{"id":"https://openalex.org/W2083485408","doi":"https://doi.org/10.1109/ipdpsw.2010.5470852","title":"Distributed monitoring of conditional entropy for anomaly detection in streams","display_name":"Distributed monitoring of conditional entropy for anomaly detection in streams","publication_year":2010,"publication_date":"2010-04-01","ids":{"openalex":"https://openalex.org/W2083485408","doi":"https://doi.org/10.1109/ipdpsw.2010.5470852","mag":"2083485408"},"language":"en","primary_location":{"id":"doi:10.1109/ipdpsw.2010.5470852","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipdpsw.2010.5470852","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2010 IEEE International Symposium on Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057218536","display_name":"Chrisil Arackaparambil","orcid":null},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chrisil Arackaparambil","raw_affiliation_strings":["Department of Computer Science, Dartmouth College, Hanover, NH, USA","Department of Computer Science, Dartmouth College, Hanover NH 03755 USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]},{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover NH 03755 USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016172156","display_name":"Sergey Bratus","orcid":null},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sergey Bratus","raw_affiliation_strings":["Department of Computer Science, Dartmouth College, Hanover, NH, USA","Department of Computer Science, Dartmouth College, Hanover NH 03755 USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]},{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover NH 03755 USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079684179","display_name":"Joshua Brody","orcid":null},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Joshua Brody","raw_affiliation_strings":["Department of Computer Science, Dartmouth College, Hanover, NH, USA","Department of Computer Science, Dartmouth College, Hanover NH 03755 USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]},{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover NH 03755 USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5111674220","display_name":"Anna Shubina","orcid":null},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Anna Shubina","raw_affiliation_strings":["Department of Computer Science, Dartmouth College, Hanover, NH, USA","Department of Computer Science, Dartmouth College, Hanover NH 03755 USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]},{"raw_affiliation_string":"Department of Computer Science, Dartmouth College, Hanover NH 03755 USA","institution_ids":["https://openalex.org/I107672454"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I107672454"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":18,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":0.9912999868392944,"subfield":{"id":"https://openalex.org/subfields/2204","display_name":"Biomedical Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7593277096748352},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"Data stream mining","score":0.6509194374084473},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6223593354225159},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.615598201751709},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5570663213729858},{"id":"https://openalex.org/keywords/statistic","display_name":"Statistic","score":0.5432528257369995},{"id":"https://openalex.org/keywords/conditional-entropy","display_name":"Conditional entropy","score":0.502274751663208},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.4865766763687134},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.4835681617259979},{"id":"https://openalex.org/keywords/network-monitoring","display_name":"Network monitoring","score":0.47894006967544556},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.4270767867565155},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.41377946734428406},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4121151268482208},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.28310346603393555},{"id":"https://openalex.org/keywords/principle-of-maximum-entropy","display_name":"Principle of maximum entropy","score":0.164819598197937},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.16337084770202637},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.1242416501045227},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.1023634672164917},{"id":"https://openalex.org/keywords/statistics","display_name":"Statistics","score":0.09528294205665588}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7593277096748352},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.6509194374084473},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6223593354225159},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.615598201751709},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5570663213729858},{"id":"https://openalex.org/C89128539","wikidata":"https://www.wikidata.org/wiki/Q1949963","display_name":"Statistic","level":2,"score":0.5432528257369995},{"id":"https://openalex.org/C101721835","wikidata":"https://www.wikidata.org/wiki/Q813908","display_name":"Conditional entropy","level":3,"score":0.502274751663208},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.4865766763687134},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.4835681617259979},{"id":"https://openalex.org/C81877898","wikidata":"https://www.wikidata.org/wiki/Q1965787","display_name":"Network monitoring","level":2,"score":0.47894006967544556},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.4270767867565155},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.41377946734428406},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4121151268482208},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28310346603393555},{"id":"https://openalex.org/C9679016","wikidata":"https://www.wikidata.org/wiki/Q1417473","display_name":"Principle