{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T12:43:37Z","timestamp":1740141817037,"version":"3.37.3"},"reference-count":16,"publisher":"SAGE Publications","issue":"9","license":[{"start":{"date-parts":[[2015,9,1]],"date-time":"2015-09-01T00:00:00Z","timestamp":1441065600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"funder":[{"name":"Ministry of Science, ICT, and Future Planning","award":["G-14-GM-IR02","K-14-L06-C15-S01"],"award-info":[{"award-number":["G-14-GM-IR02","K-14-L06-C15-S01"]}]},{"DOI":"10.13039\/501100003708","name":"Korea Institute of Science and Technology Information","doi-asserted-by":"publisher","award":["G-14-GM-IR02","K-14-L06-C15-S01"],"award-info":[{"award-number":["G-14-GM-IR02","K-14-L06-C15-S01"]}],"id":[{"id":"10.13039\/501100003708","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Distributed Sensor Networks"],"published-print":{"date-parts":[[2015,9,1]]},"abstract":"<jats:p> We present an automated verification methodology of the security events, that is, IDS alerts, based on heuristic analysis. The proposed verification methodology aims to automatically identify real cyberattacks from the security events and filter out false positive, so that the security analyst is able to conduct security monitoring and response more effectively. For the proposed verification methodology, we used the 1,528,730,667 security events that were obtained from Science and Technology Security Center (S&amp;T-SEC). We then extracted the core security events that were caused by the real cyberattacks. Among the core security events, we selected the top 20 types of the security events in the number of the real attacks that they raised. By analyzing the top 20 types of the security events, we discovered essential elements and optional elements for using in the automated verification of the security events. The evaluation results showed that the proposed verification methodology could contribute to the reduction (about 67%) of the meaningless security events. Furthermore, we demonstrated that the proposed verification methodology contributed to the detection of 140 true negatives that were not identified by the security analyst and the total accuracy of the proposed verification methodology was 96.1%. <\/jats:p>","DOI":"10.1155\/2015\/817918","type":"journal-article","created":{"date-parts":[[2015,9,27]],"date-time":"2015-09-27T21:03:51Z","timestamp":1443387831000},"page":"817918","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":1,"title":["Automated Verification Methodology of Security Events Based on Heuristic Analysis"],"prefix":"10.1177","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1755-8636","authenticated-orcid":false,"given":"Jungsuk","family":"Song","sequence":"first","affiliation":[{"name":"Korea Institute of Science and Technology Information, Daejeon 305-806, Republic of Korea"},{"name":"Korea University of Science and Technology, Daejeon 305-350, Republic of Korea"}]},{"given":"Younsu","family":"Lee","sequence":"additional","affiliation":[{"name":"Korea Institute of Science and Technology Information, Daejeon 305-806, Republic of Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4861-1970","authenticated-orcid":false,"given":"Kyuil","family":"Kim","sequence":"additional","affiliation":[{"name":"Korea Institute of Science and Technology Information, Daejeon 305-806, Republic of Korea"}]},{"given":"Seokhun","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Mobile Media, Suwon Women's University, Suwon 441-748, Republic of Korea"}]},{"given":"SooKyun","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Game Engineering, Pai Chai University, Daejeon 302-735, Republic of Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4833-3966","authenticated-orcid":false,"given":"Sang-Soo","family":"Choi","sequence":"additional","affiliation":[{"name":"Korea Institute of Science and Technology Information, Daejeon 305-806, Republic of Korea"}]}],"member":"179","published-online":{"date-parts":[[2015,9,27]]},"reference":[{"key":"B1-2015-817918","doi-asserted-by":"publisher","DOI":"10.1109\/tse.1987.232894"},{"key":"B2-2015-817918","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24852-133"},{"key":"B3-2015-817918","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39945-3"},{"key":"B4-2015-817918","series-title":"Lecture Notes in Artificial Intelligence","first-page":"184","volume-title":"Proceedings of the International Conference on Machine Learning and Data Mining (MLDM \u201805)","volume":"3587","author":"Giacinto G."},{"first-page":"74","volume-title":"Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID \u201802)","author":"Ning P.","key":"B5-2015-817918"},{"key":"B6-2015-817918","doi-asserted-by":"publisher","DOI":"10.1007\/118562141"},{"key":"B7-2015-817918","doi-asserted-by":"publisher","DOI":"10.4304\/jnw.5.1.88-97"},{"first-page":"245","volume-title":"Proceedings of the 9th ACM Conference on Computer and Communications Security","author":"Ning P.","key":"B8-2015-817918"},{"first-page":"97","volume-title":"Proceedings of the 11th Annual Network and Distributed System Security (NDSS \u201804)","author":"Ning P.","key":"B9-2015-817918"},{"key":"B10-2015-817918","doi-asserted-by":"publisher","DOI":"10.1145\/996943.996947"},{"key":"B11-2015-817918","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0103-3"},{"first-page":"51","volume-title":"Proceedings of the International Symposium on Applications and the Internet (SAINT \u201808)","author":"Song J.","key":"B12-2015-817918"},{"key":"B13-2015-817918","doi-asserted-by":"publisher","DOI":"10.1109\/infvis.2005.1532134"},{"key":"B14-2015-817918","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029219"},{"first-page":"19","volume-title":"Proceedings of the International Conference on Intelligence Fusion (ICIF \u201813)","author":"Song J. S.","key":"B15-2015-817918"},{"key":"B17-2015-817918","doi-asserted-by":"publisher","DOI":"10.1002\/sec.796"}],"container-title":["International Journal of Distributed Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1155\/2015\/817918","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/full-xml\/10.1155\/2015\/817918","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1155\/2015\/817918","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,5,7]],"date-time":"2021-05-07T12:41:13Z","timestamp":1620391273000},"score":1,"resource":{"primary":{"URL":"http:\/\/journals.sagepub.com\/doi\/10.1155\/2015\/817918"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,9,1]]},"references-count":16,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2015,9,1]]}},"alternative-id":["10.1155\/2015\/817918"],"URL":"https:\/\/doi.org\/10.1155\/2015\/817918","relation":{},"ISSN":["1550-1477","1550-1477"],"issn-type":[{"type":"print","value":"1550-1477"},{"type":"electronic","value":"1550-1477"}],"subject":[],"published":{"date-parts":[[2015,9,1]]}}}