The DOI matches its Crossref record; 37 of the 37 references it cites were found in a registry or an index.
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks
Abstract
As more and more Internet-based attacks arise, organizations are responding by deploying an assortment of security products that generate situational intelligence in the form of logs. These logs often contain high volumes of interesting and useful information about activities in the network, and are among the first data sources that information security specialists consult when they suspect that an attack has taken place. However, security products often come from a patchwork of vendors, and are inconsistently installed and administered. They generate logs whose formats differ widely and that are often incomplete, mutually contradictory, and very large in volume. Hence, although this collected information is useful, it is often dirty.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Finding groups in data: an introduction to cluster analysis
(1991) · Choice Reviews Online · doi:10.5860/choice.28-4558 · Cited by 10,474
Goodall, C. (1988) · Technometrics · doi:10.1080/00401706.1988.10488412 · Cited by 8,675
Jolliffe, I. T. (1986) · Springer Series in Statistics · doi:10.1007/978-1-4757-1904-8 · Cited by 8,273
Finding Groups in Data: An Introduction to Cluster Analysis
Kaufman, L., & Rousseeuw, P. J. (1990) · Wiley Series in Probability and Statistics · doi:10.1002/9780470316801 · Cited by 7,344 · cited 1×
“Our algorithm is an adaptation of the K-means clustering algorithm, but does not require the number of clusters to be specified in advance [25].”
MethodGu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033
Beyond blacklists: learning to detect malicious web sites from suspicious URLs
Ma, J., Saul, L. K., Savage, S., & Voelker, G. M. (2009) · Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining · doi:10.1145/1557019.1557153 · Cited by 803
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702
BotHunter: detecting malware infection through IDS-driven dialog correlation
Gu, G., Porras, P. A., Yegneswaran, V., Fong, M. W., & Lee, W. (2007) · Cited by 696
A multifaceted approach to understanding the botnet phenomenon
Abu Rajab, M., Zarfoss, J., Monrose, F., & Terzis, A. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177086 · Cited by 595
Your botnet is my botnet: analysis of a botnet takeover
Stone-Gross, B., Cova, M., Cavallaro, L., Gilbert, B., Szydlowski, M., Kemmerer, R., Kruegel, C., & Vigna, G. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653738 · Cited by 577
Research works printed but not linked: 7
- 10.1145/1269880.1269886 · doi:10.1145/1269880.1269886
- 10.5555/1317531.1317931 · doi:10.5555/1317531.1317931
- 10.1007/11555827_19 · doi:10.1007/11555827_19
- C. Livadas , R. Walsh , D. Lapsley , and W. Strayer . Using Machine Learning Techniques to Identify Botnet Traffic . In IEEE LCN , 2006 . C. Livadas, R. Walsh, D. Lapsley, and W. Strayer. Using Machine Learning Techniques to Identify Botnet Traffic. In IEEE LCN, 2006.
- 10.1007/978-3-540-87357-0_2 · doi:10.1007/978-3-540-87357-0_2
- 10.1145/1529282.1529734 · doi:10.1145/1529282.1529734
- 10.1109/DSN.2012.6263961 · doi:10.1109/dsn.2012.6263961
Cited by
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534113 · Cited by 454
Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3363224 · Cited by 319
Cyber threat detection based on artificial neural networks using event profiles
Lee, J., Kim, J., Kim, I., & Han, K. (2019) · IEEE Access · doi:10.1109/access.2019.2953095 · Cited by 188
“eral, SIEM collects relevant data produced in an organization from various sources, making it possible to detect cyber threats by matching patterns [17]–[19].”
BackgroundAnomaly-Based Insider Threat Detection Using Deep Autoencoders
Liu, L., De Vel, O., Chen, C., Zhang, J., & Xiang, Y. (2018) · 2018 IEEE International Conference on Data Mining Workshops (ICDMW) · doi:10.1109/icdmw.2018.00014 · Cited by 79
Metadata
- Authors
- Yen, T.-F., Oprea, A., Onarlioglu, K., Leetham, T., Robertson, W., Juels, A., & Kirda, E.
- Venue
- Proceedings of the 29th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2013-12-09
- Pages
- 199-208
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W1990089904
- Cited by
- 270
- References
- 37
- FWCI
- 13.08
- Type
- conference paper
- Language
- en
- Open access
- closed
- Funders
- Division of Computer and Network Systems (CNS-1116777)
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks. https://app.cochat.ai/papers/10.1145/2523649.2523670
- The paper
- Yen, T.-F., Oprea, A., Onarlioglu, K., Leetham, T., Robertson, W., Juels, A., & Kirda, E. (2013). Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks. Proceedings of the 29th Annual Computer Security Applications Conference. https://doi.org/10.1145/2523649.2523670
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
