{"id":"https://openalex.org/W1587358570","doi":null,"title":"Privacy-preserving collaborative anomaly detection","display_name":"Privacy-preserving collaborative anomaly detection","publication_year":2009,"publication_date":"2009-01-01","ids":{"openalex":"https://openalex.org/W1587358570","mag":"1587358570"},"language":"en","primary_location":{"id":"mag:1587358570","doi":null,"is_oa":false,"landing_page_url":"https://www.cs.princeton.edu/~jrex/thesis/haakon-ringberg-thesis.pdf","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5003914268","display_name":"Jennifer Rexford","orcid":"https://orcid.org/0000-0002-0231-8165","observed_orcids":["https://orcid.org/0000-0002-0231-8165"]},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jennifer Rexford","raw_affiliation_strings":["Princeton University#TAB#"],"raw_orcid":"https://orcid.org/0000-0002-0231-8165","affiliations":[{"raw_affiliation_string":"Princeton University#TAB#","institution_ids":["https://openalex.org/I20089843"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017863056","display_name":"Haakon Ringberg","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Haakon Ringberg","raw_affiliation_strings":["Princeton University#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Princeton University#TAB#","institution_ids":["https://openalex.org/I20089843"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I20089843"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9911999702453613,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9911999702453613,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.006099999882280827,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/privacy-preserving-data-sharing","display_name":"privacy-preserving data sharing","score":0.6320000290870667},{"id":"https://openalex.org/keywords/cryptographic-protocols","display_name":"cryptographic protocols","score":0.7570000290870667},{"id":"https://openalex.org/keywords/denial-of-service-attacks","display_name":"denial-of-service attacks","score":0.9340000152587891},{"id":"https://openalex.org/keywords/snort-rules","display_name":"Snort rules","score":0.5720000267028809},{"id":"https://openalex.org/keywords/network-measurement","display_name":"network measurement","score":0.3490000069141388},{"id":"https://openalex.org/keywords/port-scanning","display_name":"port scanning","score":0.9390000104904175},{"id":"https://openalex.org/keywords/worms","display_name":"worms","score":0.49300000071525574},{"id":"https://openalex.org/keywords/spam","display_name":"spam","score":0.781000018119812},{"id":"https://openalex.org/keywords/intrusion-detection-systems","display_name":"intrusion detection systems","score":0.6819999814033508}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7487093806266785},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6611800193786621},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6204673051834106},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6194038391113281},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.571397602558136},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.4714818000793457},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4356241226196289},{"id":"https://openalex.org/C63969886","wikidata":"https://www.wikidata.org/wiki/Q3536440","display_name":"Internet traffic","level":3,"score":0.41537120938301086},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.23502230644226074},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.1132037341594696},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"mag:1587358570","doi":null,"is_oa":false,"landing_page_url":"https://www.cs.princeton.edu/~jrex/thesis/haakon-ringberg-thesis.pdf","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":64,"referenced_works":["https://openalex.org/W26074071","https://openalex.org/W173953576","https://openalex.org/W192036632","https://openalex.org/W1480225633