{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T09:07:32Z","timestamp":1781255252789,"version":"3.54.1"},"reference-count":55,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"UT-Battelle, LLC","award":["DE-AC05-000R22725"],"award-info":[{"award-number":["DE-AC05-000R22725"]}]},{"name":"US Department of Energy"},{"DOI":"10.13039\/100000015","name":"Department of Energy","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100000015","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100007000","name":"Laboratory Directed Research and Development Program","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100007000","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100007000","name":"Laboratory Directed Research and Development","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100007000","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Dept. of Homeland Security Science & Technology Directorate"},{"name":"HSARPA"},{"name":"Cyber Security Division"},{"name":"DARPA XAI program","award":["N66001-17-2-4031"],"award-info":[{"award-number":["N66001-17-2-4031"]}]},{"DOI":"10.13039\/100011039","name":"IARPA","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100011039","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Visual. Comput. Graphics"],"published-print":{"date-parts":[[2019,1]]},"DOI":"10.1109\/tvcg.2018.2865029","type":"journal-article","created":{"date-parts":[[2018,8,20]],"date-time":"2018-08-20T18:18:53Z","timestamp":1534789133000},"page":"204-214","source":"Crossref","is-referenced-by-count":52,"title":["Situ: Identifying and Explaining Suspicious Behavior in Networks"],"prefix":"10.1109","volume":"25","author":[{"given":"John R.","family":"Goodall","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Eric D.","family":"Ragan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chad A.","family":"Steed","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Joel W.","family":"Reed","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"G. David","family":"Richardson","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kelly M.T.","family":"Huffer","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Robert A.","family":"Bridges","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jason A.","family":"Laska","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","first-page":"829404","article-title":"Streamsqueeze: a dynamic stream visualization for monitoring of event data","volume":"8294","author":"mansmann","year":"2012","journal-title":"Visualization and Data Analysis"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ITNG.2011.161"},{"key":"ref33","year":"0","journal-title":"Specification of the IP Flow Information Export (IPFIX) protocol for the exchange of flow information"},{"key":"ref32","year":"0","journal-title":"Cisco Systems NetFlow Services Export Version 9"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3064814.3064828"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3064814.3064828"},{"key":"ref37","first-page":"1269","article-title":"Viztree: a tool for visually mining and monitoring massive time series databases","volume":"30","author":"lin","year":"2004","journal-title":"Proceedings of the Thirtieth international conference on Very large data bases"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/508791.508835"},{"key":"ref35","first-page":"1","article-title":"Cognitive modeling of polymorphic malware using fractal based semantic characterization","author":"khan","year":"2017","journal-title":"Technologies for Homeland Security (HST) 2017 IEEE Symposium on"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.20532\/cit.2016.1002701"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-8659.2008.01222.x"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/1898147.1898149"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2897795.2897806"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2007.79"},{"key":"ref1","year":"2006","journal-title":"Skaion 2006 IARPA dataset"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1108\/09593840910962186"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/1031607.1031663"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/THS.2009.5168026"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2006.31"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CEC.2009.74"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.47"},{"key":"ref50","article-title":"Visual problem-solving support for new event triage in centralized network security monitoring: Challenges, tools and benefits","author":"stolze","year":"2003","journal-title":"IT-Incident Management & IT-Forensics - Erste Tagung der Fachgruppe SIDAR der Gesellschaft für Informatik"},{"key":"ref51","year":"0","journal-title":"TCPDUMP\/LIBPCAP public repository"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2016.10.030"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2006.255127"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2007.70589"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1108\/09685221011035241"},{"key":"ref10","first-page":"199","article-title":"Minds-minnesota intrusion detection system","author":"ertoz","year":"2004","journal-title":"Next Generation Data Mining"},{"key":"ref11","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1007\/978-1-4615-0953-0_4","article-title":"A geometric framework for unsupervised anomaly detection","author":"eskin","year":"2002","journal-title":"Applications of Data Mining in Computer Security"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/1357054.1357286"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CICYBS.2011.5949386"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2012.151"},{"key":"ref14","author":"ferragut","year":"2016","journal-title":"Detection of anomalous events"},{"key":"ref15","author":"ferragut","year":"2016","journal-title":"Real-time detection and classification of anomalous events in streaming data"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2009.5375542"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/1921168.1921179"},{"key":"ref18","year":"2014","journal-title":"Net Losses Estimating the Global Cost of Cybercrime Economic Impact of Cybercrime II"},{"key":"ref19","year":"0","journal-title":"Apache Kafka"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850805"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029217"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2494502"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2017.8258031"},{"key":"ref8","year":"0","journal-title":"Elasticsearch RESTful Distributed Search & Analytics 1 Elastic"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1177\/154193120504900304"},{"key":"ref49","year":"0","journal-title":"Siem aiops application management log management machine learning and compliance - splunk"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1518\/001872095779049543"},{"key":"ref46","year":"0","journal-title":"Argus - Auditing Network Activity"},{"key":"ref45","year":"0","journal-title":"RabbitMQ-Messaging That Just Works"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICNSC.2006.1673246"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/586143.586146"},{"key":"ref42","year":"0","journal-title":"About nanomsg"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CCAA.2016.7813926"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2663887.2663899"},{"key":"ref43","year":"0","journal-title":"Nats - open source messaging system"}],"container-title":["IEEE Transactions on Visualization and Computer Graphics"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/2945\/8547224\/08440825.pdf?arnumber=8440825","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,13]],"date-time":"2022-07-13T20:54:49Z","timestamp":1657745689000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8440825\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,1]]},"references-count":55,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tvcg.2018.2865029","relation":{},"ISSN":["1077-2626","1941-0506","2160-9306"],"issn-type":[{"value":"1077-2626","type":"print"},{"value":"1941-0506","type":"electronic"},{"value":"2160-9306","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,1]]}}}