The DOI matches its Crossref record; 38 of the 38 references it cites were found in a registry or an index.
MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking
Abstract
Evaluating anomaly detectors is a crucial task in traffic monitoring made particularly difficult due to the lack of ground truth. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labeled anomaly traffic traces. We aim at automatically finding anomalies in the MAWI archive using a new methodology that combines different and independent detectors. A key challenge is to compare the alarms raised by these detectors, though they operate at different traffic granularities. The main contribution is to propose a reliable graph-based methodology that combines any anomaly detector outputs. We evaluated four unsupervised combination strategies; the best is the one that is based on dimensionality reduction. The synergy between anomaly detectors permits to detect twice as many anomalies as the most accurate detector, and to reject numerous false positive alarms reported by the detectors. Significant anomalous traffic features are extracted from reported alarms, hence the labels assigned to the MAWI archive are concise. The results on the MAWI traffic are publicly available and updated daily. Also, this approach permits to include the results of upcoming anomaly detectors so as to improve over time the quality and variety of labels.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Farid and his team proposed a hybrid intrusion detection system that uses a combination of Naive Bayes and decision tree algorithms, and it results in the detection rate of 99.63 % on the KDD'99 dataset [79].”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [79]
Citations
Cites
Fast unfolding of communities in large networks
Blondel, V. D., Guillaume, J.-L., Lambiotte, R., & Lefebvre, E. (2008) · Journal of Statistical Mechanics: Theory and Experiment · doi:10.1088/1742-5468/2008/10/p10008 · Cited by 21,424
Fortunato, S. (2010) · Physics Reports · doi:10.1016/j.physrep.2009.11.002 · Cited by 11,293
Fast Algorithms for Mining Association Rules in Large Databases
Agrawal, R., & Srikant, R. (1994) · Very Large Data Bases · Cited by 9,454
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396
Combining Pattern Classifiers: Methods and Algorithms
Bagui, S. (2005) · Technometrics · doi:10.1198/tech.2005.s320 · Cited by 4,364
Kuncheva, L. I. (2004) · Wiley eBooks · doi:10.1002/0471660264 · Cited by 3,007
Testing Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490
Diagnosing network-wide traffic anomalies
Lakhina, A., Crovella, M., & Diot, C. (2004) · Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication · doi:10.1145/1015467.1015492 · Cited by 1,399
Mining anomalies using traffic feature distributions
Lakhina, A., Crovella, M. E., & Diot, C. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080118 · Cited by 1,064
Correspondence Analysis Handbook
Benzecri (1992) · CRC Press eBooks · doi:10.1201/9780585363035 · Cited by 928
The 1999 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00139-0 · Cited by 877
A signal analysis of network traffic anomalies
Barford, P., Kline, J., Plonka, D., & Ron, A. (2002) · ACM SIGCOMM Internet Measurement Workshop (IMW) · doi:10.1145/637201.637210 · Cited by 811
Difficulties in simulating the Internet
Floyd, S., & Paxson, V. (2001) · IEEE/ACM Transactions on Networking · doi:10.1109/90.944338 · Cited by 723
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485
A nonstationary poisson view of internet traffic
Karagiannis, T., Molle, M., Faloutsos, M., & Broido, A. (2004) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infcom.2004.1354569 · Cited by 379
Sensitivity of PCA for traffic anomaly detection
Ringberg, H., Soule, A., Rexford, J., & Diot, C. (2007) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1254882.1254895 · Cited by 360
ANTIDOTE: understanding and defending against poisoning of anomaly detectors
Rubinstein, B. I. P., Nelson, B., Huang, L., Joseph, A. D., Lau, S.-H., Rao, S., Taft, N., & Tygar, J. D. (2009) · Proceedings of the 9th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1644893.1644895 · Cited by 331
An empirical evaluation of entropy-based traffic anomaly detection
Nychis, G. P., Sekar, V., Andersen, D. G., Kim, H., & Zhang, H. (2008) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1452520.1452539 · Cited by 302
Detection and identification of network anomalies using sketch subspaces
Li, X., Bian, F., Crovella, M. E., Diot, C., Govindan, R., Iannaccone, G., & Lakhina, A. (2006) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1177080.1177099 · Cited by 232
Using Correspondence Analysis to Combine Classifiers
Merz, C. J. (1999) · Machine Learning · doi:10.1023/a:1007559205422 · Cited by 209
Seven Years and One Day: Sketching the Evolution of Internet Traffic
Borgnat, P., Dewaele, G., Fukuda, K., Abry, P., & Cho, K. (2009) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infcom.2009.5061979 · Cited by 204