of maximum entropy","level":2,"score":0.164819598197937},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.16337084770202637},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.1242416501045227},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.1023634672164917},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.09528294205665588},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/ipdpsw.2010.5470852","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipdpsw.2010.5470852","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2010 IEEE International Symposium on Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW)","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.172.3749","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.172.3749","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.ists.dartmouth.edu/library/480.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.173.1143","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.173.1143","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.dartmouth.edu/%7Ejbrody/papers/AnomalyDetection.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.215.5801","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.215.5801","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.dartmouth.edu/%7Ecja/papers/condent.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W1521238083","https://openalex.org/W1603123426","https://openalex.org/W1628908379","https://openalex.org/W1980389212","https://openalex.org/W2052207834","https://openalex.org/W2078764670","https://openalex.org/W2096847629","https://openalex.org/W2099111195","https://openalex.org/W2108673751","https://openalex.org/W2109885200","https://openalex.org/W2113061123","https://openalex.org/W2129978406","https://openalex.org/W2130598205","https://openalex.org/W2131434715","https://openalex.org/W2146189323","https://openalex.org/W2150847526","https://openalex.org/W2155915275","https://openalex.org/W2164210932","https://openalex.org/W2621193479","https://openalex.org/W2949196898","https://openalex.org/W4241915340","https://openalex.org/W6631339344","https://openalex.org/W6636171859","https://openalex.org/W6636602514","https://openalex.org/W6645423673","https://openalex.org/W6674805939","https://openalex.org/W6738367115"],"related_works":["https://openalex.org/W2375587188","https://openalex.org/W1521770704","https://openalex.org/W53300123","https://openalex.org/W4226248369","https://openalex.org/W2110365568","https://openalex.org/W2145588106","https://openalex.org/W2920690171","https://openalex.org/W2138671515","https://openalex.org/W2093862276","https://openalex.org/W2118020642"],"abstract_inverted_index":{"In":[0,199],"this":[1,89,98,200],"work":[2,201],"we":[3,202,212,234],"consider":[4],"the":[5,21,24,30,37,60,70,73,101,111,123,134,143,159,165,176,191,208,242,268],"problem":[6,22,31,185],"of":[7,26,41,72,127,145,161,179,193,245,271],"monitoring":[8,97,108,173,195,236],"information":[9],"streams":[10,28],"for":[11,224],"anomalies":[12,58],"in":[13,23,44,56,59,79,88,96,164,216,253],"a":[14,42,45,151,183,204,221,249],"scalable":[15],"and":[16,190,260],"efficient":[17],"manner.":[18],"We":[19,256],"study":[20],"context":[25],"network":[27,46,61,80,128],"where":[29],"has":[32,49],"received":[33],"significant":[34],"attention.":[35],"Monitoring":[36],"empirical":[38],"Shannon":[39],"entropy":[40,172,194],"feature":[43,74],"packet":[47],"stream":[48],"previously":[50,115],"been":[51],"shown":[52],"to":[53,119,141,157,206,219],"be":[54,83],"useful":[55],"detecting":[57,86,254],"traffic.":[62],"Entropy":[63],"is":[64,104,132,182,196],"an":[65,137,171,272],"information-theoretic":[66],"statistic":[67,102,244],"that":[68,136],"measures":[69],"variability":[71,149],"under":[75],"consideration.":[76],"Anomalous":[77],"activity":[78],"traffic":[81,129,156,163],"can":[82],"captured":[84],"by":[85,150,170],"changes":[87],"variability.":[90],"There":[91,131],"are":[92],"several":[93],"challenges,":[94],"however,":[95],"statistic.":[99],"Computing":[100],"efficiently":[103],"non-trivial.":[105],"Further,":[106],"when":[107],"multiple":[109],"features,":[110],"streaming":[112],"algorithms":[113,218],"proposed":[114],"would":[116],"likely":[117],"fail":[118],"keep":[120],"up":[121],"with":[122,186,263],"ever-increasing":[124],"channel":[125],"bandwidth":[126],"streams.":[130],"also":[133],"concern":[135],"adversary":[138],"could":[139],"attempt":[140],"mask":[142],"effect":[144],"his":[146,155],"attacks":[147],"on":[148],"mimicry":[152],"attack":[153],"disguising":[154],"mimic":[158],"distribution":[160],"normal":[162],"network,":[166],"thus":[167],"avoiding":[168],"detection":[169],"sensor.":[174],"Also,":[175],"high":[177],"rate":[178],"false":[180],"positives":[181],"big":[184],"Intrusion":[187],"Detection":[188],"Systems,":[189],"case":[192],"no":[197],"different.":[198],"propose":[203,235],"way":[205],"address":[207],"above":[209],"challenges.":[210],"First,":[211],"leverage":[213],"recent":[214],"progress":[215],"sketching":[217],"develop":[220],"distributed":[222],"approach":[223,259],"computing":[225],"entropic":[226],"statistics":[227],"accurately,":[228],"at":[229,267],"reasonable":[230],"memory":[231],"costs.":[232],"Secondly,":[233],"not":[237],"only":[238],"regular":[239],"entropy,":[240,247],"but":[241],"related":[243],"conditional":[246],"as":[248],"more":[250],"reliable":[251],"measure":[252],"anomalies.":[255],"implement":[257],"our":[258],"evaluate":[261],"it":[262],"real":[264],"data":[265],"collected":[266],"link":[269],"layer":[270],"802.11":[273],"wireless":[274],"network.":[275]},"counts_by_year":[{"year":2024,"cited_by_count":2},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":2},{"year":2015,"cited_by_count":2},{"year":2014,"cited_by_count":3},{"year":2013,"cited_by_count":1},{"year":2012,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}