{"id":"https://openalex.org/W3120240376","doi":"https://doi.org/10.1109/tkde.2021.3050400","title":"An Online Offline Framework for Anomaly Scoring and Detecting New Traffic in Network Streams","display_name":"An Online Offline Framework for Anomaly Scoring and Detecting New Traffic in Network Streams","publication_year":2021,"publication_date":"2021-01-13","ids":{"openalex":"https://openalex.org/W3120240376","doi":"https://doi.org/10.1109/tkde.2021.3050400","mag":"3120240376"},"language":"en","primary_location":{"id":"doi:10.1109/tkde.2021.3050400","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tkde.2021.3050400","pdf_url":null,"source":{"id":"https://openalex.org/S30698027","display_name":"IEEE Transactions on Knowledge and Data Engineering","issn_l":"1041-4347","issn":["1041-4347","1558-2191","2326-3865"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Knowledge and Data Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5074658627","display_name":"Murugaraj Odiathevar","orcid":"https://orcid.org/0000-0001-9397-8478"},"institutions":[{"id":"https://openalex.org/I41156924","display_name":"Victoria University of Wellington","ror":"https://ror.org/0040r6f76","country_code":"NZ","type":"education","lineage":["https://openalex.org/I41156924"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Murugaraj Odiathevar","raw_affiliation_strings":["School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand"],"raw_orcid":"https://orcid.org/0000-0001-9397-8478","affiliations":[{"raw_affiliation_string":"School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand","institution_ids":["https://openalex.org/I41156924"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036767777","display_name":"Winston K.G. Seah","orcid":"https://orcid.org/0000-0001-7147-5167"},"institutions":[{"id":"https://openalex.org/I41156924","display_name":"Victoria University of Wellington","ror":"https://ror.org/0040r6f76","country_code":"NZ","type":"education","lineage":["https://openalex.org/I41156924"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Winston K.G. Seah","raw_affiliation_strings":["School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand"],"raw_orcid":"https://orcid.org/0000-0001-7147-5167","affiliations":[{"raw_affiliation_string":"School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand","institution_ids":["https://openalex.org/I41156924"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020402037","display_name":"Marcus Frean","orcid":"https://orcid.org/0000-0001-5840-8760"},"institutions":[{"id":"https://openalex.org/I41156924","display_name":"Victoria University of Wellington","ror":"https://ror.org/0040r6f76","country_code":"NZ","type":"education","lineage":["https://openalex.org/I41156924"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Marcus Frean","raw_affiliation_strings":["School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand"],"raw_orcid":"https://orcid.org/0000-0001-5840-8760","affiliations":[{"raw_affiliation_string":"School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand","institution_ids":["https://openalex.org/I41156924"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033594570","display_name":"Alvin Valera","orcid":"https://orcid.org/0000-0001-5837-1451"},"institutions":[{"id":"https://openalex.org/I41156924","display_name":"Victoria University of Wellington","ror":"https://ror.org/0040r6f76","country_code":"NZ","type":"education","lineage":["https://openalex.org/I41156924"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Alvin Valera","raw_affiliation_strings":["School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand"],"raw_orcid":"https://orcid.org/0000-0001-5837-1451","affiliations":[{"raw_affiliation_string":"School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand","institution_ids":["https://openalex.org/I41156924"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I41156924"],"apc_list":null,"apc_paid":null,"fwci":2.5983,"has_fulltext":false,"cited_by_count":26,"citation_normalized_percentile":{"value":0.8913986,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":"34","issue":"11","first_page":"5166","last_page":"5181"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8656585216522217},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7423323392868042},{"id":"https://openalex.org/keywords/outlier","display_name":"Outlier","score":0.6281290054321289},{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.5876179933547974},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5747104287147522},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5676143169403076},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5531295537948608},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"Data stream mining","score":0.5143402814865112},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.4873121678829193},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.4105123281478882}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8656585216522217},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7423323392868042},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.6281290054321289},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.5876179933547974},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5747104287147522},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5676143169403076},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5531295537948608},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.5143402814865112},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4873121678829193},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.4105123281478882},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tkde.2021.3050400","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tkde.2021.3050400","pdf_url":null,"source":{"id":"https://openalex.org/S30698027","display_name":"IEEE