{"id":"https://openalex.org/W4312766516","doi":"https://doi.org/10.1109/dsc55868.2022.00034","title":"Light-weight Unsupervised Anomaly Detection for Encrypted Malware Traffic","display_name":"Light-weight Unsupervised Anomaly Detection for Encrypted Malware Traffic","publication_year":2022,"publication_date":"2022-07-01","ids":{"openalex":"https://openalex.org/W4312766516","doi":"https://doi.org/10.1109/dsc55868.2022.00034"},"language":"en","primary_location":{"id":"doi:10.1109/dsc55868.2022.00034","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dsc55868.2022.00034","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 7th IEEE International Conference on Data Science in Cyberspace (DSC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5000944856","display_name":"Shangbin Han","orcid":"https://orcid.org/0000-0002-1976-7856"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shangbin Han","raw_affiliation_strings":["Beihang University,School of Cyber Science and Technology,Beijing,China","School of Cyber Science and Technology, Beihang University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University,School of Cyber Science and Technology,Beijing,China","institution_ids":["https://openalex.org/I82880672"]},{"raw_affiliation_string":"School of Cyber Science and Technology, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022955566","display_name":"Qianhong Wu","orcid":"https://orcid.org/0000-0002-6407-4194"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qianhong Wu","raw_affiliation_strings":["Beihang University,School of Cyber Science and Technology,Beijing,China","School of Cyber Science and Technology, Beihang University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University,School of Cyber Science and Technology,Beijing,China","institution_ids":["https://openalex.org/I82880672"]},{"raw_affiliation_string":"School of Cyber Science and Technology, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100399382","display_name":"Han Zhang","orcid":"https://orcid.org/0000-0003-4429-9959"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Han Zhang","raw_affiliation_strings":["Tsinghua University,INSC&BNRist,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,INSC&BNRist,Beijing,China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5111808632","display_name":"Bo Qin","orcid":"https://orcid.org/0000-0001-6015-7788"},"institutions":[{"id":"https://openalex.org/I78988378","display_name":"Renmin University of China","ror":"https://ror.org/041pakw92","country_code":"CN","type":"education","lineage":["https://openalex.org/I78988378"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bo Qin","raw_affiliation_strings":["Renmin University of China,School of Information,Beijing,China","School of Information, Renmin University of China, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Renmin University of China,School of Information,Beijing,China","institution_ids":["https://openalex.org/I78988378"]},{"raw_affiliation_string":"School of Information, Renmin University of China, Beijing, China","institution_ids":["https://openalex.org/I78988378"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.6176,"has_fulltext":false,"cited_by_count":7,"citation_normalized_percentile":{"value":0.83671596,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"206","last_page":"213"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.9382611513137817},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7851821780204773},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7385040521621704},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.7006420493125916},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.676340639591217},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.6568089723587036},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.5841451287269592},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5295042991638184},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5032669901847839},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4926353096961975},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.4570562541484833},{"id":"https://openalex.org/keywords/supervised-learning","display_name":"Supervised learning","score":0.4484522342681885},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3847963511943817},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.19088482856750488},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.18576335906982422}],"concepts":[{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.9382611513137817},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7851821780204773},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7385040521621704},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.7006420493125916},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.676340639591217},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.6568089723587036},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.5841451287269592},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5295042991638184},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5032669901847839},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4926353096961975},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4570562541484833},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.4484522342681885},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3847963511943817},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.19088482856750488},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.18576335906982422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/dsc55868.2022.00034","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dsc55868.2022.00034","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 7th IEEE International Conference on Data Science in Cyberspace (DSC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W40890042","https://openalex.org/W1522301498","https://openalex.org/W2101234009","https://openalex.org/W2523246573","https://openalex.org/W2606697812","https://openalex.org/W2743556905","https://openalex.org/W2909431601","https://openalex.org/W2912711574","https://openalex.org/W2912856897","https://openalex.org/W2919493784","https://openalex.org/W2928842143","https://openalex.org/W2952956474","https://openalex.org/W2963197901","https://openalex.org/W2963467671","https://openalex.org/W2964219393","https://openalex.org/W2966906412","https://openalex.org/W2974442408","https://openalex.org/W2982853315","https://openalex.org/W2990235422","https://openalex.org/W2996798774","https://openalex.org/W2999613521","https://openalex.org/W3006050125","https://openalex.org/W3009850146","https://openalex.org/W3027247563","https://openalex.org/W3039412500","https://openalex.org/W3048465885","https://openalex.org/W3048779965","https://openalex.org/W3091867980","https://openalex.org/W3167885837","https://openalex.org/W3176096468","https://openalex.org/W3197830040","https://openalex.org/W4200411194","https://openalex.org/W4205751541","https://openalex.org/W4213137798","https://openalex.org/W4253269957","https://openalex.org/W6631190155","https://openalex.org/W6675354045","https://openalex.org/W6727249380","https://openalex.org/W6768458705","https://openalex.org/W6800519660"],"related_works":["https://openalex.org/W2806873178","https://openalex.org/W2770818364","https://openalex.org/W2965146396","https://openalex.org/W1586252162","https://openalex.org/W3148060700","https://openalex.org/W3080681248","https://openalex.org/W4376646226","https://openalex.org/W3047177827","https://openalex.org/W4287685660","https://openalex.org/W2057778272"],"abstract_inverted_index":{"Users":[0],"and":[1,20,41,101],"businesses":[2],"in":[3,73,78],"the":[4,55,58,90,103,113,118,124,130,150],"network":[5],"frequently":[6],"suffer":[7],"from":[8],"attacks":[9],"by":[10],"malware":[11,138],"like":[12],"privacy":[13],"breach.":[14],"While":[15],"encrypted":[16,120,137],"traffic":[17,139],"protects":[18],"users":[19],"businesses,":[21],"it":[22],"also":[23],"provides":[24],"convenience":[25],"for":[26,44,93],"attackers":[27],"to":[28,71,96,107],"avoid":[29],"detection.":[30],"Existing":[31],"anomaly":[32,85,132],"detection":[33,86,133],"systems":[34],"use":[35,117],"supervised":[36,158],"learning":[37,159],"with":[38,157],"high-dimension":[39,51],"features":[40,52],"employ":[42],"experts":[43],"labeling.":[45],"However,":[46],"our":[47,127,146],"exploration":[48],"reveals":[49],"that":[50,145],"will":[53],"reduce":[54],"efficiency":[56,100],"of":[57,126,152],"classification":[59],"model.":[60],"Besides,":[61],"their":[62],"training":[63,112],"needs":[64],"abundant":[65],"high-quality":[66],"labels,":[67],"which":[68,88,154],"is":[69,155],"difficult":[70],"obtain":[72],"practice.":[74],"Facing":[75],"these":[76],"challenges,":[77],"this":[79],"paper,":[80],"we":[81,115],"propose":[82],"an":[83],"unsupervised":[84,109],"method,":[87],"adopts":[89],"three-layer":[91],"Autoencoder":[92],"feature":[94],"compression":[95],"improve":[97],"model":[98],"running":[99],"employs":[102],"classical":[104],"Kmeans":[105],"algorithm":[106],"achieve":[108,149],"classification.":[110],"When":[111],"Autoencoder,":[114],"only":[116],"normal":[119],"traffic.":[121],"We":[122],"compare":[123],"performance":[125],"method":[128,147],"against":[129],"state-of-the-art":[131],"algorithms":[134],"using":[135],"open":[136],"data":[140],"set.":[141],"The":[142],"results":[143],"demonstrate":[144],"can":[148],"Fl-measure":[151],"0.95,":[153],"competitive":[156],"algorithms.":[160]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}