Network Anomaly Detection: Methods, Systems and Tools

Bhuyan, Monowar H.; Bhattacharyya, D. K.; Kalita, J. K.

doi:10.1109/surv.2013.052213.00046

Cited by 1,348

The DOI matches its Crossref record; 9 of the 9 references it cites were found in a registry or an index.

Network Anomaly Detection: Methods, Systems and Tools

Bhuyan, Monowar H., Bhattacharyya, D. K., Kalita, J. K.·2014·IEEE Communications Surveys & Tutorials

DOI 10.1109/surv.2013.052213.00046

Open this paper in CoChat — free account

Abstract

Network anomaly detection is an important and dynamic research area. Many network intrusion detection methods and systems (NIDS) have been proposed in the literature. In this paper, we provide a structured and comprehensive overview of various facets of network anomaly detection so that a researcher can become quickly familiar with every aspect of network anomaly detection. We present attacks normally encountered by network intrusion detection systems. We categorize existing network anomaly detection methods and systems based on the underlying computational techniques used. Within this framework, we briefly describe and compare a large number of network anomaly detection methods and systems. In addition, we also discuss tools that can be used by network defenders and datasets that researchers in network anomaly detection can use. We also highlight research directions in network anomaly detection.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

Integrity signals

Registry

Crossref · 10.1109/surv.2013.052213.00046

Cites

9 of 9 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Induction of decision trees
Quinlan, J. R. (1986) · Machine Learning · doi:10.1007/bf00116251 · Cited by 21,439
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168
Bayesian network classifiers
Friedman, N., Geiger, D., & Goldszmidt, M. (1997) · Machine Learning · doi:10.1023/a:1007465528199 · Cited by 4,742
Identification of Outliers
Hawkins, D. M. (1980) · doi:10.1007/978-94-015-3994-4 · Cited by 2,982
Ensemble-based classifiers
Rokach, L. (2010) · Artificial Intelligence Review · doi:10.1007/s10462-009-9124-7 · Cited by 2,657
Robust classification for imprecise environments
Provost, F., & Fawcett, T. (2001) · Machine Learning · doi:10.1023/a:1007601015854 · Cited by 1,250
Toward Credible Evaluation of Anomaly-Based Intrusion-Detection Methods
Tavallaee, M., Stakhanova, N., & Ghorbani, A. A. (2010) · IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews) · doi:10.1109/tsmcc.2010.2048428 · Cited by 280
A clustering-based method for unsupervised intrusion detections
Jiang, S., Song, X., Wang, H., Han, J.-J., & Li, Q.-H. (2006) · Pattern Recognition Letters · doi:10.1016/j.patrec.2005.11.007 · Cited by 164
A comprehensive survey of numeric and symbolic outlier mining techniques
Agyemang, M., Barker, K., & Alhajj, R. (2006) · Intelligent Data Analysis · doi:10.3233/ida-2006-10604 · Cited by 164

