MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking
Abstract
Evaluating anomaly detectors is a crucial task in traffic monitoring made particularly difficult due to the lack of ground truth. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labeled anomaly traffic traces. We aim at automatically finding anomalies in the MAWI archive using a new methodology that combines different and independent detectors. A key challenge is to compare the alarms raised by these detectors, though they operate at different traffic granularities. The main contribution is to propose a reliable graph-based methodology that combines any anomaly detector outputs. We evaluated four unsupervised combination strategies; the best is the one that is based on dimensionality reduction. The synergy between anomaly detectors permits to detect twice as many anomalies as the most accurate detector, and to reject numerous false positive alarms reported by the detectors. Significant anomalous traffic features are extracted from reported alarms, hence the labels assigned to the MAWI archive are concise. The results on the MAWI traffic are publicly available and updated daily. Also, this approach permits to include the results of upcoming anomaly detectors so as to improve over time the quality and variety of labels.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Farid and his team proposed a hybrid intrusion detection system that uses a combination of Naive Bayes and decision tree algorithms, and it results in the detection rate of 99.63 % on the KDD'99 dataset.
“Farid and his team proposed a hybrid intrusion detection system that uses a combination of Naive Bayes and decision tree algorithms, and it results in the detection rate of 99.63 % on the KDD'99 dataset [79].”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [79]
Cites
Fast unfolding of communities in large networks
Blondel, V. D., Guillaume, J.-L., Lambiotte, R., & Lefebvre, E. (2008) · Journal of Statistical Mechanics: Theory and Experiment · doi:10.1088/1742-5468/2008/10/p10008 · Cited by 21,424 · see citing works
Fortunato, S. (2010) · Physics Reports · doi:10.1016/j.physrep.2009.11.002 · Cited by 11,293 · see citing works
Fast Algorithms for Mining Association Rules in Large Databases
Agrawal, R., & Srikant, R. (1994) · Very Large Data Bases · Cited by 9,454 · see citing works
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · see citing works
Combining Pattern Classifiers: Methods and Algorithms
Bagui, S. (2005) · Technometrics · doi:10.1198/tech.2005.s320 · Cited by 4,364 · see citing works
Kuncheva, L. I. (2004) · Wiley eBooks · doi:10.1002/0471660264 · Cited by 3,007 · see citing works
Testing Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · see citing works
Diagnosing network-wide traffic anomalies
Lakhina, A., Crovella, M., & Diot, C. (2004) · Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication · doi:10.1145/1015467.1015492 · Cited by 1,399 · see citing works
Mining anomalies using traffic feature distributions
Lakhina, A., Crovella, M. E., & Diot, C. (2005) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/1080091.1080118 · Cited by 1,062 · see citing works
Correspondence Analysis Handbook
Benzecri (1992) · CRC Press eBooks · doi:10.1201/9780585363035 · Cited by 928 · see citing works
The 1999 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00139-0 · Cited by 877 · see citing works
A signal analysis of network traffic anomalies
Barford, P., Kline, J., Plonka, D., & Ron, A. (2002) · ACM SIGCOMM Internet Measurement Workshop (IMW) · doi:10.1145/637201.637210 · Cited by 811 · see citing works
Difficulties in simulating the Internet
Floyd, S., & Paxson, V. (2001) · IEEE/ACM Transactions on Networking · doi:10.1109/90.944338 · Cited by 723 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
A nonstationary poisson view of internet traffic
Karagiannis, T., Molle, M., Faloutsos, M., & Broido, A. (2004) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infcom.2004.1354569 · Cited by 379 · see citing works
