{"id":"https://openalex.org/W2147029177","doi":"https://doi.org/10.1109/tnet.2011.2109009","title":"A Network Activity Classification Schema and Its Application to Scan Detection","display_name":"A Network Activity Classification Schema and Its Application to Scan Detection","publication_year":2011,"publication_date":"2011-03-02","ids":{"openalex":"https://openalex.org/W2147029177","doi":"https://doi.org/10.1109/tnet.2011.2109009","mag":"2147029177"},"language":"en","primary_location":{"id":"doi:10.1109/tnet.2011.2109009","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnet.2011.2109009","pdf_url":null,"source":{"id":"https://openalex.org/S62238642","display_name":"IEEE/ACM Transactions on Networking","issn_l":"1063-6692","issn":["1063-6692","1558-2566"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE/ACM Transactions on Networking","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5074507745","display_name":"J. Treurniet","orcid":null},"institutions":[{"id":"https://openalex.org/I1297460800","display_name":"Defence Research and Development Canada","ror":"https://ror.org/00hgy8d33","country_code":"CA","type":"government","lineage":["https://openalex.org/I1297460800","https://openalex.org/I1336338359","https://openalex.org/I2802286613"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Joanne Treurniet","raw_affiliation_strings":["Defence Research and Development Canada, Ottawa, ONT, Canada","Defence Research & Development Canada, Ottawa, ON, Canada#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Defence Research and Development Canada, Ottawa, ONT, Canada","institution_ids":["https://openalex.org/I1297460800"]},{"raw_affiliation_string":"Defence Research & Development Canada, Ottawa, ON, Canada#TAB#","institution_ids":["https://openalex.org/I1297460800"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5074507745"],"corresponding_institution_ids":["https://openalex.org/I1297460800"],"apc_list":null,"apc_paid":null,"fwci":8.4168,"has_fulltext":false,"cited_by_count":40,"citation_normalized_percentile":{"value":0.97404694,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"19","issue":"5","first_page":"1396","last_page":"1404"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8446881771087646},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.6573225259780884},{"id":"https://openalex.org/keywords/schema","display_name":"Schema (genetic algorithms)","score":0.5968310832977295},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5805624723434448},{"id":"https://openalex.org/keywords/session","display_name":"Session (web analytics)","score":0.5523899793624878},{"id":"https://openalex.org/keywords/prioritization","display_name":"Prioritization","score":0.5430060029029846},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5060920119285583},{"id":"https://openalex.org/keywords/visibility","display_name":"Visibility","score":0.4927251636981964},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.477236270904541},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.4529981017112732},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.42853349447250366},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4276151955127716},{"id":"https://openalex.org/keywords/training-set","display_name":"Training set","score":0.4194623827934265},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4062706530094147},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3636435866355896},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.30254262685775757},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.215467631816864}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8446881771087646},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.6573225259780884},{"id":"https://openalex.org/C52146309","wikidata":"https://www.wikidata.org/wiki/Q7431116","display_name":"Schema (genetic algorithms)","level":2,"score":0.5968310832977295},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5805624723434448},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.5523899793624878},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.5430060029029846},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5060920119285583},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.4927251636981964},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.477236270904541},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.4529981017112732},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.42853349447250366},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4276151955127716},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.4194623827934265},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4062706530094147},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3636435866355896},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30254262685775757},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.215467631816864},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnet.2011.2109009","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnet.2011.2109009","pdf_url":null,"source":{"id":"https://openalex.org/S62238642","display_name":"IEEE/ACM