Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 1,750

The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.

A survey of network anomaly detection techniques

Ahmed, Mohiuddin, Naser Mahmood, Abdun, Hu, Jiankun·2016·Journal of Network and Computer Applications
DOI 10.1016/j.jnca.2015.11.016
Open this paper in CoChat — free account

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1016/j.jnca.2015.11.016

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 1 references

Research works printed but not linked: 76

  1. Ahmed M, Mahmood A. Clustering based semantic data summarization technique: a new approach. In: 2014 IEEE 9th conference on industrial electronics and applications (ICIEA), 2014, p. 1780–5. · doi:10.1109/iciea.2014.6931456
  2. Ahmed M, Mahmood A. Network traffic analysis based on collective anomaly detection. In: 2014 IEEE 9th conference on industrial electronics and applications (ICIEA), 2014. p. 1141–46. · DOI
  3. Ahmed M, Mahmood AN. Network traffic pattern analysis using improved information-theoretic co-clustering based collective anomaly detection. In: Security and privacy in communication networks, Lecture notes of the institute for computer sciences, social informatics and telecommunications engineering, vol. 153. Springer International Publishing, 2014. p. 1–16. · doi:10.1007/978-3-319-23802-9_17
  4. Ahmed, 2015, Novel approach for network traffic pattern analysis using clustering-based collective anomaly detection, Ann. Data Sci., 2, 111, 10.1007/s40745-015-0035-y · DOI
  5. Ahmed M, Naser A. A novel approach for outlier detection and clustering improvement. In: 2013 8th IEEE conference on industrial electronics and applications (ICIEA), 2013, p. 577–82. · DOI
  6. Ahmed M, Mahmood AN, Hu J. Outlier Detection, CRC Press, New York, USA, 2014. p. 3–21, Chapter 1 (in book: The State of the Art in Intrusion Prevention and Detection). · doi:10.1201/b16390-3
  7. Ahmed, 2016, A survey of anomaly detection techniques in financial domain, Future Gener Comp Syst, 55, 278, 10.1016/j.future.2015.01.001 · DOI · Paper page
  8. Ahmed, 2015, An investigation of performance analysis of anomaly detection techniques for big data in scada systems, EAI Endorsed Trans Ind Netw Intell Syst, 15, 1
  9. Ahmed, 2015, An efficient technique for network traffic summarization using multiview clustering and statistical sampling, EAI Endorsed Trans Scalable Inf Syst, 15, 1
  10. Ahmed, 2015, Heart disease diagnosis using co-clustering, vol. 139, 61
  11. Ahmed, 2015, A novel approach for network traffic summarization, vol. 139, 51
  12. Ahmed, 2015, An efficient approach for complex data summarization using multiview clustering, vol. 139, 38
  13. Ambusaidi, 2014, Intrusion detection method based on nonlinear correlation measure, Int J Internet Protoc Technol, 8, 77, 10.1504/IJIPT.2014.066377 · doi:10.1504/ijipt.2014.066377
  14. Banerjee, 2007, A generalized maximum entropy approach to bregman co-clustering and matrix approximation, J Mach Learn Res, 8, 1919
  15. Beckman, 1983, Outlier .s, Technometrics, 25, 119
  16. Chandola, 2009, Anomaly detection: a survey, ACM Comput Surv, 41, 15:1, 10.1145/1541880.1541882 · DOI · Paper page
  17. Creech G, Hu J. Generation of a new ids test dataset: time to retire the kdd collection, In: Wireless communications and networking conference (WCNC), 2013 IEEE, 2013. p. 4487–92. · DOI · Paper page
  18. Debar, 2000, A revised taxonomy for intrusion-detection systems, Ann Des Télécommun, 55, 361, 10.1007/BF02994844 · DOI · Paper page
  19. Deljac, 2015, Early detection of network element outages based on customer trouble calls, Decis Support Syst, 73, 57, 10.1016/j.dss.2015.02.014 · DOI
