{ "schema_version": "0.1.0", "record_type": "research-topic", "topic_id": "anomaly-detection", "label": "Anomaly Detection", "title": "Systems Anomaly Detection Research", "description": "Research papers on anomaly detection in traces, logs, performance data, cloud systems, and IoT environments.", "introduction": "This topic addresses detecting behavior that differs from normal execution, service, workload, or network patterns. The papers cover statistical screening, clustering, sequence analysis, log parsing, trace evidence, and classification, with the individual records preserving the datasets, labels, baselines, and metrics used.", "aliases": [ "systems anomaly detection", "performance anomaly detection", "trace anomaly detection" ], "search_terms": [ "anomaly detection", "performance anomalies", "trace anomalies", "log anomaly detection", "IoT anomaly detection" ], "related_topics": [ "machine-learning", "performance-analysis", "root-cause-analysis", "observability", "predictive-monitoring" ], "canonical_url": "https://threadslab.org/research-publications/topics/anomaly-detection.html", "paper_count": 25, "papers": [ { "paper_id": "b-perf-black-box-performance-antipatterns", "title": "B-Perf: Black-box Performance Antipattern Detection Using System-level Execution Tracing", "year": 2026, "authors": [ "Morteza Noferesti", "Mahsa Panahandeh", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/b-perf-black-box-performance-antipatterns/", "canonical_source_url": "https://doi.org/10.1145/3777884.3797014", "core_contribution": "B-Perf reconstructs execution, memory, and messaging behavior from Linux kernel-level traces and infers performance-antipattern indicators without requiring application source access or intrusive instrumentation.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "anomaly-detection" ], "keywords": [ "performance antipatterns", "black-box detection", "system-level execution traces", "LTTng", "Trace Compass", "critical paths", "resource contention", "execution serialization", "allocation churn", "small-message overhead" ] }, { "paper_id": "lmat-adaptive-tracing-language-models", "title": "LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models", "year": 2026, "authors": [ "Kasra Darvishi", "Morteza Noferesti", "Yuvraj Sehgal", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/lmat-adaptive-tracing-language-models/", "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112890", "core_contribution": "LMAT combines multi-task language models for kernel-event and event-duration prediction with online change detection, lightweight error-vector root-cause analysis, and adaptive tracing control.", "tags": [ "kernel-tracing", "system-tracing", "llm-assisted-analysis", "observability", "anomaly-detection", "root-cause-analysis", "trace-reduction" ], "keywords": [ "adaptive tracing", "LTTng", "kernel events", "system-call sequences", "event-duration modeling", "language models", "LSTM", "BERT", "multi-task learning", "HDBSCAN", "change detection", "root-cause analysis", "Apache", "Sock Shop", "OpenTelemetry", "Prometheus", "stress-ng", "trace reduction", "trace overhead" ] }, { "paper_id": "developing-a-taxonomy-for-advanced-log-parsing-techniques", "title": "Developing a Taxonomy for Advanced Log Parsing Techniques", "year": 2025, "authors": [ "Issam Sedki", "Abdelwahab Hamou-Lhadj", "Otmane Ait Mohamed", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/developing-a-taxonomy-for-advanced-log-parsing-techniques/", "canonical_source_url": "https://doi.org/10.1109/ICPC66645.2025.00061", "core_contribution": "The paper introduces a taxonomy of log-event characteristics that explains why different log parsers fail across systems and parser families.", "tags": [ "observability", "trace-analysis", "anomaly-detection", "performance-analysis" ], "keywords": [ "log parsing", "log event characteristics", "LEC taxonomy", "LogHub", "Drain", "IPLoM", "AEL", "Spell", "LenMa", "LogMine", "SHISO", "ULP", "open coding", "regex", "NER", "chi-square", "parser errors", "token