Sensitivity of PCA for traffic anomaly detection
Ringberg, H., Soule, A., Rexford, J., & Diot, C. (2007) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1254882.1254895 · Cited by 360 · see citing works
ANTIDOTE: understanding and defending against poisoning of anomaly detectors
Rubinstein, B. I. P., Nelson, B., Huang, L., Joseph, A. D., Lau, S.-H., Rao, S., Taft, N., & Tygar, J. D. (2009) · Proceedings of the 9th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1644893.1644895 · Cited by 331 · see citing works
An empirical evaluation of entropy-based traffic anomaly detection
Nychis, G. P., Sekar, V., Andersen, D. G., Kim, H., & Zhang, H. (2008) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1452520.1452539 · Cited by 302 · see citing works
Detection and identification of network anomalies using sketch subspaces
Li, X., Bian, F., Crovella, M. E., Diot, C., Govindan, R., Iannaccone, G., & Lakhina, A. (2006) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1177080.1177099 · Cited by 232 · see citing works
Using Correspondence Analysis to Combine Classifiers
Merz, C. J. (1999) · Machine Learning · doi:10.1023/a:1007559205422 · Cited by 209 · see citing works
Seven Years and One Day: Sketching the Evolution of Internet Traffic
Borgnat, P., Dewaele, G., Fukuda, K., Abry, P., & Cho, K. (2009) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infcom.2009.5061979 · Cited by 204 · see citing works
Self-citationTraffic data repository at the WIDE project
Cho, K., Mitsuya, K., & Kato, A. (2000) · Cited by 203 · see citing works
Sensitivity of PCA for traffic anomaly detection
Ringberg, H., Soule, A., Rexford, J., & Diot, C. (2007) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1269899.1254895 · Cited by 173 · see citing works
Anomaly Extraction in Backbone Networks Using Association Rules
Brauckhoff, D., Dimitropoulos, X. A., Wagner, A., & Salamatian, K. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187306 · Cited by 156 · see citing works
Non-Gaussian and Long Memory Statistical Characterizations for Internet Traffic with Anomalies
Scherrer, A., Larrieu, N., Owezarski, P., Borgnat, P., & Abry, P. (2007) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2007.12 · Cited by 139 · see citing works
Self-citationDewaele, G., Fukuda, K., Borgnat, P., Abry, P., & Cho, K. (2007) · doi:10.1145/1352664.1352675 · Cited by 118 · see citing works
Self-citationInternet Traffic Behavior Profiling for Network Security Monitoring
Xu, K., Zhang, Z.-L., & Bhattacharyya, S. (2008) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2007.911438 · Cited by 102 · see citing works
The need for simulation in evaluating anomaly detectors
Ringberg, H., Roughan, M., & Rexford, J. (2008) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1341431.1341443 · Cited by 70 · see citing works
Anomaly extraction in backbone networks using association rules
Brauckhoff, D., Dimitropoulos, X. A., Wagner, A., & Salamatian, K. (2009) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1644893.1644897 · Cited by 57 · see citing works
Accurate anomaly detection through parallelism
Shanbhag, S., & Wolf, T. (2009) · IEEE Network · doi:10.1109/mnet.2009.4804320 · Cited by 50 · see citing works
Evaluation of Anomaly Detection Based on Sketch and PCA
Kanda, Y., Fukuda, K., & Sugawara, T. (2010) · IEEE Global Telecommunications Conference (GLOBECOM) · doi:10.1109/glocom.2010.5683878 · Cited by 25 · see citing works
Self-citationAn Automatic and Dynamic Parameter Tuning of a Statistics-Based Anomaly Detection Algorithm
Himura, Y., Fukuda, K., Cho, K., & Esaki, H. (2009) · International Conference on Communications · doi:10.1109/icc.2009.5198722 · Cited by 23 · see citing works
Self-citationAn Information-Theoretic Combining Method for Multi-Classifier Anomaly Detection Systems
Ashfaq, A. B., Javed, M., Khayam, S. A., & Radha, H. (2010) · International Conference on Communications · doi:10.1109/icc.2010.5501984 · Cited by 21 · see citing works