Show all 9 references

Research works printed but not linked: 209

10.1016/j.jss.2010.03.046 · DOI
10.1109/MCAS.2006.1688199 · DOI · Paper page
10.1016/j.csi.2007.07.008 · DOI
10.1016/j.inffus.2006.10.002 · DOI · Paper page
10.1007/978-3-540-76929-3_24 · DOI
10.1109/ICDM.2010.140 · DOI
10.1016/j.cose.2004.09.008 · DOI · Paper page
10.1109/ISCC.2010.5546735 · DOI
naldurg, 2004, A Temporal Logic Based Framework for Intrusion Detection, Proc IFIP WG 6 1 Int Conf Formal Techn Netw Distrib Syst, 359
10.1109/IWIAS.2003.1192454 · DOI
kayacik, 2005, Selecting Features for Intrusion Detection: A Feature Relevance Analysis on KDD 99 Intrusion Detection Datasets, Proc 3rd Annual Conf Privacy Security Trust
heady, 1990, The Architecture of a Network Level Intrusion Detection System, Tech Rep TR-90
zhang, 2001, HIDE: a Hierarchical Network Intrusion Detection System Using Statistical Preprocessing and Neural Network Classification, IEEE Systems Man and Cybernetics Information Assurance Workshop
daniel, 2001, ADAM: a testbed for exploring the use of data mining in intrusion detection, ACM SIGMOD Record, 30, 15, 10.1145/604264.604268 · DOI
10.1504/IJSN.2010.032218 · doi:10.1504/ijsn.2010.032218
fragkiadakis, 2012, A Survey on Security Threats and Detection Techniques in Cognitive Radio Networks, IEEE Commun Surveys Tutorials, pp, 1
10.1016/j.comcom.2004.07.002 · DOI · Paper page
10.1109/TSP.2003.814797 · DOI · Paper page
ertoz, 2004, Data Mining[mdash]Next Generation Challenges and Future Directions
10.1007/s10710-010-9101-6 · DOI
10.1109/ICDM.2006.165 · DOI · Paper page
10.1016/S0167-8655(03)00004-7 · DOI
10.1016/j.patcog.2011.06.014 · DOI
10.1016/j.comnet.2008.11.011 · DOI · Paper page
rehak, 2008, CAMNEP: Agent-based Network Intrusion Detection System, Proc 7th International Joint Conference on Autonomous Agents and Multiagent Systems Industrial Track, 133
10.3923/itj.2012.1243.1250 · doi:10.3923/itj.2012.1243.1250
zhi-dong, 2011, Decision-level fusion model of multi-source intrusion detection alerts, J Communications, 32, 121
10.1109/TIFS.2008.928539 · DOI
shifflet, 2005, A Technique Independent Fusion Model For Network Intrusion Detection, Proceedings of the Midstates Conference on Undergraduate Research in Computer Science and Mathematics, 3, 13
10.1109/SURV.2010.032810.00007 · doi:10.1109/surv.2010.032810.00007
10.1109/SURV.2009.090208 · doi:10.1109/surv.2009.090208
breiman, 1984, Classification and Regression Trees
10.1016/j.asoc.2009.06.019 · DOI · Paper page
10.1109/CNMT.2009.5374676 · DOI
10.1109/TVT.2006.874579 · doi:10.1109/tvt.2006.874579
10.1109/SURV.2010.032210.00054 · DOI · Paper page
10.1109/TVT.2007.901875 · doi:10.1109/tvt.2007.901875
10.1109/MWC.2007.4396943 · doi:10.1109/mwc.2007.4396943
10.1145/1216370.1216373 · DOI · Paper page
10.1002/dac.853 · DOI
10.1504/IJKESDP.2009.021985 · doi:10.1504/ijkesdp.2009.021985
10.1137/1.9781611972788.22 · DOI · Paper page
gao, 2005, Ant colony optimization based network intrusion feature selection and detection, Proc International Conference on Machine Learning and Cybernetics, 6, 3871
10.1109/3477.484436 · DOI · Paper page
10.1007/978-1-4615-0953-0_1 · DOI
10.1016/j.asoc.2010.12.011 · doi:10.1016/j.asoc.2010.12.011
10.1109/ICHIT.2006.253508 · DOI
10.1109/ACIIDS.2009.59 · doi:10.1109/aciids.2009.59
adetunmbi, 2008, Network Intrusion Detection based on Rough Set and k-Nearest Neighbour, International Journal of Computing and ICT Research, 2, 60
xian, 2005, A novel intrusion detection method based on clonal selection clustering algorithm, Proc International Conference on Machine Learning and Cybernetics, 6
10.1109/ICECS.2003.1302048 · doi:10.1109/icecs.2003.1302048
10.1007/BF01001956 · DOI · Paper page
cai, 2003, A rough set theory based method for anomaly intrusion detection in computer network systems, Expert Systems, 20, 251, 10.1111/1468-0394.00249 · doi:10.1111/1468-0394.00249
10.1016/S1088-467X(97)00008-5 · DOI · Paper page
10.1145/2076623.2076647 · doi:10.1145/2076623.2076647
portnoy, 2001, Intrusion detection with unlabeled data using clustering, Proc ACM CSS Workshop on Data Mining Applied to Security
10.1145/1081870.1081917 · DOI · Paper page
theiler, 2003, Resampling approach for anomaly detection in multispectral images, Proc SPIE, 5093, 230, 10.1117/12.487069 · DOI
10.1145/375663.375673 · DOI
hsu, 2005, An integrated framework for visualized and exploratory pattern discovery in mixed data, IEEE Trans Knowl Data Eng, 18, 161
