{"id":"https://openalex.org/W3003920670","doi":"https://doi.org/10.1109/iscc47284.2019.8969587","title":"Modeling User Network Behavior Based on Network Packet Sketches for Masquerade Detection","display_name":"Modeling User Network Behavior Based on Network Packet Sketches for Masquerade Detection","publication_year":2019,"publication_date":"2019-06-01","ids":{"openalex":"https://openalex.org/W3003920670","doi":"https://doi.org/10.1109/iscc47284.2019.8969587","mag":"3003920670"},"language":"en","primary_location":{"id":"doi:10.1109/iscc47284.2019.8969587","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc47284.2019.8969587","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042330595","display_name":"Zhiyuan Lv","orcid":null},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiyuan Lv","raw_affiliation_strings":["Tsinghua University,Department of Computer Science and Technology,Beijing,China","Department of Computer Science and Technology, Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,Department of Computer Science and Technology,Beijing,China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101491459","display_name":"Youjian Zhao","orcid":"https://orcid.org/0000-0001-9841-1796"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Youjian Zhao","raw_affiliation_strings":["Tsinghua University,Department of Computer Science and Technology,Beijing,China","Department of Computer Science and Technology, Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,Department of Computer Science and Technology,Beijing,China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5115603296","display_name":"Haibin Li","orcid":"https://orcid.org/0009-0007-7241-5060"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haibin Li","raw_affiliation_strings":["Tsinghua University,Department of Computer Science and Technology,Beijing,China","Department of Computer Science and Technology, Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,Department of Computer Science and Technology,Beijing,China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I99065089"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8551260828971863},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.7087048292160034},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6996651887893677},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.6923456788063049},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.5780678987503052},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5378555059432983},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5314338207244873},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.5069323182106018},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4768591821193695},{"id":"https://openalex.org/keywords/enterprise-private-network","display_name":"Enterprise private network","score":0.4459552764892578},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.41013389825820923},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3326624035835266}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8551260828971863},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.7087048292160034},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6996651887893677},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.6923456788063049},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.5780678987503052},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5378555059432983},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5314338207244873},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5069323182106018},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4768591821193695},{"id":"https://openalex.org/C149859251","wikidata":"https://www.wikidata.org/wiki/Q483426","display_name":"Enterprise private network","level":2,"score":0.4459552764892578},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.41013389825820923},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3326624035835266},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/iscc47284.2019.8969587","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc47284.2019.8969587","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W1458873377","https://openalex.org/W1502922572","https://openalex.org/W1536598138","https://openalex.org/W1559049942","https://openalex.org/W1760565668","https://openalex.org/W1898491644","https://openalex.org/W1965343849","https://openalex.org/W1967331239","https://openalex.org/W1973704753","https://openalex.org/W1991210879","https://openalex.org/W1995976200","https://openalex.org/W2040519706","https://openalex.org/W2128728535","https://openalex.org/W2131998781","https://openalex.org/W2142638723","https://openalex.org/W2144584907","https://openalex.org/W2164210932","https://openalex.org/W2203571366","https://openalex.org/W2395792877","https://openalex.org/W2402548350","https://openalex.org/W2492347508","https://openalex.org/W2538737552","https://openalex.org/W2890871880","https://openalex.org/W2896600304","https://openalex.org/W2963879636","https://openalex.org/W6628526219","https://openalex.org/W6632257772","https://openalex.org/W6680741580","https://openalex.org/W6755717367"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W4387194049","https://openalex.org/W2018332730","https://openalex.org/W2063508592"],"abstract_inverted_index":{"Nowadays,":[0],"masquerade":[1,45,88],"attack":[2,46],"caused":[3],"by":[4,178],"identity":[5],"misuse":[6],"is":[7,121],"a":[8,15,34,84],"kind":[9],"of":[10,173],"severe":[11],"insider":[12],"threat":[13],"and":[14,55,71,86,99,126,144,170],"common":[16,35],"security":[17],"problem":[18],"for":[19,37,43,75,123],"most":[20,40,124],"organizations.":[21],"Although":[22],"the":[23,133,171],"anomaly":[24],"detection":[25,89],"based":[26],"on":[27],"machine":[28],"learning":[29],"has":[30],"been":[31],"applied":[32],"as":[33],"method":[36,90,120,160],"this":[38,80],"problem,":[39],"existing":[41],"approaches":[42],"detecting":[44],"usually":[47],"use":[48],"host-based":[49,59],"data":[50,60,143,149],"to":[51,64,77,94,129,168],"profile":[52,95],"user":[53,96,142,175],"behavior":[54,98,177],"detect":[56,100],"anomaly.":[57],"However,":[58],"are":[61,117],"too":[62],"sensitive":[63],"collect,":[65],"which":[66],"results":[67,156,182],"in":[68,150,183],"poor":[69],"universality":[70],"makes":[72],"it":[73],"difficult":[74],"enterprises":[76,125],"deploy.":[78,130],"In":[79],"paper,":[81],"we":[82,135],"propose":[83],"cheap":[85],"general":[87],"with":[91,114,164],"high":[92],"accuracy":[93],"network":[97,103,111,176,179],"anomaly,":[101],"using":[102],"packet":[104,112,180],"sketches":[105,181],"(IP,":[106],"port,":[107],"protocol,":[108],"etc.).":[109],"As":[110],"headers":[113],"standardized":[115],"format":[116],"non-sensitive,":[118],"our":[119,159],"suitable":[122],"much":[127],"cheaper":[128],"To":[131],"validate":[132],"method,":[134],"collected":[136],"more":[137],"than":[138],"10":[139],"TB":[140],"normal":[141],"5":[145],"GB":[146],"simulated":[147],"masquerader":[148],"real":[151],"enterprise":[152],"environment.":[153],"The":[154],"experimental":[155],"show":[157],"that":[158],"achieves":[161],"good":[162,184],"performance":[163],"average":[165],"AUC":[166],"up":[167],"0.988":[169],"approach":[172],"modeling":[174],"time":[185],"efficiency.":[186]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}