A Hough-transform-based anomaly detector with an adaptive time interval
Fontugne, R., & Fukuda, K. (2011) · ACM SIGAPP Applied Computing Review · doi:10.1145/2034594.2034598 · Cited by 17 · see citing works
Self-citationA Database of Anomalous Traffic for Assessing Profile Based IDS
Owezarski, P. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-12365-8_5 · Cited by 11 · see citing works
A Hough-transform-based anomaly detector with an adaptive time interval
Fontugne, R., & Fukuda, K. (2011) · ACM Symposium on Applied Computing · doi:10.1145/1982185.1982290 · Cited by 11 · see citing works
Self-citationA Longitudinal Study of Small-Time Scaling Behavior of Internet Traffic
Gupta, H., Ribeiro, V. J., & Mahanti, A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-12963-6_7 · Cited by 6 · see citing works
Uncovering Relations between Traffic Classifiers and Anomaly Detectors via Graph Theory
Fontugne, R., Borgnat, P., Abry, P., & Fukuda, K. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-12365-8_8 · Cited by 3 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,313 · see citing works
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,298 · see citing works
Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications
Xu, H., Feng, Y., Chen, J., Wang, Z., Qiao, H., Chen, W., Zhao, N., Li, Z., Bu, J., Li, Z., et al. (2018) · International World Wide Web Conference (WWW) · doi:10.1145/3178876.3185996 · Cited by 1,001 · see citing works
A survey of network-based intrusion detection data sets
Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Andreas Hotho, A. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.005 · Cited by 977 · see citing works
An empirical comparison of botnet detection methods
García, S., Grill, M., Stiborek, J., & Zunino, A. (2014) · Computers & Security · doi:10.1016/j.cose.2014.05.011 · Cited by 962 · see citing works
Anomaly Detection in Streams with Extreme Value Theory
Siffer, A., Fouque, P.-A., Termier, A., & Largouët, C. (2017) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3097983.3098144 · Cited by 601 · see citing works
Event labeling combining ensemble detectors and background knowledge
Fanaee‐T, H., & da Gama, J. M. P. (2013) · Progress in Artificial Intelligence · doi:10.1007/s13748-013-0040-3 · Cited by 423 · see citing works
Intrusion detection and Big Heterogeneous Data: a Survey
Zuech, R., Khoshgoftaar, T. M., & Wald, R. (2015) · Journal Of Big Data · doi:10.1186/s40537-015-0013-4 · Cited by 328 · see citing works
FedMCCS: Multicriteria Client Selection Model for Optimal IoT Federated Learning
AbdulRahman, S., Tout, H., Mourad, A., & Talhi, C. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3028742 · Cited by 323 · see citing works
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works
Liu, D., Zhao, Y., Xu, H., Sun, Y., Pei, D., Luo, J., Jing, X., & Mei, F. (2015) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2815675.2815679 · Cited by 257 · see citing works
UGR‘16: A new dataset for the evaluation of cyclostationarity-based network IDSs
Maciá‐Fernández, G., Camacho, J., Carrión, R. M., García‐Teodoro, P., & Therón, R. (2017) · Computers & Security · doi:10.1016/j.cose.2017.11.004 · Cited by 214 · see citing works
Flow-based intrusion detection: Techniques and challenges
Umer, M. F., Sher, M., & Bi, Y. (2017) · Computers & Security · doi:10.1016/j.cose.2017.05.009 · Cited by 205 · see citing works
Evaluating Computer Intrusion Detection Systems
Milenkoski, A., Vieira, M. P. A., Kounev, S., Avritzer, A., & Payne, B. D. (2015) · ACM Computing Surveys · doi:10.1145/2808691 · Cited by 194 · see citing works
A Survey on Data-driven Network Intrusion Detection
Chou, D., & Jiang, M. (2021) · ACM Computing Surveys · doi:10.1145/3472753 · Cited by 219 · see citing works
Gumusbas, D., Yıldırım, T., Genovese, A., & Scotti, F. (2020) · IEEE Systems Journal · doi:10.1109/jsyst.2020.2992966 · Cited by 183 · see citing works