  20. Eskin E. Anomaly detection over noisy data using learned probability distributions. In: Proceedings of the seventeenth international conference on machine learning, ICML ׳00, San Francisco, CA, USA, Morgan Kaufmann Publishers Inc., 2000. p. 255–62.
  21. Ester M, Kriegel H-P, Sander J, Xu X. A density-based algorithm for discovering clusters in large spatial databases with noise. In: KDD׳96, 1996. p. 226–31.
  22. Estevez-Tapiador, 2004, Anomaly detection methods in wired networks: a survey and taxonomy, Comput Commun, 27, 1569, 10.1016/j.comcom.2004.07.002 · DOI · Paper page
  23. Furnell, 2007, A new taxonomy for comparing intrusion detection systems, Internet Res, 17, 88, 10.1108/10662240710730515 · doi:10.1108/10662240710730515
  24. Gogoi, 2011, A survey of outlier detection methods in network anomaly identification, Comput J, 54, 570, 10.1093/comjnl/bxr026 · DOI · Paper page
  25. Govaert, 2008, Block clustering with Bernoulli mixture models: comparison of different approaches, Comput Stat Data Anal, 52, 3233, 10.1016/j.csda.2007.09.007 · DOI
  26. Guan Y, Ghorbani A, Belacel N. Y-means: a clustering method for intrusion detection. In: IEEE CCECE 2003 Canadian conference on electrical and computer engineering, 2003, vol. 2; 2003. p. 1083–6. · DOI
  27. Hawkins, 2002, Outlier detection using replicator neural networks, vol. 2454, 170
  28. Heller KA, Svore KM, Keromytis AD, Stolfo SJ. One class support vector machines for detecting anomalous windows registry accesses. In: Proceedings of the workshop on data mining for computer security, 2003.
  29. Hodge, 2004, A survey of outlier detection methodologies, Artif Intell Rev, 22, 85, 10.1023/B:AIRE.0000045502.10941.a9 · doi:10.1023/b:aire.0000045502.10941.a9 · Paper page
  30. Hoplaros, 2014, Data summarization for network traffic monitoring, J Netw Comput Appl, 37, 194, 10.1016/j.jnca.2013.02.021 · doi:10.1016/j.jnca.2013.02.021
  31. Hu W, Liao Y, Vemuri VR. Robust anomaly detection using support vector machines. In: Proceedings of the international conference on machine learning; 2003.
  32. Jain, 1999, Data clustering: a review, ACM Comput Surv, 31, 264, 10.1145/331499.331504 · DOI · Paper page
  33. Kendall K. A database of computer attacks for the evaluation of intrusion detection systems. In: Proceedings of DARPA information survivability conference and exposition (DISCEX); 1999. p. 12–26.
  34. Kruegel C, Mutz D, Robertson W, Valeur F. Bayesian event classification for intrusion detection. In: Proceedings of 19th annual computer security applications conference; 2003. p. 14–23. · DOI · Paper page
  35. Krügel C, Toth T, Kirda E. Service specific anomaly detection for network intrusion detection. In: Proceedings of the 2002 ACM symposium on applied computing, SAC ׳02, ACM, New York, NY, USA; 2002. p. 201–8. · DOI · Paper page
  36. Lee W, Xiang D. Information-theoretic measures for anomaly detection. In: Proceedings of 2001 IEEE symposium on security and privacy, 2001 S P 2001; 2001. p. 130–43.
  37. Lee W, Stolfo S, Mok K. A data mining framework for building intrusion detection models. In: Proceedings of the 1999 IEEE Symposium on Security and Privacy; 1999. p. 120–32.
  38. Leung K, Leckie C. Unsupervised anomaly detection in network intrusion detection using clusters. In: Proceedings of the twenty-eighth Australasian conference on computer science – vol. 38, ACSC ׳05, Australian Computer Society, Inc., Darlinghurst, Australia, Australia; 2005. p. 333–42.
  39. Liao, 2013, Intrusion detection system: a comprehensive review, J Netw Comput Appl, 36, 16, 10.1016/j.jnca.2012.09.004 · DOI · Paper page
  40. Lin J, Keogh E, Fu A, Van Herle H. Approximations to magic: finding unusual medical time series. In: Proceedings of the 18th IEEE symposium on computer-based medical systems, CBMS ׳05, IEEE Computer Society, Washington, DC, USA; 2005. p. 329–334. · DOI
