{"id":"https://openalex.org/W3009412409","doi":"https://doi.org/10.1109/access.2020.2977591","title":"How Much Training Data is Enough? A Case Study for HTTP Anomaly-Based Intrusion Detection","display_name":"How Much Training Data is Enough? A Case Study for HTTP Anomaly-Based Intrusion Detection","publication_year":2020,"publication_date":"2020-01-01","ids":{"openalex":"https://openalex.org/W3009412409","doi":"https://doi.org/10.1109/access.2020.2977591","mag":"3009412409"},"language":"en","primary_location":{"id":"doi:10.1109/access.2020.2977591","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.2977591","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09019687.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09019687.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5051920060","display_name":"Rafael Estepa","orcid":"https://orcid.org/0000-0001-8505-1920"},"institutions":[{"id":"https://openalex.org/I79238269","display_name":"Universidad de Sevilla","ror":"https://ror.org/03yxnpp24","country_code":"ES","type":"education","lineage":["https://openalex.org/I79238269"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Rafael Estepa","raw_affiliation_strings":["Department of Telematics Engineering, University of Seville, Seville, Spain"],"raw_orcid":"https://orcid.org/0000-0001-8505-1920","affiliations":[{"raw_affiliation_string":"Department of Telematics Engineering, University of Seville, Seville, Spain","institution_ids":["https://openalex.org/I79238269"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071465643","display_name":"Jes\u00fas E. D\u0131\u0301az-Verdejo","orcid":"https://orcid.org/0000-0002-8424-9932"},"institutions":[{"id":"https://openalex.org/I173304897","display_name":"Universidad de Granada","ror":"https://ror.org/04njjy449","country_code":"ES","type":"education","lineage":["https://openalex.org/I173304897"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Jesus E. Diaz-Verdejo","raw_affiliation_strings":["Department of Signal Theory, Telematics and Communications, CITIC, University of Granada, Granada, Spain"],"raw_orcid":"https://orcid.org/0000-0002-8424-9932","affiliations":[{"raw_affiliation_string":"Department of Signal Theory, Telematics and Communications, CITIC, University of Granada, Granada, Spain","institution_ids":["https://openalex.org/I173304897"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015226343","display_name":"Antonio Estepa","orcid":"https://orcid.org/0000-0003-1841-3973"},"institutions":[{"id":"https://openalex.org/I79238269","display_name":"Universidad de Sevilla","ror":"https://ror.org/03yxnpp24","country_code":"ES","type":"education","lineage":["https://openalex.org/I79238269"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Antonio Estepa","raw_affiliation_strings":["Department of Telematics Engineering, University of Seville, Seville, Spain"],"raw_orcid":"https://orcid.org/0000-0003-1841-3973","affiliations":[{"raw_affiliation_string":"Department of Telematics Engineering, University of Seville, Seville, Spain","institution_ids":["https://openalex.org/I79238269"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5051570639","display_name":"Germ\u00e1n Madinabeitia","orcid":"https://orcid.org/0000-0001-6376-4620"},"institutions":[{"id":"https://openalex.org/I79238269","display_name":"Universidad de Sevilla","ror":"https://ror.org/03yxnpp24","country_code":"ES","type":"education","lineage":["https://openalex.org/I79238269"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"German Madinabeitia","raw_affiliation_strings":["Department of Telematics Engineering, University of Seville, Seville, Spain"],"raw_orcid":"https://orcid.org/0000-0001-6376-4620","affiliations":[{"raw_affiliation_string":"Department of Telematics Engineering, University of