HELAD: A novel network anomaly detection model based on heterogeneous ensemble learning
Zhong, Y. C., Chen, W., Wang, Z., Chen, Y., Wang, K., Li, Y., Yin, X., Shi, X., Yang, J., & Li, K. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.107049 · Cited by 172 · see citing works
Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats
Chen, Z., Liu, J., Shen, Y., Şimşek, M., Kantarcı, B., Mouftah, H. T., & Djukic, P. (2022) · ACM Computing Surveys · doi:10.1145/3530812 · Cited by 167 · see citing works
An End-to-End Framework for Machine Learning-Based Network Intrusion Detection System
Bertoli, G. D. C., Pereira, L. A., Saotome, O., dos Santos, A. L., Verri, F. A. N., Marcondes, C. A. C., Barbieri, S., Rodrigues, M. S., & de Oliveira, J. M. P. (2021) · IEEE Access · doi:10.1109/access.2021.3101188 · Cited by 144 · see citing works
KDD Cup 99 Data Sets: A Perspective on the Role of Data Sets in Network Intrusion Detection Research
Siddique, K., Akhtar, Z., Khan, F. A., & Kim, Y. (2019) · Computer · doi:10.1109/mc.2018.2888764 · Cited by 143 · see citing works
Online and Scalable Unsupervised Network Anomaly Detection Method
Dromard, J., Roudière, G., & Owezarski, P. (2016) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2016.2627340 · Cited by 142 · see citing works
RouteNet-Fermi: Network Modeling With Graph Neural Networks
Ferriol-Galmés, M., Paillissé, J., Suárez‐Varela, J., Rusek, K., Xiao, S., Shi, X., Cheng, X., Barlet‐Ros, P., & Cabellos‐Aparicio, A. (2023) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2023.3269983 · Cited by 130 · see citing works
Molina-Coronado, B., Mori, U., Mendiburu, A., & Miguel-Alonso, J. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3016246 · Cited by 140 · see citing works
Privacy and Security Aspects of E-Government in Smart Cities
Yang, L., Elisa, N., & Eliot, N. (2018) · Elsevier eBooks · doi:10.1016/b978-0-12-815032-0.00007-x · Cited by 125 · see citing works
A Survey on the Development of Self-Organizing Maps for Unsupervised Intrusion Detection
Qu, X., Yang, L., Guo, K., Ma, L., Sun, M., Ke, M., & Li, M. (2019) · Mobile Networks and Applications · doi:10.1007/s11036-019-01353-0 · Cited by 110 · see citing works
Real time dataset generation framework for intrusion detection systems in IoT
Al-Hadhrami, Y., & Hussain, F. K. (2020) · Future Generation Computer Systems · doi:10.1016/j.future.2020.02.051 · Cited by 105 · see citing works
DAPT 2020 - Constructing a Benchmark Dataset for Advanced Persistent Threats
Myneni, S., Chowdhary, A., Sabur, A., Sengupta, S., Agrawal, G., Huang, D., & Kang, M. H. (2020) · Communications in computer and information science · doi:10.1007/978-3-030-59621-7_8 · Cited by 105 · see citing works
Ensemble-learning Approaches for Network Security and Anomaly Detection
Vanerio, J., & Casas, P. (2017) · doi:10.1145/3098593.3098594 · Cited by 104 · see citing works
Generating Network Intrusion Detection Dataset Based on Real and Encrypted Synthetic Attack Traffic
Ferriyan, A., Thamrin, A. H., Takeda, K., & Murai, J. (2021) · Applied Sciences · doi:10.3390/app11177868 · Cited by 103 · see citing works
BigFlow: Real-time and reliable anomaly-based intrusion detection for high-speed networks
Viegas, E. K., Santin, A. O., Bessani, A., & Neves, N. (2018) · Future Generation Computer Systems · doi:10.1016/j.future.2018.09.051 · Cited by 100 · see citing works
An Empirical Evaluation of Deep Learning for Network Anomaly Detection
Malaiya, R. K., Kwon, D., Suh, S. C., Kim, H., Kim, I., & Kim, J. (2019) · IEEE Access · doi:10.1109/access.2019.2943249 · Cited by 91 · see citing works
Robust and Unsupervised KPI Anomaly Detection Based on Conditional Variational Autoencoder
Li, Z., Chen, W., & Pei, D. (2018) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/pccc.2018.8710885 · Cited by 89 · see citing works
Fontugne, R., Abry, P., Fukuda, K., Veitch, D., Cho, K., Borgnat, P., & Wendt, H. (2017) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2017.2675450 · Cited by 88 · see citing works
