{"id":"https://openalex.org/W3070976782","doi":"https://doi.org/10.1109/tifs.2020.3017928","title":"Modelling Behavioural Dynamics for Asymmetric Application Layer DDoS Detection","display_name":"Modelling Behavioural Dynamics for Asymmetric Application Layer DDoS Detection","publication_year":2020,"publication_date":"2020-08-19","ids":{"openalex":"https://openalex.org/W3070976782","doi":"https://doi.org/10.1109/tifs.2020.3017928","mag":"3070976782"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2020.3017928","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2020.3017928","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5027025279","display_name":"Amit Praseed","orcid":"https://orcid.org/0000-0003-3965-0118"},"institutions":[{"id":"https://openalex.org/I11880225","display_name":"National Institute of Technology Karnataka","ror":"https://ror.org/01hz4v948","country_code":"IN","type":"education","lineage":["https://openalex.org/I11880225"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Amit Praseed","raw_affiliation_strings":["National Institute of Technology Karnataka, Surathkal, India"],"raw_orcid":"https://orcid.org/0000-0003-3965-0118","affiliations":[{"raw_affiliation_string":"National Institute of Technology Karnataka, Surathkal, India","institution_ids":["https://openalex.org/I11880225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059811306","display_name":"P. Santhi Thilagam","orcid":"https://orcid.org/0000-0002-8359-1330"},"institutions":[{"id":"https://openalex.org/I11880225","display_name":"National Institute of Technology Karnataka","ror":"https://ror.org/01hz4v948","country_code":"IN","type":"education","lineage":["https://openalex.org/I11880225"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"P. Santhi Thilagam","raw_affiliation_strings":["National Institute of Technology Karnataka, Surathkal, India"],"raw_orcid":"https://orcid.org/0000-0002-8359-1330","affiliations":[{"raw_affiliation_string":"National Institute of Technology Karnataka, Surathkal, India","institution_ids":["https://openalex.org/I11880225"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I11880225"],"apc_list":null,"apc_paid":null,"fwci":3.8897,"has_fulltext":false,"cited_by_count":51,"citation_normalized_percentile":{"value":0.93580299,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"16","issue":null,"first_page":"617","last_page":"626"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8858045339584351},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7623142004013062},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5580235719680786},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5064111948013306},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.502112627029419},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.4632158875465393},{"id":"https://openalex.org/keywords/probabilistic-logic","display_name":"Probabilistic logic","score":0.4577568471431732},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.45196470618247986},{"id":"https://openalex.org/keywords/application-layer","display_name":"Application layer","score":0.4479960799217224},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.4160225987434387},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3799792528152466},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3200898766517639},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3066703975200653},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2233494520187378}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8858045339584351},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7623142004013062},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5580235719680786},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5064111948013306},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.502112627029419},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.4632158875465393},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.4577568471431732},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.45196470618247986},{"id":"https://openalex.org/C190793597","wikidata":"https://www.wikidata.org/wiki/Q189768","display_name":"Application layer","level":3,"score":0.4479960799217224},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.4160225987434387},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3799792528152466},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3200898766517639},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3066703975200653},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2233494520187378},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2020.3017928","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2020.3017928","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.5600000023841858,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320325255","display_name":"Ministry of Electronics and Information technology","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W1998139240","https://openalex.org/W2009363597","https://openalex.org/W2030996295","https://openalex.org/W2043253283","https://openalex.org/W2069198714","https://openalex.org/W2072955950","https://openalex.org/W2073229702","https://openalex.org/W2092891024","https://openalex.org/W2095824774","https://openalex.org/W2107363720","https://openalex.org/W2110811647","https://openalex.org/W2111556044","https://openalex.org/W2123967542","https://openalex.org/W2124589355","https://openalex.org/W2134598092","https://openalex.org/W2170874246","https://openalex.org/W2406529704","https://openalex.org/W2743617586","https://openalex.org/W2743775608","https://openalex.org/W2798467083","https://openalex.org/W2888872082","https://openalex.org/W2892142441","https://openalex.org/W2943816301","https://openalex.org/W2955533854","https://openalex.org/W2987595184","https://openalex.org/W4288419205","https://openalex.org/W6714087132","https://openalex.org/W6754357002","https://openalex.org/W6762295027","https://openalex.org/W6765268592"],"related_works":["https://openalex.org/W2908108831","https://openalex.org/W2375951120","https://openalex.org/W3005836778","https://openalex.org/W2754163055","https://openalex.org/W2552641916","https://openalex.org/W4254515188","https://openalex.org/W2954653956","https://openalex.org/W2591571751","https://openalex.org/W2070220341","https://openalex.org/W2991861214"],"abstract_inverted_index":{"Asymmetric":[0],"application":[1],"layer":[2],"DDoS":[3,96],"attacks":[4,16,29,50],"using":[5,114],"computationally":[6],"intensive":[7],"HTTP":[8],"requests":[9],"are":[10,35],"an":[11,101],"extremely":[12,142],"dangerous":[13],"class":[14],"of":[15,18,54,111],"capable":[17],"taking":[19],"down":[20],"web":[21,191],"servers":[22],"with":[23,123],"relatively":[24],"few":[25],"attacking":[26],"connections.":[27],"These":[28],"consume":[30],"limited":[31],"network":[32],"bandwidth":[33],"and":[34,58,71,90,132,144,163,182,185],"similar":[36],"to":[37,64,105,140,189],"legitimate":[38,112,131],"traffic,":[39],"which":[40,62,75,159,193],"makes":[41,76,160,194],"their":[42],"detection":[43,46,73,92,138,180],"difficult.":[44],"Existing":[45],"mechanisms":[47,93],"for":[48,79,87,94,128,197],"these":[49],"use":[51],"indirect":[52],"representations":[53],"actual":[55,108],"user":[56],"behaviour":[57],"complex":[59],"modelling":[60],"techniques,":[61],"leads":[63],"a":[65,85,115,124,146,178],"higher":[66],"false":[67],"positive":[68],"rate":[69,181],"(FPR)":[70],"longer":[72],"time,":[74],"them":[77],"unsuitable":[78],"real":[80,198],"time":[81,199],"use.":[82,200],"There":[83],"is":[84,103],"need":[86],"simple,":[88],"efficient":[89],"adaptable":[91,162],"asymmetric":[95],"attacks.":[97],"In":[98,149],"this":[99],"work,":[100],"attempt":[102],"made":[104],"model":[106,152],"the":[107,137,151,165,190],"behavioural":[109],"dynamics":[110],"users":[113],"simple":[116],"annotated":[117],"Probabilistic":[118],"Timed":[119],"Automata":[120],"(PTA)":[121],"along":[122],"suspicion":[125],"scoring":[126],"mechanism":[127,139],"differentiating":[129],"between":[130],"malicious":[133],"users.":[134],"This":[135],"allows":[136],"be":[141],"fast":[143],"have":[145],"low":[147,183],"FPR.":[148],"addition,":[150],"can":[153],"incrementally":[154],"learn":[155],"from":[156],"run-time":[157],"traces,":[158],"it":[161,195],"reduces":[164],"FPR":[166,184],"further.":[167],"Experiments":[168],"on":[169],"public":[170],"datasets":[171],"reveal":[172],"that":[173],"our":[174],"proposed":[175],"approach":[176],"has":[177],"high":[179],"adds":[186],"negligible":[187],"overhead":[188],"server,":[192],"ideal":[196]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":11},{"year":2022,"cited_by_count":12},{"year":2021,"cited_by_count":6}],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2025-10-10T00:00:00"}