{"id":"https://openalex.org/W2908453820","doi":"https://doi.org/10.1109/milcom.2018.8599738","title":"Machine Learning Based DDos Detection Through NetFlow Analysis","display_name":"Machine Learning Based DDos Detection Through NetFlow Analysis","publication_year":2018,"publication_date":"2018-10-01","ids":{"openalex":"https://openalex.org/W2908453820","doi":"https://doi.org/10.1109/milcom.2018.8599738","mag":"2908453820"},"language":"en","primary_location":{"id":"doi:10.1109/milcom.2018.8599738","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom.2018.8599738","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2018 - 2018 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5022675997","display_name":"Jiangpan Hou","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiangpan Hou","raw_affiliation_strings":["Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070081476","display_name":"Peipei Fu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Peipei Fu","raw_affiliation_strings":["Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101031616","display_name":"Zigang Cao","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zigang Cao","raw_affiliation_strings":["Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5008915740","display_name":"Anlin Xu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Anlin Xu","raw_affiliation_strings":["Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, University of Chinese Academy of Sciences, BeiJing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.0712,"has_fulltext":false,"cited_by_count":45,"citation_normalized_percentile":{"value":0.95421656,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.9875444769859314},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.9000349044799805},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8140566945075989},{"id":"https://openalex.org/keywords/trinoo","display_name":"Trinoo","score":0.6022560000419617},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.5151878595352173},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.47877299785614014},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4627644419670105},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.42263031005859375},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.41611552238464355},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.38331979513168335},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3417045772075653}],"concepts":[{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.9875444769859314},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.9000349044799805},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8140566945075989},{"id":"https://openalex.org/C43639116","wikidata":"https://www.wikidata.org/wiki/Q7843050","display_name":"Trinoo","level":5,"score":0.6022560000419617},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.5151878595352173},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.47877299785614014},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4627644419670105},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.42263031005859375},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.41611552238464355},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.38331979513168335},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3417045772075653},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/milcom.2018.8599738","is_oa":false,"landing_page_url":"https://doi.org/10.1109/milcom.2018.8599738","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"MILCOM 2018 - 2018 IEEE Military Communications Conference (MILCOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W40890042","https://openalex.org/W2085802616","https://openalex.org/W2120777856","https://openalex.org/W2168917894","https://openalex.org/W2200019417","https://openalex.org/W2260798440","https://openalex.org/W2276629685","https://openalex.org/W2579093384","https://openalex.org/W2597441556","https://openalex.org/W2765633793","https://openalex.org/W2774112487","https://openalex.org/W2789828921","https://openalex.org/W2963065250","https://openalex.org/W6684764302","https://openalex.org/W6687848532","https://openalex.org/W6719796978","https://openalex.org/W6731854414","https://openalex.org/W6745452051"],"related_works":["https://openalex.org/W2783466926","https://openalex.org/W4286539397","https://openalex.org/W1968168724","https://openalex.org/W2204131204","https://openalex.org/W2001331025","https://openalex.org/W4322008378","https://openalex.org/W2383770723","https://openalex.org/W2754163055","https://openalex.org/W2186749541","https://openalex.org/W2097156747"],"abstract_inverted_index":{"Distributed":[0],"Denial":[1],"of":[2,49,127,144,195],"Service":[3],"(DDos)":[4],"has":[5],"been":[6],"a":[7,74,105,114,149,188],"lasting":[8],"severe":[9],"threat":[10],"to":[11,29,41,44,65,76],"Internet,":[12],"which":[13,119],"is":[14,39,157,169,206],"evolving":[15],"both":[16],"in":[17,32,60,100,197],"technique":[18],"and":[19,84,93,109,123,148,191],"traffic":[20,54,79,122,126],"volume":[21],"recently.":[22],"Many":[23],"traditional":[24,174],"detection":[25],"methods":[26],"fail":[27],"due":[28],"their":[30],"limitations":[31],"real-time,":[33],"complexity":[34],"or":[35],"universality.":[36],"Therefore,":[37],"it":[38,111,168],"necessary":[40],"explore":[42],"how":[43],"timely":[45],"detect":[46],"different":[47,128],"kinds":[48,129],"DDOS":[50],"by":[51,107,112,130,187],"utilizing":[52],"simple":[53],"sampling":[55,97],"data":[56,99],"such":[57,162],"as":[58,163],"NetFlow":[59,81,98,184],"high":[61],"speed":[62],"networks":[63],"up":[64],"Tbps":[66],"bandwidth.":[67],"In":[68],"this":[69],"paper,":[70],"we":[71,88,103,177],"put":[72],"forward":[73],"scheme":[75],"identify":[77],"DDos":[78,125,132,160,165,196],"with":[80],"feature":[82],"selection":[83],"machine":[85],"learning.":[86],"Firstly,":[87],"extract":[89],"adaptive":[90],"flow-based":[91],"features":[92,95],"pattern-based":[94],"from":[96],"real-time.":[101],"Then":[102],"build":[104],"detector":[106,180,205],"RandomForest":[108],"evaluate":[110],"using":[113],"research":[115],"lab":[116],"network":[117],"trace":[118],"contains":[120],"benign":[121],"simulated":[124],"popular":[131],"tools.":[133],"Experiment":[134],"results":[135],"show":[136],"that":[137,172,203],"our":[138,155,179,204],"method":[139,156],"achieves":[140],"an":[141],"average":[142],"accuracy":[143],"more":[145,170],"than":[146,152],"99%":[147],"false-positive":[150],"less":[151],"0.5%.":[153],"Besides,":[154],"valid":[158],"for":[159,208],"means":[161],"stealthy":[164],"attack":[166],"so":[167],"universal":[171],"typical":[173],"methods.":[175],"Finally,":[176],"apply":[178],"on":[181],"the":[182,193],"real-world":[183,209],"logs":[185],"provided":[186],"large":[189],"ISP,":[190],"measure":[192],"characteristics":[194],"several":[198],"dimensions.":[199],"This":[200],"also":[201],"proves":[202],"applicable":[207],"network.":[210]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":7},{"year":2022,"cited_by_count":12},{"year":2021,"cited_by_count":7},{"year":2020,"cited_by_count":8},{"year":2019,"cited_by_count":3}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}