Self-citationTraffic data repository at the WIDE project
Cho, K., Mitsuya, K., & Kato, A. (2000) · Cited by 203
Sensitivity of PCA for traffic anomaly detection
Ringberg, H., Soule, A., Rexford, J., & Diot, C. (2007) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1269899.1254895 · Cited by 173
Anomaly Extraction in Backbone Networks Using Association Rules
Brauckhoff, D., Dimitropoulos, X. A., Wagner, A., & Salamatian, K. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187306 · Cited by 156
Non-Gaussian and Long Memory Statistical Characterizations for Internet Traffic with Anomalies
Scherrer, A., Larrieu, N., Owezarski, P., Borgnat, P., & Abry, P. (2007) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2007.12 · Cited by 139
Self-citationDewaele, G., Fukuda, K., Borgnat, P., Abry, P., & Cho, K. (2007) · doi:10.1145/1352664.1352675 · Cited by 118
Self-citationInternet Traffic Behavior Profiling for Network Security Monitoring
Xu, K., Zhang, Z.-L., & Bhattacharyya, S. (2008) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2007.911438 · Cited by 102
The need for simulation in evaluating anomaly detectors
Ringberg, H., Roughan, M., & Rexford, J. (2008) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1341431.1341443 · Cited by 70
Anomaly extraction in backbone networks using association rules
Brauckhoff, D., Dimitropoulos, X. A., Wagner, A., & Salamatian, K. (2009) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1644893.1644897 · Cited by 57
Accurate anomaly detection through parallelism
Shanbhag, S., & Wolf, T. (2009) · IEEE Network · doi:10.1109/mnet.2009.4804320 · Cited by 50
Evaluation of Anomaly Detection Based on Sketch and PCA
Kanda, Y., Fukuda, K., & Sugawara, T. (2010) · IEEE Global Telecommunications Conference (GLOBECOM) · doi:10.1109/glocom.2010.5683878 · Cited by 25
Self-citationAn Automatic and Dynamic Parameter Tuning of a Statistics-Based Anomaly Detection Algorithm
Himura, Y., Fukuda, K., Cho, K., & Esaki, H. (2009) · International Conference on Communications · doi:10.1109/icc.2009.5198722 · Cited by 23
Self-citationAn Information-Theoretic Combining Method for Multi-Classifier Anomaly Detection Systems
Ashfaq, A. B., Javed, M., Khayam, S. A., & Radha, H. (2010) · International Conference on Communications · doi:10.1109/icc.2010.5501984 · Cited by 21
A Hough-transform-based anomaly detector with an adaptive time interval
Fontugne, R., & Fukuda, K. (2011) · ACM SIGAPP Applied Computing Review · doi:10.1145/2034594.2034598 · Cited by 17
Self-citationA Database of Anomalous Traffic for Assessing Profile Based IDS
Owezarski, P. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-12365-8_5 · Cited by 11
A Hough-transform-based anomaly detector with an adaptive time interval
Fontugne, R., & Fukuda, K. (2011) · ACM Symposium on Applied Computing · doi:10.1145/1982185.1982290 · Cited by 11
Self-citationA Longitudinal Study of Small-Time Scaling Behavior of Internet Traffic
Gupta, H., Ribeiro, V. J., & Mahanti, A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-12963-6_7 · Cited by 6
Uncovering Relations between Traffic Classifiers and Anomaly Detectors via Graph Theory
Fontugne, R., Borgnat, P., Abry, P., & Fukuda, K. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-12365-8_8 · Cited by 3
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,514
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,386
Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications
Xu, H., Feng, Y., Chen, J., Wang, Z., Qiao, H., Chen, W., Zhao, N., Li, Z., Bu, J., Li, Z., et al. (2018) · International World Wide Web Conference (WWW) · doi:10.1145/3178876.3185996 · Cited by 1,081
A survey of network-based intrusion detection data sets
Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Andreas Hotho, A. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.005 · Cited by 977
An empirical comparison of botnet detection methods
García, S., Grill, M., Stiborek, J., & Zunino, A. (2014) · Computers & Security · doi:10.1016/j.cose.2014.05.011 · Cited by 962
Metadata
- Authors
- Fontugne, R., Borgnat, P., Abry, P., & Fukuda, K.
- Affiliations
- The Graduate University for Advanced Studies, SOKENDAI (JP)
- École Normale Supérieure de Lyon (FR)
- National Institute of Informatics (JP)
- Venue
- Proceedings of the 6th International COnference
- Publisher
- ACM
- Published
- 2010-11-30
- Pages
- 1-12
- OpenAlex
- W2040333627
- Cited by
- 295
- References
- 38
- Citations by year
- 2026: 13 · 2025: 19 · 2024: 24 · 2023: 14 · 2022: 27 · 2021: 26 · 2020: 38 · 2019: 33 · 2018: 31 · 2017: 18 · 2016: 16 · 2015: 12 · 2014: 7 · 2013: 4 · 2012: 4
- FWCI
- 4.90
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Proceedings of the 6th International Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- network anomaly detection, traffic monitoring, dimensionality reduction, false positive reduction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
