The DOI matches its Crossref record; 38 of the 38 references it cites were found in a registry or an index.
MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking
Abstract
Evaluating anomaly detectors is a crucial task in traffic monitoring made particularly difficult due to the lack of ground truth. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labeled anomaly traffic traces. We aim at automatically finding anomalies in the MAWI archive using a new methodology that combines different and independent detectors. A key challenge is to compare the alarms raised by these detectors, though they operate at different traffic granularities. The main contribution is to propose a reliable graph-based methodology that combines any anomaly detector outputs. We evaluated four unsupervised combination strategies; the best is the one that is based on dimensionality reduction. The synergy between anomaly detectors permits to detect twice as many anomalies as the most accurate detector, and to reject numerous false positive alarms reported by the detectors. Significant anomalous traffic features are extracted from reported alarms, hence the labels assigned to the MAWI archive are concise. The results on the MAWI traffic are publicly available and updated daily. Also, this approach permits to include the results of upcoming anomaly detectors so as to improve over time the quality and variety of labels.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Farid and his team proposed a hybrid intrusion detection system that uses a combination of Naive Bayes and decision tree algorithms, and it results in the detection rate of 99.63 % on the KDD'99 dataset [79].”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [79]
Citations
Cites
Fast unfolding of communities in large networks
Blondel, V. D., Guillaume, J.-L., Lambiotte, R., & Lefebvre, E. (2008) · Journal of Statistical Mechanics: Theory and Experiment · doi:10.1088/1742-5468/2008/10/p10008 · Cited by 21,424
Fortunato, S. (2010) · Physics Reports · doi:10.1016/j.physrep.2009.11.002 · Cited by 11,293
Fast Algorithms for Mining Association Rules in Large Databases
Agrawal, R., & Srikant, R. (1994) · Very Large Data Bases · Cited by 9,454
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396
Combining Pattern Classifiers: Methods and Algorithms
Bagui, S. (2005) · Technometrics · doi:10.1198/tech.2005.s320 · Cited by 4,364
Kuncheva, L. I. (2004) · Wiley eBooks · doi:10.1002/0471660264 · Cited by 3,007
Testing Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490
Diagnosing network-wide traffic anomalies
Lakhina, A., Crovella, M., & Diot, C. (2004) · Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication · doi:10.1145/1015467.1015492 · Cited by 1,399
Mining anomalies using traffic feature distributions
Lakhina, A., Crovella, M. E., & Diot, C. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080118 · Cited by 1,064
Correspondence Analysis Handbook
Benzecri (1992) · CRC Press eBooks · doi:10.1201/9780585363035 · Cited by 928
Cited by
Sorted by citations
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,514
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,386
Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications
Xu, H., Feng, Y., Chen, J., Wang, Z., Qiao, H., Chen, W., Zhao, N., Li, Z., Bu, J., Li, Z., et al. (2018) · International World Wide Web Conference (WWW) · doi:10.1145/3178876.3185996 · Cited by 1,081
A survey of network-based intrusion detection data sets
Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Andreas Hotho, A. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.005 · Cited by 977
An empirical comparison of botnet detection methods
García, S., Grill, M., Stiborek, J., & Zunino, A. (2014) · Computers & Security · doi:10.1016/j.cose.2014.05.011 · Cited by 962
Metadata
- Authors
- Fontugne, R., Borgnat, P., Abry, P., & Fukuda, K.
- Affiliations
- The Graduate University for Advanced Studies, SOKENDAI (JP)
- École Normale Supérieure de Lyon (FR)
- National Institute of Informatics (JP)
- Venue
- Proceedings of the 6th International COnference
- Publisher
- ACM
- Published
- 2010-11-30
- Pages
- 1-12
- OpenAlex
- W2040333627
- Cited by
- 295
- References
- 38
- Citations by year
- 2026: 13 · 2025: 19 · 2024: 24 · 2023: 14 · 2022: 27 · 2021: 26 · 2020: 38 · 2019: 33 · 2018: 31 · 2017: 18 · 2016: 16 · 2015: 12 · 2014: 7 · 2013: 4 · 2012: 4
- FWCI
- 4.90
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Proceedings of the 6th International Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- network anomaly detection, traffic monitoring, dimensionality reduction, false positive reduction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