Self-citationNetwork traffic fusion and analysis against DDoS flooding attacks with a novel reversible sketch
Jing, X., Yan, Z., Jiang, X., & Pedrycz, W. (2018) · Information Fusion · doi:10.1016/j.inffus.2018.10.013 · Cited by 87 · see citing works
A LSTM-FCNN based multi-class intrusion detection using scalable framework
Sahu, S. K., Mohapatra, D. P., Rout, J. K., Sahoo, K. S., Pham, Q., & Dao, N. (2022) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2022.107720 · Cited by 82 · see citing works
Building a Digital Twin for network optimization using Graph Neural Networks
Ferriol-Galmés, M., Suárez‐Varela, J., Paillissé, J., Shi, X., Xiao, S., Cheng, X., Barlet‐Ros, P., & Cabellos‐Aparicio, A. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109329 · Cited by 82 · see citing works
On High-Speed Flow-Based Intrusion Detection Using Snort-Compatible Signatures
Erlacher, F., & Dressler, F. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.2973992 · Cited by 78 · see citing works
Pour, M. S., Mangino, A., Friday, K., Rathbun, M., Bou‐Harb, E., Iqbal, F., Samtani, S., Crichigno, J., & Ghani, N. (2019) · Computers & Security · doi:10.1016/j.cose.2019.101707 · Cited by 77 · see citing works
An Encoding Technique for CNN-based Network Anomaly Detection
Kim, T., Suh, S. C., Kim, H., Kim, J., & Kim, J. (2018) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2018.8622568 · Cited by 76 · see citing works
Recent endeavors in machine learning-powered intrusion detection systems for the Internet of Things
Manivannan, D. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.103925 · Cited by 78 · see citing works
Kenyon, A., Deka, L., & Elizondo, D. A. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102022 · Cited by 74 · see citing works
On Generating Network Traffic Datasets with Synthetic Attacks for Intrusion Detection
Cordero, C. G., Vasilomanolakis, E., Wainakh, A., Mühlhäuser, M., & Nadjm‐Tehrani, S. (2021) · ACM Transactions on Privacy and Security · doi:10.1145/3424155 · Cited by 4 · see citing works
Power spectrum entropy based detection and mitigation of low-rate DoS attacks
Chen, Z., Yeo, C. K., Lee, B., & Lau, C. T. (2018) · Computer Networks · doi:10.1016/j.comnet.2018.02.029 · Cited by 69 · see citing works
Situ: Identifying and Explaining Suspicious Behavior in Networks
Goodall, J. R., Ragan, E. D., Steed, C. A., Reed, J. W., Richardson, G. D., Huffer, K. M. T., Bridges, R. A., & Laska, J. A. (2018) · IEEE Transactions on Visualization and Computer Graphics · doi:10.1109/tvcg.2018.2865029 · Cited by 69 · see citing works
Analyzing flow-based anomaly intrusion detection using Replicator Neural Networks
Cordero, C. G., Hauke, S., Mühlhäuser, M., & Fischer, M. (2016) · Conference on Privacy, Security and Trust · doi:10.1109/pst.2016.7906980 · Cited by 60 · see citing works
Jeune, L. L., Goedemé, T., & Mentens, N. (2021) · IEEE Access · doi:10.1109/access.2021.3075066 · Cited by 58 · see citing works
PAC-GPT: A Novel Approach to Generating Synthetic Network Traffic With GPT-3
Kholgh, D. K., & Kostakos, P. (2023) · IEEE Access · doi:10.1109/access.2023.3325727 · Cited by 58 · see citing works
Detection of slow port scans in flow-based network traffic
Ring, M., Landes, D., & Andreas Hotho, A. (2018) · PLoS ONE · doi:10.1371/journal.pone.0204507 · Cited by 58 · see citing works
SDNScore: A statistical defense mechanism against DDoS attacks in SDN environment
Kalkan, K., Gür, G., & Alagöz, F. (2017) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc.2017.8024605 · Cited by 56 · see citing works
Viegas, E. K., Santin, A. O., & Abreu, V. (2020) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2020.3038618 · Cited by 54 · see citing works
Makris, I., Karampasi, A. S., Grammatikis, P. I. R., Episkopos, N., Iturbe, E., Rios, E., Piperigkos, N., Lalos, A. S., Xenakis, C., Λάγκας, Θ., et al. (2024) · Computer Science Review · doi:10.1016/j.cosrev.2024.100717 · Cited by 61 · see citing works
