{"id":"https://openalex.org/W3010078685","doi":"https://doi.org/10.1109/globecom38437.2019.9014334","title":"Hierarchical Neural Networks for Detecting Anomalous Traffic Flows","display_name":"Hierarchical Neural Networks for Detecting Anomalous Traffic Flows","publication_year":2019,"publication_date":"2019-12-01","ids":{"openalex":"https://openalex.org/W3010078685","doi":"https://doi.org/10.1109/globecom38437.2019.9014334","mag":"3010078685"},"language":"en","primary_location":{"id":"doi:10.1109/globecom38437.2019.9014334","is_oa":false,"landing_page_url":"https://doi.org/10.1109/globecom38437.2019.9014334","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Global Communications Conference (GLOBECOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5031632001","display_name":"Seung\u2010Jin Ryu","orcid":"https://orcid.org/0000-0001-8810-2375"},"institutions":[{"id":"https://openalex.org/I4387156240","display_name":"National Security Research Institute","ror":"https://ror.org/01rg5mm74","country_code":"KR","type":"government","lineage":["https://openalex.org/I2801339556","https://openalex.org/I4210144908","https://openalex.org/I4387152098","https://openalex.org/I4387156240"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Seung-Jin Ryu","raw_affiliation_strings":["National Security Research Institute, Daejeon, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Security Research Institute, Daejeon, Republic of Korea","institution_ids":["https://openalex.org/I4387156240"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043660997","display_name":"Wooyoung Go","orcid":null},"institutions":[{"id":"https://openalex.org/I4387156240","display_name":"National Security Research Institute","ror":"https://ror.org/01rg5mm74","country_code":"KR","type":"government","lineage":["https://openalex.org/I2801339556","https://openalex.org/I4210144908","https://openalex.org/I4387152098","https://openalex.org/I4387156240"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Wooyoung Go","raw_affiliation_strings":["National Security Research Institute, Daejeon, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Security Research Institute, Daejeon, Republic of Korea","institution_ids":["https://openalex.org/I4387156240"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101869066","display_name":"Daewoo Lee","orcid":"https://orcid.org/0000-0002-9546-0610"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Daewoo Lee","raw_affiliation_strings":["RTst Co., Daejeon, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RTst Co., Daejeon, Republic of Korea","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058435875","display_name":"Hanjun Yoon","orcid":null},"institutions":[{"id":"https://openalex.org/I4387156240","display_name":"National Security Research Institute","ror":"https://ror.org/01rg5mm74","country_code":"KR","type":"government","lineage":["https://openalex.org/I2801339556","https://openalex.org/I4210144908","https://openalex.org/I4387152098","https://openalex.org/I4387156240"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Han-Jun Yoon","raw_affiliation_strings":["National Security Research Institute, Daejeon, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Security Research Institute, Daejeon, Republic of Korea","institution_ids":["https://openalex.org/I4387156240"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8223556876182556},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6804202795028687},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6673617362976074},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6294823884963989},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5902377367019653},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5121467113494873},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5002520084381104},{"id":"https://openalex.org/keywords/traffic-flow","display_name":"Traffic flow (computer networking)","score":0.48349979519844055},{"id":"https://openalex.org/keywords/feature-vector","display_name":"Feature vector","score":0.48136478662490845},{"id":"https://openalex.org/keywords/sequence","display_name":"Sequence (biology)","score":0.4800656735897064},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.46476492285728455},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.44982969760894775},{"id":"https://openalex.org/keywords/architecture","display_name":"Architecture","score":0.4281196892261505},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.42751529812812805},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.32192176580429077},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.2622436285018921}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8223556876182556},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6804202795028687},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6673617362976074},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6294823884963989},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5902377367019653},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5121467113494873},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5002520084381104},{"id":"https://openalex.org/C207512268","wikidata":"https://www.wikidata.org/wiki/Q3074551","display_name":"Traffic