Seville, Seville, Spain","institution_ids":["https://openalex.org/I79238269"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":1.5455,"has_fulltext":true,"cited_by_count":14,"citation_normalized_percentile":{"value":0.83741039,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":"8","issue":null,"first_page":"44410","last_page":"44425"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.679581880569458},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6686218976974487},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.661666750907898},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.6586677432060242},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.5605623126029968},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.401810884475708}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.679581880569458},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6686218976974487},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.661666750907898},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.6586677432060242},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.5605623126029968},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.401810884475708},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1109/access.2020.2977591","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.2977591","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09019687.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:digibug.ugr.es:10481/96323","is_oa":true,"landing_page_url":"https://hdl.handle.net/10481/96323","pdf_url":"https://digibug.ugr.es/bitstream/10481/96323/1/How_Much_Training_Data_is_Enough_A_Case_Study_for_HTTP_Anomaly-Based_Intrusion_Detection.pdf","source":{"id":"https://openalex.org/S4306400567","display_name":"Institutional Repository of the University of Granada (University of Granada)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I173304897","host_organization_name":"Universidad de Granada","host_organization_lineage":["https://openalex.org/I173304897"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"journal article"},{"id":"pmh:oai:digibug.ugr.es:10481/61835","is_oa":true,"landing_page_url":"http://hdl.handle.net/10481/61835","pdf_url":null,"source":{"id":"https://openalex.org/S4306400567","display_name":"Institutional Repository of the University of Granada (University of Granada)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I173304897","host_organization_name":"Universidad de Granada","host_organization_lineage":["https://openalex.org/I173304897"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:doaj.org/article:2f7d913325d544fb875361ead8d9d839","is_oa":true,"landing_page_url":"https://doaj.org/article/2f7d913325d544fb875361ead8d9d839","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 8, Pp 44410-44425 (2020)","raw_type":"article"},{"id":"pmh:oai:idus.us.es:11441/107307","is_oa":true,"landing_page_url":"https://idus.us.es/handle//11441/107307","pdf_url":null,"source":{"id":"https://openalex.org/S4306400333","display_name":"idUS (Universidad de Sevilla)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I79238269","host_organization_name":"Universidad de Sevilla","host_organization_lineage":["https://openalex.org/I79238269"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1109/access.2020.2977591","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.2977591","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09019687.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/12","display_name":"Responsible consumption and production","score":0.41999998688697815}],"awards":[{"id":"https://openalex.org/G1079111398","display_name":null,"funder_award_id":"CTA 1669/22/2017","funder_id":"https://openalex.org/F4320323891","funder_display_name":"Corporaci\u00f3n Tecnol\u00f3gica de Andaluc\u00eda"},{"id":"https://openalex.org/G6962709567","display_name":null,"funder_award_id":"PI-1786/22/2018","funder_id":"https://openalex.org/F4320323891","funder_display_name":"Corporaci\u00f3n Tecnol\u00f3gica de Andaluc\u00eda"},{"id":"https://openalex.org/G7854369033","display_name":null,"funder_award_id":"PI-1736/22/2017","funder_id":"https://openalex.org/F4320323891","funder_display_name":"Corporaci\u00f3n Tecnol\u00f3gica de Andaluc\u00eda"}],"funders":[{"id":"https://openalex.org/F4320310967","display_name":"Universidad de Sevilla","ror":"https://ror.org/03yxnpp24"},{"id":"https://openalex.org/F4320323891","display_name":"Corporaci\u00f3n Tecnol\u00f3gica de