{"id":"https://openalex.org/W2170435906","doi":"https://doi.org/10.1145/1850795.1850804","title":"Traffic classification using visual motifs","display_name":"Traffic classification using visual motifs","publication_year":2010,"publication_date":"2010-09-02","ids":{"openalex":"https://openalex.org/W2170435906","doi":"https://doi.org/10.1145/1850795.1850804","mag":"2170435906"},"language":"en","primary_location":{"id":"doi:10.1145/1850795.1850804","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1850795.1850804","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Seventh International Symposium on Visualization for Cyber Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081221670","display_name":"Wilson Lian","orcid":null},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wilson Lian","raw_affiliation_strings":["University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069862528","display_name":"Fabian Monrose","orcid":"https://orcid.org/0000-0002-9805-2217"},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Fabian Monrose","raw_affiliation_strings":["University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5113677892","display_name":"John McHugh","orcid":null},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"John McHugh","raw_affiliation_strings":["University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.15666052,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":94},"biblio":{"volume":null,"issue":null,"first_page":"70","last_page":"78"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9959999918937683,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8073412775993347},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.6425936818122864},{"id":"https://openalex.org/keywords/visualization","display_name":"Visualization","score":0.6252508759498596},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.579914391040802},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5662482976913452},{"id":"https://openalex.org/keywords/traffic-classification","display_name":"Traffic classification","score":0.5605169534683228},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.5551985502243042},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.5194965600967407},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.4873145520687103},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4694216847419739},{"id":"https://openalex.org/keywords/precision-and-recall","display_name":"Precision and recall","score":0.46675586700439453},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.46196502447128296},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.42567378282546997},{"id":"https://openalex.org/keywords/operator","display_name":"Operator (biology)","score":0.41873660683631897},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3995853662490845},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.15103229880332947}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8073412775993347},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.6425936818122864},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.6252508759498596},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.579914391040802},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5662482976913452},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.5605169534683228},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.5551985502243042},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5194965600967407},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4873145520687103},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4694216847419739},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.46675586700439453},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.46196502447128296},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.42567378282546997},{"id":"https://openalex.org/C17020691","wikidata":"https://www.wikidata.org/wiki/Q139677","display_name":"Operator (biology)","level":5,"score":0.41873660683631897},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3995853662490845},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.15103229880332947},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C86339819","wikidata":"https://www.wikidata.org/wiki/Q407384","display_name":"Transcription factor","level":3,"score":0.0},{"id":"https://openalex.org/C158448853","wikidata":"https://www.wikidata.org/wiki/Q425218","display_name":"Repressor","level":4,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1850795.1850804","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1850795.1850804","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Seventh International Symposium on Visualization for Cyber Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7376112547","display_name":null,"funder_award_id":"CNS-0852649","funder_id":"https://openalex.org/F4320337388","funder_display_name":"Division of Computer and Network Systems"}],"funders":[{"id":"https://openalex.org/F4320337388","display_name":"Division of Computer and Network Systems","ror":"https://ror.org/02rdzmk74"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W105475431","https://openalex.org/W1481798173","https://openalex.org/W1543057386","https://openalex.org/W1600115249","https://openalex.org/W1603200341","https://openalex.org/W1608222975","https://openalex.org/W1894334734","https://openalex.org/W1916902331","https://openalex.org/W1955645522","https://openalex.org/W1988918299","https://openalex.org/W1995476838","https://openalex.org/W1999024927","https://openalex.org/W2045414949","https://openalex.org/W2112493326","https://openalex.org/W2122226347","https://openalex.org/W2134511994","https://openalex.org/W2134632326","https://openalex.org/W2135088779","https://openalex.org/W2146211060","https://openalex.org/W2166657964","https://openalex.org/W2167266744","https://openalex.org/W2172017522","https://openalex.org/W6681652963"],"related_works":["https://openalex.org/W2041550843","https://openalex.org/W2537489883","https://openalex.org/W2017644937","https://openalex.org/W1976515580","https://openalex.org/W3011161512","https://openalex.org/W2928278548","https://openalex.org/W2978828483","https://openalex.org/W4301866626","https://openalex.org/W2917586021","https://openalex.org/W2062731068"],"abstract_inverted_index":{"In":[0],"this":[1,164],"paper,":[2],"we":[3,26,182],"explore":[4],"the":[5,13,30,50,58,121,153],"effectiveness":[6],"of":[7,29,42,54,92,125,155],"using":[8,163],"graphical":[9],"methods":[10],"for":[11,100,102,128,147],"isolating":[12],"differences":[14],"between":[15],"common":[16],"application":[17,35,83],"protocols---both":[18],"in":[19,49,85],"their":[20],"transient":[21],"and":[22,52,61,158,199,207],"steady-state":[23],"behavior.":[24],"Specifically,":[25,181],"take":[27],"advantage":[28],"observation":[31],"that":[32,45,107,201],"many":[33],"Internet":[34],"protocols":[36,84],"proscribe":[37],"a":[38,78,89,111,149,178],"very":[39],"specific":[40],"series":[41],"client/server":[43],"interactions":[44],"are":[46],"clearly":[47],"visible":[48],"sizes":[51],"timing":[53],"packets":[55],"produced":[56],"at":[57],"network":[59,173],"layer":[60],"below.":[62],"We":[63,143],"show":[64,200],"how":[65],"so-called":[66],"\"visual":[67],"motifs\"":[68],"built":[69],"on":[70,114,152,160,194],"these":[71],"features":[72],"can":[73,97],"be":[74,98],"used":[75],"to":[76,81,105,110,131,136,166,189],"assist":[77],"human":[79],"operator":[80],"recognize":[82],"unidentified":[86],"traffic.":[87],"From":[88],"practical":[90],"point":[91],"view,":[93],"visual":[94,156],"traffic":[95,109,138],"classification":[96],"used,":[99],"example,":[101],"anomaly":[103],"detection":[104,130],"verify":[106],"all":[108],"web":[112],"server":[113],"TCP":[115],"port":[116],"80":[117],"does":[118],"indeed":[119],"exhibit":[120],"characteristic":[122],"behavior":[123],"patterns":[124,171],"HTTP,":[126],"or":[127,135],"misuse":[129],"find":[132],"unauthorized":[133],"servers":[134],"identify":[137],"generated":[139],"by":[140],"prohibited":[141],"applications.":[142],"present":[144],"our":[145,161,202],"technique":[146,165],"building":[148],"classifier":[150],"based":[151],"notion":[154],"motifs":[157],"report":[159],"experience":[162],"automatically":[167],"classify":[168],"on-the-wire":[169],"behavioral":[170],"from":[172,177],"flow":[174],"data":[175],"collected":[176],"campus":[179],"network.":[180],"analyze":[183],"over":[184,190],"1":[185],"billion":[186],"flows":[187],"corresponding":[188],"5":[191],"million":[192],"sessions":[193],"nearly":[195],"200":[196],"distinct":[197],"ports":[198],"approach":[203],"achieves":[204],"high":[205],"recall":[206],"precision.":[208]},"counts_by_year":[{"year":2015,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}