{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:43:34Z","timestamp":1750308214246,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":18,"publisher":"ACM","license":[{"start":{"date-parts":[[2004,10,29]],"date-time":"2004-10-29T00:00:00Z","timestamp":1099008000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2004,10,29]]},"DOI":"10.1145\/1029208.1029227","type":"proceedings-article","created":{"date-parts":[[2005,1,30]],"date-time":"2005-01-30T17:58:48Z","timestamp":1107107928000},"page":"119-123","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["Scatter (and other) plots for visualizing user profiling data and network traffic"],"prefix":"10.1145","author":[{"given":"Tom","family":"Goldring","sequence":"first","affiliation":[{"name":"National Security Agency"}]}],"member":"320","published-online":{"date-parts":[[2004,10,29]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"ftp:\/\/ftp.njit.edu\/pub\/manikopo\/data.  ftp:\/\/ftp.njit.edu\/pub\/manikopo\/data."},{"key":"e_1_3_2_1_2_1","unstructured":"www.ll.mit.edu\/IST\/ideval\/data\/data_index.html.  www.ll.mit.edu\/IST\/ideval\/data\/data_index.html."},{"key":"e_1_3_2_1_3_1","unstructured":"Joint work with m. s. postol.  Joint work with m. s. postol."},{"key":"e_1_3_2_1_4_1","unstructured":"Renoir: General network visualization and manipulation program. http:\/\/www.nsa.gov\/techtrans\/techt00013.cfm.  Renoir: General network visualization and manipulation program. http:\/\/www.nsa.gov\/techtrans\/techt00013.cfm."},{"key":"e_1_3_2_1_5_1","volume-title":"AAAI\/ICML 1998 Workshop on Predicting the Future","author":"Davison B.","year":"1998","unstructured":"B. Davison and H. Hirsch . Predicting sequences of user actions . In AAAI\/ICML 1998 Workshop on Predicting the Future , 1998 . B. Davison and H. Hirsch. Predicting sequences of user actions. In AAAI\/ICML 1998 Workshop on Predicting the Future, 1998."},{"key":"e_1_3_2_1_6_1","volume-title":"Analyzing process table and window title data for user identification in a windows environment","author":"DeVault K.","year":"2004","unstructured":"K. DeVault , N. Tucey , and D. Marchette . Analyzing process table and window title data for user identification in a windows environment . Naval Surface Warfare Center , NSWCDD\/TR-03\/122, 2004 . K. DeVault, N. Tucey, and D. Marchette. Analyzing process table and window title data for user identification in a windows environment. Naval Surface Warfare Center, NSWCDD\/TR-03\/122, 2004."},{"key":"e_1_3_2_1_7_1","volume-title":"ICDM Workshop on Data Mining for Computer Security","author":"Goldring T.","year":"2003","unstructured":"T. Goldring . Authenticating users by profiling behavior . In ICDM Workshop on Data Mining for Computer Security . Melbourne, Florida , November 2003 . T. Goldring. Authenticating users by profiling behavior. In ICDM Workshop on Data Mining for Computer Security. Melbourne, Florida, November 2003."},{"key":"e_1_3_2_1_8_1","unstructured":"Javitz and Valdes. The nides statistical component description and justification. http:\/\/www.sdl.sri.com\/projects\/nides\/reports\/statreport.ps.gz.  Javitz and Valdes. The nides statistical component description and justification. http:\/\/www.sdl.sri.com\/projects\/nides\/reports\/statreport.ps.gz."},{"key":"e_1_3_2_1_9_1","volume-title":"AAAI-97 Workshop on AI Approaches to Fraud Detection and Risk Management","author":"Lane T.","year":"1997","unstructured":"T. Lane and C. E. Brodley . Sequence matching and learning in anomaly detection for computer security . In AAAI-97 Workshop on AI Approaches to Fraud Detection and Risk Management . Providence, RI , 1997 . T. Lane and C. E. Brodley. Sequence matching and learning in anomaly detection for computer security. In AAAI-97 Workshop on AI Approaches to Fraud Detection and Risk Management. Providence, RI, 1997."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"crossref","DOI":"10.1007\/978-1-4757-3458-4","volume-title":"Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint","author":"Marchette D.","year":"2001","unstructured":"D. Marchette . Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint . Springer Verlag , 2001 . D. Marchette. Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint. Springer Verlag, 2001."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/12.980003"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.5555\/647883.738240"},{"key":"e_1_3_2_1_14_1","volume-title":"Air Force Research Laboratory, AFRL-SN-WP-TR-2002-1102","author":"Reiher P.","year":"2002","unstructured":"P. Reiher . File profiling for insider threats. Sensors Directorate , Air Force Research Laboratory, AFRL-SN-WP-TR-2002-1102 , 2002 . P. Reiher. File profiling for insider threats. Sensors Directorate, Air Force Research Laboratory, AFRL-SN-WP-TR-2002-1102, 2002."},{"key":"e_1_3_2_1_15_1","volume-title":"Fourth International Symposium on Recent Advances in Intrusion Detection","author":"Shavlik J.","year":"2001","unstructured":"J. Shavlik , M. Shavlik , and M. Fahland . Evaluating software sensors for actively profiling windows 2000 computer users . In Fourth International Symposium on Recent Advances in Intrusion Detection . Davis, CA , 2001 . J. Shavlik, M. Shavlik, and M. Fahland. Evaluating software sensors for actively profiling windows 2000 computer users. In Fourth International Symposium on Recent Advances in Intrusion Detection. Davis, CA, 2001."},{"key":"e_1_3_2_1_16_1","unstructured":"T. Spyrou and J. Darzentas. Intention modeling: Approximating computer user intentions for detection and prediction of intrusions. In S. K. Katsikas and D. Gritzalis (eds.) Information Systems Security: Facing the Information Society of the 21'st Century.   T. Spyrou and J. Darzentas. Intention modeling: Approximating computer user intentions for detection and prediction of intrusions. In S. K. Katsikas and D. Gritzalis (eds.) Information Systems Security: Facing the Information Society of the 21'st Century."},{"key":"e_1_3_2_1_17_1","unstructured":"D. Swayne D. Cook A. Buja and D. Lang. gobi manual. http:\/\/www.ggobi.org\/manual.pdf 2003.  D. Swayne D. Cook A. Buja and D. Lang. gobi manual. http:\/\/www.ggobi.org\/manual.pdf 2003."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/829514.830544"},{"issue":"1","key":"e_1_3_2_1_19_1","first-page":"12","article-title":"Intrusion detection based on structural zeroes","volume":"9","author":"Theus M.","year":"1998","unstructured":"M. Theus and M. Schonlau . Intrusion detection based on structural zeroes . Statistical Computing & Graphics Newsletter , 9 ( 1 ): 12 -- 17 , 1998 . M. Theus and M. Schonlau. Intrusion detection based on structural zeroes. Statistical Computing & Graphics Newsletter, 9(1):12--17, 1998.","journal-title":"Statistical Computing & Graphics Newsletter"}],"event":{"name":"CCS04: 11th ACM Conference on Computer and Communications Security 2004","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control","ACM Association for Computing Machinery"],"location":"Washington DC USA","acronym":"CCS04"},"container-title":["Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1029208.1029227","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1029208.1029227","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T16:31:07Z","timestamp":1750264267000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1029208.1029227"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2004,10,29]]},"references-count":18,"alternative-id":["10.1145\/1029208.1029227","10.1145\/1029208"],"URL":"https:\/\/doi.org\/10.1145\/1029208.1029227","relation":{},"subject":[],"published":{"date-parts":[[2004,10,29]]},"assertion":[{"value":"2004-10-29","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}