The DOI matches its Crossref record; 114 of the 119 references it cites were found in a registry or an index, and 4 are not checked yet.
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Abstract
This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“The C4.5 algorithm [200], the ID3 algorithm [199], and the CART algorithm [55] are among the well-known decision tree algorithms used for intrusion detection.”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [55]
In the citing paper
“Though there are various surveys on ML in networking [18,61,82,142,246,339], this survey is purposefully different.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [82]
In the citing paper
“Whereas, Fadlullah et al. [142] and Buczak et al. [82], both state-of-theart surveys, have a specialized treatment of ML to specific problems in networking.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [82]
Citations
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Zadeh, L. A. (1965) · Information and Control · doi:10.1016/s0019-9958(65)90241-x · Cited by 67,855
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
Zadeh, L. A. (1996) · Cited by 46,960
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387
Collective dynamics of ‘small-world’ networks
Watts, D. J., & Strogatz, S. H. (1998) · Nature · doi:10.1038/30918 · Cited by 43,060
The Nature of Statistical Learning Theory
Vapnik, V. N. (1995) · doi:10.1007/978-1-4757-2440-0 · Cited by 39,138
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,543
(1992) · Cited by 23,431
Multilayer feedforward networks are universal approximators
Hornik, K., Stinchcombe, M., & White, H. (1989) · Neural Networks · doi:10.1016/0893-6080(89)90020-8 · Cited by 21,728
Quinlan, J. R. (1986) · Machine Learning · doi:10.1007/bf00116251 · Cited by 21,439
(1996) · Cited by 20,179
MapReduce: simplified data processing on large clusters
Dean, J., & Ghemawat, S. (2008) · Communications of the ACM · doi:10.1145/1327452.1327492 · Cited by 18,476
The WEKA data mining software: an update
Hall, M., Frank, E., Holmes, G., Pfahringer, B., Reutemann, P., & Witten, I. H. (2009) · ACM SIGKDD Explorations Newsletter · doi:10.1145/1656274.1656278 · Cited by 17,750
A Tutorial on Support Vector Machines for Pattern Recognition
Burges, C. J. C. (1998) · Data Mining and Knowledge Discovery · doi:10.1023/a:1009715923555 · Cited by 16,616
Kohonen, T. (1995) · Springer series in information sciences · doi:10.1007/978-3-642-56927-2 · Cited by 16,032
Mining association rules between sets of items in large databases
Agrawal, R., Imieliński, T., & Swami, A. (1993) · Proceedings of the 1993 ACM SIGMOD international conference on Management of data · doi:10.1145/170035.170072 · Cited by 14,907
Jolliffe, I. T. (2005) · Wiley eBooks · doi:10.1002/0470013192.bsa501 · Cited by 14,522
Genetic Programming: On the Programming of Computers by Means of Natural Selection
Koza, J. R. (1992) · Medical Entomology and Zoology · Cited by 13,082
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
Multilayer feedforward networks are universal approximators
HornikK., StinchcombeM., & WhiteH. (1989) · Neural Networks · doi:10.5555/70405.70408 · Cited by 9,266
Kohonen, T. (1990) · Proceedings of the IEEE · doi:10.1109/5.58325 · Cited by 8,414
Experiments with a new boosting algorithm
Freund, Y., & Schapire, R. E. (1996) · Cited by 8,189
Multivariate Adaptive Regression Splines
Friedman, J. H. (1991) · The Annals of Statistics · doi:10.1214/aos/1176347963 · Cited by 8,108
Ant colony system: a cooperative learning approach to the traveling salesman problem
Dorigo, M., & Gambardella, L. M. (1997) · IEEE Transactions on Evolutionary Computation · doi:10.1109/4235.585892 · Cited by 8,081
Algorithms for Clustering Data
Sarle, W. S., Jain, A. K., & Dubes, R. C. (1990) · Technometrics · doi:10.2307/1268876 · Cited by 7,893
Chiang, L. H., Russell, E. L., & Braatz, R. D. (2001) · Advanced textbooks in control and signal processing · doi:10.1007/978-1-4471-0347-9_4 · Cited by 6,684
Algorithms for clustering data
Flury, B. N. (1989) · Journal of Statistical Planning and Inference · doi:10.1016/0378-3758(89)90033-5 · Cited by 6,493
Forney, G. D. (1973) · Proceedings of the IEEE · doi:10.1109/proc.1973.9030 · Cited by 5,805
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396
Agrawal, R., & Srikant, R. (2002) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde.1995.380415 · Cited by 5,150
