{"id":"https://openalex.org/W2079512170","doi":"https://doi.org/10.1109/infcom.2012.6195581","title":"Traffic anomaly detection based on the IP size distribution","display_name":"Traffic anomaly detection based on the IP size distribution","publication_year":2012,"publication_date":"2012-03-01","ids":{"openalex":"https://openalex.org/W2079512170","doi":"https://doi.org/10.1109/infcom.2012.6195581","mag":"2079512170"},"language":"en","primary_location":{"id":"doi:10.1109/infcom.2012.6195581","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infcom.2012.6195581","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2012 Proceedings IEEE INFOCOM","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5024590241","display_name":"Fabio Soldo","orcid":null},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Fabio Soldo","raw_affiliation_strings":["Google, Inc., USA","Google, Inc, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google, Inc., USA","institution_ids":["https://openalex.org/I1291425158"]},{"raw_affiliation_string":"Google, Inc, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030261484","display_name":"Ahmed Metwally","orcid":"https://orcid.org/0000-0002-1084-8078"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ahmed Metwally","raw_affiliation_strings":["Google, Inc., USA","Google, Inc, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google, Inc., USA","institution_ids":["https://openalex.org/I1291425158"]},{"raw_affiliation_string":"Google, Inc, USA","institution_ids":["https://openalex.org/I1291425158"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I1291425158"],"apc_list":null,"apc_paid":null,"fwci":1.4148,"has_fulltext":false,"cited_by_count":19,"citation_normalized_percentile":{"value":0.81250943,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7952383756637573},{"id":"https://openalex.org/keywords/dynamic-host-configuration-protocol","display_name":"Dynamic Host Configuration Protocol","score":0.7939188480377197},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7014099359512329},{"id":"https://openalex.org/keywords/profiling","display_name":"Profiling (computer programming)","score":0.6466231942176819},{"id":"https://openalex.org/keywords/aggregate","display_name":"Aggregate (composite)","score":0.5140687227249146},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5064142942428589},{"id":"https://openalex.org/keywords/ip-address","display_name":"Ip address","score":0.47919973731040955},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.330687940120697},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3234063982963562},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.2596641182899475},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.08983814716339111}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7952383756637573},{"id":"https://openalex.org/C26876914","wikidata":"https://www.wikidata.org/wiki/Q11166","display_name":"Dynamic Host Configuration Protocol","level":3,"score":0.7939188480377197},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7014099359512329},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.6466231942176819},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.5140687227249146},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5064142942428589},{"id":"https://openalex.org/C2985371682","wikidata":"https://www.wikidata.org/wiki/Q11135","display_name":"Ip address","level":2,"score":0.47919973731040955},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.330687940120697},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3234063982963562},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2596641182899475},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.08983814716339111},{"id":"https://openalex.org/C159985019","wikidata":"https://www.wikidata.org/wiki/Q181790","display_name":"Composite material","level":1,"score":0.0},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/infcom.2012.6195581","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infcom.2012.6195581","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2012 Proceedings IEEE INFOCOM","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.674.5150","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.674.5150","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/37739.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7099999785423279}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W6401868","https://openalex.org/W123401891","https://openalex.org/W190437827","https://openalex.org/W623251121","https://openalex.org/W1218993402","https://openalex.org/W1539523973","https://openalex.org/W2001377641","https://openalex.org/W2020275022","https://openalex.org/W2096273775","https://openalex.org/W2099194763","https://openalex.org/W2119714163","https://openalex.org/W2122646361","https://openalex.org/W2141177935","https://openalex.org/W2146950091","https://openalex.org/W2150010379","https://openalex.org/W2154525144","https://openalex.org/W2158441306","https://openalex.org/W2173213060","https://openalex.org/W3162333642","https://openalex.org/W6600244090","https://openalex.org/W6604917381","https://openalex.org/W6607693206","https://openalex.org/W6627876637","https://openalex.org/W6632452292","https://openalex.org/W6683036876"],"related_works":["https://openalex.org/W2348743152","https://openalex.org/W2387410074","https://openalex.org/W2388824599","https://openalex.org/W2078208973","https://openalex.org/W149667787","https://openalex.org/W4243112758","https://openalex.org/W2357026184","https://openalex.org/W2355302603","https://openalex.org/W2385654542","https://openalex.org/W2350706358"],"abstract_inverted_index":{"In":[0],"this":[1],"paper":[2],"we":[3],"present":[4],"a":[5,37,53,74,103],"data-driven":[6],"framework":[7,55],"for":[8,80,133],"detecting":[9],"machine-generated":[10,33,97],"traffic":[11,34],"based":[12,101],"on":[13,73,102],"the":[14,18,23,46],"IP":[15,48],"size,":[16],"i.e.,":[17],"number":[19],"of":[20,106,149],"users":[21],"sharing":[22],"same":[24],"source":[25],"IP.":[26],"Our":[27],"main":[28],"observation":[29],"is":[30,100,110,126],"that":[31,56,86],"diverse":[32],"attacks":[35,108],"share":[36],"common":[38],"characteristic:":[39],"they":[40],"induce":[41],"an":[42],"anomalous":[43],"deviation":[44],"from":[45],"expected":[47],"size":[49],"distribution.":[50],"We":[51,69,84],"develop":[52],"principled":[54],"automatically":[57],"detects":[58],"and":[59,66,109,117,125,136],"classifies":[60],"these":[61,107],"deviations":[62],"using":[63],"statistical":[64],"tests":[65],"ensemble":[67],"learning.":[68],"evaluate":[70],"our":[71,87],"approach":[72,88],"massive":[75],"dataset":[76],"collected":[77],"at":[78],"Google":[79],"90":[81],"consecutive":[82],"days.":[83],"argue":[85],"combines":[89],"desirable":[90],"characteristics:":[91],"it":[92,99,121,131,138],"can":[93],"accurately":[94],"detect":[95],"fraudulent":[96],"traffic;":[98],"fundamental":[104],"characteristic":[105],"thus":[111],"robust":[112],"(e.g.,":[113],"to":[114,119,128],"DHCP":[115],"re-assignment)":[116],"hard":[118],"evade;":[120],"has":[122],"low":[123],"complexity":[124],"easy":[127],"parallelize,":[129],"making":[130],"suitable":[132],"large-scale":[134],"detection;":[135],"finally,":[137],"does":[139],"not":[140],"entail":[141],"profiling":[142],"users,":[143],"but":[144],"leverages":[145],"only":[146],"aggregate":[147],"statistics":[148],"network":[150],"traffic.":[151]},"counts_by_year":[{"year":2022,"cited_by_count":2},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":2},{"year":2014,"cited_by_count":3}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}