structure" ] }, { "paper_id": "efficient-communication-performance-antipattern-detection-microservices", "title": "Efficient Detection of Communication-related Performance Anti-patterns in Microservices", "year": 2025, "authors": [ "Masoumeh Nourollahi", "Naser Ezzati-Jivan", "Adel Belkheiri", "Michel Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/efficient-communication-performance-antipattern-detection-microservices/", "canonical_source_url": "https://doi.org/10.22541/au.175533132.24109345/v1", "core_contribution": "The preprint combines communication-related kernel/system-call events with distributed traces to detect communication performance anti-patterns in microservices.", "tags": [ "microservices", "system-tracing", "anomaly-detection", "machine-learning", "performance-analysis" ], "keywords": [ "communication anti-patterns", "DeathStarBench", "LTTng", "Trace Compass", "Jaeger", "system calls", "distributed traces", "Blob", "Empty Semi Trucks", "supervised learning", "semi-supervised learning" ] }, { "paper_id": "synthlogai-synthetic-linux-log-generation", "title": "SynthLogAI: Generative AI for Synthetic Linux Log Generation and Evaluation", "year": 2025, "authors": [ "Hridoy Rahman", "Naser Ezzati-Jivan", "Blessing Ogbuokiri" ], "page_url": "https://threadslab.org/research-publications/papers/synthlogai-synthetic-linux-log-generation/", "canonical_source_url": "https://doi.org/10.1109/CASCON66301.2025.00032", "core_contribution": "SynthLogAI benchmarks statistical, sequence, transformer, and prompt-based generative models for producing synthetic Linux logs while measuring fidelity, downstream utility, and privacy.", "tags": [ "machine-learning", "observability", "anomaly-detection", "system-tracing" ], "keywords": [ "synthetic Linux logs", "generative AI", "log generation", "log evaluation", "CASCON 2025" ] }, { "paper_id": "iot-anomaly-classification-cnn-bilstm-two-tiered", "title": "A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model", "year": 2024, "authors": [ "Yue Guan", "Morteza Noferesti", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/iot-anomaly-classification-cnn-bilstm-two-tiered/", "canonical_source_url": "https://doi.org/10.1016/j.simpa.2024.100646", "core_contribution": "The paper proposes a two-tier IoT intrusion detector that first separates normal from anomalous flows and then classifies the attack type with a CNN-BiLSTM model.", "tags": [ "iot-security", "anomaly-detection", "machine-learning", "deep-learning-systems" ], "keywords": [ "IoT anomaly detection", "CNN-BiLSTM", "SMOTE", "particle swarm optimization", "PSO", "Software Impacts", "classification" ] }, { "paper_id": "context-aware-root-cause-localization-in-distributed-traces-using-social-network-analysis-work-i", "title": "Context-aware Root Cause Localization in Distributed Traces Using Social Network Analysis (Work In Progress paper)", "year": 2024, "authors": [ "Mahsa Panahandeh", "Naser Ezzati-Jivan", "Abdelwahab Hamou-Lhadj", "James Miller" ], "page_url": "https://threadslab.org/research-publications/papers/context-aware-root-cause-localization-in-distributed-traces-using-social-network-analysis-work-i/", "canonical_source_url": "https://doi.org/10.1145/3629527.3651426", "core_contribution": "The work-in-progress paper combines service-call graph context, social-network analysis, and spectrum-based fault localization to rank distributed-trace root causes.", "tags": [ "root-cause-analysis", "microservices", "social-network-analysis", "anomaly-detection", "performance-analysis" ], "keywords": [ "context-aware RCA", "service-call graph", "distributed traces", "service communities", "Louvain", "PageRank", "Jaccard distance", "Ochiai", "CPU stress", "network delay", "network loss", "AIOps Challenge 2020" ] }, { "paper_id": "enhancing-performance-engineering-with-kernel-events", "title": "Enhancing empirical software performance engineering research with kernel-level events: A comprehensive system tracing approach", "year": 2024, "authors": [ "Morteza