{"id":"https://openalex.org/W2142645456","doi":"https://doi.org/10.1093/comjnl/bxr134","title":"MBST: Detecting Packet-Level Traffic Anomalies by Feature Stability","display_name":"MBST: Detecting Packet-Level Traffic Anomalies by Feature Stability","publication_year":2012,"publication_date":"2012-01-05","ids":{"openalex":"https://openalex.org/W2142645456","doi":"https://doi.org/10.1093/comjnl/bxr134","mag":"2142645456"},"language":"en","primary_location":{"id":"doi:10.1093/comjnl/bxr134","is_oa":false,"landing_page_url":"https://doi.org/10.1093/comjnl/bxr134","pdf_url":null,"source":{"id":"https://openalex.org/S44643521","display_name":"The Computer Journal","issn_l":"0010-4620","issn":["0010-4620","1460-2067"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Computer Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5054557971","display_name":"Baopeng Zhang","orcid":"https://orcid.org/0000-0003-2592-2354"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"B. Zhang","raw_affiliation_strings":["Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037577175","display_name":"Jian Yang","orcid":"https://orcid.org/0000-0003-4887-3444"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"J. Yang","raw_affiliation_strings":["Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100702646","display_name":"Jun Wu","orcid":"https://orcid.org/0000-0002-1512-524X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"J. Wu","raw_affiliation_strings":["Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100441364","display_name":"Ziyi Wang","orcid":"https://orcid.org/0000-0001-8174-0593"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Z. Wang","raw_affiliation_strings":["Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network Research Center, Tsinghua National Laboratory for Information Science and Technology (TNList), Department of Computer Science and Technology, Tsinghua University, Beijing, P.R. China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5054557971"],"corresponding_institution_ids":["https://openalex.org/I99065089"],"apc_list":{"value":2635,"currency":"GBP","value_usd":3232},"apc_paid":null,"fwci":1.8153,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.86758027,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"56","issue":"10","first_page":"1176","last_page":"1188"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9850000143051147,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6659106016159058},{"id":"https://openalex.org/keywords/wavelet","display_name":"Wavelet","score":0.5452365279197693},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5381093621253967},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.519627034664154},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.5096778869628906},{"id":"https://openalex.org/keywords/false-alarm","display_name":"False alarm","score":0.5060803294181824},{"id":"https://openalex.org/keywords/gaussian","display_name":"Gaussian","score":0.48130717873573303},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.44645583629608154},{"id":"https://openalex.org/keywords/airfield-traffic-pattern","display_name":"Airfield traffic pattern","score":0.443903386592865},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4250718951225281},{"id":"https://openalex.org/keywords/uncorrelated","display_name":"Uncorrelated","score":0.41791510581970215},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.40651267766952515},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.38870278000831604},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.37037885189056396},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.25493746995925903},{"id":"https://openalex.org/keywords/statistics","display_name":"Statistics","score":0.2320055067539215},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.07895597815513611},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.07220712304115295}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6659106016159058},{"id":"https://openalex.org/C47432892","wikidata":"https://www.wikidata.org/wiki/Q831390","display_name":"Wavelet","level":2,"score":0.5452365279197693},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5381093621253967},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.519627034664154},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.5096778869628906},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.5060803294181824},{"id":"https://openalex.org/C163716315","wikidata":"https://www.wikidata.org/wiki/Q901177","display_name":"Gaussian","level":2,"score":0.48130717873573303},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.44645583629608154},{"id":"https://openalex.org/C204673680","wikidata":"https://www.wikidata.org/wiki/Q1628107","display_name":"Airfield traffic pattern","level":2,"score":0.443903386592865},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4250718951225281},{"id":"https://openalex.org/C169345407","wikidata":"https://www.wikidata.org/wiki/Q8216221","display_name":"Uncorrelated","level":2,"score":0.41791510581970215},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.40651267766952515},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38870278000831604},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.37037885189056396},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.25493746995925903},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.2320055067539215},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.07895597815513611},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.07220712304115295},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1093/comjnl/bxr134","is_oa":false,"landing_page_url":"https://doi.org/10.1093/comjnl/bxr134","pdf_url":null,"source":{"id":"https://openalex.org/S44643521","display_name":"The Computer Journal","issn_l":"0010-4620","issn":["0010-4620","1460-2067"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Computer Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2360779366","https://openalex.org/W2027155377","https://openalex.org/W1972654397","https://openalex.org/W1995027010","https://openalex.org/W1983393909","https://openalex.org/W2040150569","https://openalex.org/W2468095590","https://openalex.org/W2132174924","https://openalex.org/W1911540634","https://openalex.org/W2013909972"],"abstract_inverted_index":{"In":[0],"this":[1,57,68],"paper,":[2],"we":[3,24,70],"present":[4],"a":[5,41,53,72,168,173],"statistical":[6],"analysis":[7],"of":[8,182],"six":[9],"traffic":[10,29,38,119,139],"features":[11,30],"based":[12],"on":[13,67,116,137],"entropy":[14],"and":[15,23,33,47,85,102,106,131,134],"distinct":[16],"feature":[17],"number":[18,181],"at":[19],"the":[20,94,103,126,153],"packet":[21],"level,":[22],"find":[25],"that,":[26],"although":[27],"these":[28],"are":[31,45],"unstable":[32],"show":[34],"seasonal":[35],"patterns":[36],"like":[37],"volume":[39],"in":[40,52,98],"long-time":[42],"period,":[43],"they":[44],"stable":[46],"consistent":[48],"with":[49,93,147,158],"Gaussian":[50],"distribution":[51],"short-time":[54],"period.":[55],"However,":[56],"equilibrium":[58],"property":[59],"will":[60],"be":[61],"violated":[62],"by":[63],"some":[64],"anomalies.":[65],"Based":[66],"observation,":[69],"propose":[71],"Multi-dimensional":[73],"Box":[74],"plot":[75],"method":[76,92,96],"for":[77,164,176],"Short-time":[78],"scale":[79],"Traffic":[80],"(MBST)":[81],"to":[82],"classify":[83],"abnormal":[84],"normal":[86],"traffic.":[87],"We":[88],"compare":[89],"our":[90,99],"new":[91],"MCST":[95,132],"proposed":[97],"prior":[100],"work":[101],"well-known":[104],"wavelet-based":[105,130],"A":[107],"Short-Timescale":[108],"Uncorrelated-Traffic":[109],"Equilibrium":[110],"(ASTUTE)":[111],"techniques.":[112],"The":[113],"detection":[114,135],"result":[115,136],"synthetic":[117],"anomaly":[118],"shows":[120],"that":[121,141],"MBST":[122,142,160],"can":[123,143],"better":[124,163],"detect":[125,144],"low-rate":[127],"attacks":[128],"than":[129,152],"methods,":[133],"real":[138],"demonstrates":[140],"more":[145],"anomalies":[146,166,178],"lower":[148],"false":[149],"alarm":[150],"rate":[151],"two":[154],"methods.":[155],"Especially":[156],"compared":[157],"ASTUTE,":[159],"performs":[161],"much":[162],"detecting":[165,177],"involving":[167,179],"few":[169],"large":[170,180],"flows":[171],"despite":[172],"little":[174],"poor":[175],"small":[183],"flows.":[184]},"counts_by_year":[{"year":2016,"cited_by_count":1},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":3},{"year":2013,"cited_by_count":1}],"updated_date":"2026-06-23T06:36:01.041984","created_date":"2025-10-10T00:00:00"}