flow (computer networking)","level":2,"score":0.48349979519844055},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.48136478662490845},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.4800656735897064},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.46476492285728455},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.44982969760894775},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.4281196892261505},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.42751529812812805},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.32192176580429077},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2622436285018921},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C153349607","wikidata":"https://www.wikidata.org/wiki/Q36649","display_name":"Visual arts","level":1,"score":0.0},{"id":"https://openalex.org/C54355233","wikidata":"https://www.wikidata.org/wiki/Q7162","display_name":"Genetics","level":1,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C142362112","wikidata":"https://www.wikidata.org/wiki/Q735","display_name":"Art","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/globecom38437.2019.9014334","is_oa":false,"landing_page_url":"https://doi.org/10.1109/globecom38437.2019.9014334","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Global Communications Conference (GLOBECOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":37,"referenced_works":["https://openalex.org/W433644524","https://openalex.org/W1522301498","https://openalex.org/W1533861849","https://openalex.org/W1674877186","https://openalex.org/W1921523184","https://openalex.org/W2079735306","https://openalex.org/W2095705004","https://openalex.org/W2096205677","https://openalex.org/W2116065364","https://openalex.org/W2133564696","https://openalex.org/W2149600645","https://openalex.org/W2159438919","https://openalex.org/W2168917894","https://openalex.org/W2296509296","https://openalex.org/W2470673105","https://openalex.org/W2606697812","https://openalex.org/W2772317693","https://openalex.org/W2773246426","https://openalex.org/W2783245345","https://openalex.org/W2795175906","https://openalex.org/W2840169530","https://openalex.org/W2890507837","https://openalex.org/W2904109097","https://openalex.org/W2963106521","https://openalex.org/W2963516518","https://openalex.org/W2964121744","https://openalex.org/W2964308564","https://openalex.org/W4297747285","https://openalex.org/W4301866626","https://openalex.org/W6631943919","https://openalex.org/W6637096788","https://openalex.org/W6670297073","https://openalex.org/W6674330103","https://openalex.org/W6684764302","https://openalex.org/W6736700160","https://openalex.org/W6745899033","https://openalex.org/W6747687235"],"related_works":["https://openalex.org/W1544967040","https://openalex.org/W2594425278","https://openalex.org/W2347338493","https://openalex.org/W2797286879","https://openalex.org/W2037047765","https://openalex.org/W2146932554","https://openalex.org/W2357468538","https://openalex.org/W1577110157","https://openalex.org/W2171331105","https://openalex.org/W4241964992"],"abstract_inverted_index":{"Intrusion":[0],"Detection":[1],"System":[2],"(IDS)":[3],"is":[4],"designed":[5],"to":[6,39,66],"protect":[7],"network":[8,17],"assets":[9],"by":[10],"inspecting":[11],"specified":[12],"region":[13],"or":[14],"properties":[15],"of":[16,50,53,88],"traffic.":[18],"To":[19],"represent":[20],"hierarchical":[21],"traffic":[22,95],"flows":[23],"comprehensively,":[24],"this":[25],"paper":[26],"proposes":[27],"a":[28,73],"deep":[29],"learning":[30],"architecture":[31],"for":[32,46,92],"anomaly":[33],"detection.":[34],"We":[35],"employ":[36],"CNN":[37,58],"model":[38],"automatically":[40],"extract":[41],"an":[42],"adequate":[43],"feature":[44,76],"vector":[45],"each":[47],"message":[48,70],"composed":[49],"unidirectional":[51],"sequence":[52],"packets.":[54],"Based":[55],"upon":[56],"the":[57,68,85,89],"structure,":[59],"we":[60],"build":[61],"BiLSTM":[62],"with":[63],"attention":[64],"mechanism":[65],"summarize":[67],"sequential":[69],"vectors":[71],"as":[72],"representative":[74],"flow":[75],"vector.":[77],"Empirical":[78],"evidence":[79],"from":[80],"reduced":[81],"UNSW-NB15":[82],"dataset":[83],"indicates":[84],"superior":[86],"performance":[87],"proposed":[90],"method":[91],"detecting":[93],"anomalous":[94],"flows.":[96]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2020,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}