Artificial neural networks: a tutorial
Jain, A. K., Mao, J., & Mohiuddin, K. M. (1996) · Computer · doi:10.1109/2.485891 · Cited by 5,095
Maximum Likelihood from Incomplete Data via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1976) · Cited by 4,517
Bayesian Networks and Decision Graphs
Jensen, F. V., & Nielsen, T. D. (2007) · Information science and statistics · doi:10.1007/978-0-387-68282-2 · Cited by 4,157
(2024) · Physics Subject Headings (PhySH) · doi:10.29172/7c2a6982-6d72-4cd8-bba6-2fccb06a7011 · Cited by 4,081
Cohen, W. W. (1995) · Elsevier eBooks · doi:10.1016/b978-1-55860-377-6.50023-2 · Cited by 3,890
Genetic Algorithms and Machine Learning
Goldberg, D. E., & Holland, J. H. (1988) · Machine Learning · doi:10.1023/a:1022602019183 · Cited by 3,193
Ensemble based systems in decision making
Robi Polikar, A. (2006) · IEEE Circuits and Systems Magazine · doi:10.1109/mcas.2006.1688199 · Cited by 3,031
Evolution strategies – A comprehensive introduction
Beyer, H.-G., & Schwefel, H. (2002) · Natural Computing · doi:10.1023/a:1015059928466 · Cited by 2,810
An empirical comparison of supervised learning algorithms
Caruana, R., & Niculescu-Mizil, A. (2006) · Proceedings of the 23rd international conference on Machine learning - ICML '06 · doi:10.1145/1143844.1143865 · Cited by 2,780
Fast discovery of association rules
Agrawal, R., Mannila, H., Srikant, R., Toivonen, H. T. T., & Verkamo, A. I. (1996) · Knowledge Discovery and Data Mining · Cited by 2,376
Anomaly-based network intrusion detection: Techniques, systems and challenges
García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009) · Computers & Security · doi:10.1016/j.cose.2008.08.003 · Cited by 2,085
The KDD process for extracting useful knowledge from volumes of data
Fayyad, U., Piatetsky-Shapiro, G., & Smyth, P. (1996) · Communications of the ACM · doi:10.1145/240455.240464 · Cited by 1,934
Extreme learning machines: a survey
Huang, G.-B., Wang, D. H., & Lan, Y. (2011) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-011-0019-y · Cited by 1,922
Bayesian Networks and Decision Graphs
Jensen, F. V. (2001) · Springer eBooks · doi:10.1007/978-1-4757-3502-4 · Cited by 1,743
A Tutorial on Learning with Bayesian Networks
Heckerman, D. E. (2008) · Studies in computational intelligence · doi:10.1007/978-3-540-85066-3_3 · Cited by 1,712
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664
Network Anomaly Detection: Methods, Systems and Tools
Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.052213.00046 · Cited by 1,358
A Tutorial on Learning with Bayesian Networks
Heckerman, D. E. (1998) · Springer eBooks · doi:10.1007/978-94-011-5014-9_11 · Cited by 1,242
A data mining framework for building intrusion detection models
Lee, W., Stolfo, S. J., & Mok, K. W. (2003) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/secpri.1999.766909 · Cited by 1,156
The immune system, adaptation, and machine learning
Farmer, J. D., Packard, N. H., & Perelson, A. S. (1986) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(86)90240-x · Cited by 1,109
Baum, L. E., & Eagon, J. A. (1967) · Bulletin of the American Mathematical Society · doi:10.1090/s0002-9904-1967-11751-8 · Cited by 1,053
The decay of turbulence in the burgers model
Moiseev, S. S., Toor, A. V., & Yanovsky, V. (1981) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(81)90072-5 · Cited by 1,050
Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Fried, D. J., Graf, I., Haines, J. W., Kendall, K. R., McClung, D., Weber, D., Webster, S. E., Wyschogrod, D., Cunningham, R. K., et al. (2002) · DARPA Information Survivability Conference and Exposition · doi:10.1109/discex.2000.821506 · Cited by 918
The 1999 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00139-0 · Cited by 877
The use of computational intelligence in intrusion detection systems: A review
Wu, S. X., & Banzhaf, W. (2009) · Applied Soft Computing · doi:10.1016/j.asoc.2009.06.019 · Cited by 707
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 676
Intrusion Detection Techniques for Mobile Wireless Networks
Zhang, Y., Lee, W., & Huang, Y.-A. (2003) · Wireless Networks · doi:10.1023/a:1024600519144 · Cited by 675
Transitivity in Structural Models of Small Groups
Holland, P. W., & Leinhardt, S. (1971) · Comparative Group Studies · doi:10.1177/104649647100200201 · Cited by 664