10.1137/1.9780898718348 · DOI · Paper page
ghorbani, 2009, Network Intrusion Detection and Prevention Concepts and Techniques
10.1504/IJSN.2008.016199 · DOI
10.1016/0020-7101(95)01136-3 · DOI
10.1007/11941439_127 · doi:10.1007/11941439_127
schapire, 1999, A brief introduction to boosting, Proceedings of the Joint International Conference for Artificial Intelligence, 1401
10.1109/INFCOM.2009.5061947 · DOI
anderson, 1995, Detecting unusual program behaviour using the statistical component of the next-generation intrusion detection expert system (NIDES), Tech Rep SRIO-CSL-95-06
denning, 1985, Requirements and model for IDES a real-time intrusion detection system, Tech Rep 83F 83-01-00
10.1109/32.372146 · DOI · Paper page
10.1504/IJSN.2011.043674 · doi:10.1504/ijsn.2011.043674
10.1145/1541880.1541882 · DOI · Paper page
10.1016/j.comnet.2007.02.001 · DOI · Paper page
edgeworth, 1887, On discordant observations, Philosophy Mag, 23, 364
10.1023/B:AIRE.0000045502.10941.a9 · doi:10.1023/b:aire.0000045502.10941.a9 · Paper page
10.1016/j.cose.2008.08.003 · DOI · Paper page
choi, 2010, A Survey of Binary Similarity and Distance Measures, J Systemics Cybernetics and Informatics, 8, 43
10.1145/586143.586146 · DOI
10.1109/SURV.2008.080406 · DOI · Paper page
10.1016/j.asoc.2009.10.003 · DOI
tan, 2005, Introduction to Data Mining
10.1109/MDSO.2005.53 · DOI
cha, 2007, Comprehensive Survey on Distance/Similarity Measures between Probability Density Functions, Math Models Methods Appl Sci, 1, 300
10.1504/IJKESDP.2009.021985 · doi:10.1504/ijkesdp.2009.021985
ning, 2003, Intrusion Detection
10.1109/NOMS.2008.4575130 · doi:10.1109/noms.2008.4575130
10.1093/comjnl/bxr035 · DOI
10.1111/j.1469-8137.1912.tb05611.x · DOI · Paper page
goodman, 1954, Measures of associations for cross-validations, J American Statistics Association, 49, 732
10.1016/0377-0427(87)90125-7 · DOI · Paper page
10.1146/annurev.es.05.110174.000533 · DOI
10.1080/01969727308546047 · DOI
10.1109/34.85677 · DOI · Paper page
10.2307/2284239 · DOI
10.1007/BF02339490 · DOI · Paper page
10.1080/00401706.1960.10489888 · DOI · Paper page
eskin, 2000, Anomaly detection over noisy data using learned probability distributions, Proc 7th Int Conf Machine Learning, 255
chen, 2006, Survey and taxonomy of feature selection algorithms in intrusion detection system, 2nd SKLOIS Conference on Information Security and Cryptology, 153, 10.1007/11937807_13 · doi:10.1007/11937807_13
10.1109/ICPR.2010.378 · doi:10.1109/icpr.2010.378
10.1016/j.cose.2009.01.001 · DOI
10.1109/SAINT.2003.1183050 · DOI · Paper page
10.1109/TPAMI.2005.159 · DOI · Paper page
10.1016/j.jnca.2011.01.002 · DOI · Paper page
10.1080/01969727408546059 · DOI · Paper page
10.1109/TPAMI.1979.4766909 · DOI · Paper page
10.1111/j.2044-8317.1976.tb00714.x · DOI · Paper page
10.1080/01621459.1975.10480256 · DOI · Paper page
10.1016/j.future.2010.12.017 · DOI
locasto, 2005, FLIPS: Hybrid Adaptive Intrusion Prevention, Recent Advances in Intrusion Detection, 82
10.1016/j.jnca.2005.06.003 · DOI · Paper page
arumugam, 2010, Implementation of two class classifiers for hybrid intrusion detection, International Conference on Communication and Computational Intelligence, 486
10.1109/ARES.2006.7 · DOI
10.1016/j.compeleceng.2008.12.005 · DOI · Paper page
10.1002/sec.592 · DOI
10.1007/11427469_77 · doi:10.1007/11427469_77
10.1109/ICNSC.2006.1673246 · doi:10.1109/icnsc.2006.1673246
10.1109/ICNS.2007.49 · DOI
subramoniam, 2005, Development of a Comprehensive Intrusion Detection System - Challenges and Approaches, Proc of the International Conference on Information Systems Security, 332, 10.1007/11593980_27 · doi:10.1007/11593980_27
10.1109/CSO.2010.62 · doi:10.1109/cso.2010.62
agrawal, 1994, Fast Algorithms for Mining Association Rules in Large Databases, Proc the 28th International Conference on Very Large Data Bases, 487
10.1016/j.cose.2010.12.004 · DOI
10.1109/CSAC.2003.1254306 · DOI · Paper page
10.1007/978-3-642-04843-2_32 · doi:10.1007/978-3-642-04843-2_32
10.1109/ICCSN.2010.104 · DOI
10.1109/TKDE.2007.44 · DOI
10.1145/1401890.1401915 · DOI
chan, 2003, A machine learning approach to anomaly detection, Tech Rep CS-2003-06
10.1109/MCOM.2002.1039860 · DOI · Paper page
wang, 2004, Anomalous Payload-Based Network Intrusion Detection, Proc Recent Advances in Intrusion Detection, 203, 10.1007/978-3-540-30143-1_11 · DOI · Paper page
10.1109/ICDM.2003.1250987 · DOI
10.1243/0954406981521448 · DOI