Unsupervised Online Anomaly Detection With Parameter Adaptation for KPI Abrupt Changes
Yu, G. W., Cai, Z., Wang, S., Chen, H., Liu, F., & Liu, A. (2019) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2019.2962701 · Cited by 53 · see citing works
Evasion Attack and Defense on Machine Learning Models in Cyber-Physical Systems: A Survey
Wang, S., Ko, R. K. L., Bai, G., Dong, N., Choi, T., & Zhang, Y. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3344808 · Cited by 55 · see citing works
Hashdoop: A MapReduce framework for network anomaly detection
Fontugne, R., Mazel, J., & Fukuda, K. (2014) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infcomw.2014.6849281 · Cited by 52 · see citing works
Self-citationCyber Attack Prediction: From Traditional Machine Learning to Generative Artificial Intelligence
Ankalaki, S., Atmakuri, A. R., Pallavi, M., Hukkeri, G. S., Jan, T., & Naik, G. R. (2025) · IEEE Access · doi:10.1109/access.2025.3547433 · Cited by 63 · see citing works
Quantitative comparison of unsupervised anomaly detection algorithms for intrusion detection
Falcão, F., Zoppi, T., Silva, C. B. V., dos Santos, A. A., Fonseca, B., Ceccarelli, A., & Bondavalli, A. (2019) · ACM Symposium on Applied Computing · doi:10.1145/3297280.3297314 · Cited by 52 · see citing works
Cybersecurity Deep: Approaches, Attacks Dataset, and Comparative Study
Barik, K., Misra, S., Konar, K., Sanz, L. F., & Koyuncu, M. (2022) · Applied Artificial Intelligence · doi:10.1080/08839514.2022.2055399 · Cited by 50 · see citing works
A distributed filtering mechanism against DDoS attacks: ScoreForCore
Kalkan, K., & Alagöz, F. (2016) · Computer Networks · doi:10.1016/j.comnet.2016.08.023 · Cited by 50 · see citing works
Network Traffic Generation: A Survey and Methodology
Adeleke, O. A., Bastin, N., & Gurkan, D. (2022) · ACM Computing Surveys · doi:10.1145/3488375 · Cited by 49 · see citing works
A taxonomy of anomalies in backbone network traffic
Mazel, J., Fontugne, R., & Fukuda, K. (2014) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2014.6906328 · Cited by 49 · see citing works
Self-citationEfficient KPI Anomaly Detection Through Transfer Learning for Large-Scale Web Services
Zhang, S., Zhong, Z., Li, D., Fan, Q., Sun, Y., Zhu, M., Zhang, Y., Pei, D., Sun, J., Liu, Y., et al. (2022) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2022.3180785 · Cited by 49 · see citing works
ADMIRE: Anomaly detection method using entropy-based PCA with three-step sketches
Kanda, Y., Fontugne, R., Fukuda, K., & Sugawara, T. (2012) · Computer Communications · doi:10.1016/j.comcom.2012.12.002 · Cited by 46 · see citing works
Self-citationNdibwile, J. D., Govardhan, A., Okada, K., & Kadobayashi, Y. (2015) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac.2015.240 · Cited by 45 · see citing works
Reinforcement Learning for Intrusion Detection: More Model Longness and Fewer Updates
dos Santos, R. R., Viegas, E. K., Santin, A. O., & Cogo, V. V. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3207094 · Cited by 41 · see citing works
Network security and anomaly detection with Big-DAMA, a big data analytics framework
Casas, P., Soro, F., Vanerio, J., Settanni, G., & D’Alconzo, A. (2017) · IEEE International Conference on Cloud Networking · doi:10.1109/cloudnet.2017.8071525 · Cited by 40 · see citing works
Hybrid DDoS Detection Framework Using Matching Pursuit Algorithm
Erhan, D., & Anarım, E. (2020) · IEEE Access · doi:10.1109/access.2020.3005781 · Cited by 40 · see citing works
Practical Intrusion Detection of Emerging Threats
Mills, R., Marnerides, A. K., Broadbent, M., & Race, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3091517 · Cited by 40 · see citing works
A two-stage flow-based intrusion detection model for next-generation networks
Umer, M. F., Sher, M., & Bi, Y. (2018) · PLoS ONE · doi:10.1371/journal.pone.0180945 · Cited by 39 · see citing works
Stream-based Machine Learning for Network Security and Anomaly Detection