","https://openalex.org/W1498592591","https://openalex.org/W1503304944","https://openalex.org/W1516506771","https://openalex.org/W1520914943","https://openalex.org/W1521184571","https://openalex.org/W1528076390","https://openalex.org/W1544695791","https://openalex.org/W1555169622","https://openalex.org/W1604570940","https://openalex.org/W1655958391","https://openalex.org/W1881594620","https://openalex.org/W1889757464","https://openalex.org/W1968439359","https://openalex.org/W1976047426","https://openalex.org/W1984680759","https://openalex.org/W1992479210","https://openalex.org/W2000309792","https://openalex.org/W2009250465","https://openalex.org/W2012095206","https://openalex.org/W2017464959","https://openalex.org/W2018026534","https://openalex.org/W2020765652","https://openalex.org/W2030553727","https://openalex.org/W2031006315","https://openalex.org/W2032210760","https://openalex.org/W2044384431","https://openalex.org/W2055261595","https://openalex.org/W2060565099","https://openalex.org/W2060823524","https://openalex.org/W2073346043","https://openalex.org/W2080330461","https://openalex.org/W2087405576","https://openalex.org/W2092422002","https://openalex.org/W2093507182","https://openalex.org/W2095708839","https://openalex.org/W2096273775","https://openalex.org/W2111707959","https://openalex.org/W2112135709","https://openalex.org/W2113344319","https://openalex.org/W2121511513","https://openalex.org/W2128567487","https://openalex.org/W2132280055","https://openalex.org/W2134006599","https://openalex.org/W2136420282","https://openalex.org/W2143087446","https://openalex.org/W2143824669","https://openalex.org/W2145185087","https://openalex.org/W2148603752","https://openalex.org/W2151657570","https://openalex.org/W2152955531","https://openalex.org/W2157578436","https://openalex.org/W2161954933","https://openalex.org/W2164210932","https://openalex.org/W2165071399","https://openalex.org/W2166748118","https://openalex.org/W2241398548","https://openalex.org/W2293322640","https://openalex.org/W2325359287","https://openalex.org/W2752651477","https://openalex.org/W2950950709"],"related_works":["https://openalex.org/W7097159413","https://openalex.org/W7099434678","https://openalex.org/W1982660449","https://openalex.org/W1929143073","https://openalex.org/W1544273037","https://openalex.org/W4288391282","https://openalex.org/W3133030918","https://openalex.org/W7018297847","https://openalex.org/W2029449924","https://openalex.org/W2889869662"],"abstract_inverted_index":{"Unwanted":[0,10],"traffic":[1,11,24,38,68,137,170,173,186,207,239],"is":[2,39,174,223,338,451,467],"a":[3,123,162,219,276,379,389,401,447],"major":[4,330],"concern":[5],"in":[6,80,86,177,252,388,412,425],"the":[7,50,65,74,115,132,194,203,216,235,268,281,297,320,333,340,354,362,366,376,418],"Internet":[8],"today.":[9],"includes":[12],"Denial":[13],"of":[14,29,35,67,105,107,112,118,135,165,184,196,205,237,271,299,319,343,365,378,403,420,428,464,472],"Service":[15],"attacks,":[16,191],"worms,":[17],"and":[18,21,43,73,109,258,308,374,415,446],"spam.":[19],"Identifying":[20],"mitigating":[22],"unwanted":[23,136,172,185,206,238,413],"costs":[25],"businesses":[26],"many":[27,110,158,182],"billions":[28],"USD":[30],"every":[31],"year.":[32],"The":[33,435],"process":[34],"identifying":[36],"this":[37,119,151,259,272,285,370],"called":[40],"anomaly":[41,287,336],"detection,":[42],"Intrusion":[44],"Detection":[45],"Systems":[46],"(IDS\u2019es)":[47],"are":[48,346],"among":[49],"most":[51],"prevalent":[52],"techniques.":[53],"IDS\u2019es,":[54],"such":[55,97,188],"as":[56,98,138,189],"Snort,":[57,139],"allow":[58],"users":[59],"to":[60,77,130,156,225,254,349,386,399,469],"write":[61],"\u201crules\u201d":[62],"that":[63,69,125,150,202,218,279,311,339,357,383,391,406,423],"specify":[64],"properties":[66],"should":[70,208],"be":[71,78,91,410],"detected":[72,300],"corrective":[75],"action":[76],"taken":[79],"