yu, 2012, A Nonparametric Adaptive CUSUM Method And Its Application In Network Anomaly Detection, International Journal of Advancements in Computing Technology, 4, 280, 10.4156/ijact.vol4.issue1.32 · doi:10.4156/ijact.vol4.issue1.32
10.1109/TKDE.2007.1009 · DOI · Paper page
10.1109/INFOCOM.2008.232 · doi:10.1109/infocom.2008.232
10.1155/2009/837601 · DOI · Paper page
10.1109/TDSC.2011.14 · doi:10.1109/tdsc.2011.14
10.1109/TSMCC.2008.923876 · DOI · Paper page
10.1016/j.eswa.2009.05.029 · DOI · Paper page
10.1016/j.eswa.2011.06.033 · DOI
selim, 2011, Hybrid Multi-level Intrusion Detection System, International Journal of Information and Computer Security, 9, 23
10.1145/1330107.1330147 · DOI · Paper page
10.1016/j.cpc.2009.05.004 · DOI
yu, 2010, A New Model of Intelligent Hybrid Network Intrusion Detection System, International Conference on Bioinformatics and Biomedical Technology, 386
10.1109/CISDA.2009.5356528 · DOI · Paper page
2009, NSL-KDD data set for network-based intrusion detection systems
10.1109/DISCEX.2000.821515 · DOI · Paper page
10.1016/j.cose.2011.12.012 · DOI · Paper page
10.1007/978-3-642-32129-0_34 · DOI
bhuyan, 2012, AOCD: An Adaptive Outlier Based Coordinated Scan Detection Approach, International J Network Security, 14, 339
mahoney, 2003, An Analysis of the 1999 DARPAILincoin Laboratory Evaluation Data for Network Anomaly Detection, Proc Int l Symp Recent Advances in Intrusion Detection, 220, 10.1007/978-3-540-45248-5_13 · DOI · Paper page
10.1145/382912.382923 · DOI · Paper page
xu, 2010, Intrusion Detection using Continuous Time Bayesian Networks, J Artificial Intelligence Research, 39, 745, 10.1613/jair.3050 · DOI
mell, 2003, An Overview of Issues in Testing Intrusion Detection Systems, 10.6028/NIST.IR.7007 · DOI · Paper page
weiss, 2003, The Handbook of Data Mining, 426
wang, 2008, Statistical Techniques for Network Security Modern Statistically-Based Intrusion Detection and Protection
dokas, 2002, Data Mining for Network Intrusion Detection, Proc NSF Workshop on next Generation Data Mining
10.1145/775047.775092 · DOI
lippmann, 2000, Evaluating Intrusion Detection Systems: The 1998 DARPA Offline Intrusion Detection Evaluation, Proc DARPA Information Survivability Conference and Exposition, 12
10.1145/357830.357849 · DOI · Paper page
10.1016/S0140-3664(00)00364-9 · DOI
10.1109/ICC.2008.304 · doi:10.1109/icc.2008.304
10.1145/1947940.1948050 · DOI
havkin, 1999, Neural Networks
10.5120/2303-2914 · DOI
10.1016/j.cose.2006.05.003 · DOI
cannady, 2000, Applying CMAC-Based On-Line Learning to Intrusion Detection, Proc IEEE-INNS-ENNS International Joint Conference on Neural Networks, 5, 405, 10.1109/IJCNN.2000.861503 · DOI
10.1109/3468.935046 · DOI · Paper page
carpenter, 2010, Adaptive resonance theory, CAS/CNS Technical Report Series no 008
10.1109/5.58325 · DOI · Paper page
maxion, 2004, Proper Use of ROC Curves in Intrusion/Anomaly Detection, Tech Report CS-TR
10.1145/319709.319712 · DOI
10.1109/WKDD.2009.214 · doi:10.1109/wkdd.2009.214
10.1016/j.neucom.2006.10.146 · DOI
10.1109/72.279189 · doi:10.1109/72.279189
10.1109/ICIII.2010.578 · doi:10.1109/iciii.2010.578
labib, 2002, NSOM: A Tool To Detect Denial Of Service Attacks Using Self-Organizing Maps, Tech Rep
10.1109/IWIA.2006.18 · doi:10.1109/iwia.2006.18
mahoney, 2001, PHAD: Packet Header Anomaly Detection for Identifying Hostile Network Traffic, Tech Tech Rep cs-2001-04
10.1109/NAFIPS.2000.877441 · DOI
geramiraz, 2012, Adaptive Anomaly-Based Intrusion Detection System Using Fuzzy Controller, International Journal of Network Security, 14, 352
anderson, 1980, Computer Security Threat Monitoring and Surveillance, Tech Rep
10.1016/j.asoc.2008.06.001 · DOI · Paper page
10.1145/332159.332161 · DOI · Paper page
10.1109/TSMCC.2010.2050685 · DOI
yu, 2003, Handbook of Natural Computing
10.3923/itj.2011.648.655 · DOI
10.1007/s00778-006-0002-5 · DOI · Paper page
10.1016/j.cose.2008.12.001 · DOI
10.1007/978-3-642-20757-0_3 · DOI
10.1504/IJSN.2010.037661 · doi:10.1504/ijsn.2010.037661
10.1007/978-3-642-17881-8_8 · DOI
10.1023/A:1006624031083 · DOI · Paper page
10.1145/956804.956828 · doi:10.1145/956804.956828
rousseeuw, 1987, Robust Regression and Outlier Detection, 10.1002/0471725382 · DOI · Paper page
barnett, 1994, Outliers in Statistical Data
beckman, 1983, Outliers, Technometrics, 25, 119
10.1016/j.comcom.2012.01.016 · DOI · Paper page
10.1109/ICCIS.2006.252287 · DOI
10.1109/WGEC.2009.72 · DOI
10.1093/comjnl/bxr026 · DOI · Paper page