Transactions on Networking","issn_l":"1063-6692","issn":["1063-6692","1558-2566"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE/ACM Transactions on Networking","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W1521150922","https://openalex.org/W1523622246","https://openalex.org/W1540641082","https://openalex.org/W1559528794","https://openalex.org/W1649901946","https://openalex.org/W1674145689","https://openalex.org/W1744212210","https://openalex.org/W1860995734","https://openalex.org/W1920802909","https://openalex.org/W1988918299","https://openalex.org/W2009250465","https://openalex.org/W2011628134","https://openalex.org/W2081357650","https://openalex.org/W2096030967","https://openalex.org/W2108303927","https://openalex.org/W2109033797","https://openalex.org/W2109599309","https://openalex.org/W2109807070","https://openalex.org/W2128346726","https://openalex.org/W2130430857","https://openalex.org/W2158060559","https://openalex.org/W2168938675","https://openalex.org/W2186449981","https://openalex.org/W2222268126","https://openalex.org/W2498461899","https://openalex.org/W4230038347","https://openalex.org/W4236546623","https://openalex.org/W4239152584","https://openalex.org/W6633446064","https://openalex.org/W6637673871"],"related_works":["https://openalex.org/W2392812199","https://openalex.org/W4200176076","https://openalex.org/W598185802","https://openalex.org/W2506292322","https://openalex.org/W2355516524","https://openalex.org/W2361471170","https://openalex.org/W2025616642","https://openalex.org/W1954972543","https://openalex.org/W2954738200","https://openalex.org/W4226107239"],"abstract_inverted_index":{"Internet":[0,55,181],"traffic":[1,182],"is":[2,24,31,47,133,158],"neither":[3],"well-behaved":[4],"nor":[5],"well-understood,":[6],"which":[7],"makes":[8],"it":[9],"difficult":[10],"to":[11,167,189,191],"detect":[12],"malicious":[13],"activities":[14,72,203],"such":[15],"as":[16,108],"scanning.":[17],"A":[18],"large":[19,126],"portion":[20],"of":[21,25,54,62,65,84,97,128,150,174,201],"scanning":[22],"activity":[23,165],"a":[26,42,93,103,130,142],"slow":[27],"scan":[28,44,109,195],"type":[29,83],"and":[30,71,89,146],"not":[32],"currently":[33],"detectable":[34],"by":[35,75,183],"security":[36],"appliances.":[37],"In":[38,92],"this":[39],"proof-of-concept":[40],"study,":[41],"new":[43],"detection":[45,119],"technique":[46,177],"demonstrated":[48],"that":[49],"also":[50,198],"improves":[51],"our":[52],"understanding":[53],"traffic.":[56],"Sessions":[57],"are":[58,73,137],"created":[59],"using":[60],"models":[61],"the":[63,82,86,90,112,125,148,151,154,192,202,206],"behavior":[64],"packet-level":[66],"data":[67,95,157],"between":[68],"host":[69],"pairs,":[70],"identified":[74,107],"grouping":[76],"sessions":[77],"based":[78,139],"on":[79,140,147,205],"patterns":[80],"in":[81,153,160],"session,":[85],"IP":[87],"addresses,":[88],"ports.":[91],"24-h":[94],"set":[96],"nearly":[98],"10":[99],"million":[100],"incoming":[101],"sessions,":[102],"prodigious":[104],"78%":[105],"were":[106,115],"probes.":[110],"Of":[111],"scans,":[113,129],"80%":[114],"slower":[116],"than":[117],"basic":[118],"methods":[120],"can":[121],"identify.":[122],"To":[123],"manage":[124],"volume":[127],"prioritization":[131],"method":[132],"introduced":[134],"wherein":[135],"scans":[136],"ranked":[138],"whether":[141],"response":[143],"was":[144],"made":[145],"periodicity":[149],"probes":[152],"scan.":[155],"The":[156],"stored":[159],"an":[161],"efficient":[162],"manner,":[163],"allowing":[164],"information":[166],"be":[168],"retained":[169],"for":[170],"very":[171],"long":[172],"periods":[173],"time.":[175],"This":[176],"provides":[178],"insight":[179],"into":[180],"classifying":[184],"known":[185],"activities,":[186],"giving":[187],"visibility":[188],"threats":[190],"network":[193],"through":[194],"detection,":[196],"while":[197],"extending":[199],"awareness":[200],"occurring":[204],"network.":[207]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":4},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":8},{"year":2013,"cited_by_count":9},{"year":2012,"cited_by_count":4}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}