{"id":"https://openalex.org/W2087323048","doi":"https://doi.org/10.1109/broadnets.2006.4374397","title":"A Statistical Approach to Anomaly Detection in Interdomain Routing","display_name":"A Statistical Approach to Anomaly Detection in Interdomain Routing","publication_year":2006,"publication_date":"2006-10-01","ids":{"openalex":"https://openalex.org/W2087323048","doi":"https://doi.org/10.1109/broadnets.2006.4374397","mag":"2087323048"},"language":"en","primary_location":{"id":"doi:10.1109/broadnets.2006.4374397","is_oa":false,"landing_page_url":"https://doi.org/10.1109/broadnets.2006.4374397","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2006 3rd International Conference on Broadband Communications, Networks and Systems","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5034543204","display_name":"Santosh L. Deshpande","orcid":"https://orcid.org/0000-0001-5152-0952"},"institutions":[{"id":"https://openalex.org/I165799507","display_name":"Rensselaer Polytechnic Institute","ror":"https://ror.org/01rtyzb94","country_code":"US","type":"education","lineage":["https://openalex.org/I165799507"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"S. Deshpande","raw_affiliation_strings":["Rensselaer Polytechnic Institute, Troy, NY, USA","Rensselaer Polytechnic Institute, Troy, NY 12180. Email: deshps@rpi.edu"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Rensselaer Polytechnic Institute, Troy, NY, USA","institution_ids":["https://openalex.org/I165799507"]},{"raw_affiliation_string":"Rensselaer Polytechnic Institute, Troy, NY 12180. Email: deshps@rpi.edu","institution_ids":["https://openalex.org/I165799507"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054336795","display_name":"Marina Thottan","orcid":null},"institutions":[{"id":"https://openalex.org/I72090969","display_name":"Nokia (United States)","ror":"https://ror.org/038km2573","country_code":"US","type":"company","lineage":["https://openalex.org/I2738502077","https://openalex.org/I72090969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"M. Thottan","raw_affiliation_strings":["Bell Laboratories, Murray Hill, NJ, USA","Bell Laboratories, Murray Hill, NJ 07974. Email: marinat@research.bell-labs.com"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bell Laboratories, Murray Hill, NJ, USA","institution_ids":[]},{"raw_affiliation_string":"Bell Laboratories, Murray Hill, NJ 07974. Email: marinat@research.bell-labs.com","institution_ids":["https://openalex.org/I72090969"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103907847","display_name":"T.K. Ho","orcid":null},"institutions":[{"id":"https://openalex.org/I72090969","display_name":"Nokia (United States)","ror":"https://ror.org/038km2573","country_code":"US","type":"company","lineage":["https://openalex.org/I2738502077","https://openalex.org/I72090969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"T. K. Ho","raw_affiliation_strings":["Bell Laboratories, Murray Hill, NJ, USA","Bell Laboratories, Murray Hill, NJ 07974. Email: tkh@research.bell-labs.com"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bell Laboratories, Murray Hill, NJ, USA","institution_ids":[]},{"raw_affiliation_string":"Bell Laboratories, Murray Hill, NJ 07974. Email: tkh@research.bell-labs.com","institution_ids":["https://openalex.org/I72090969"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5041189303","display_name":"Biplab Sikdar","orcid":"https://orcid.org/0000-0002-0084-4647"},"institutions":[{"id":"https://openalex.org/I165799507","display_name":"Rensselaer Polytechnic Institute","ror":"https://ror.org/01rtyzb94","country_code":"US","type":"education","lineage":["https://openalex.org/I165799507"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"B. Sikdar","raw_affiliation_strings":["Rensselaer Polytechnic Institute, Troy, NY, USA","Rensselaer Polytechnic Institute, Troy, NY 12180. Email: sikdab@rpi.edu"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Rensselaer Polytechnic Institute, Troy, NY, USA","institution_ids":["https://openalex.org/I165799507"]},{"raw_affiliation_string":"Rensselaer Polytechnic Institute, Troy, NY 12180. Email: sikdab@rpi.edu","institution_ids":["https://openalex.org/I165799507"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.8926,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.87359969,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":94},"biblio":{"volume":"24","issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7674431204795837},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.764510452747345},{"id":"https://openalex.org/keywords/ewma-chart","display_name":"EWMA chart","score":0.761933445930481},{"id":"https://openalex.org/keywords/border-gateway-protocol","display_name":"Border Gateway Protocol","score":0.7423943281173706},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.5374785661697388},{"id":"https://openalex.org/keywords/router","display_name":"Router","score":0.48908787965774536},{"id":"https://openalex.org/keywords/default-free-zone","display_name":"Default-free zone","score":0.48904213309288025},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4881337583065033},{"id":"https://openalex.org/keywords/routing-protocol","display_name":"Routing protocol","score":0.4875935912132263},{"id":"https://openalex.org/keywords/routing","display_name":"Routing (electronic design automation)","score":0.4216685891151428},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4172791540622711},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.414573609828949},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.39631137251853943},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3659312129020691},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.34481197595596313},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.28836512565612793},{"id":"https://openalex.org/keywords/routing-table","display_name":"Routing table","score":0.13297724723815918},{"id":"https://openalex.org/keywords/link-state-routing-protocol","display_name":"Link-state routing