200 of 209 shown

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332
Survey of intrusion detection systems: Techniques, datasets and challenges
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0038-7 · Cited by 2,024
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2988293 · Cited by 1,392
Malware traffic classification using convolutional neural network for representation learning
Wang, W., Zhu, M., Zeng, X., Ye, X., & Sheng, Y. (2017) · 2017 International Conference on Information Networking (ICOIN) · doi:10.1109/icoin.2017.7899588 · Cited by 1,177
Machine Learning for Anomaly Detection: A Systematic Review
Nassif, A. B., Talib, M. A., Nasir, Q., & Dakalbab, F. M. (2021) · IEEE Access · doi:10.1109/access.2021.3083060 · Cited by 748

See all 1,348

Authors: Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K.
Venue: IEEE Communications Surveys & Tutorials
Publisher: Institute of Electrical and Electronics Engineers (IEEE)
Published: 2014
Volume: 16
Issue: 1
Pages: 303-336
ISSN: 1553-877X (ISSN-L)
DOI: 10.1109/surv.2013.052213.00046
OpenAlex: W1966809779
Cited by: 1,348
References: 9
FWCI: 66.96
Type: journal article
Language: en
Open access: closed
Licence: ieeexplore.ieee.org/Xplorehelp/downloads/license-information/IEEE.html (vor)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page: CoChat. (2026). Citation check: Network Anomaly Detection: Methods, Systems and Tools. https://app.cochat.ai/papers/10.1109/surv.2013.052213.00046
The paper: Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2014). Network Anomaly Detection: Methods, Systems and Tools. IEEE Communications Surveys & Tutorials. https://doi.org/10.1109/surv.2013.052213.00046

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.

Network Anomaly Detection: Methods, Systems and Tools

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Self-check

Citations

Cites

Cited by

Metadata

Record

About these checks

How to cite

Data sources