response.":[81],"Unfortunately,":[82],"applying":[83],"these":[84],"rules":[85,160],"an":[87,178],"online":[88],"setting":[89,180],"can":[90,153],"prohibitively":[92],"expensive":[93],"for":[94,144,248],"large":[95],"networks,":[96,294],"Tier-1":[99],"ISPs,":[100],"which":[101],"may":[102],"have":[103,313],"tens":[104],"thousands":[106],"links":[108],"Gbps":[111],"traffic.":[113,198],"In":[114,267,361],"first":[116],"chapter":[117,270,364],"thesis":[120,273,367],"we":[121,274,295,368],"present":[122,275],"system":[124,152],"leverages":[126],"machine":[127],"learning":[128],"algorithms":[129],"detect":[131],"same":[133],"type":[134],"but":[140],"on":[141,480],"summarized":[142],"data":[143],"faster":[145],"processing.":[146],"Our":[147,395,462],"results":[148],"demonstrate":[149],"effectively":[154],"learn":[155],"classify":[157],"Snort":[159],"with":[161,332],"high":[163],"degree":[164],"accuracy.":[166],"\r\nUnfortunately,":[167],"distinguishing":[168],"good":[169],"from":[171,284,292],"challenging":[175],"even":[176],"offline":[179],"because":[181,439],"types":[183],"traffic,":[187],"network":[190,301],"deliberately":[192],"mimic":[193],"behavior":[195],"normal":[197],"We":[199],"therefore":[200],"propose":[201],"targets":[204],"collaborate":[209,387],"by":[210,323,372],"correlating":[211],"their":[212,256,359,393],"attack":[213],"data,":[214],"under":[215],"assumption":[217],"given":[220],"malicious":[221,245],"host":[222],"likely":[224],"affect":[226],"more":[227,455],"than":[228,456],"one":[229],"victim":[230],"over":[231],"time.":[232],"That":[233],"is,":[234],"senders":[236],"will":[240,262],"use":[241,261,358],"individual":[242],"computers":[243],"(i.e.,":[244,432],"hosts)":[246],"repeatedly":[247],"various":[249],"nefarious":[250],"purposes":[251],"order":[253],"maximize":[255],"profits,":[257],"repeated":[260],"leave":[263],"traces":[264,291],"across":[265],"networks.":[266],"second":[269],"measurement":[277],"study":[278],"quantifies":[280],"potential":[282],"gain":[283],"collaborative":[286,335],"detection.":[288],"Specifically,":[289],"using":[290],"operational":[293],"calculate":[296],"fraction":[298,427],"anomalies":[302],"(viz.,":[303],"IP":[304,404,421,449,474],"scans,":[305,307],"port":[306],"DoS":[309],"attacks)":[310],"could":[312],"been":[314],"mitigated":[315],"if":[316],"some":[317,426],"subset":[318],"victims":[321,385],"collaborated":[322],"sharing":[324],"information":[325,352],"about":[326,353],"past":[327],"perpetrators.":[328],"\r\nOne":[329],"challenge":[331],"proposed":[334],"detection":[337],"human":[341],"owner/operators":[342],"participating":[344,458],"networks":[345,459],"often":[347],"hesitant":[348],"openly":[350],"share":[351],"hosts":[355],"(customers)":[356],"services.":[360],"third":[363],"address":[369,450],"problem":[371],"proposing":[373],"evaluating":[375],"efficiency":[377],"novel":[380],"cryptographic":[381],"protocol":[382,396,436,466],"allows":[384,397],"manner":[390],"protects":[392],"privacy.":[394],"participants":[398],"submit":[400],"set":[402,419],"addresses":[405,422,475],"they":[407],"suspect":[408,430,460,473],"might":[409],"engaging":[411],"activity,":[414],"it":[416,440],"returns":[417],"existed":[424],"all":[429],"sets":[431],"threshold":[433],"set-intersection).":[434],"preserves":[437],"privacy":[438],"never":[441],"reveals":[442],"who":[443],"suspected":[444],"whom,":[445],"submitted":[448],"only":[452],"revealed":[453],"when":[454,478],"n":[457],"it.":[461],"implementation":[463],"said":[465],"able":[468],"correlate":[470],"millions":[471],"per":[476],"hour":[477],"running":[479],"two":[481],"quad-core":[482],"machines.":[483]},"counts_by_year":[{"year":2020,"cited_by_count":1},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":1},{"year":2013,"cited_by_count":1},{"year":2012,"cited_by_count":2}],"updated_date":"2026-11-03T10:50:19.383937","created_date":"2016-06-24T00:00:00"}