Random-Forests-Based Network Intrusion Detection Systems
Zhang, J., Zulkernine, M., & Haque, A. (2008) · IEEE Transactions on Systems Man and Cybernetics Part C (Applications and Reviews) · doi:10.1109/tsmcc.2008.923876 · Cited by 587
Mining fuzzy association rules in databases
Kuok, C. M., Fu, A. W.-C., & Wong, M. H. (1998) · ACM SIGMOD Record · doi:10.1145/273244.273257 · Cited by 532
Naive Bayes vs decision trees in intrusion detection systems
Amor, N. B., Salem Benferhat, A., & Elouedi, Z. (2004) · ACM Symposium on Applied Computing · doi:10.1145/967900.967989 · Cited by 491
EXPOSURE : Finding malicious domains using passive DNS analysis
Bilge, L. (2011) · Cited by 482
Mutual information-based feature selection for intrusion detection systems
Amiri, F., Yousefi, M. R., Lucas, C., Shakery, A., & Yazdani, N. (2011) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2011.01.002 · Cited by 473
An Overview of IP Flow-Based Intrusion Detection
Sperotto, A., Schaffrath, G., Sadre, R., Morariu, C., Pras, A., & Stiller, B. (2010) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2010.032210.00054 · Cited by 467
A hybrid machine learning approach to network anomaly detection
Shon, T., & Moon, J. (2007) · Information Sciences · doi:10.1016/j.ins.2007.03.025 · Cited by 455
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
Lyon, G. F. (2009) · Medical Entomology and Zoology · Cited by 432
Artificial Neural Networks for Misuse Detection
Cannady, J. (1998) · Cited by 417
Li, Y., Xia, J., Zhang, S., Yan, J., Ai, X., & Dai, K. (2011) · Expert Systems with Applications · doi:10.1016/j.eswa.2011.07.032 · Cited by 386
Intrusion detection using an ensemble of intelligent paradigms
Mukkamala, S., Sung, A. H., & Abraham, A. (2004) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2004.01.003 · Cited by 372
Unsupervised anomaly detection in network intrusion detection using clusters
Leung, K., & Leckie, C. A. (2005) · Cited by 350
Bayesian event classification for intrusion detection
Kruegel, C., Mutz, D. H., Robertson, W., & Valeur, F. (2004) · Annual Computer Security Applications Conference · doi:10.1109/csac.2003.1254306 · Cited by 344
Bilge, L., Şen, S., Balzarotti, D., et al. (2014) · ACM Transactions on Information and System Security · doi:10.1145/2584679 · Cited by 317
Usilng Machine Learning Technliques to Identify Botnet Traffic
Livadas, C., Walsh, R., Lapsley, D., et al. (2006) · Conference on Local Computer Networks · doi:10.1109/lcn.2006.322210 · Cited by 302
Using Genetic Algorithm for Network Intrusion Detection
Li, W. (2004) · Cited by 260
Bilge, L., Balzarotti, D., Robertson, W., et al. (2012) · Annual Computer Security Applications Conference · doi:10.1145/2420950.2420969 · Cited by 251
Using Decision Trees to Improve Signature-Based Intrusion Detection
Kruegel, C., & Toth, T. A. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45248-5_10 · Cited by 242
Intrusion detection using fuzzy association rules
Tajbakhsh, A., Rahmati, M., & Mirzaei, A. (2008) · Applied Soft Computing · doi:10.1016/j.asoc.2008.06.001 · Cited by 241
Improving intrusion detection performance using keyword selection and neural networks
Lippmann, R. P., & Cunningham, R. K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00140-7 · Cited by 240
Sequeira, K., & Zaki, M. J. (2002) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/775047.775103 · Cited by 229
Practical Data Hiding in TCP/IP
Ahsan, K., & Kundur, D. (2002) · Cited by 226
Using artificial anomalies to detect unknown and known network intrusions
Fan, W., Miller, M. L., Stolfo, S. J., et al. (2004) · Knowledge and Information Systems · doi:10.1007/s10115-003-0132-7 · Cited by 222
A Theory and Methodology of Inductive Learning
Michalski, R. S. (1983) · Springer eBooks · doi:10.1007/978-3-662-12405-5_4 · Cited by 222
NETWORK INTRUSION DETECTION USING NAÏVE BAYES
Panda, M., & Patra, M. R. (2007) · Cited by 219
Time complexity of evolutionary algorithms for combinatorial optimization: A decade of results
Oliveto, P. S., He, J., & Yao, X. (2007) · Machine Intelligence Research · doi:10.1007/s11633-007-0281-3 · Cited by 217
A THEORY AND METHODOLOGY OF INDUCTIVE LEARNING
Michalski, R. S. (1983) · Machine Learning · doi:10.1016/b978-0-08-051054-5.50008-x · Cited by 206
Robust Support Vector Machines for Anomaly Detection in Computer Security.