protocol","score":0.13044530153274536},{"id":"https://openalex.org/keywords/control-chart","display_name":"Control chart","score":0.12209978699684143}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7674431204795837},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.764510452747345},{"id":"https://openalex.org/C74746147","wikidata":"https://www.wikidata.org/wiki/Q5324652","display_name":"EWMA chart","level":4,"score":0.761933445930481},{"id":"https://openalex.org/C178086212","wikidata":"https://www.wikidata.org/wiki/Q11155","display_name":"Border Gateway Protocol","level":5,"score":0.7423943281173706},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.5374785661697388},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.48908787965774536},{"id":"https://openalex.org/C101396714","wikidata":"https://www.wikidata.org/wiki/Q3021187","display_name":"Default-free zone","level":5,"score":0.48904213309288025},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4881337583065033},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.4875935912132263},{"id":"https://openalex.org/C74172769","wikidata":"https://www.wikidata.org/wiki/Q1446839","display_name":"Routing (electronic design automation)","level":2,"score":0.4216685891151428},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4172791540622711},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.414573609828949},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.39631137251853943},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3659312129020691},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.34481197595596313},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28836512565612793},{"id":"https://openalex.org/C184896649","wikidata":"https://www.wikidata.org/wiki/Q290066","display_name":"Routing table","level":4,"score":0.13297724723815918},{"id":"https://openalex.org/C89305328","wikidata":"https://www.wikidata.org/wiki/Q1755411","display_name":"Link-state routing protocol","level":4,"score":0.13044530153274536},{"id":"https://openalex.org/C196985124","wikidata":"https://www.wikidata.org/wiki/Q1369242","display_name":"Control chart","level":3,"score":0.12209978699684143},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/broadnets.2006.4374397","is_oa":false,"landing_page_url":"https://doi.org/10.1109/broadnets.2006.4374397","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2006 3rd International Conference on Broadband Communications, Networks and Systems","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.6499999761581421,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W1506281249","https://openalex.org/W1604234405","https://openalex.org/W1964890720","https://openalex.org/W1970026646","https://openalex.org/W1983405933","https://openalex.org/W1986240373","https://openalex.org/W1990312804","https://openalex.org/W1997184885","https://openalex.org/W2058815839","https://openalex.org/W2098989705","https://openalex.org/W2099086552","https://openalex.org/W2107509798","https://openalex.org/W2113872681","https://openalex.org/W2118340964","https://openalex.org/W2118341703","https://openalex.org/W2119665367","https://openalex.org/W2121635209","https://openalex.org/W2125877832","https://openalex.org/W2130882486","https://openalex.org/W2131389289","https://openalex.org/W2131738300","https://openalex.org/W2146697465","https://openalex.org/W2165811958","https://openalex.org/W3041231242","https://openalex.org/W4244494905","https://openalex.org/W6646783274","https://openalex.org/W6677763703","https://openalex.org/W6677799911","https://openalex.org/W6780273375"],"related_works":["https://openalex.org/W2159943424","https://openalex.org/W2536809794","https://openalex.org/W2375534108","https://openalex.org/W3202068393","https://openalex.org/W2393962653","https://openalex.org/W2391574262","https://openalex.org/W1567526064","https://openalex.org/W2312391375","https://openalex.org/W2752569328","https://openalex.org/W2156839650"],"abstract_inverted_index":{"A":[0,81],"number":[1],"of":[2,30,39,97,103],"events":[3,120],"such":[4],"as":[5,137,139,155],"hurricanes,":[6],"earthquakes,":[7],"power":[8],"outages":[9],"can":[10,59,129],"cause":[11,20],"large-scale":[12],"failures":[13,125],"in":[14,18,22],"the":[15,23,37,76,90,95,104],"Internet.":[16],"These":[17],"turn":[19],"anomalies":[21,41],"interdomain":[24],"routing":[25],"process.":[26],"The":[27,101],"policy-based":[28],"nature":[29],"border":[31],"gateway":[32],"protocol":[33],"(BGP)":[34],"further":[35],"aggravates":[36],"effect":[38],"these":[40],"causing":[42],"severe,":[43],"long":[44],"lasting":[45],"route":[46],"fluctuations.":[47],"In":[48],"this":[49],"work":[50],"we":[51],"propose":[52],"an":[53,98],"architecture":[54],"for":[55,71],"anomaly":[56],"detection":[57],"that":[58,116,147],"be":[60,130],"implemented":[61],"on":[62,89],"individual":[63],"routers.":[64],"We":[65,114,144],"use":[66],"statistical":[67],"pattern":[68],"recognition":[69],"techniques":[70],"extracting":[72],"meaningful":[73],"features":[74],"from":[75],"BGP":[77],"update":[78],"message":[79],"data.":[80,113],"time-series":[82],"segmentation":[83],"algorithm":[84,106],"is":[85,107,152],"then":[86],"carried":[87],"out":[88],"feature":[91],"traces":[92],"to":[93,157],"detect":[94],"onset":[96],"instability":[99],"event":[100],"performance":[102],"proposed":[105],"evaluated":[108],"using":[109],"real":[110],"Internet":[111],"trace":[112],"show":[115,146],"instabilities":[117],"triggered":[118],"by":[119],"like":[121,159],"router":[122],"mis-configurations,":[123],"infrastructure":[124],"and":[126],"worm":[127],"attacks":[128],"detected":[131],"with":[132],"a":[133],"false":[134],"alarm":[135],"rate":[136],"low":[138],"0.0083":[140],"alarms":[141],"per":[142],"hour.":[143],"also":[145],"our":[148],"learning":[149],"based":[150,165],"mechanism":[151],"highly":[153],"robust":[154],"compared":[156],"methods":[158],"exponentially":[160],"weighted":[161],"moving":[162],"average":[163],"(EWMA)":[164],"detection.":[166]},"counts_by_year":[{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}