Andaluc\u00eda","ror":"https://ror.org/03a54va40"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3009412409.pdf","grobid_xml":"https://content.openalex.org/works/W3009412409.grobid-xml"},"referenced_works_count":45,"referenced_works":["https://openalex.org/W34732858","https://openalex.org/W158061484","https://openalex.org/W988335224","https://openalex.org/W1504161274","https://openalex.org/W1525444119","https://openalex.org/W1546047689","https://openalex.org/W1577239570","https://openalex.org/W1593532658","https://openalex.org/W1967331239","https://openalex.org/W1971881088","https://openalex.org/W1985987493","https://openalex.org/W2021418511","https://openalex.org/W2046163812","https://openalex.org/W2053822404","https://openalex.org/W2064274762","https://openalex.org/W2072506223","https://openalex.org/W2077508905","https://openalex.org/W2084496302","https://openalex.org/W2085866051","https://openalex.org/W2096847629","https://openalex.org/W2103154003","https://openalex.org/W2103414007","https://openalex.org/W2106885368","https://openalex.org/W2112029993","https://openalex.org/W2122646361","https://openalex.org/W2142889610","https://openalex.org/W2146450186","https://openalex.org/W2155378438","https://openalex.org/W2295071300","https://openalex.org/W2343514605","https://openalex.org/W2417137833","https://openalex.org/W2597441556","https://openalex.org/W2747144285","https://openalex.org/W2789828921","https://openalex.org/W2790483978","https://openalex.org/W2807656656","https://openalex.org/W2890707978","https://openalex.org/W2904539465","https://openalex.org/W3098598053","https://openalex.org/W4254697110","https://openalex.org/W6606458114","https://openalex.org/W6632634077","https://openalex.org/W6674805939","https://openalex.org/W6696927340","https://openalex.org/W6751855928"],"related_works":["https://openalex.org/W2337148208","https://openalex.org/W3004832009","https://openalex.org/W2806741695","https://openalex.org/W3036013726","https://openalex.org/W1971929717","https://openalex.org/W1724519426","https://openalex.org/W2351051591","https://openalex.org/W2369534771","https://openalex.org/W2357468538","https://openalex.org/W2364419519"],"abstract_inverted_index":{"Most":[0],"anomaly-based":[1,39],"intrusion":[2],"detectors":[3],"rely":[4],"on":[5,34,135,141],"models":[6],"that":[7,66,76,165,182,221,238],"learn":[8],"from":[9,207],"training":[10,57,67,169,249],"datasets":[11,24,195,219],"whose":[12],"quality":[13],"is":[14,69,119,139,171],"crucial":[15],"in":[16,83,124],"their":[17],"performance.":[18],"Albeit":[19],"the":[20,28,31,35,38,52,110,116,125,148,152,198,208,252],"properties":[21,150],"of":[22,30,37,55,71,86,97,112,121,127,130,144,151,200,210,214,225,231],"suitable":[23],"have":[25],"been":[26],"formulated,":[27],"influence":[29],"dataset":[32,206],"size":[33,54,60],"performance":[36],"detector":[40,129],"has":[41],"received":[42],"scarce":[43],"attention":[44],"so":[45,65],"far.":[46],"In":[47,99],"this":[48,100],"work,":[49],"we":[50,102],"investigate":[51],"optimal":[53],"a":[56,104,128,142,190,204],"dataset.":[58],"This":[59],"should":[61],"be":[62,186,243],"large":[63],"enough":[64],"data":[68,80,113,160,170,183,250],"representative":[70,120],"normal":[72,122],"behavior,":[73],"but":[74],"after":[75],"point,":[77],"collecting":[78,248],"more":[79,168,222],"may":[81],"result":[82],"unnecessary":[84],"waste":[85],"time":[87,163],"and":[88,203,228],"computational":[89],"resources,":[90],"not":[91,172],"to":[92,106,147,174,176,217],"mention":[93],"an":[94,244],"increased":[95],"risk":[96],"overtraining.":[98],"spirit,":[101],"provide":[103],"method":[105,216,241],"find":[107],"out":[108],"when":[109,167],"amount":[111],"collected":[114,196],"at":[115,197,251],"production":[117,253],"environment":[118],"behavior":[123],"context":[126],"HTTP":[131],"URI":[132],"attacks":[133],"based":[134],"1-grammar.":[136],"Our":[137],"approach":[138,246],"founded":[140],"set":[143],"indicators":[145,155],"related":[146],"statistical":[149],"data.":[153],"These":[154],"are":[156],"periodically":[157],"calculated":[158],"during":[159],"collection,":[161],"producing":[162],"series":[164],"stabilize":[166],"expected":[173],"translate":[175],"better":[177],"system":[178],"performance,":[179],"which":[180],"indicates":[181],"collection":[184],"can":[185,242],"stopped.":[187],"We":[188],"present":[189],"case":[191],"study":[192],"with":[193],"real-life":[194],"University":[199,209],"Seville":[201],"(Spain)":[202],"public":[205],"Saskatchewan.":[211],"The":[212],"application":[213],"our":[215,239],"these":[218],"showed":[220],"than":[223],"42%":[224],"one":[226],"trace,":[227],"almost":[229],"20%":[230],"another":[232],"were":[233],"unnecessarily":[234],"collected,":[235],"thereby":[236],"showing":[237],"proposed":[240],"efficient":[245],"for":[247],"environment.":[254]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}