{"id":"https://openalex.org/W4415125598","doi":"https://doi.org/10.1109/tifs.2025.3620640","title":"SnifferDog: Comprehensively Learning Heterogeneous Features of Network Traffic to Identify Malicious Flows","display_name":"SnifferDog: Comprehensively Learning Heterogeneous Features of Network Traffic to Identify Malicious Flows","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4415125598","doi":"https://doi.org/10.1109/tifs.2025.3620640"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3620640","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3620640","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Xi Luo","orcid":"https://orcid.org/0009-0008-8991-0153"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xi Luo","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0008-8991-0153","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100411650","display_name":"Lihua Yin","orcid":"https://orcid.org/0000-0001-8829-4442"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lihua Yin","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-8829-4442","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067387192","display_name":"Hongyu Yang","orcid":"https://orcid.org/0009-0006-0719-8605"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongyu Yang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0006-0719-8605","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000077857","display_name":"Zeyan Liu","orcid":"https://orcid.org/0000-0001-9237-7603"},"institutions":[{"id":"https://openalex.org/I146416000","display_name":"University of Kansas","ror":"https://ror.org/001tmjg57","country_code":"US","type":"education","lineage":["https://openalex.org/I146416000"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zeyan Liu","raw_affiliation_strings":["Department of EECS and the Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA","Department of EECS and Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of EECS and the Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA","institution_ids":["https://openalex.org/I146416000"]},{"raw_affiliation_string":"Department of EECS and Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA","institution_ids":["https://openalex.org/I146416000"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Weizhe Chen","orcid":"https://orcid.org/0009-0009-5578-7350"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weizhe Chen","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0009-5578-7350","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101824334","display_name":"Shijie Jia","orcid":"https://orcid.org/0000-0002-4262-9478"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4391768012","display_name":"State Key Laboratory of Information Security","ror":"https://ror.org/012cr4033","country_code":null,"type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404","https://openalex.org/I4391768012"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shijie Jia","raw_affiliation_strings":["State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, State Key Laboratory of Information Security, Chinese Academy of Sciences, China"],"raw_orcid":"https://orcid.org/0000-0002-4262-9478","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]},{"raw_affiliation_string":"Institute of Information Engineering, State Key Laboratory of Information Security, Chinese Academy of Sciences, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366","https://openalex.org/I4391768012"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052233895","display_name":"Bo Luo","orcid":"https://orcid.org/0000-0001-8196-2436"},"institutions":[{"id":"https://openalex.org/I146416000","display_name":"University of Kansas","ror":"https://ror.org/001tmjg57","country_code":"US","type":"education","lineage":["https://openalex.org/I146416000"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bo Luo","raw_affiliation_strings":["Department of EECS and the Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA","Department of EECS and Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA"],"raw_orcid":"https://orcid.org/0000-0001-8196-2436","affiliations":[{"raw_affiliation_string":"Department of EECS and the Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA","institution_ids":["https://openalex.org/I146416000"]},{"raw_affiliation_string":"Department of EECS and Institute of Information Sciences, The University of Kansas, Lawrence, KS, USA","institution_ids":["https://openalex.org/I146416000"]}]},{"author_position":"last","author":{"id":null,"display_name":"Hongli Xiang","orcid":"https://orcid.org/0009-0001-7502-0511"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongli Xiang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0001-7502-0511","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.30501461,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":null,"first_page":"11684","last_page":"11699"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9948999881744385,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9939000010490417,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.7251999974250793},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6909999847412109},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6610000133514404},{"id":"https://openalex.org/keywords/relation","display_name":"Relation (database)","score":0.6399000287055969},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.5842999815940857},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5602999925613403},{"id":"https://openalex.org/keywords/flow-network","display_name":"Flow network","score":0.46799999475479126},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4189000129699707}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8967000246047974},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.7251999974250793},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6909999847412109},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6610000133514404},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.6399000287055969},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.5842999815940857},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5602999925613403},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.46799999475479126},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4189000129699707},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.414000004529953},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.41040000319480896},{"id":"https://openalex.org/C38349280","wikidata":"https://www.wikidata.org/wiki/Q1434290","display_name":"Flow (mathematics)","level":2,"score":0.38510000705718994},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3804999887943268},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.37310001254081726},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.37220001220703125},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3458000123500824},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.30239999294281006},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.28929999470710754},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.28529998660087585},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.27799999713897705},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2775999903678894},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2775000035762787},{"id":"https://openalex.org/C2779136372","wikidata":"https://www.wikidata.org/wiki/Q10283002","display_name":"Information flow","level":2,"score":0.271699994802475},{"id":"https://openalex.org/C54108766","wikidata":"https://www.wikidata.org/wiki/Q391064","display_name":"Packet loss","level":3,"score":0.26440000534057617},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.25940001010894775}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3620640","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3620640","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4586726719","display_name":null,"funder_award_id":"2022YFB3104100","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":54,"referenced_works":["https://openalex.org/W987648574","https://openalex.org/W1514171102","https://openalex.org/W2031163547","https://openalex.org/W2067792375","https://openalex.org/W2078408680","https://openalex.org/W2098897917","https://openalex.org/W2127404964","https://openalex.org/W2267339884","https://openalex.org/W2296509296","https://openalex.org/W2297844173","https://openalex.org/W2326324325","https://openalex.org/W2743289140","https://openalex.org/W2772317693","https://openalex.org/W2789828921","https://openalex.org/W2840169530","https://openalex.org/W2898726669","https://openalex.org/W2919115771","https://openalex.org/W2946445608","https://openalex.org/W2982682021","https://openalex.org/W3001675796","https://openalex.org/W3014732532","https://openalex.org/W3021219025","https://openalex.org/W3033696346","https://openalex.org/W3082191933","https://openalex.org/W3086115535","https://openalex.org/W3096966075","https://openalex.org/W3113693716","https://openalex.org/W3118162870","https://openalex.org/W3121022046","https://openalex.org/W3126140213","https://openalex.org/W3128341305","https://openalex.org/W3136205675","https://openalex.org/W3136284412","https://openalex.org/W3162956350","https://openalex.org/W3164796711","https://openalex.org/W3172092329","https://openalex.org/W3195954353","https://openalex.org/W3208773001","https://openalex.org/W4206209637","https://openalex.org/W4206397888","https://openalex.org/W4214699222","https://openalex.org/W4224211479","https://openalex.org/W4224315052","https://openalex.org/W4226126799","https://openalex.org/W4293197722","https://openalex.org/W4312748334","https://openalex.org/W4324007233","https://openalex.org/W4367047070","https://openalex.org/W4396949749","https://openalex.org/W4399666315","https://openalex.org/W4402264131","https://openalex.org/W4405183428","https://openalex.org/W4408304291","https://openalex.org/W4409886528"],"related_works":[],"abstract_inverted_index":{"Deep":[0],"learning":[1],"has":[2],"recently":[3],"attracted":[4],"significant":[5],"attention":[6,127],"in":[7,35,71,186,201],"the":[8,29,78,140,147],"field":[9],"of":[10,18,31,97,157,195],"network":[11,32,53,189],"intrusion":[12],"detection.":[13],"Despite":[14],"a":[15,51,85,92,98,100,122,125,191],"substantial":[16],"number":[17],"efforts":[19],"have":[20],"been":[21],"made,":[22],"previous":[23],"works":[24],"struggle":[25],"to":[26,83,107,131],"comprehensively":[27],"learn":[28,108],"features":[30,69,116,145],"traffic,":[33],"resulting":[34,151],"inconsistent":[36],"performance":[37],"across":[38,169],"various":[39],"environments":[40,174],"and":[41,63,66,74,80,102,111,124,142,160],"attacks.":[42],"To":[43],"address":[44],"these":[45],"limitation,":[46],"this":[47],"study":[48],"presents":[49],"SnifferDog,":[50],"novel":[52],"attack":[54],"detection":[55,165],"system":[56],"that":[57,137],"takes":[58],"raw":[59],"packets":[60,79],"as":[61,117],"input":[62],"rationally":[64],"extracts":[65],"integrates":[67],"heterogeneous":[68],"involved":[70],"packets,":[72],"flows":[73,81],"topology.":[75],"It":[76],"formats":[77],"concurrently":[82],"achieve":[84],"high-level":[86],"throughout":[87],"for":[88],"feature":[89],"learning.":[90],"Then,":[91],"flow":[93,119,148,152],"pretraining":[94],"model":[95,136],"consisting":[96],"LSTM,":[99],"self-attention":[101],"cross-attention":[103],"layers":[104,128],"is":[105],"developed":[106],"both":[109],"sequential":[110],"nonsequential":[112],"inter":[113],"packet":[114],"relation":[115,144],"initial":[118],"vectors.":[120,149],"Subsequently,":[121],"node-to-node":[123],"node-to-edge":[126],"are":[129],"implemented":[130],"enhance":[132],"an":[133],"inductive":[134],"GNN":[135],"dynamically":[138],"embeds":[139],"flow-to-flow":[141,159],"flow-to-topology":[143,161],"into":[146],"The":[150],"vectors":[153],"involve":[154],"comprehensive":[155],"information":[156],"packet-to-packet,":[158],"relations,":[162],"enabling":[163],"high":[164],"performance.":[166],"In-lab":[167],"experiments":[168],"eight":[170],"datasets":[171],"from":[172],"diverse":[173],"demonstrate":[175],"SnifferDog\u2019s":[176,199],"superior":[177],"effectiveness":[178],"over":[179],"existing":[180],"solutions.":[181],"A":[182],"scalable":[183],"prototype":[184],"deployed":[185],"our":[187],"institute\u2019s":[188],"achieves":[190],"false":[192],"positive":[193],"rate":[194],"only":[196],"0.08%,":[197],"validating":[198],"practicality":[200],"real-world":[202],"scenarios.":[203]},"counts_by_year":[],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-14T00:00:00"}