{"id":"https://openalex.org/W7203653508","doi":"https://doi.org/10.2139/ssrn.7300329","title":"Evidence-Based Network Anomaly Detection via a Whitelist of Discretized Flow Signatures","display_name":"Evidence-Based Network Anomaly Detection via a Whitelist of Discretized Flow Signatures","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7203653508","doi":"https://doi.org/10.2139/ssrn.7300329"},"language":"en","primary_location":{"id":"doi:10.2139/ssrn.7300329","doi":"https://doi.org/10.2139/ssrn.7300329","is_oa":true,"landing_page_url":"https://doi.org/10.2139/ssrn.7300329","pdf_url":null,"source":{"id":"https://openalex.org/S4210172589","display_name":"SSRN Electronic Journal","issn_l":"1556-5068","issn":["1556-5068"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1318003438","host_organization_name":"RELX Group (Netherlands)","host_organization_lineage":["https://openalex.org/I1318003438"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"parent_works":[],"lineage":["https://openalex.org/W7203653508"],"child_works_count":0,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.2139/ssrn.7300329","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5159763320","display_name":"Youna Choi","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I110273157","display_name":"Kookmin University","ror":"https://ror.org/0049erg63","country_code":"KR","type":"education","lineage":["https://openalex.org/I110273157"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Youna Choi","raw_affiliation_strings":["Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)","institution_ids":["https://openalex.org/I110273157"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100622516","display_name":"Hyunmin Kim","orcid":"https://orcid.org/0000-0002-5954-6417","observed_orcids":["https://orcid.org/0000-0002-5954-6417"]},"institutions":[{"id":"https://openalex.org/I110273157","display_name":"Kookmin University","ror":"https://ror.org/0049erg63","country_code":"KR","type":"education","lineage":["https://openalex.org/I110273157"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"HyunMin Kim","raw_affiliation_strings":["Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)","institution_ids":["https://openalex.org/I110273157"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147322371","display_name":"Hangbeom Cho","orcid":"https://orcid.org/0009-0004-8426-7374","observed_orcids":["https://orcid.org/0009-0004-8426-7374"]},"institutions":[{"id":"https://openalex.org/I110273157","display_name":"Kookmin University","ror":"https://ror.org/0049erg63","country_code":"KR","type":"education","lineage":["https://openalex.org/I110273157"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Hangbeom Cho","raw_affiliation_strings":["Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)"],"raw_orcid":"https://orcid.org/0009-0004-8426-7374","affiliations":[{"raw_affiliation_string":"Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)","institution_ids":["https://openalex.org/I110273157"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5113922468","display_name":"MyungKeun Yoon","orcid":"https://orcid.org/0000-0003-1987-1394","observed_orcids":["https://orcid.org/0000-0003-1987-1394"]},"institutions":[{"id":"https://openalex.org/I110273157","display_name":"Kookmin University","ror":"https://ror.org/0049erg63","country_code":"KR","type":"education","lineage":["https://openalex.org/I110273157"]}],"countries":["KR"],"is_corresponding":true,"raw_author_name":"Myungkeun Yoon","raw_affiliation_strings":["Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kookmin University, Chongnung-dong, Songbuk-gu, Seoul, 136-702, Korea, Republic of (South Korea)","institution_ids":["https://openalex.org/I110273157"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5113922468"],"corresponding_institution_ids":["https://openalex.org/I110273157"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/network-intrusion-detection","display_name":"network intrusion detection","score":0.8939999938011169},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.7770000100135803},{"id":"https://openalex.org/keywords/flow-records","display_name":"flow records","score":0.5989999771118164},{"id":"https://openalex.org/keywords/white-list","display_name":"white list","score":0.3449999988079071},{"id":"https://openalex.org/keywords/false-positive-results","display_name":"false positives","score":0.6269999742507935},{"id":"https://openalex.org/keywords/base-rate-fallacy","display_name":"base rate fallacy","score":0.9700000286102295},{"id":"https://openalex.org/keywords/explainable-security","display_name":"explainable security","score":0.5450000166893005},{"id":"https://openalex.org/keywords/sliding-window-aggregation","display_name":"sliding window aggregation","score":0.7300000190734863},{"id":"https://openalex.org/keywords/iot-security","display_name":"Internet of Things security","score":0.4339999854564667},{"id":"https://openalex.org/keywords/edge-deployment","display_name":"edge