Transactions on Knowledge and Data Engineering","issn_l":"1041-4347","issn":["1041-4347","1558-2191","2326-3865"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Knowledge and Data Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":74,"referenced_works":["https://openalex.org/W6908809","https://openalex.org/W1524715972","https://openalex.org/W1648214972","https://openalex.org/W1869928576","https://openalex.org/W1959608418","https://openalex.org/W1970088130","https://openalex.org/W1972978214","https://openalex.org/W1974828111","https://openalex.org/W1984073246","https://openalex.org/W1985987493","https://openalex.org/W1990680872","https://openalex.org/W2025768430","https://openalex.org/W2077488147","https://openalex.org/W2095705004","https://openalex.org/W2111406701","https://openalex.org/W2118020555","https://openalex.org/W2118023920","https://openalex.org/W2132870739","https://openalex.org/W2144200194","https://openalex.org/W2144936818","https://openalex.org/W2157578436","https://openalex.org/W2276629685","https://openalex.org/W2290151134","https://openalex.org/W2296509296","https://openalex.org/W2334853001","https://openalex.org/W2337344967","https://openalex.org/W2340896621","https://openalex.org/W2346714907","https://openalex.org/W2426032775","https://openalex.org/W2500517591","https://openalex.org/W2509223312","https://openalex.org/W2516866958","https://openalex.org/W2526794381","https://openalex.org/W2531160404","https://openalex.org/W2548564261","https://openalex.org/W2548748044","https://openalex.org/W2555676925","https://openalex.org/W2565148042","https://openalex.org/W2736723828","https://openalex.org/W2737540862","https://openalex.org/W2770458211","https://openalex.org/W2775542991","https://openalex.org/W2785362611","https://openalex.org/W2798336999","https://openalex.org/W2800094109","https://openalex.org/W2808472075","https://openalex.org/W2808940893","https://openalex.org/W2809400334","https://openalex.org/W2809684781","https://openalex.org/W2885070483","https://openalex.org/W2886020981","https://openalex.org/W2890235427","https://openalex.org/W2901321248","https://openalex.org/W2902061487","https://openalex.org/W2907421153","https://openalex.org/W2912944782","https://openalex.org/W2947340273","https://openalex.org/W2963546708","https://openalex.org/W2969495950","https://openalex.org/W2975416010","https://openalex.org/W2997574889","https://openalex.org/W3098957257","https://openalex.org/W4235451434","https://openalex.org/W4254182148","https://openalex.org/W4254420769","https://openalex.org/W6600284362","https://openalex.org/W6631943919","https://openalex.org/W6640963894","https://openalex.org/W6674330103","https://openalex.org/W6675186613","https://openalex.org/W6681096077","https://openalex.org/W6755655770","https://openalex.org/W6888835487","https://openalex.org/W7073807420"],"related_works":["https://openalex.org/W2499612753","https://openalex.org/W3111802945","https://openalex.org/W2946096271","https://openalex.org/W2295423552","https://openalex.org/W3107369729","https://openalex.org/W2998615029","https://openalex.org/W3190734578","https://openalex.org/W1595351371","https://openalex.org/W3121032028","https://openalex.org/W91065195"],"abstract_inverted_index":{"Network":[0],"data":[1,26,60,123],"constantly":[2],"evolves":[3],"with":[4,24,137],"new":[5,30,76,138,169],"network":[6],"applications":[7],"and":[8,44,68,78,111,134,148,171,178,186],"protocols.":[9],"There":[10],"is":[11,153],"a":[12,84,92,113,145],"need":[13,40],"for":[14,41,115,124],"robust":[15],"techniques":[16],"to":[17,63,86,121,155,167],"detect":[18,56,168],"anomalous":[19],"behaviour.":[20],"Offline":[21],"models":[22,54,177,198],"trained":[23],"static":[25],"lose":[27],"validity":[28],"when":[29],"variants":[31],"of":[32,66,98,108],"traffic":[33,77,110,170],"emerge.":[34],"They":[35],"require":[36],"retraining":[37],"but":[38],"the":[39,64,96,149,163,184],"ground":[42],"truth":[43],"lengthy":[45],"training":[46],"times":[47],"make":[48],"this":[49],"task":[50],"challenging.":[51],"Meanwhile,":[52],"online":[53,117,127,197],"which":[55],"outliers":[57],"in":[58,144,199],"streaming":[59],"are":[61,142],"susceptible":[62],"curse":[65],"dimensionality":[67],"natural":[69],"variability.":[70],"Today\u2019s":[71],"anomalies":[72],"may":[73],"be":[74],"tomorrow\u2019s":[75],"existing":[79],"methods":[80,182],"do":[81],"not":[82],"provide":[83],"way":[85],"differentiate":[87],"between":[88],"them.":[89],"We":[90,159],"propose":[91],"framework":[93,190],"that":[94],"makes":[95],"most":[97],"both":[99],"approaches:":[100],"an":[101,116],"offline":[102,195],"deep":[103,175],"learning":[104,176],"model":[105,120,128],"extracts":[106],"features":[107],"normal":[109],"provides":[112],"bias":[114],"outlier":[118,180],"detection":[119,181],"select":[122],"training.":[125],"The":[126,189],"retains":[129],"its":[130],"previously":[131],"learnt":[132],"knowledge":[133],"retrains":[135],"itself":[136],"data.":[139],"Online":[140],"thresholds":[141],"updated":[143],"drifting":[146],"manner":[147],"Mann-Whitney":[150],"U":[151],"test":[152],"incorporated":[154],"prevent":[156],"inaccurate":[157],"updates.":[158],"perform":[160],"analysis":[161],"on":[162,183],"scores,":[164],"develop":[165],"heuristics":[166],"evaluate":[172],"using":[173],"three":[174],"four":[179],"UNSW-NB15":[185],"CTU-13":[187],"datasets.":[188],"improves":[191],"upon":[192],"any":[193],"individual":[194],"or":[196],"isolation.":[200]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":3}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}