{"id":"https://openalex.org/W2168883902","doi":"https://doi.org/10.1145/1177080.1177096","title":"Semi-automated discovery of application session structure","display_name":"Semi-automated discovery of application session structure","publication_year":2006,"publication_date":"2006-10-25","ids":{"openalex":"https://openalex.org/W2168883902","doi":"https://doi.org/10.1145/1177080.1177096","mag":"2168883902"},"language":"en","primary_location":{"id":"doi:10.1145/1177080.1177096","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1177080.1177096","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 6th ACM SIGCOMM conference on Internet measurement","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017617720","display_name":"Jayanthkumar Kannan","orcid":null},"institutions":[{"id":"https://openalex.org/I134446601","display_name":"Berkeley College","ror":"https://ror.org/02xewxa75","country_code":"US","type":"education","lineage":["https://openalex.org/I134446601"]},{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jayanthkumar Kannan","raw_affiliation_strings":["UC Berkeley, Berkeley, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UC Berkeley, Berkeley, CA, USA","institution_ids":["https://openalex.org/I134446601","https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066707136","display_name":"Jaeyeon Jung","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jaeyeon Jung","raw_affiliation_strings":["Mazu Networks, Cambridge, MA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Mazu Networks, Cambridge, MA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002219113","display_name":"Vern Paxson","orcid":"https://orcid.org/0009-0005-2673-543X"},"institutions":[{"id":"https://openalex.org/I1297971548","display_name":"International Computer Science Institute","ror":"https://ror.org/01ewh7m12","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1297971548"]},{"id":"https://openalex.org/I148283060","display_name":"Lawrence Berkeley National Laboratory","ror":"https://ror.org/02jbv0t02","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I148283060","https://openalex.org/I39565521"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vern Paxson","raw_affiliation_strings":["International Computer Science Institute and Lawrence Berkeley National Laboratory, Berkeley, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"International Computer Science Institute and Lawrence Berkeley National Laboratory, Berkeley, CA, USA","institution_ids":["https://openalex.org/I1297971548","https://openalex.org/I148283060"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030047891","display_name":"C. Emre Koksal","orcid":"https://orcid.org/0000-0001-8463-4446"},"institutions":[{"id":"https://openalex.org/I5124864","display_name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne","ror":"https://ror.org/02s376052","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I5124864"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Can Emre Koksal","raw_affiliation_strings":["EPFL, Luasanne, Switzerland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"EPFL, Luasanne, Switzerland","institution_ids":["https://openalex.org/I5124864"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.4162,"has_fulltext":false,"cited_by_count":60,"citation_normalized_percentile":{"value":0.95049634,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"119","last_page":"132"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/session","display_name":"Session (web analytics)","score":0.8316915035247803},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.824699878692627},{"id":"https://openalex.org/keywords/signature","display_name":"Signature (topology)","score":0.4679518938064575},{"id":"https://openalex.org/keywords/data-structure","display_name":"Data structure","score":0.46102744340896606},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.434741348028183},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.4180566668510437},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3398340344429016},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3323368728160858},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.30364370346069336}],"concepts":[{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.8316915035247803},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.824699878692627},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.4679518938064575},{"id":"https://openalex.org/C162319229","wikidata":"https://www.wikidata.org/wiki/Q175263","display_name":"Data structure","level":2,"score":0.46102744340896606},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.434741348028183},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4180566668510437},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3398340344429016},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3323368728160858},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.30364370346069336},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1145/1177080.1177096","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1177080.1177096","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 6th ACM SIGCOMM conference on Internet measurement","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.107.9344","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.107.9344","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.imconf.net/imc-2006/papers/p12-kannan.