<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-03364573</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-21T10:21:28+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Data-Driven Field Mapping of Security Logs for Integrated Monitoring</title>
            <author role="aut">
              <persName>
                <forename type="first">Seungoh</forename>
                <surname>Choi</surname>
              </persName>
              <email type="md5">b7abe928ba4a792f8423c2211e7ed77e</email>
              <email type="domain">nsr.re.kr</email>
              <idno type="idhal" notation="numeric">1112207</idno>
              <idno type="halauthorid" notation="string">1102833-1112207</idno>
              <affiliation ref="#struct-171895"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Yesol</forename>
                <surname>Kim</surname>
              </persName>
              <idno type="halauthorid">2298718-0</idno>
              <affiliation ref="#struct-171895"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jeong-Han</forename>
                <surname>Yun</surname>
              </persName>
              <idno type="halauthorid">1102835-0</idno>
              <affiliation ref="#struct-171895"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Byung-Gil</forename>
                <surname>Min</surname>
              </persName>
              <idno type="halauthorid">2298719-0</idno>
              <affiliation ref="#struct-171895"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Hyoung-Chun</forename>
                <surname>Kim</surname>
              </persName>
              <idno type="halauthorid">2298720-0</idno>
              <affiliation ref="#struct-171895"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2021-10-04 17:49:53</date>
              <date type="whenModified">2021-11-03 07:05:58</date>
              <date type="whenReleased">2021-10-04 17:55:12</date>
              <date type="whenProduced">2019-03-11</date>
              <date type="whenEndEmbargoed">2022-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-03364573v1/document">
                <date notBefore="2022-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-03364573v1/file/491841_1_En_13_Chapter.pdf" id="file-3364573-2952459">
                <date notBefore="2022-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-03364573</idno>
            <idno type="halUri">https://inria.hal.science/hal-03364573</idno>
            <idno type="halBibtex">choi:hal-03364573</idno>
            <idno type="halRefHtml">&lt;i&gt;13th International Conference on Critical Infrastructure Protection (ICCIP)&lt;/i&gt;, Mar 2019, Arlington, VA, United States. pp.253-268, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-030-34647-8_13"&gt;&amp;#x27E8;10.1007/978-3-030-34647-8_13&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">13th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2019, Arlington, VA, United States. pp.253-268, &amp;#x27E8;10.1007/978-3-030-34647-8_13&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-3364573-2952459"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-ICCIP" corresp="IFIP-AICT">IFIP-ICCIP</idno>
            <idno type="stamp" n="IFIP-WG11-10" corresp="IFIP-AICT">IFIP-WG11-10</idno>
            <idno type="stamp" n="IFIP-AICT-570" corresp="IFIP-AICT">Critical Infrastructure Protection XIII</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 5: Cyber-Physical Systems Security</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Data-Driven Field Mapping of Security Logs for Integrated Monitoring</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Seungoh</forename>
                    <surname>Choi</surname>
                  </persName>
                  <email type="md5">b7abe928ba4a792f8423c2211e7ed77e</email>
                  <email type="domain">nsr.re.kr</email>
                  <idno type="idhal" notation="numeric">1112207</idno>
                  <idno type="halauthorid" notation="string">1102833-1112207</idno>
                  <affiliation ref="#struct-171895"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Yesol</forename>
                    <surname>Kim</surname>
                  </persName>
                  <idno type="halauthorid">2298718-0</idno>
                  <affiliation ref="#struct-171895"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jeong-Han</forename>
                    <surname>Yun</surname>
                  </persName>
                  <idno type="halauthorid">1102835-0</idno>
                  <affiliation ref="#struct-171895"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Byung-Gil</forename>
                    <surname>Min</surname>
                  </persName>
                  <idno type="halauthorid">2298719-0</idno>
                  <affiliation ref="#struct-171895"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Hyoung-Chun</forename>
                    <surname>Kim</surname>
                  </persName>
                  <idno type="halauthorid">2298720-0</idno>
                  <affiliation ref="#struct-171895"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>13th International Conference on Critical Infrastructure Protection (ICCIP)</title>
                  <date type="start">2019-03-11</date>
                  <date type="end">2019-03-12</date>
                  <settlement>Arlington, VA</settlement>
                  <country key="US">United States</country>
                </meeting>
                <editor>Jason Staggs</editor>
                <editor>Sujeet Shenoi</editor>
                <imprint>
                  <publisher>Springer International Publishing</publisher>
                  <biblScope unit="serie">Critical Infrastructure Protection XIII</biblScope>
                  <biblScope unit="volume">AICT-570</biblScope>
                  <biblScope unit="pp">253-268</biblScope>
                  <date type="datePub">2019</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-030-34647-8_13</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">integrated system monitoring</term>
                <term xml:lang="en">event logs</term>
                <term xml:lang="en">Security</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>As industrial control system vulnerabilities and attacks increase, security controls must be applied to operational technologies. The growing demand for security threat monitoring and analysis techniques that integrate information from security logs has resulted in enterprise security management systems giving way to security information and event management systems. Nevertheless, it is vital to implement some form of pre-processing to collect, integrate and analyze security events efficiently. Operators still have to manually check entire security logs or write scripts or parsers that draw on domain knowledge, tasks that are time-consuming and error-prone.To address these challenges, this chapter focuses on the data-driven mapping of security logs to support the integrated monitoring of operational technology systems. The characteristics of security logs from security appliances used in critical infrastructure assets are analyzed to create a tool that maps different security logs to field categories to support integrated system monitoring. The tool reduces the effort needed by operators to manually process security logs even when the logged data generated by security appliances has new or modified formats.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
              <org type="consortium">WG 11.10</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-171895" status="VALID">
          <idno type="ROR">https://ror.org/03ysstz10</idno>
          <orgName>Electronics and Telecommunications Research Institute [DaeJeon]</orgName>
          <orgName type="acronym">ETRI</orgName>
          <desc>
            <address>
              <addrLine>161 Gajeong-Dong, YuSeong-Gu, DaeJeon, 305-700</addrLine>
              <country key="KR"/>
            </address>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>