Hu, W., Liao, Y., & Vemuri, V. R. (2003) · International Conference on Machine Learning and Applications · Cited by 186
NETWORK-BASED INTRUSION DETECTION USING NEURAL NETWORKS
Bivens, A., Palagiri, C., Smith, R. N., et al. (2002) · Cited by 178
PMML: An Open Standard for Sharing Models
Guazzelli, A., Zeller, M., Lin, W.-C., & Williams, G. (2009) · The R Journal · doi:10.32614/rj-2009-010 · Cited by 162
A data mining approach for database intrusion detection
Hu, Y., & Panda, B. (2004) · ACM Symposium on Applied Computing · doi:10.1145/967900.968048 · Cited by 149
Detecting New Forms of Network Intrusion Using Genetic Programming
Lu, W., & Traoré, I. (2004) · Computational Intelligence · doi:10.1111/j.0824-7935.2004.00247.x · Cited by 141
Ye, N. (2013) · CRC Press eBooks · doi:10.1201/b15288-10 · Cited by 140
HMMPayl: An intrusion detection system based on Hidden Markov Models
Ariu, D., Tronci, R., & Giacinto, G. (2011) · Computers & Security · doi:10.1016/j.cose.2010.12.004 · Cited by 129
Evolutionary Design of Intrusion Detection Programs
Abraham, A., Groşan, C., & Martı́n-Vide, C. (2007) · doi:10.6633/ijns.200705.4(3).12 · Cited by 110
Investigating hidden Markov models capabilities in anomaly detection
Joshi, S. S., & Phoha, V. V. (2005) · doi:10.1145/1167350.1167387 · Cited by 96
Machine Learning Approach for IP-Flow Record Anomaly Detection
Wagner, C., François, J., State, R., & Engel, T. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-20757-0_3 · Cited by 91
A Framework for an Adaptive Intrusion Detection System using Bayesian Network
Jemili, F., Zaghdoud, M., & Ahmed, M. B. (2007) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2007.379535 · Cited by 85
Using Hidden Markov Models to Evaluate the Risks of Intrusions
Årnes, A., Valeur, F., Vigna, G., et al. (2006) · Lecture notes in computer science · doi:10.1007/11856214_8 · Cited by 78
Hansen, J. V., Lowry, P. B., Meservy, R. D., & McDonald, D. M. (2006) · Decision Support Systems · doi:10.1016/j.dss.2006.04.004 · Cited by 78
Comparative Study of Supervised Machine Learning Techniques for Intrusion Detection
Gharibian, F., & Ghorbani, A. A. (2007) · Conference on Communication Networks and Services Research · doi:10.1109/cnsr.2007.22 · Cited by 69
Comparative Analysis of Premises Valuation Models Using KEEL, RapidMiner, and WEKA
Graczyk, M., Lasota, T., & Trawiński, B. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04441-0_70 · Cited by 60
Artificial intelligence and the future of cybersecurity
Morel, B. F. (2011) · doi:10.1145/2046684.2046699 · Cited by 58
A Naive Bayes Approach for Detecting Coordinated Attacks
Benferhat, S., Kenaza, T., & Mokhtari, A. (2008) · doi:10.1109/compsac.2008.213 · Cited by 49
Machine Learning Applied to Cyber Operations
Blowers, M. K., & Williams, J. (2013) · Advances in information security · doi:10.1007/978-1-4614-7597-2_10 · Cited by 48
Rule based Network Intrusion Detection using Genetic Algorithm
Khan, M. S. A. (2011) · International Journal of Computer Applications · doi:10.5120/2303-2914 · Cited by 46
Using data mining to discover signatures in network-based intrusion detection
Han, H. L., Lu, X.-L., & Ren, L.-Y. (2003) · International Conference on Machine Learning and Cybernetics · doi:10.1109/icmlc.2002.1176698 · Cited by 41
Cyber Security Challenges: Designing Efficient Intrusion Detection Systems and Antivirus Tools
Mukkamala, S., Sung, A. H., & Abraham, A. (2004) · Cited by 41
Characterizing network traffic by means of the NetMine framework
Apiletti, D., Baralis, E., Cerquitelli, T., et al. (2008) · Computer Networks · doi:10.1016/j.comnet.2008.12.011 · Cited by 39
Beyer, H.-G. (2007) · Scholarpedia · doi:10.4249/scholarpedia.1965 · Cited by 38