  41. Mahmood, 2008, An efficient clustering scheme to exploit hierarchical data in network traffic analysis, IEEE Trans Knowl Data Eng, 20, 752, 10.1109/TKDE.2007.190725 · DOI
  42. Mahmood, 2010, Critical infrastructure protection: resource efficient sampling to improve detection of less frequent patterns in network traffic, J Netw Comput Appl, 33, 491, 10.1016/j.jnca.2010.01.003 · doi:10.1016/j.jnca.2010.01.003
  43. Mahoney, 2003, An analysis of the 1999 darpa/lincoln laboratory evaluation data for network anomaly detection, vol. 2820, 220
  44. Markou, 2003, Novelty detection: a review; part 2: neural network based approaches, Signal Process, 83, 2499, 10.1016/j.sigpro.2003.07.019 · DOI · Paper page
  45. Münz G, Li S, Carle G. Traffic anomaly detection using kmeans clustering. In: In GI/ITG Workshop MMBnet, 2007.
  46. Noble CC, Cook DJ. Graph-based anomaly detection. In: Proceedings of the ninth ACM SIGKDD international conference on knowledge discovery and data mining, KDD ׳03, ACM, New York, NY, USA; 2003. p. 631–6. · DOI · Paper page
  47. NSL-KDD, accessed: 2014-12-29. URL 〈http://nsl.cs.unb.ca/NSL-KDD/〉.
  48. Oldmeadow, 2004, Adaptive clustering for network intrusion detection, vol. 3056, 255
  49. Papalexakis EE, Beutel A, Steenkiste P. Network anomaly detection using co-clustering. In: Proceedings of the 2012 international conference on advances in social networks analysis and mining (ASONAM 2012), ASONAM ׳12, IEEE Computer Society, Washington, DC, USA; 2012. p. 403–10. · DOI
  50. Patcha, 2007, An overview of anomaly detection techniques: existing solutions and latest technological trends, Comput Netw, 51, 3448, 10.1016/j.comnet.2007.02.001 · DOI · Paper page
  51. Pelleg D, Moore AW. X-means: extending k-means with efficient estimation of the number of clusters. In: Proceedings of the seventeenth international conference on machine learning, ICML ׳00, San Francisco, CA, USA; Morgan Kaufmann Publishers Inc., 2000. p. 727–34.
  52. Petrovic S, Alvarez G, Orfila A, Carbo J. Labelling clusters in an intrusion detection system using a combination of clustering evaluation techniques. In: Proceedings of the 39th annual Hawaii international conference on System Sciences, 2006. HICSS ׳06, vol. 6; 2006. p. 129b–129b. · doi:10.1109/hicss.2006.247
  53. Phua C, Lee VCS, Smith-Miles K, Gayler RW. A comprehensive survey of data mining-based fraud detection research, CoRR abs/1009.6119. URL arxiv.org/abs/1009.6119. · arXiv
  54. Platt JC. Advances in kernel methods. In: Fast training of support vector machines using sequential minimal optimization. MIT Press, Cambridge, MA, USA; 1999. p. 185–208. · DOI · Paper page
  55. Poojitha G, Kumar K, Reddy P. Intrusion detection using artificial neural network, In: 2010 International conference on computing communication and networking technologies (ICCCNT); 2010. p. 1–7. · doi:10.1109/icccnt.2010.5592568
  56. Portnoy L, Eskin E, Stolfo S. Intrusion detection with unlabeled data using clustering. In: Proceedings of ACM CSS workshop on data mining applied to security (DMSA); 2001.
  57. Qin, 2011, Monitoring abnormal network traffic based on blind source separation approach, J. Netw. Comput. Appl., 34, 1732, 10.1016/j.jnca.2011.06.006 · doi:10.1016/j.jnca.2011.06.006
  58. Ramadas, 2003, Detecting anomalous network traffic with self-organizing maps, vol. 2820, 36
  59. Rubner Y, Tomasi C, Guibas L. A metric for distributions with applications to image databases. In: Sixth international conference on computer vision, 1998; 1998. p. 59–66. · DOI · Paper page
