{"id":"https://openalex.org/W3102937575","doi":"https://doi.org/10.1109/tnsm.2020.3037019","title":"Online Anomaly Detection Leveraging Stream-Based Clustering and Real-Time Telemetry","display_name":"Online Anomaly Detection Leveraging Stream-Based Clustering and Real-Time Telemetry","publication_year":2020,"publication_date":"2020-11-10","ids":{"openalex":"https://openalex.org/W3102937575","doi":"https://doi.org/10.1109/tnsm.2020.3037019","mag":"3102937575"},"language":"en","primary_location":{"id":"doi:10.1109/tnsm.2020.3037019","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2020.3037019","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5033804798","display_name":"Andrian Putina","orcid":"https://orcid.org/0000-0002-8820-8353"},"institutions":[{"id":"https://openalex.org/I12356871","display_name":"T\u00e9l\u00e9com Paris","ror":"https://ror.org/01naq7912","country_code":"FR","type":"education","lineage":["https://openalex.org/I12356871","https://openalex.org/I205703379","https://openalex.org/I4210145102"]}],"countries":["FR"],"is_corresponding":true,"raw_author_name":"Andrian Putina","raw_affiliation_strings":["Telecom Paris, Paris, France"],"affiliations":[{"raw_affiliation_string":"Telecom Paris, Paris, France","institution_ids":["https://openalex.org/I12356871"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052449763","display_name":"Dario Rossi","orcid":"https://orcid.org/0000-0003-3936-8876"},"institutions":[{"id":"https://openalex.org/I4210123571","display_name":"Huawei Technologies (France)","ror":"https://ror.org/02rbzf697","country_code":"FR","type":"company","lineage":["https://openalex.org/I2250955327","https://openalex.org/I4210123571"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Dario Rossi","raw_affiliation_strings":["Huawei Technologies France, Boulogne Billancourt, France"],"affiliations":[{"raw_affiliation_string":"Huawei Technologies France, Boulogne Billancourt, France","institution_ids":["https://openalex.org/I4210123571"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5033804798"],"corresponding_institution_ids":["https://openalex.org/I12356871"],"apc_list":null,"apc_paid":null,"fwci":1.9029,"has_fulltext":false,"cited_by_count":30,"citation_normalized_percentile":{"value":0.89103488,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":"18","issue":"1","first_page":"839","last_page":"854"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8678598403930664},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7902552485466003},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6552073955535889},{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.5006992816925049},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.49330034852027893},{"id":"https://openalex.org/keywords/telemetry","display_name":"Telemetry","score":0.46705615520477295},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.45534855127334595},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.4543137550354004},{"id":"https://openalex.org/keywords/troubleshooting","display_name":"Troubleshooting","score":0.44978344440460205},{"id":"https://openalex.org/keywords/outlier","display_name":"Outlier","score":0.44288331270217896},{"id":"https://openalex.org/keywords/dbscan","display_name":"DBSCAN","score":0.4195399582386017},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.24882283806800842},{"id":"https://openalex.org/keywords/fuzzy-clustering","display_name":"Fuzzy clustering","score":0.16072824597358704},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.14542832970619202},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.11168107390403748}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8678598403930664},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7902552485466003},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6552073955535889},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.5006992816925049},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.49330034852027893},{"id":"https://openalex.org/C183121708","wikidata":"https://www.wikidata.org/wiki/Q209867","display_name":"Telemetry","level":2,"score":0.46705615520477295},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.45534855127334595},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.4543137550354004},{"id":"https://openalex.org/C147494362","wikidata":"https://www.wikidata.org/wiki/Q2078905","display_name":"Troubleshooting","level":2,"score":0.44978344440460205},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.44288331270217896},{"id":"https://openalex.org/C46576248","wikidata":"https://www.wikidata.org/wiki/Q1114630","display_name":"DBSCAN","level":5,"score":0.4195399582386017},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.24882283806800842},{"id":"https://openalex.org/C17212007","wikidata":"https://www.wikidata.org/wiki/Q5511111","display_name":"Fuzzy clustering","level":3,"score":0.16072824597358704},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.14542832970619202},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.11168107390403748},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C104047586","wikidata":"https://www.wikidata.org/wiki/Q5033439","display_name":"Canopy clustering algorithm","level":4,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2020.3037019","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2020.3037019","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6331593186","display_name":null,"funder_award_id":"YBN2018125164","funder_id":"https://openalex.org/F4320322183","funder_display_name":"Huawei