A Novel Network Intrusion Detection System (NIDS) Based on Signatures Search of Data Mining
Hu, Z., Zhitang, L., & Junqi, W. (2008) · doi:10.1109/wkdd.2008.48 · Cited by 38
OMC-IDS: At the Cross-Roads of OLAP Mining and Intrusion Detection
Brahmi, H., Brahmi, I., & Yahia, S. B. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-30220-6_2 · Cited by 34
Boosting the Area under the ROC Curve
Long, P., & Servedio, R. A. (2007) · Cited by 33
Towards Quantifying the Possible Risk in e-commerce Interactions for RDSS
Hussain, F. K., Chang, E. J., Hussain, F. K., & Dillon, T. S. (2007) · IEEE International Conference on e-Business Engineering (ICEBE) · doi:10.1109/icebe.2007.89 · Cited by 30
Intrusion signature creation via clustering anomalies
Hendry, G., & Yang, S. J. (2008) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.775886 · Cited by 28
Real-Time Correlation of Network Security Alerts
Li, Z., Zhang, A., Lei, J., & Wang, L. (2007) · IEEE International Conference on e-Business Engineering (ICEBE) · doi:10.1109/icebe.2007.69 · Cited by 25
Sung, A. H., Abraham, A., & Mukkamala, S. (2005) · Auerbach Publications eBooks · doi:10.1201/9781420031225.ch6 · Cited by 11
Improving a neuro-fuzzy classifier using exploratory factor analysis
Martens, J., Wets, G., Vanthienen, J., & Mues, C. (2000) · International Journal of Intelligent Systems · doi:10.1002/1098-111x(200008)15:8 · Cited by 3
Flagged first, then by citations
1 of the 119 references couldn’t be matched to a known paper.
Research works printed but not linked: 14
- Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
- 2000, R Core Team
- Jacobson, 1989, The Tcpdump Manual Page
- Combs, 2014, Wireshark
- 2014, Sourcefire
- Stolfo, 2014, KDD Cup 1999 Data Set
- 2015, IBM
- 10.4108/wkdd.2008.2686 · DOI
- 2014, Politecnico di Torino, Analyzer 3.0
- Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
- Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
- 10.2307/2984875 · DOI
- Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
- Paxson, 2004, Bro 0.9
Cited by
Sorted by citations
A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks
Yin, C., Zhu, Y., Fei, J., & He, X. (2017) · IEEE Access · doi:10.1109/access.2017.2762418 · Cited by 2,100
Survey of intrusion detection systems: Techniques, datasets and challenges
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0038-7 · Cited by 2,024
“AIDS methods can be categorized into three main groups: Statistics-based (Chao et al., 2015), knowledge-based (Elhag et al., 2015; Can & Sahingoz, 2015), and machine learning-based (Buczak & Guven, 2016; Mesh-ram & Haas, 2017).”
Deep Learning in Mobile and Wireless Networking: A Survey
Zhang, C., Patras, P., & Haddadi, H. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2904897 · Cited by 1,913
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2988293 · Cited by 1,392
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,514
Metadata
- Authors
- Buczak, A. L., & Guven, E.
- Affiliations
- Johns Hopkins University (US)
- ORCID
- Buczak, Anna L.
- Venue
- IEEE Communications Surveys & Tutorials
- Published
- 2016
- Volume
- 18
- Issue
- 2
- Pages
- 1153-1176
- ISSN
- 1553-877X (ISSN-L)
- 2373-745X
- OpenAlex
- W2342408547
- Semantic Scholar
- 971766088dfaf63fb55e6f0190b14f28f2c98ad0
- Cited by
- 3,332
- References
- 119
- Citations by year
- 2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11
- FWCI
- 115.39
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Communications Surveys & Tutorials (publishedVersion)
- Funders
- Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
- Keywords
- intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review