Noferesti", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/enhancing-performance-engineering-with-kernel-events/", "canonical_source_url": "https://doi.org/10.1016/j.jss.2024.112117", "core_contribution": "The paper releases a reusable Linux kernel-event and system-call artifact with controlled application workloads, injected resource noise, and analysis scenarios for software performance engineering.", "tags": [ "kernel-tracing", "system-tracing", "performance-engineering", "observability", "anomaly-detection" ], "keywords": [ "LTTng", "Linux kernel events", "system calls", "kernel tracepoints", "Elasticsearch", "Kibana", "IoT dataset", "stress-ng", "CPU noise", "I/O noise", "network noise", "memory noise", "software phase detection", "24,263,691 events" ] }, { "paper_id": "resource-life-cycle-aware-noise-detection-kernel-events", "title": "Resource Life-Cycle Aware Noise Detection via Kernel Event Monitoring", "year": 2024, "authors": [ "Morteza Noferesti", "Ben Grandy", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/resource-life-cycle-aware-noise-detection-kernel-events/", "canonical_source_url": "https://doi.org/10.1109/CASCON62161.2024.10838205", "core_contribution": "The paper detects and localizes performance noise by aligning passive kernel-event evidence with the life cycle of CPU, disk, and network requests rather than treating resource utilization as an undifferentiated aggregate.", "tags": [ "kernel-tracing", "system-tracing", "anomaly-detection", "performance-analysis" ], "keywords": [ "kernel event monitoring", "resource life cycle", "noise detection", "CPU requests", "disk requests", "network requests" ] }, { "paper_id": "toward-adaptive-tracing-language-models", "title": "Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models", "year": 2024, "authors": [ "Kasra Darvishi", "Morteza Noferesti", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/toward-adaptive-tracing-language-models/", "canonical_source_url": "https://doi.org/10.1145/3639476.3639778", "core_contribution": "The paper proposes an adaptive tracing loop that combines language-model prediction of kernel-event sequences and event durations with change detection and root-cause analysis, so detailed tracing is activated only around significant behavior shifts.", "tags": [ "kernel-tracing", "system-tracing", "llm-assisted-analysis", "observability", "anomaly-detection", "root-cause-analysis", "trace-reduction" ], "keywords": [ "adaptive tracing", "LTTng", "kernel events", "system-call sequences", "event-duration modeling", "language models", "LSTM", "BERT", "multi-task learning", "change detection", "root-cause analysis", "Apache2", "trace reduction", "trace overhead" ] }, { "paper_id": "cnn-bilstm-rpl-attacks-iot-smart-grid", "title": "CNN-BiLSTM-Based Classification of RPL Attacks in IoT Smart Grid Networks (Industry Track)", "year": 2023, "authors": [ "Yue Guan", "Morteza Noferesti", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/cnn-bilstm-rpl-attacks-iot-smart-grid/", "canonical_source_url": "https://doi.org/10.1145/3626562.3626832", "core_contribution": "The paper applies a CNN-BiLSTM intrusion classifier to RPL/IoT traffic, combining convolutional feature extraction with bidirectional sequence modeling after imbalance-aware flow preprocessing.", "tags": [ "iot-security", "deep-learning-systems", "machine-learning", "anomaly-detection" ], "keywords": [ "RPL attacks", "IoT smart grid", "CNN-BiLSTM", "routing attacks", "intrusion detection", "Middleware 2023" ] }, { "paper_id": "emd-scs-malware-detection-sonification-system-calls", "title": "EMD-SCS: A Dynamic Behavioral Approach for Early Malware Detection with Sonification of System Call Sequences", "year": 2023, "authors": [ "Raghav Bhardwaj", "Morteza Noferesti", "Madeline Janecek", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/emd-scs-malware-detection-sonification-system-calls/", "canonical_source_url": "https://doi.org/10.1109/TRUSTCOM60117.2023.00235", "core_contribution": "EMD-SCS combines sequence prediction of system calls with sonification so that partial