Technologies"}],"funders":[{"id":"https://openalex.org/F4320322183","display_name":"Huawei Technologies","ror":"https://ror.org/00cmhce21"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":59,"referenced_works":["https://openalex.org/W42722137","https://openalex.org/W182707955","https://openalex.org/W187043655","https://openalex.org/W1484777458","https://openalex.org/W1504694836","https://openalex.org/W1969609037","https://openalex.org/W1975415766","https://openalex.org/W2020754036","https://openalex.org/W2043409701","https://openalex.org/W2049058890","https://openalex.org/W2061351406","https://openalex.org/W2088241971","https://openalex.org/W2099940443","https://openalex.org/W2101234009","https://openalex.org/W2111817166","https://openalex.org/W2112653086","https://openalex.org/W2116300222","https://openalex.org/W2118020642","https://openalex.org/W2119821739","https://openalex.org/W2125055259","https://openalex.org/W2127218421","https://openalex.org/W2128824222","https://openalex.org/W2131389289","https://openalex.org/W2141689873","https://openalex.org/W2144182447","https://openalex.org/W2152576712","https://openalex.org/W2154053567","https://openalex.org/W2157578436","https://openalex.org/W2163462010","https://openalex.org/W2189503625","https://openalex.org/W2242464395","https://openalex.org/W2328654303","https://openalex.org/W2333251588","https://openalex.org/W2342249984","https://openalex.org/W2378284627","https://openalex.org/W2472119793","https://openalex.org/W2477023729","https://openalex.org/W2490563124","https://openalex.org/W2490927957","https://openalex.org/W2508613954","https://openalex.org/W2542543501","https://openalex.org/W2555676925","https://openalex.org/W2562836854","https://openalex.org/W2592484110","https://openalex.org/W2751399725","https://openalex.org/W2779046793","https://openalex.org/W2790604390","https://openalex.org/W2886342218","https://openalex.org/W2928232427","https://openalex.org/W2999031389","https://openalex.org/W3048947774","https://openalex.org/W3185700573","https://openalex.org/W4239510810","https://openalex.org/W6607543680","https://openalex.org/W6675354045","https://openalex.org/W6687188548","https://openalex.org/W6709747150","https://openalex.org/W6720330311","https://openalex.org/W6730713231"],"related_works":["https://openalex.org/W3013479934","https://openalex.org/W4318325534","https://openalex.org/W4240398146","https://openalex.org/W2467308209","https://openalex.org/W2294483539","https://openalex.org/W2913357653","https://openalex.org/W1981753479","https://openalex.org/W4288326138","https://openalex.org/W2949824837","https://openalex.org/W2911594695"],"abstract_inverted_index":{"Recent":[0],"technology":[1],"evolution":[2],"allows":[3],"network":[4,41],"equipment":[5],"to":[6,16,66,102,115,224],"continuously":[7],"stream":[8],"a":[9,25,48,106],"wealth":[10],"of":[11,21,33,70,79,82,111,118,146,201,214],"\u201ctelemetry\u201d":[12],"information,":[13],"which":[14],"pertains":[15],"multiple":[17],"protocols":[18],"and":[19,29,43,72,99,131,153,169,189],"layers":[20],"the":[22,67,77,143,185,209,225],"stack,":[23],"at":[24],"very":[26],"fine":[27],"spatial-grain":[28],"high-frequency.":[30],"This":[31],"deluge":[32],"telemetry":[34,74],"data":[35],"clearly":[36],"offers":[37],"new":[38],"opportunities":[39],"for":[40,51],"control":[42,71],"troubleshooting,":[44],"but":[45],"also":[46],"poses":[47],"serious":[49],"challenge":[50,60],"what":[52],"concerns":[53],"its":[54],"real-time":[55,80],"processing.":[56],"We":[57,122],"tackle":[58],"this":[59],"by":[61],"applying":[62],"streaming":[63],"machine-learning":[64],"techniques":[65],"continuous":[68],"flow":[69],"data-plane":[73],"data,":[75],"with":[76,125,183,208],"purpose":[78],"detection":[81,90,179],"anomalies.":[83],"In":[84,206],"particular,":[85],"we":[86,216],"implement":[87],"an":[88,95],"anomaly":[89],"engine":[91],"that":[92,175],"leverages":[93],"DenStream,":[94],"unsupervised":[96],"clustering":[97],"technique,":[98],"apply":[100],"it":[101],"features":[103],"collected":[104],"from":[105],"large-scale":[107],"testbed":[108],"comprising":[109],"tens":[110],"routers":[112],"traversed":[113],"up":[114],"3Terabit/s":[116],"worth":[117],"real":[119],"application":[120],"traffic.":[121],"contrast":[123],"DenStream":[124,176],"offline":[126],"algorithms":[127,140,165],"such":[128,141],"as":[129,136,138,142,221],"DBScan":[130],"Local":[132],"Outlier":[133,150],"Factor":[134],"(LOF),":[135],"well":[137],"online":[139],"windowed":[144],"version":[145],"DBScan,":[147],"ExactSTORM,":[148],"Continuous":[149],"Detection":[151],"(COD)":[152],"Robust":[154],"Random":[155],"Cut":[156],"Forest":[157],"(RRCF).":[158],"Our":[159],"experimental":[160],"campaign":[161],"compares":[162],"these":[163],"seven":[164],"under":[166],"both":[167],"accuracy":[168],"computational":[170],"complexity":[171],"viewpoints:":[172],"results":[173,180],"testify":[174],"(i)":[177],"achieves":[178],"on":[181],"par":[182],"RRCF,":[184],"best":[186],"performing":[187],"algorithm":[188],"(ii)":[190],"is":[191],"significantly":[192],"faster":[193,203],"than":[194,204],"other":[195],"approaches,":[196],"notably":[197],"over":[198],"two":[199],"orders":[200],"magnitude":[202],"RRCF.":[205],"spirit":[207],"recent":[210],"trend":[211],"toward":[212],"reproducibility":[213],"results,":[215],"make":[217],"our":[218],"code":[219],"available":[220],"open":[222],"source":[223],"scientific":[226],"community.":[227]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":5},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":3}],"updated_date":"2026-04-14T08:04:32.555800","created_date":"2025-10-10T00:00:00"}