  60. Shafi, 2013, Evaluation of an adaptive genetic-based signature extraction system for network intrusion detection, Pattern Anal Appl, 16, 549, 10.1007/s10044-011-0255-5 · DOI
  61. Shiravi, 2012, Toward developing a systematic approach to generate benchmark datasets for intrusion detection, Comput Secur, 31, 357, 10.1016/j.cose.2011.12.012 · DOI · Paper page
  62. Shyu M-L, Chen S-C, Sarinnapakorn K, Chang L. A novel anomaly detection scheme based on principal component classifier. In: IEEE foundations and new directions of data mining workshop, in conjunction with ICDM׳03, 2003. p. 171–9.
  63. Su, 2011, Using clustering to improve the knn-based classifiers for online anomaly network traffic identification, J Netw Comput Appl, 34, 722, 10.1016/j.jnca.2010.10.009 · DOI
  64. Syarif, 2012, Unsupervised clustering approach for network anomaly detection, vol. 293, 135
  65. Tan, 2014, A system for denial-of-service attack detection based on multivariate correlation analysis, IEEE Trans Parallel Distrib Syst, 25, 447, 10.1109/TPDS.2013.146 · DOI · Paper page
  66. Tan Z, Nagar UT, He X, Nanda P, Liu RP, Wang S, Hu J. Enhancing big data security with collaborative intrusion detection. IEEE Cloud Comput 2014:27–33. · DOI
  67. Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans Inf Syst Secur 2000:3(4):262–94. · DOI · Paper page
  68. Thottan, 2003, Anomaly detection in ip networks, IEEE Trans Signal Process, 51, 2191, 10.1109/TSP.2003.814797 · DOI · Paper page
  69. Towards a taxonomy of intrusion-detection systems, Comput. Netw. 31 (9) (1999) 805–822. · DOI · Paper page
  70. Vasilomanolakis, 2015, Taxonomy and survey of collaborative intrusion detection, ACM Comput Surv, 47, 551, 10.1145/2716260 · DOI · Paper page
  71. Wang, 2005, A nonlinear correlation measure for multivariable data set, Phys D: Nonlinear Phenom, 200, 287, 10.1016/j.physd.2004.11.001 · doi:10.1016/j.physd.2004.11.001
  72. Xie, 2011, Anomaly detection in wireless sensor networks: a survey, J Netw Comput Appl, 34, 1302, 10.1016/j.jnca.2011.03.004 · DOI · Paper page
  73. Yang Y, McLaughlin K, Littler T, Sezer S, Wang H. Rule-based intrusion detection system for scada networks. In: Renewable power generation conference (RPG 2013), 2nd IET; 2013. p. 1–4. · DOI
  74. Ye, 2001, An anomaly detection technique based on a chi-square statistic for detecting intrusions into information systems, Qual Relaib Eng Int, 17, 105, 10.1002/qre.392 · DOI
  75. Zhang Z, Li J, Manikopoulos CN, Jorgenson J, Ucles J. Hide: a hierarchical network intrusion detection system using statistical preprocessing and neural network classification. In: Proceedings of IEEE workshop on information assurance and security; 2001. p. 85–90.
  76. Zhu, 2011, Intelligent rate control for supporting real-time traffic in wlan mesh networks, J Netw Comput Appl, 34, 1449, 10.1016/j.jnca.2010.08.014 · doi:10.1016/j.jnca.2010.08.014

Cited by

See all 1,750

Metadata

Authors
Ahmed, M., Naser Mahmood, A., & Hu, J.
Venue
Journal of Network and Computer Applications
Publisher
Elsevier BV
Published
2016-01
Volume
60
Pages
19-31
ISSN
1084-8045 (ISSN-L)
DOI
10.1016/j.jnca.2015.11.016
OpenAlex
W2278186031
Cited by
1,750
References
1
FWCI
66.39
Type
journal article
Language
en
Open access
closed
Licence
  • www.elsevier.com/tdm/userlicense/1.0/ (tdm)
  • www.elsevier.com/legal/tdmrep-license (tdm)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: A survey of network anomaly detection techniques. https://app.cochat.ai/papers/10.1016/j.jnca.2015.11.016
The paper
Ahmed, M., Naser Mahmood, A., & Hu, J. (2016). A survey of network anomaly detection techniques. Journal of Network and Computer Applications. https://doi.org/10.1016/j.jnca.2015.11.016

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.