{"id":"https://openalex.org/W4295789122","doi":"https://doi.org/10.1109/tnse.2022.3206353","title":"MSCA: An Unsupervised Anomaly Detection System for Network Security in Backbone Network","display_name":"MSCA: An Unsupervised Anomaly Detection System for Network Security in Backbone Network","publication_year":2022,"publication_date":"2022-09-14","ids":{"openalex":"https://openalex.org/W4295789122","doi":"https://doi.org/10.1109/tnse.2022.3206353"},"language":"en","primary_location":{"id":"doi:10.1109/tnse.2022.3206353","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2022.3206353","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100727177","display_name":"Yating Liu","orcid":"https://orcid.org/0000-0002-5256-1331"},"institutions":[{"id":"https://openalex.org/I4210114105","display_name":"Tsinghua\u2013Berkeley Shenzhen Institute","ror":"https://ror.org/02hhwwz98","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210114105","https://openalex.org/I95457486","https://openalex.org/I99065089"]},{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yating Liu","raw_affiliation_strings":["Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China","The Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China","institution_ids":["https://openalex.org/I4210114105","https://openalex.org/I99065089"]},{"raw_affiliation_string":"The Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100621681","display_name":"Yuantao Gu","orcid":"https://orcid.org/0000-0002-8427-1021"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuantao Gu","raw_affiliation_strings":["Department of Electronic and Engineering, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-8427-1021","affiliations":[{"raw_affiliation_string":"Department of Electronic and Engineering, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003439795","display_name":"Xinyue Shen","orcid":"https://orcid.org/0000-0001-7760-0897"},"institutions":[{"id":"https://openalex.org/I4210114105","display_name":"Tsinghua\u2013Berkeley Shenzhen Institute","ror":"https://ror.org/02hhwwz98","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210114105","https://openalex.org/I95457486","https://openalex.org/I99065089"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinyue Shen","raw_affiliation_strings":["Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China","institution_ids":["https://openalex.org/I4210114105","https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009239895","display_name":"Qingmin Liao","orcid":"https://orcid.org/0000-0002-7509-3964"},"institutions":[{"id":"https://openalex.org/I4210114105","display_name":"Tsinghua\u2013Berkeley Shenzhen Institute","ror":"https://ror.org/02hhwwz98","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210114105","https://openalex.org/I95457486","https://openalex.org/I99065089"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qingmin Liao","raw_affiliation_strings":["Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-7509-3964","affiliations":[{"raw_affiliation_string":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China","institution_ids":["https://openalex.org/I4210114105","https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101517339","display_name":"Quan Yu","orcid":"https://orcid.org/0000-0002-4486-2070"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Quan Yu","raw_affiliation_strings":["Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-4486-2070","affiliations":[{"raw_affiliation_string":"Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.9964,"has_fulltext":false,"cited_by_count":15,"citation_normalized_percentile":{"value":0.86914503,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"10","issue":"1","first_page":"223","last_page":"238"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7717512845993042},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.7412904500961304},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7201757431030273},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.6792495250701904},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5255022048950195},{"id":"https://openalex.org/keywords/association-rule-learning","display_name":"Association rule learning","score":0.4778268337249756},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.463156133890152},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.41252878308296204},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4112267792224884},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.35571762919425964}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7717512845993042},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.7412904500961304},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7201757431030273},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6792495250701904},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5255022048950195},{"id":"https://openalex.org/C193524817","wikidata":"https://www.wikidata.org/wiki/Q386780","display_name":"Association