deployment","score":0.4490000009536743}],"concepts":[{"id":"https://openalex.org/C73000952","wikidata":"https://www.wikidata.org/wiki/Q17007827","display_name":"Discretization","level":2,"score":0.7063000202178955},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6378999948501587},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.6248000264167786},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5906999707221985},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.4867999851703644},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4860999882221222},{"id":"https://openalex.org/C38349280","wikidata":"https://www.wikidata.org/wiki/Q1434290","display_name":"Flow (mathematics)","level":2,"score":0.4659999907016754},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3970000147819519},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.37380000948905945},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.3488999903202057},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.3425000011920929},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3418000042438507},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.3310999870300293},{"id":"https://openalex.org/C102392041","wikidata":"https://www.wikidata.org/wiki/Q592860","display_name":"Sliding window protocol","level":3,"score":0.314300000667572},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.3012999892234802},{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.3012000024318695},{"id":"https://openalex.org/C43711488","wikidata":"https://www.wikidata.org/wiki/Q7534783","display_name":"Skew","level":2,"score":0.2948000133037567},{"id":"https://openalex.org/C160920958","wikidata":"https://www.wikidata.org/wiki/Q7662746","display_name":"Synthetic data","level":2,"score":0.29350000619888306},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.27379998564720154},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.2720000147819519},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.26820001006126404},{"id":"https://openalex.org/C152745839","wikidata":"https://www.wikidata.org/wiki/Q5438153","display_name":"Fault detection and isolation","level":3,"score":0.26600000262260437},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C2775936607","wikidata":"https://www.wikidata.org/wiki/Q466845","display_name":"Tracking (education)","level":2,"score":0.2628999948501587},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2615000009536743},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2590000033378601},{"id":"https://openalex.org/C146599234","wikidata":"https://www.wikidata.org/wiki/Q511093","display_name":"Centroid","level":2,"score":0.2515000104904175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.2139/ssrn.7300329","doi":"https://doi.org/10.2139/ssrn.7300329","is_oa":true,"landing_page_url":"https://doi.org/10.2139/ssrn.7300329","pdf_url":null,"source":{"id":"https://openalex.org/S4210172589","display_name":"SSRN Electronic Journal","issn_l":"1556-5068","issn":["1556-5068"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1318003438","host_organization_name":"RELX Group (Netherlands)","host_organization_lineage":["https://openalex.org/I1318003438"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.2139/ssrn.7300329","doi":"https://doi.org/10.2139/ssrn.7300329","is_oa":true,"landing_page_url":"https://doi.org/10.2139/ssrn.7300329","pdf_url":null,"source":{"id":"https://openalex.org/S4210172589","display_name":"SSRN Electronic Journal","issn_l":"1556-5068","issn":["1556-5068"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1318003438","host_organization_name":"RELX Group (Netherlands)","host_organization_lineage":["https://openalex.org/I1318003438"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W1985987493","https://openalex.org/W2000756828","https://openalex.org/W2031163547","https://openalex.org/W2077488147","https://openalex.org/W2100495367","https://openalex.org/W2342408547","https://openalex.org/W2393727648","https://openalex.org/W2470356888","https://openalex.org/W2614230424","https://openalex.org/W2762334305","https://openalex.org/W2913699715","https://openalex.org/W2919493784","https://openalex.org/W2921135734","https://openalex.org/W2962879957","https://openalex.org/W2980759281","https://openalex.org/W3002088392","https://openalex.org/W3003685271","https://openalex.org/W3015181824","https://openalex.org/W3026820624","https://openalex.org/W3035311645","https://openalex.org/W3179147591","https://openalex.org/W3184976423","https://openalex.org/W3203072121","https://openalex.org/W4296473472","https://openalex.org/W4309346044","https://openalex.org/W4312539457","https://openalex.org/W4381736190","https://openalex.org/W4382982361","https://openalex.org/W7084753414"],"related_works":["https://openalex.org/W2104936918","https://openalex.org/W2099389120","https://openalex.org/W7097138059","https://openalex.org/W2116688314","https://openalex.org/W1981765918","https://openalex.org/W188118421","https://openalex.org/W2386019729","https://openalex.org/W2607918523","https://openalex.org/W1941748144","https://openalex.org/W1980792387"],"abstract_inverted_index":null,"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2026-08-18T00:00:00"}