{"id":"https://openalex.org/W2136420282","doi":"https://doi.org/10.1109/infcom.2009.5061947","title":"Rule-Based Anomaly Detection on IP Flows","display_name":"Rule-Based Anomaly Detection on IP Flows","publication_year":2009,"publication_date":"2009-04-01","ids":{"openalex":"https://openalex.org/W2136420282","doi":"https://doi.org/10.1109/infcom.2009.5061947","mag":"2136420282"},"language":"en","primary_location":{"id":"doi:10.1109/infcom.2009.5061947","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infcom.2009.5061947","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE INFOCOM 2009","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048558842","display_name":"Nick Duffield","orcid":"https://orcid.org/0000-0001-7211-1584"},"institutions":[{"id":"https://openalex.org/I1283103587","display_name":"AT&T (United States)","ror":"https://ror.org/02bbd5539","country_code":"US","type":"company","lineage":["https://openalex.org/I1283103587"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"N. Duffield","raw_affiliation_strings":["AT&T Labs.-Res., Florham Park, NJ"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AT&T Labs.-Res., Florham Park, NJ","institution_ids":["https://openalex.org/I1283103587"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026605560","display_name":"Patrick Haffner","orcid":"https://orcid.org/0000-0002-2319-5109"},"institutions":[{"id":"https://openalex.org/I1283103587","display_name":"AT&T (United States)","ror":"https://ror.org/02bbd5539","country_code":"US","type":"company","lineage":["https://openalex.org/I1283103587"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"P. Haffner","raw_affiliation_strings":["AT&T Labs.-Res., Florham Park, NJ"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AT&T Labs.-Res., Florham Park, NJ","institution_ids":["https://openalex.org/I1283103587"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110245986","display_name":"Balachander Krishnamurthy","orcid":null},"institutions":[{"id":"https://openalex.org/I1283103587","display_name":"AT&T (United States)","ror":"https://ror.org/02bbd5539","country_code":"US","type":"company","lineage":["https://openalex.org/I1283103587"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"B. Krishnamurthy","raw_affiliation_strings":["AT&T Labs.-Res., Florham Park, NJ"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AT&T Labs.-Res., Florham Park, NJ","institution_ids":["https://openalex.org/I1283103587"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017863056","display_name":"Haakon Ringberg","orcid":null},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"H. Ringberg","raw_affiliation_strings":["Department of Computer Science, Princeton University, Princeton, NJ, USA","Department of Computer Science, Princeton University, Princeton , NJ, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Princeton University, Princeton, NJ, USA","institution_ids":["https://openalex.org/I20089843"]},{"raw_affiliation_string":"Department of Computer Science, Princeton University, Princeton , NJ, USA","institution_ids":["https://openalex.org/I20089843"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":66,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"424","last_page":"432"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8451855182647705},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.7119095325469971},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6818144917488098},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.6523246765136719},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5971062183380127},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5782811641693115},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5756781697273254},{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.5225488543510437},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5168564915657043},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5068336129188538},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.49534931778907776},{"id":"https://openalex.org/keywords/packet-analyzer","display_name":"Packet analyzer","score":0.4877086579799652},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4770033657550812},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.4632185101509094},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4431290030479431},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.18397188186645508}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8451855182647705},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.7119095325469971},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6818144917488098},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.6523246765136719},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5971062183380127},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5782811641693115},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5756781697273254},{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.5225488543510437},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5168564915657043},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5068336129188538},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.49534931778907776},{"id":"https://openalex.org/C95362637","wikidata":"https://www.wikidata.org/wiki/Q54366","display_name":"Packet