Proc. Mensch Comput. 2023 - Workshopband","author":"\u201dRohde","year":"2023"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.02.052"},{"issue":"10","key":"ref63","doi-asserted-by":"crossref","first-page":"958","DOI":"10.12720\/jcm.14.10.958-964","article-title":"Assessing the Internet of Things security risks","volume":"14","author":"Abbass","year":"2019","journal-title":"J. Commun."},{"key":"ref64","first-page":"2443","article-title":"ALASTOR: Reconstructing the provenance of serverless intrusions","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Datta","year":"2022"},{"key":"ref65","first-page":"4087","article-title":"Guarding serverless applications with Kalium","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Jegan","year":"2023"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM53939.2023.10228884"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/s13740-021-00122-1"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2021.3114843"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/VizSec53666.2021.00012"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2019.110432"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3417066"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/VizSec53666.2021.00007"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359805"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2015.7381796"}],"container-title":["IEEE Transactions on Cloud Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6245519\/11278842\/11122875.pdf?arnumber=11122875","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,6]],"date-time":"2025-12-06T06:58:45Z","timestamp":1765004325000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11122875\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":74,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tcc.2025.3598060","relation":{},"ISSN":["2168-7161","2372-0018"],"issn-type":[{"value":"2168-7161","type":"electronic"},{"value":"2372-0018","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10]]}}}