{"id":"https://openalex.org/W7138928271","doi":"https://doi.org/10.1016/j.comnet.2026.112188","title":"Advanced similarity metrics for IP flow data analytics","display_name":"Advanced similarity metrics for IP flow data analytics","publication_year":2026,"publication_date":"2026-03-18","ids":{"openalex":"https://openalex.org/W7138928271","doi":"https://doi.org/10.1016/j.comnet.2026.112188"},"language":"en","primary_location":{"id":"doi:10.1016/j.comnet.2026.112188","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.comnet.2026.112188","pdf_url":null,"source":{"id":"https://openalex.org/S63392143","display_name":"Computer Networks","issn_l":"1389-1286","issn":["1389-1286","1872-7069"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computer Networks","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.comnet.2026.112188","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5014844671","display_name":"I. Petr","orcid":"https://orcid.org/0000-0003-3367-6990"},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":true,"raw_author_name":"Ivo Petr","raw_affiliation_strings":["Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic"],"raw_orcid":"https://orcid.org/0000-0003-3367-6990","affiliations":[{"raw_affiliation_string":"Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic","institution_ids":["https://openalex.org/I44504214"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025580931","display_name":"Jitka Hrab\u00e1kov\u00e1","orcid":"https://orcid.org/0000-0002-2290-8234"},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Jitka Hrab\u00e1kov\u00e1","raw_affiliation_strings":["Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic"],"raw_orcid":"https://orcid.org/0000-0002-2290-8234","affiliations":[{"raw_affiliation_string":"Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic","institution_ids":["https://openalex.org/I44504214"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059776265","display_name":"Magda Friedjungov\u00e1","orcid":"https://orcid.org/0000-0002-3363-294X"},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Magda Friedjungov\u00e1","raw_affiliation_strings":["Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic"],"raw_orcid":"https://orcid.org/0000-0002-3363-294X","affiliations":[{"raw_affiliation_string":"Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic","institution_ids":["https://openalex.org/I44504214"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067356570","display_name":"Daniel Va\u0161ata","orcid":"https://orcid.org/0000-0003-0616-4340"},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Daniel Va\u0161ata","raw_affiliation_strings":["Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic"],"raw_orcid":"https://orcid.org/0000-0003-0616-4340","affiliations":[{"raw_affiliation_string":"Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic","institution_ids":["https://openalex.org/I44504214"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5129857779","display_name":"Karel Hynek","orcid":null},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Karel Hynek","raw_affiliation_strings":["Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic"],"raw_orcid":"https://orcid.org/0000-0002-8281-618X","affiliations":[{"raw_affiliation_string":"Faculty of Information Technology, Czech Technical University, Th\u00e1kurova 9, 160 00, Prague Prague 6, Czech Republic","institution_ids":["https://openalex.org/I44504214"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5014844671"],"corresponding_institution_ids":["https://openalex.org/I44504214"],"apc_list":{"value":2460,"currency":"USD","value_usd":2460},"apc_paid":{"value":2460,"currency":"USD","value_usd":2460},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.23720874,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"281","issue":null,"first_page":"112188","last_page":"112188"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.91839998960495,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.91839998960495,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.05570000037550926,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.003000000026077032,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5663999915122986},{"id":"https://openalex.org/keywords/k-nearest-neighbors-algorithm","display_name":"k-nearest neighbors algorithm","score":0.5608000159263611},{"id":"https://openalex.org/keywords/measure","display_name":"Measure (data warehouse)","score":0.5254999995231628},{"id":"https://openalex.org/keywords/outlier","display_name":"Outlier","score":0.4993000030517578},{"id":"https://openalex.org/keywords/traffic-classification","display_name":"Traffic classification","score":0.4912000000476837},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.4578000009059906},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.4562000036239624},{"id":"https://openalex.org/keywords/similarity-measure","display_name":"Similarity measure","score":0.43130001425743103},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.39559999108314514},{"id":"https://openalex.org/keywords/distance-measures","display_name":"Distance measures","score":0.3896999955177307}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8633999824523926},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.61080002784729},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5663999915122986},{"id":"https://openalex.org/C113238511","wikidata":"https://www.wikidata.org/wiki/Q1071612","display_name":"k-nearest neighbors algorithm","level":2,"score":0.5608000159263611},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5446000099182129},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.5254999995231628},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.4993000030517578},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.4912000000476837},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4578000009059906},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4562000036239624},{"id":"https://openalex.org/C2776517306","wikidata":"https://www.wikidata.org/wiki/Q29017317","display_name":"Similarity measure","level":2,"score":0.43130001425743103},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3970000147819519},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.39559999108314514},{"id":"https://openalex.org/C2639959","wikidata":"https://www.wikidata.org/wiki/Q1344778","display_name":"Distance measures","level":2,"score":0.3896999955177307},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.37959998846054077},{"id":"https://openalex.org/C82668687","wikidata":"https://www.wikidata.org/wiki/Q3046456","display_name":"Earth