Mulinka, P., & Casas, P. (2018) · doi:10.1145/3229607.3229612 · Cited by 39 · see citing works
Nawir, M., Amir, A., Lynn, O. B., Yaakob, N., & Ahmad, R. B. (2018) · Journal of Physics Conference Series · doi:10.1088/1742-6596/1018/1/012015 · Cited by 37 · see citing works
Comparison of Classification Algorithms on ICMPv6-Based DDoS Attacks Detection
Elejla, O. E., Belaton, B., Anbar, M., Alabsi, B. A., & Al-Ani, A. K. (2018) · Lecture notes in electrical engineering · doi:10.1007/978-981-13-2622-6_34 · Cited by 37 · see citing works
Korczyński, M., Hamieh, A., Huh, J. H., Holm, H., Rajagopalan, S. R., & Fefferman, N. H. (2016) · IEEE Communications Magazine · doi:10.1109/mcom.2016.7497768 · Cited by 36 · see citing works
Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis
Tang, D., Dai, R., Tang, L., & Li, X. (2020) · Human-centric Computing and Information Sciences · doi:10.1186/s13673-020-0210-9 · Cited by 35 · see citing works
Improving Data Generalization With Variational Autoencoders for Network Traffic Anomaly Detection
Monshizadeh, M., Khatri, V., Gamdou, M., Kantola, R., & Yan, Z. (2021) · IEEE Access · doi:10.1109/access.2021.3072126 · Cited by 35 · see citing works
Hunting attacks in the dark: clustering and correlation analysis for unsupervised anomaly detection
Mazel, J., Casas, P., Fontugne, R., Fukuda, K., & Owezarski, P. (2015) · International Journal of Network Management · doi:10.1002/nem.1903 · Cited by 33 · see citing works
Self-citationToward feasible machine learning model updates in network-based intrusion detection
Horchulhack, P., Viegas, E. K., & Santin, A. O. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108618 · Cited by 33 · see citing works
CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting
Koumar, J., Hynek, K., Čejka, T., & Šiška, P. (2025) · Scientific Data · doi:10.1038/s41597-025-04603-x · Cited by 33 · see citing works
An information-theoretic method for the detection of anomalies in network traffic
Callegari, C., Giordano, S., & Pagano, M. (2017) · Computers & Security · doi:10.1016/j.cose.2017.07.004 · Cited by 32 · see citing works
Mondragón, J. C. M., Branco, P., Jourdan, G.-V., Gutierrez-Rodríguez, A. E., & Biswal, R. R. (2025) · Applied Intelligence · doi:10.1007/s10489-025-06422-4 · Cited by 35 · see citing works
Towards the creation of synthetic, yet realistic, intrusion detection datasets
Vasilomanolakis, E., Cordero, C. G., Milanov, N., & Mühlhäuser, M. (2016) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms.2016.7502989 · Cited by 30 · see citing works
ENIDrift: A Fast and Adaptive Ensemble System for Network Intrusion Detection under Real-world Drift
Wang, X. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3567992 · Cited by 30 · see citing works
On the educated selection of unsupervised algorithms via attacks and anomaly classes
Zoppi, T., Ceccarelli, A., Salani, L., & Bondavalli, A. (2020) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102474 · Cited by 28 · see citing works
ID2T: A DIY dataset creation toolkit for Intrusion Detection Systems
Cordero, C. G., Vasilomanolakis, E., Milanov, N., Koch, C., Hausheer, D., & Mühlhäuser, M. (2015) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2015.7346912 · Cited by 28 · see citing works
Application-Aware Firewall Mechanism for Software Defined Networks
Nife, F. N., & Kotulski, Z. (2020) · Journal of Network and Systems Management · doi:10.1007/s10922-020-09518-z · Cited by 28 · see citing works
Mazel, J., Casas, P., Labit, Y., & Owezarski, P. (2011) · Conference on Network and Service Management · doi:10.5555/2147671.2147683 · Cited by 27 · see citing works
Wang, A., Guo, Y., Fang, H., Lakshman, T. V., & Chen, S. (2015) · ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) · doi:10.1145/2716281.2836100 · Cited by 27 · see citing works
The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users
Dietz, K., Mühlhauser, M., Kögel, J., Schwinger, S., Sichermann, M., Seufert, M., Herrmann, D., & Hoßfeld, T. (2024) · IEEE Access · doi:10.1109/access.2024.3406939 · Cited by 26 · see citing works