rule learning","level":2,"score":0.4778268337249756},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.463156133890152},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.41252878308296204},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4112267792224884},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.35571762919425964},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnse.2022.3206353","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2022.3206353","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.7099999785423279,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G6788006064","display_name":"\u57fa\u4e8e\u5b50\u7a7a\u95f4\u805a\u7c7b\u7684\u9c81\u68d2\u9ad8\u65af\u6df7\u5408\u6a21\u578b\u53c2\u6570\u4f30\u8ba1\u7814\u7a76","funder_award_id":"61971266","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322392","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W1561843061","https://openalex.org/W1603862517","https://openalex.org/W1605113984","https://openalex.org/W1967376128","https://openalex.org/W1982304603","https://openalex.org/W1995484833","https://openalex.org/W2038536589","https://openalex.org/W2039207705","https://openalex.org/W2040333627","https://openalex.org/W2055434856","https://openalex.org/W2059343208","https://openalex.org/W2065202763","https://openalex.org/W2065643612","https://openalex.org/W2086540457","https://openalex.org/W2102481563","https://openalex.org/W2118931532","https://openalex.org/W2127084909","https://openalex.org/W2141177935","https://openalex.org/W2166858086","https://openalex.org/W2293275308","https://openalex.org/W2328654303","https://openalex.org/W2419565365","https://openalex.org/W2547414809","https://openalex.org/W2616698631","https://openalex.org/W2734557681","https://openalex.org/W2741396778","https://openalex.org/W2884561390","https://openalex.org/W2887511144","https://openalex.org/W2898491100","https://openalex.org/W2971046657","https://openalex.org/W3011010806","https://openalex.org/W3039673966","https://openalex.org/W3084688615","https://openalex.org/W3087852527","https://openalex.org/W3093562373","https://openalex.org/W3121723140","https://openalex.org/W3138598418","https://openalex.org/W4205619620","https://openalex.org/W6633310491","https://openalex.org/W6636057541","https://openalex.org/W6657020421","https://openalex.org/W6668990524"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2667207928","https://openalex.org/W2912112202","https://openalex.org/W4377864969","https://openalex.org/W3120251014"],"abstract_inverted_index":{"Anomaly":[0],"detection":[1,75,169,175,190],"is":[2,34,55,122,148],"a":[3,30,38,72],"crucial":[4],"topic":[5],"in":[6,25,187],"network":[7],"security":[8],"which":[9,33,79],"refers":[10],"to":[11,36,59,90,127,151],"automatically":[12],"mining":[13,89,147],"known":[14,104],"and":[15,62,86,94,98,105,125,132,141,157,185,194,198],"unknown":[16,106],"attacks":[17],"or":[18,113],"threats.":[19],"Many":[20],"detectors":[21],"have":[22],"been":[23],"proposed":[24,168],"the":[26,60,136,153,167],"last":[27],"decade.":[28],"Nonetheless,":[29],"practical":[31],"solution,":[32],"able":[35],"provide":[37],"high":[39],"True":[40],"Positive":[41,48],"Rate":[42,49],"(TPR)":[43],"with":[44],"an":[45,179],"acceptable":[46],"False":[47],"(FPR)":[50],"without":[51,109],"any":[52,110],"prior":[53,114],"information,":[54],"still":[56],"challenging":[57],"due":[58],"complexity":[61],"variability":[63],"of":[64,138,181,196],"anomaly":[65],"pattern.":[66],"In":[67],"this":[68],"article,":[69],"we":[70],"propose":[71],"novel":[73],"unsupervised":[74,84,174],"system":[76],"called":[77],"MSCA":[78],"applies":[80],"multiple":[81],"sketches,":[82,131],"K-means++":[83],"clustering,":[85],"association":[87,145,158],"rule":[88,146],"detect":[91],"traffic":[92,107,112,120,128],"anomalies":[93,108],"analyze":[95],"anomalous":[96,154],"features":[97],"correlations.":[99],"It":[100,177],"can":[101],"blindly":[102],"identify":[103],"labeled":[111],"signatures":[115],"about":[116],"data":[117,121],"distribution.":[118],"Rich":[119],"first":[123],"aggregated":[124],"compacted":[126],"flows":[129],"by":[130,135],"further":[133],"detected":[134],"combination":[137],"clustering":[139],"algorithm":[140],"voting":[142],"strategy.":[143],"Then":[144],"finally":[149],"utilized":[150],"find":[152],"frequent":[155],"item-sets":[156],"rules.":[159],"Numerical":[160],"experiments":[161],"on":[162],"MAWILAB":[163],"datasets":[164],"demonstrate":[165],"that":[166],"method":[170],"outperforms":[171],"other":[172],"reference":[173],"methods.":[176],"achieves":[178],"accuracy":[180],"99.86%,":[182],"99.97%,":[183],"97.08%,":[184],"95.19%":[186],"overall":[188],"four":[189],"types":[191],"including":[192],"IP":[193],"port":[195],"source":[197],"destination.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":4}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}