{"id":"https://openalex.org/W3098856714","doi":"https://doi.org/10.1109/nof50125.2020.9249194","title":"HUMAN - Hierarchical Clustering for Unsupervised Anomaly Detection & Interpretation","display_name":"HUMAN - Hierarchical Clustering for Unsupervised Anomaly Detection & Interpretation","publication_year":2020,"publication_date":"2020-10-12","ids":{"openalex":"https://openalex.org/W3098856714","doi":"https://doi.org/10.1109/nof50125.2020.9249194","mag":"3098856714"},"language":"en","primary_location":{"id":"doi:10.1109/nof50125.2020.9249194","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nof50125.2020.9249194","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 11th International Conference on Network of the Future (NoF)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089835284","display_name":"Pavol Mulinka","orcid":"https://orcid.org/0000-0002-9394-8794"},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Pavol Mulinka","raw_affiliation_strings":["CTU Czech Technical University in Prague"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CTU Czech Technical University in Prague","institution_ids":["https://openalex.org/I44504214"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081556750","display_name":"Pedro Casas","orcid":"https://orcid.org/0000-0002-0951-2331"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"AIT Austrian Institute of Technology GmbH","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Pedro Casas","raw_affiliation_strings":["AIT Austrian Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AIT Austrian Institute of Technology","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101814201","display_name":"Kensuke Fukuda","orcid":"https://orcid.org/0000-0001-8372-2807"},"institutions":[{"id":"https://openalex.org/I184597095","display_name":"National Institute of Informatics","ror":"https://ror.org/04ksd4g47","country_code":"JP","type":"facility","lineage":["https://openalex.org/I1319490839","https://openalex.org/I184597095","https://openalex.org/I4210158934"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Kensuke Fukuda","raw_affiliation_strings":["NII National Institute of Informatics in Tokyo"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NII National Institute of Informatics in Tokyo","institution_ids":["https://openalex.org/I184597095"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052475274","display_name":"Luk\u00e1\u0161 Kencl","orcid":"https://orcid.org/0000-0002-3339-7118"},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Lukas Kencl","raw_affiliation_strings":["CTU Czech Technical University in Prague"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CTU Czech Technical University in Prague","institution_ids":["https://openalex.org/I44504214"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.7034,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.64783242,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"132","last_page":"140"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7746170163154602},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7717435359954834},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.7399454116821289},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.6875326633453369},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5945526361465454},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5030905604362488},{"id":"https://openalex.org/keywords/hierarchical-clustering","display_name":"Hierarchical clustering","score":0.4940634071826935},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4655386209487915},{"id":"https://openalex.org/keywords/ground-truth","display_name":"Ground truth","score":0.44920623302459717},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.4184942841529846}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7746170163154602},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7717435359954834},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.7399454116821289},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.6875326633453369},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5945526361465454},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5030905604362488},{"id":"https://openalex.org/C92835128","wikidata":"https://www.wikidata.org/wiki/Q1277447","display_name":"Hierarchical clustering","level":3,"score":0.4940634071826935},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4655386209487915},{"id":"https://openalex.org/C146849305","wikidata":"https://www.wikidata.org/wiki/Q370766","display_name":"Ground truth","level":2,"score":0.44920623302459717},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4184942841529846}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/nof50125.2020.9249194","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nof50125.2020.9249194","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 11th