Performance Evaluation of a Combined Anomaly Detection Platform
Monshizadeh, M., Khatri, V., Atli, B. G., Kantola, R., & Yan, Z. (2019) · IEEE Access · doi:10.1109/access.2019.2930832 · Cited by 26 · see citing works
A Reliable Semi-Supervised Intrusion Detection Model: One Year of Network Traffic Anomalies
Viegas, E. K., Santin, A. O., Cogo, V. V., & Abreu, V. (2020) · International Conference on Communications · doi:10.1109/icc40277.2020.9148916 · Cited by 25 · see citing works
Self-adversarial variational autoencoder with spectral residual for time series anomaly detection
Liu, Y., Lin, Y., Xiao, Q., Hu, G., & Wang, J. (2021) · Neurocomputing · doi:10.1016/j.neucom.2021.06.030 · Cited by 24 · see citing works
Visual Anomaly Detection in Event Sequence Data
Guo, S., Jin, Z., Chen, Q., Gotz, D., Hongyuan Zha, B., & Cao, N. (2019) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata47090.2019.9005687 · Cited by 30 · see citing works
Bridging machine learning and computer network research: a survey
Yang, C. H., Geng, J., Wang, Y., Li, J., Li, D., & Wu, J. (2018) · CCF Transactions on Networking · doi:10.1007/s42045-018-0009-7 · Cited by 23 · see citing works
Chen, Z., Cheng, G., Xu, Z., Xu, K., Shan, Y., & Zhang, J. (2022) · Applied Sciences · doi:10.3390/app122211731 · Cited by 22 · see citing works
GML learning, a generic machine learning model for network measurements analysis
Casas, P., Vanerio, J., & Fukuda, K. (2017) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm.2017.8255998 · Cited by 22 · see citing works
Self-citationBoğaziçi University distributed denial of service dataset
Erhan, D., & Anarım, E. (2020) · Data in Brief · doi:10.1016/j.dib.2020.106187 · Cited by 22 · see citing works
An Energy-Efficient Intrusion Detection Offloading Based on DNN for Edge Computing
Simioni, J. A., Viegas, E. K., Santin, A. O., & de Matos, É. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3544060 · Cited by 21 · see citing works
Detection of network anomalies using Improved-MSPCA with sketches
Chen, Z., Yeo, C. K., Lee, B., & Lau, C. T. (2016) · Computers & Security · doi:10.1016/j.cose.2016.10.010 · Cited by 21 · see citing works
Anomaly Detection via Federated Learning
Vucovich, M., Tarcar, A. K., Rebelo, P., Rahman, A., Nandakumar, D., Redino, C., Choi, K., Schiller, R., Bhattacharya, S., Veeramani, B., et al. (2023) · International Telecommunication Networks and Applications Conference (ITNAC) · doi:10.1109/itnac59571.2023.10368517 · Cited by 21 · see citing works
Similarity as a central approach to flow‐based anomaly detection
Drašar, M., Vizváry, M., & Vykopal, J. (2014) · International Journal of Network Management · doi:10.1002/nem.1867 · Cited by 21 · see citing works
Hyperscaling Internet Graph Analysis with D4M on the MIT SuperCloud
Gadepally, V. N., Kepner, J., Milechin, L., Arcand, W., Bestor, D., Bergeron, B., Byun, C., Hubbell, M., Houle, M., Jones, M., et al. (2018) · IEEE High Performance Extreme Computing Conference · doi:10.1109/hpec.2018.8547552 · Cited by 20 · see citing works
- Authors
- Fontugne, R., Borgnat, P., Abry, P., & Fukuda, K.
- Affiliations
- The Graduate University for Advanced Studies, SOKENDAI (JP)
- École Normale Supérieure de Lyon (FR)
- National Institute of Informatics (JP)
- Venue
- Proceedings of the 6th International COnference
- Publisher
- ACM
- Published
- 2010-11-30
- Pages
- 1-12
- OpenAlex
- W2040333627
- Cited by
- 295
- References
- 38
- Citations by year
- 2026: 13 · 2025: 19 · 2024: 24 · 2023: 14 · 2022: 27 · 2021: 26 · 2020: 38 · 2019: 33 · 2018: 31 · 2017: 18 · 2016: 16 · 2015: 12 · 2014: 7 · 2013: 4 · 2012: 4
- FWCI
- 4.90
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Proceedings of the 6th International Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- network anomaly detection, traffic monitoring, dimensionality reduction, false positive reduction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