analyzer","level":3,"score":0.4877086579799652},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4770033657550812},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.4632185101509094},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4431290030479431},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.18397188186645508},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/infcom.2009.5061947","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infcom.2009.5061947","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE INFOCOM 2009","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.145.1613","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.145.1613","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.research.att.com/~bala/papers/infocom2009.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Decent work and economic growth","id":"https://metadata.un.org/sdg/8","score":0.4099999964237213}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W26074071","https://openalex.org/W1516506771","https://openalex.org/W1881594620","https://openalex.org/W1968439359","https://openalex.org/W1976047426","https://openalex.org/W2012095206","https://openalex.org/W2030553727","https://openalex.org/W2031006315","https://openalex.org/W2032210760","https://openalex.org/W2055261595","https://openalex.org/W2087405576","https://openalex.org/W2111707959","https://openalex.org/W2121511513","https://openalex.org/W2128567487","https://openalex.org/W2148603752","https://openalex.org/W2164210932","https://openalex.org/W2293322640","https://openalex.org/W3138598418","https://openalex.org/W4244952642","https://openalex.org/W4245906277","https://openalex.org/W4248484754","https://openalex.org/W6601098373","https://openalex.org/W6639070383"],"related_works":["https://openalex.org/W2086304464","https://openalex.org/W3088530179","https://openalex.org/W1971040605","https://openalex.org/W2037047765","https://openalex.org/W1523103140","https://openalex.org/W4293863310","https://openalex.org/W4385692127","https://openalex.org/W2121836138","https://openalex.org/W2128567487","https://openalex.org/W2053550965"],"abstract_inverted_index":{"Rule-based":[0],"packet":[1,69,85,98,142],"classification":[2],"is":[3,37,149],"a":[4,15,91,102,115,129],"powerful":[5],"method":[6],"for":[7,43,62,118,152],"identifying":[8],"traffic":[9],"anomalies,":[10],"with":[11,101],"network":[12,28,48,161],"security":[13],"as":[14,67],"key":[16],"application":[17],"area.":[18],"While":[19],"popular":[20],"systems":[21],"like":[22],"Snort":[23],"are":[24],"used":[25],"in":[26,72,158],"many":[27,47],"locations,":[29],"comprehensive":[30],"deployment":[31],"across":[32],"Tier-1":[33],"service":[34],"provider":[35],"networks":[36],"costly":[38],"due":[39],"to":[40,96,127],"the":[41,64,68,110,124],"need":[42],"high-speed":[44],"monitors":[45],"at":[46],"ingress":[49],"points.":[50],"Since":[51],"ISPs":[52],"already":[53],"collect":[54],"flow":[55,87,107],"statistics":[56],"ubiquitously,":[57],"can":[58],"we":[59],"use":[60],"it":[61],"detecting":[63],"same":[65,111],"anomalies":[66],"based":[70],"rules":[71],"spite":[73],"of":[74,78,136,146,168,172],"aggregation":[75],"and":[76,86,122,155],"absence":[77],"payload":[79],"information?":[80],"We":[81,113,132],"exploit":[82],"correlations":[83],"between":[84],"level":[88,99],"information":[89],"via":[90],"machine":[92],"learning":[93],"(ML)":[94],"approach":[95],"associate":[97],"alarms":[100],"feature":[103],"vector":[104],"derived":[105],"from":[106],"records":[108],"on":[109,140],"traffic.":[112],"describe":[114,123],"system":[116],"architecture":[117],"network-wide":[119],"flow-":[120],"alarming":[121],"steps":[125],"required":[126],"establish":[128],"proof-":[130],"of-concept.":[131],"evaluate":[133],"prediction":[134,147],"accuracy":[135],"candidate":[137],"ML":[138,153],"algorithms":[139],"actual":[141],"traces.":[143],"The":[144],"duration":[145],"effectiveness":[148],"an":[150],"issue":[151],"approaches":[154],"more":[156],"so":[157],"resource":[159],"intensive":[160],"applications.":[162],"Initial":[163],"results":[164],"show":[165],"little":[166],"impairment":[167],"performance":[169],"over":[170],"periods":[171],"one":[173],"or":[174],"two":[175],"weeks.":[176]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":4},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":5},{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":5},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":1},{"year":2015,"cited_by_count":3},{"year":2014,"cited_by_count":3},{"year":2013,"cited_by_count":7},{"year":2012,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}