execution prefixes can support early malware detection and an interpretable auditory alert.", "tags": [ "system-tracing", "anomaly-detection", "machine-learning", "performance-analysis" ], "keywords": [ "malware detection", "system-call sequences", "sonification", "Hamming distance", "detection rate", "false-positive rate", "EMD-SCS" ] }, { "paper_id": "identification-and-classification-of-jmh-microbenchmark-states-using-time-series-analysis", "title": "Identification and Classification of JMH Microbenchmark States using Time Series Analysis", "year": 2023, "authors": [ "Tom Wallace", "Beatrice M. Ombuki-Berman", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/identification-and-classification-of-jmh-microbenchmark-states-using-time-series-analysis/", "canonical_source_url": "https://doi.org/10.1145/3578245.3584694", "core_contribution": "The paper uses time-series analysis to identify and classify warmup, steady-state, and anomalous states in Java JMH microbenchmarks.", "tags": [ "performance-analysis", "performance-engineering", "anomaly-detection", "machine-learning" ], "keywords": [ "Java Microbenchmark Harness", "JMH", "benchmark states", "steady state", "warmup", "Matrix Profile", "motifs", "discords", "PELT", "change points", "Stumpy", "Ruptures", "time-series analysis" ] }, { "paper_id": "pasd-statistical-debugging-kernel-events", "title": "PASD: A Performance Analysis Approach Through the Statistical Debugging of Kernel Events", "year": 2023, "authors": [ "Mohammed Adib Khan", "Morteza Noferesti", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/pasd-statistical-debugging-kernel-events/", "canonical_source_url": "https://doi.org/10.1109/scam59687.2023.00025", "core_contribution": "PASD uses Linux kernel-event traces, Perf call stacks, and statistical debugging to rank functions associated with performance problems without application-source instrumentation.", "tags": [ "kernel-tracing", "performance-analysis", "root-cause-analysis", "anomaly-detection" ], "keywords": [ "statistical debugging", "Linux kernel tracepoints", "Perf", "perf record", "call stacks", "sched_switch", "Firefox", "Coreutils", "ls", "Bug 1637586", "Bug 1565019", "function suspect ranking" ] }, { "paper_id": "towards-a-classification-of-log-parsing-errors", "title": "Towards a Classification of Log Parsing Errors", "year": 2023, "authors": [ "Issam Sedki", "Abdelwahab Hamou-Lhadj", "Otmane Ait Mohamed", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/towards-a-classification-of-log-parsing-errors/", "canonical_source_url": "https://doi.org/10.1109/ICPC58990.2023.00023", "core_contribution": "The paper classifies recurring log-parsing errors and connects them to token and event characteristics that can guide parser design and logging practice.", "tags": [ "observability", "trace-analysis", "anomaly-detection", "performance-analysis" ], "keywords": [ "log parsing", "parser errors", "Drain", "AEL", "Spell", "ULP", "LogHub", "tokenization", "logging practices", "dynamic tokens", "static tokens", "delimiter-aware logging", "parser error taxonomy" ] }, { "paper_id": "iot-anomaly-intrusion-detection-poster-abstract", "title": "Deep Learning Driven Anomaly Based Intrusion Detection System for IoT: Poster Abstract", "year": 2022, "authors": [ "Yue Guan", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/iot-anomaly-intrusion-detection-poster-abstract/", "canonical_source_url": "https://doi.org/10.1145/3565386.3565493", "core_contribution": "The poster proposes a hybrid IoT intrusion-detection pipeline with binary anomaly detection followed by multiclass attack classification.", "tags": [ "iot-security", "anomaly-detection", "machine-learning", "deep-learning-systems" ], "keywords": [ "IoTID20", "RNN", "SMOTE", "PSO", "binary classification", "multiclass classification", "IoT attacks", "intrusion detection" ] }, { "paper_id": "n-lane-bridge-performance-antipatterns", "title": "N-Lane Bridge Performance Antipattern Analysis Using System-Level Execution Tracing", "year": 2022, "authors": [ "Riley VanDonge", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/n-lane-bridge-performance-antipatterns/", "canonical_source_url": "https://doi.org/10.1109/scam55253.2022.00015", "core_contribution": "N-Lane Bridge extends One-Lane Bridge analysis to active-resource bottlenecks and uses LTTng system-level traces to distinguish application-caused congestion from external interference.