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.114.4832","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.114.4832","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.berkeley.edu/~kjk/sessions.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.468.315","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.468.315","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://ants.iis.sinica.edu.tw/3BkMJ9lTeWXTSrrvNoKNFDxRm3zFwRR/27/2006_IMC_Semi-automatedDiscoveryOfApplicationSessionStructure.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.79.2481","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.79.2481","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.icir.org/vern/papers/session-discovery.IMC06.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/4","display_name":"Quality Education","score":0.699999988079071}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W29275369","https://openalex.org/W127688506","https://openalex.org/W179636102","https://openalex.org/W1489157620","https://openalex.org/W1550624107","https://openalex.org/W1579427489","https://openalex.org/W1943309769","https://openalex.org/W1989121667","https://openalex.org/W1990312847","https://openalex.org/W1993275183","https://openalex.org/W2012095206","https://openalex.org/W2058521308","https://openalex.org/W2066782797","https://openalex.org/W2069499077","https://openalex.org/W2084960044","https://openalex.org/W2089985195","https://openalex.org/W2101080231","https://openalex.org/W2102970979","https://openalex.org/W2103312864","https://openalex.org/W2103919170","https://openalex.org/W2105047865","https://openalex.org/W2105818147","https://openalex.org/W2108355512","https://openalex.org/W2116398767","https://openalex.org/W2122889548","https://openalex.org/W2124478678","https://openalex.org/W2126484746","https://openalex.org/W2128945468","https://openalex.org/W2133985894","https://openalex.org/W2137754263","https://openalex.org/W2142872720","https://openalex.org/W2148275477","https://openalex.org/W2148346742","https://openalex.org/W2153964544","https://openalex.org/W2156916299","https://openalex.org/W2171873915","https://openalex.org/W4230133813","https://openalex.org/W4300306656","https://openalex.org/W6605166902"],"related_works":["https://openalex.org/W4230197055","https://openalex.org/W4296749040","https://openalex.org/W621808327","https://openalex.org/W644007644","https://openalex.org/W2497198634","https://openalex.org/W3012257603","https://openalex.org/W1586784764","https://openalex.org/W4292264782","https://openalex.org/W1559289099","https://openalex.org/W3016450995"],"abstract_inverted_index":{"While":[0],"the":[1,8,28,51,59,68,74,130,147,155,201,212],"problem":[2],"of":[3,10,30,34,36,46,81,104,132,141,150,180,203,214],"analyzing":[4],"network":[5,142,230],"traffic":[6,22,222],"at":[7,23],"granularity":[9],"individual":[11],"connections":[12,38,61],"has":[13,219],"seen":[14],"considerable":[15],"previous":[16],"work":[17,218],"and":[18,58,117,187,211,224,232],"tool":[19],"development,":[20],"understanding":[21],"a":[24,85,90,109,138,194],"higher":[25],"level":[26],"-":[27,39],"structure":[29,149],"user-initiated":[31],"sessions":[32,97,152],"comprised":[33],"groups":[35],"related":[37],"remains":[40],"much":[41],"less":[42],"explored.":[43],"Some":[44],"types":[45,80],"session":[47,183,209],"structure,":[48],"such":[49,83,107],"as":[50,84,108,173],"coupling":[52],"between":[53],"an":[54,167,181],"FTP":[55],"control":[56],"connection":[57,143],"data":[60],"it":[62],"spawns,":[63],"have":[64],"prespecified":[65],"forms,":[66],"though":[67],"specifications":[69],"do":[70],"not":[71],"guarantee":[72],"how":[73],"forms":[75],"appear":[76],"in":[77,119,129,154,161,200],"practice.":[78],"Other":[79],"sessions,":[82],"user":[86],"reading":[87],"email":[88],"with":[89,169],"browser,":[91],"only":[92],"manifest":[93],"empirically.":[94],"Still":[95],"other":[96],"might":[98],"exist":[99],"without":[100],"us":[101],"even":[102],"knowing":[103],"their":[105,207],"presence,":[106],"botnet":[110],"zombie":[111],"receiving":[112],"instructions":[113],"from":[114,193],"its":[115],"master":[116],"proceeding":[118],"turn":[120],"to":[121,145,165,221],"carry":[122],"them":[123],"out.":[124],"We":[125,185],"present":[126,166],"algorithms":[127],"rooted":[128],"statistics":[131],"Poisson":[133],"processes":[134],"that":[135,162,205],"can":[136],"mine":[137],"large":[139,195],"corpus":[140],"logs":[144],"extract":[146],"apparent":[148],"application":[151],"embedded":[153],"connections.":[156],"Our":[157,217],"methods":[158,190],"are":[159],"semi-automated":[160],"we":[163],"aim":[164],"analyst":[168],"high-quality":[170],"information":[171],"(expressed":[172],"regular":[174],"expressions)":[175],"reflecting":[176],"different":[177,208],"possible":[178],"abstractions":[179],"application's":[182],"structure.":[184],"develop":[186],"test":[188],"our":[189],"using":[191],"traces":[192],"Internet":[196],"site,":[197],"finding":[198],"diversity":[199],"number":[202],"applications":[204,220],"manifest,":[206],"structures,":[210],"presence":[213],"abnormal":[215],"behavior.":[216],"characterization":[223],"monitoring,":[225],"source":[226],"models":[227],"for":[228],"synthesizing":[229],"traffic,":[231],"anomaly":[233],"detection.":[234]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2020,"cited_by_count":2},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":3},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":6},{"year":2013,"cited_by_count":6},{"year":2012,"cited_by_count":2}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}