mover's distance","level":2,"score":0.3792000114917755},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.3774999976158142},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.375900000333786},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.3750999867916107},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.37070000171661377},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.3637999892234802},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.3504999876022339},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.3165000081062317},{"id":"https://openalex.org/C133972139","wikidata":"https://www.wikidata.org/wiki/Q5058371","display_name":"Cellular traffic","level":3,"score":0.2937999963760376},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2800999879837036},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.27469998598098755},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.27469998598098755},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.2720000147819519},{"id":"https://openalex.org/C109659709","wikidata":"https://www.wikidata.org/wiki/Q3407504","display_name":"Affinity propagation","level":5,"score":0.26980000734329224},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.2639999985694885},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2637999951839447}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.comnet.2026.112188","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.comnet.2026.112188","pdf_url":null,"source":{"id":"https://openalex.org/S63392143","display_name":"Computer Networks","issn_l":"1389-1286","issn":["1389-1286","1872-7069"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computer Networks","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.comnet.2026.112188","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.comnet.2026.112188","pdf_url":null,"source":{"id":"https://openalex.org/S63392143","display_name":"Computer Networks","issn_l":"1389-1286","issn":["1389-1286","1872-7069"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computer Networks","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5611503438","display_name":"Flow-based Encrypted Traffic Analysis","funder_award_id":"VJ02010024","funder_id":"https://openalex.org/F4320311333","funder_display_name":"Ministerstvo Vnitra \u010cesk\u00e9 Republiky"}],"funders":[{"id":"https://openalex.org/F4320311333","display_name":"Ministerstvo Vnitra \u010cesk\u00e9 Republiky","ror":"https://ror.org/05w1nn565"},{"id":"https://openalex.org/F4320321005","display_name":"Ministerstvo \u0160kolstv\u00ed, Ml\u00e1de\u017ee a T\u011blov\u00fdchovy","ror":"https://ror.org/037n8p820"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W1941748144","https://openalex.org/W1965555277","https://openalex.org/W2001619934","https://openalex.org/W2032938251","https://openalex.org/W2078436544","https://openalex.org/W2093859880","https://openalex.org/W2105642232","https://openalex.org/W2146950091","https://openalex.org/W2165232124","https://openalex.org/W2294798173","https://openalex.org/W2585086731","https://openalex.org/W2750674396","https://openalex.org/W2756489700","https://openalex.org/W2963469388","https://openalex.org/W3043844898","https://openalex.org/W3161599138","https://openalex.org/W3181596493","https://openalex.org/W3208904656","https://openalex.org/W3214146295","https://openalex.org/W4210880854","https://openalex.org/W4309779554","https://openalex.org/W4312537006","https://openalex.org/W4321021237","https://openalex.org/W4321487091","https://openalex.org/W4379279904","https://openalex.org/W4385816233","https://openalex.org/W4403537945","https://openalex.org/W4404627583"],"related_works":[],"abstract_inverted_index":{"Machine":[0],"learning":[1,31,141],"techniques":[2,32],"provide":[3],"powerful":[4],"tools":[5],"for":[6,24],"analysis":[7],"of":[8,17,28,55,84,115,135,162,177,234,254],"encrypted":[9,41],"network":[10],"traffic.":[11],"We":[12,212],"present":[13,109],"a":[14,20,25,72,139,153,159,251],"novel":[15,178,209],"set":[16],"features":[18,47,70,179],"and":[19,37,107,128,203,236,242],"distance":[21,66,86,126,222],"measure":[22,67,87,127],"suitable":[23,252],"wide":[26],"variety":[27],"distance-based":[29,191],"machine":[30],"useful":[33],"in":[34,40,71,121,172],"classification,":[35,195],"clustering,":[36],"novelty":[38],"detection":[39,205],"traffic":[42,210,228],"flow":[43],"data.":[44],"The":[45,64,82,99,175],"proposed":[46,65,125,221],"are":[48,180],"given":[49],"by":[50],"distances":[51],"between":[52],"probability":[53],"distributions":[54],"such":[56],"characteristics":[57],"as":[58,111],"packet":[59],"sizes":[60],"or":[61],"inter-arrival":[62],"times.":[63],"incorporates":[68],"those":[69],"fractional":[73],"l":[74],"p":[75,78],"-metric":[76],"with":[77,123,138,149,158],"close":[79],"to":[80,207,225,249],"0.1.":[81],"effectiveness":[83],"the":[85,104,124,132,145,173,184,199,220,232,244],"is":[88,147],"evaluated":[89],"using":[90,183,219],"an":[91],"extensive":[92],"labeled":[93],"dataset":[94,100,157],"containing":[95],"154":[96],"web":[97],"services.":[98],"was":[101],"captured":[102],"on":[103,190],"ISP":[105],"backbone,":[106],"we":[108,196,230],"it":[110],"supplementary":[112],"material.":[113],"Application":[114],"k":[116],"-nearest":[117],"neighbors":[118],"(kNN)":[119],"algorithm":[120,248],"combination":[122],"feature":[129],"selection":[130],"gives":[131],"classification":[133,229],"accuracy":[134,167],"91.0%.":[136],"Comparison":[137],"deep":[140],"model":[142],"shows":[143],"that":[144,214],"kNN":[146,235],"competitive":[148],"state-of-the-art":[150],"models.":[151],"On":[152],"different":[154],"publicly":[155],"available":[156],"low":[160],"number":[161],"classes,":[163],"our":[164],"approach":[165],"reaches":[166],"99.6%,":[168],"outperforming":[169],"models":[170],"presented":[171],"literature.":[174],"benefits":[176],"further":[181],"demonstrated":[182],"LightGBM":[185],"model,":[186],"i.e.":[187],"without":[188],"relying":[189],"techniques.":[192],"Besides":[193],"direct":[194],"have":[197],"used":[198],"local":[200],"outlier":[201],"factor":[202],"rank-based":[204],"algorithms":[206],"detect":[208],"flows.":[211],"show":[213],"their":[215],"performance":[216,233],"improves":[217],"when":[218],"measure.":[223],"Finally,":[224],"speed":[226],"up":[227],"compared":[231],"Approximate":[237],"Nearest":[238],"Neighbors":[239],"(ANN)":[240],"algorithm,":[241],"applied":[243],"Affinity":[245],"propagation":[246],"clustering":[247],"select":[250],"subset":[253],"kNN/ANN":[255],"training":[256],"points.":[257]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2026-03-20T00:00:00"}