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "anomaly-detection" ], "keywords": [ "N-Lane Bridge", "One-Lane Bridge", "performance antipatterns", "system-level execution tracing", "LTTng", "Trace Compass", "sched_switch", "sched_wakeup", "futex", "Firefox PDF.js", "InDebitO", "SysBench", "memory paging", "CPU preemption" ] }, { "paper_id": "performance-anomaly-detection-sequence-alignment", "title": "Performance Anomaly Detection through Sequence Alignment of System-Level Traces", "year": 2022, "authors": [ "Madeline Janecek", "Naser Ezzati-Jivan", "Abdelwahab Hamou-Lhadj" ], "page_url": "https://threadslab.org/research-publications/papers/performance-anomaly-detection-sequence-alignment/", "canonical_source_url": "https://doi.org/10.1145/3524610.3527898", "core_contribution": "The framework combines critical-path extraction, coarse anomaly checks, OPTICS execution clustering, and MUSCLE multiple sequence alignment to localize performance differences in system-level traces.", "tags": [ "system-tracing", "anomaly-detection", "performance-analysis", "trace-analysis" ], "keywords": [ "sequence alignment", "MUSCLE", "OPTICS", "critical path", "system-level traces", "performance anomalies", "LTTng", "Docker", "execution clustering", "trace overhead" ] }, { "paper_id": "efficient-heap-monitoring-memory-leak-root-cause", "title": "Efficient Heap Monitoring Tool for Memory Leak Detection and Root-cause Analysis", "year": 2021, "authors": [ "Vahid Azhari", "Simar Bhamra", "Naser Ezzati-Jivan", "Francois Tetreault" ], "page_url": "https://threadslab.org/research-publications/papers/efficient-heap-monitoring-memory-leak-root-cause/", "canonical_source_url": "https://doi.org/10.1109/BigData52589.2021.9671473", "core_contribution": "The paper presents a low-intrusion heap monitor that records allocation call stacks and uses persistent heap-growth filtering plus trace correlation to identify likely memory-leak roots.", "tags": [ "resource-analysis", "anomaly-detection", "performance-analysis", "system-tracing" ], "keywords": [ "heap monitoring", "memory leaks", "root-cause analysis", "memory management", "BigData 2021" ] }, { "paper_id": "malware-system-calls-detection-using-hybrid-system", "title": "Malware System Calls Detection Using Hybrid System", "year": 2021, "authors": [ "Yue Guan", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/malware-system-calls-detection-using-hybrid-system/", "canonical_source_url": "https://doi.org/10.1109/SysCon48628.2021.9447094", "core_contribution": "The paper combines LTTng system-call monitoring with recurrent and Transformer-style models for malware and anomalous system-behavior detection.", "tags": [ "kernel-tracing", "system-tracing", "anomaly-detection", "machine-learning", "observability" ], "keywords": [ "malware detection", "system-call analysis", "LTTng", "Trace Compass", "LSTM", "Transformer", "multi-head attention", "PyTorch", "Linux VMs", "sequence classification", "precision", "recall", "unknown attacks" ] }, { "paper_id": "anomaly-detection-ddos-attacks-cloud-environment", "title": "The Use of Anomaly Detection for the Detection of Different Types of DDoS Attacks in Cloud Environment", "year": 2021, "authors": [ "Hossein Abbasi", "Naser Ezzati-Jivan", "Martine Bellaiche", "Chamseddine Talhi", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/anomaly-detection-ddos-attacks-cloud-environment/", "canonical_source_url": "https://doi.org/10.1007/s41635-021-00119-z", "core_contribution": "The paper proposes a cloud-side anomaly detector that combines traffic, virtual-machine resource, and kernel-level indicators to identify several DDoS classes through change-point