International Conference on Network of the Future (NoF)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2396116908","display_name":"Detecting IPv6 network scan with DNS backscatter","funder_award_id":"18H03237","funder_id":"https://openalex.org/F4320334764","funder_display_name":"Japan Society for the Promotion of Science"}],"funders":[{"id":"https://openalex.org/F4320334764","display_name":"Japan Society for the Promotion of Science","ror":"https://ror.org/00hhkn466"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":45,"referenced_works":["https://openalex.org/W151377110","https://openalex.org/W154256836","https://openalex.org/W1128809682","https://openalex.org/W1501500081","https://openalex.org/W1673310716","https://openalex.org/W1697154133","https://openalex.org/W1975415766","https://openalex.org/W2038536589","https://openalex.org/W2040333627","https://openalex.org/W2057923756","https://openalex.org/W2080844349","https://openalex.org/W2096118443","https://openalex.org/W2101234009","https://openalex.org/W2107145385","https://openalex.org/W2107557955","https://openalex.org/W2122646361","https://openalex.org/W2126751256","https://openalex.org/W2160642098","https://openalex.org/W2171029115","https://openalex.org/W2278186031","https://openalex.org/W2337344967","https://openalex.org/W2408186052","https://openalex.org/W2427323587","https://openalex.org/W2530551364","https://openalex.org/W2542991588","https://openalex.org/W2555676925","https://openalex.org/W2601243251","https://openalex.org/W2740924709","https://openalex.org/W2741396778","https://openalex.org/W2765719629","https://openalex.org/W2768606982","https://openalex.org/W2783366320","https://openalex.org/W2787533383","https://openalex.org/W2795983726","https://openalex.org/W2809684781","https://openalex.org/W2902159133","https://openalex.org/W2941323067","https://openalex.org/W2989964158","https://openalex.org/W3009802283","https://openalex.org/W3015571647","https://openalex.org/W4247105055","https://openalex.org/W6637131181","https://openalex.org/W6675354045","https://openalex.org/W6750189595","https://openalex.org/W6774525873"],"related_works":["https://openalex.org/W2047973478","https://openalex.org/W4295532600","https://openalex.org/W2063823869","https://openalex.org/W2067569035","https://openalex.org/W2090985514","https://openalex.org/W2804364458","https://openalex.org/W2885323543","https://openalex.org/W4298130764","https://openalex.org/W4285233543","https://openalex.org/W4230838436"],"abstract_inverted_index":{"The":[0,168],"automatic":[1],"detection":[2,148],"and":[3,25,65,88,109,126,137,149],"interpretation":[4,150],"of":[5,41,135,151,162,178,181,191],"network":[6,81],"traffic":[7,82],"anomalies":[8,49],"through":[9,158],"machine":[10],"learning":[11],"is":[12,21],"a":[13,53,75,93,118],"well-known":[14],"problem,":[15],"for":[16,79,194],"which":[17,84,121],"no":[18],"general":[19,76,195],"solution":[20],"available.":[22],"Both":[23],"supervised":[24],"unsupervised":[26,80,160,176,196],"(i.e.,":[27],"anomaly":[28],"detection)":[29],"approaches":[30,56],"require":[31],"prior":[32],"knowledge":[33],"on":[34,46,99,101],"the":[35,47,102,114,132,147,159,175,189],"monitoring":[36],"data,":[37,116,187],"either":[38],"in":[39,66,92,113,141,154],"terms":[40],"normal":[42],"operation":[43],"profiles":[44],"or":[45,183],"specific":[48],"to":[50,63,174],"detect.":[51],"As":[52],"consequence,":[54],"both":[55,86],"have":[57],"clear":[58],"limitations":[59],"when":[60],"it":[61],"comes":[62],"detecting,":[64],"particular":[67],"interpreting,":[68],"previously":[69],"unseen":[70],"events.":[71],"We":[72,130],"present":[73],"HUMAN,":[74],"hierarchical-clustering-based":[77],"approach":[78,120,170],"analysis,":[83],"can":[85,107,171],"detect":[87,108],"interpret":[89,110],"anomalous":[90],"behaviors":[91],"completely":[94],"black-box":[95],"manner,":[96],"without":[97],"relying":[98],"ground-truth":[100],"system":[103],"under":[104],"analysis.":[105],"HUMAN":[106,136,169],"complex":[111],"patterns":[112],"analyzed":[115],"using":[117,143],"structural":[119],"exploits":[122],"hierarchical":[123,192],"cluster":[124],"relationships":[125],"correlation":[127],"among":[128],"features.":[129],"describe":[131],"building":[133],"blocks":[134],"explain":[138],"its":[139],"functioning":[140],"detail,":[142],"as":[144],"case":[145],"study":[146],"performance":[152],"issues":[153],"major":[155],"cloud":[156,165],"platforms,":[157],"analysis":[161,177],"distributed":[163],"active":[164],"latency":[166],"measurements.":[167],"be":[172],"applied":[173],"any":[179],"kind":[180],"nested":[182],"hierarchically":[184],"structured":[185],"multi-dimensional":[186],"showing":[188],"potential":[190],"clustering":[193],"data":[197],"analytics.":[198]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":1}],"updated_date":"2026-08-27T14:10:00.468798","created_date":"2025-10-10T00:00:00"}