evidence.", "tags": [ "anomaly-detection", "machine-learning", "resource-analysis", "performance-analysis" ], "keywords": [ "DDoS attacks", "cloud environment", "CUSUM", "bandwidth exhaustion", "application exhaustion", "connection exhaustion", "anomaly detection" ] }, { "paper_id": "multi-level-host-based-intrusion-detection-system-for-internet-of-things", "title": "Multi-level Host-based Intrusion Detection System for Internet of Things", "year": 2020, "authors": [ "Robin Gassais", "Naser Ezzati-Jivan", "Jose M. Fernandez", "Daniel Aloise", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/multi-level-host-based-intrusion-detection-system-for-internet-of-things/", "canonical_source_url": "https://doi.org/10.1186/s13677-020-00206-6", "core_contribution": "The paper combines host-level user/kernel tracing with machine learning to detect intrusion behavior on constrained IoT and home-automation systems.", "tags": [ "iot-security", "kernel-tracing", "machine-learning", "anomaly-detection", "lttng", "observability" ], "keywords": [ "IoT intrusion detection", "host-based IDS", "LTTng", "barectf", "Common Trace Format", "Babeltrace", "Raspberry Pi 3", "Home Assistant", "Decision Tree", "Random Forest", "Gradient Boosted Trees", "SVM", "MLP", "LSTM", "Mirai", "ransomware", "CPU overhead", "memory overhead" ] }, { "paper_id": "automatic-cause-detection-web-applications", "title": "Automatic Cause Detection of Performance Problems in Web Applications", "year": 2019, "authors": [ "Quentin Fournier", "Naser Ezzati-Jivan", "Daniel Aloise", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/automatic-cause-detection-web-applications/", "canonical_source_url": "https://doi.org/10.1109/ISSREW.2019.00102", "core_contribution": "The paper presents a tracing and analysis pipeline that detects slow web requests and groups them by internal execution behavior to expose likely causes.", "tags": [ "kernel-tracing", "web-performance", "anomaly-detection", "root-cause-analysis" ], "keywords": [ "web requests", "user-space tracing", "kernel-space tracing", "outlier detection", "behavior clustering", "PHP cache contention" ] }, { "paper_id": "machine-learning-based-edos-attack-detection-technique-using-execution-trace-analysis", "title": "Machine Learning-Based EDoS Attack Detection Technique Using Execution Trace Analysis", "year": 2019, "authors": [ "Hossein Abbasi", "Naser Ezzati-Jivan", "Martine Bellaiche", "Chamseddine Talhi", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/machine-learning-based-edos-attack-detection-technique-using-execution-trace-analysis/", "canonical_source_url": "https://doi.org/10.1007/s41635-018-0061-2", "core_contribution": "The paper combines execution-trace and virtual-machine metrics with machine learning to detect EDoS behavior and restrict resource expansion to apparently normal VMs.", "tags": [ "anomaly-detection", "kernel-tracing", "machine-learning", "performance-analysis", "resource-analysis", "system-tracing" ], "keywords": [ "Economic Denial of Sustainability", "EDoS", "DDoS", "cloud computing", "execution trace analysis", "LTTng", "QEMU", "KVM", "Apache", "MySQL", "HTTPFlooder", "LoadRunner", "WEKA", "multilayer perceptron", "SVM", "Snort" ] }, { "paper_id": "intrusion-response-systems-survey-taxonomy", "title": "Intrusion Response Systems: Survey and Taxonomy", "year": 2012, "authors": [ "Alireza Shameli-Sendi", "Naser Ezzati-Jivan", "Masoume Jabbarifar", "Michel Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/intrusion-response-systems-survey-taxonomy/", "canonical_source_url": "https://publications.polymtl.ca/14629/", "core_contribution": "This survey organizes intrusion-response systems around automation, response cost, decision evaluation, adjustment, execution, attack paths, and risk assessment.", "tags": [ "anomaly-detection", "root-cause-analysis", "observability" ], "keywords": [ "intrusion response systems", "response cost", "automated response", "NIDS", "HIDS", "IDMEF", "adaptive response", "retroactive response", "attack paths", "risk assessment" ] } ] }