{"id":"https://openalex.org/W2011505318","doi":"https://doi.org/10.1145/2068816.2068820","title":"Detecting, validating and characterizing computer infections in the wild","display_name":"Detecting, validating and characterizing computer infections in the wild","publication_year":2011,"publication_date":"2011-11-02","ids":{"openalex":"https://openalex.org/W2011505318","doi":"https://doi.org/10.1145/2068816.2068820","mag":"2011505318"},"language":"en","primary_location":{"id":"doi:10.1145/2068816.2068820","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2068816.2068820","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5043655606","display_name":"Elias Raftopoulos","orcid":null},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Elias Raftopoulos","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5080514654","display_name":"Xenofontas Dimitropoulos","orcid":"https://orcid.org/0000-0003-2600-7633"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Xenofontas Dimitropoulos","raw_affiliation_strings":["ETH Zurich, Zurich, Switzerland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ETH Zurich, Zurich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I35440088"],"apc_list":null,"apc_paid":null,"fwci":2.2881,"has_fulltext":false,"cited_by_count":18,"citation_normalized_percentile":{"value":0.8841437,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"29","last_page":"44"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.8775935173034668},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.798409104347229},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7969051599502563},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.7678818106651306},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7657375931739807},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.6240373849868774},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.6174517869949341},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5575947761535645},{"id":"https://openalex.org/keywords/footprint","display_name":"Footprint","score":0.5371822118759155},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5263755917549133},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.495293527841568},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.37090763449668884},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3374099135398865},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2310630977153778}],"concepts":[{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.8775935173034668},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.798409104347229},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7969051599502563},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.7678818106651306},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7657375931739807},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.6240373849868774},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.6174517869949341},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5575947761535645},{"id":"https://openalex.org/C132943942","wikidata":"https://www.wikidata.org/wiki/Q2562511","display_name":"Footprint","level":2,"score":0.5371822118759155},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5263755917549133},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.495293527841568},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37090763449668884},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3374099135398865},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2310630977153778},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2068816.2068820","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2068816.2068820","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W109441098","https://openalex.org/W123401891","https://openalex.org/W177666592","https://openalex.org/W1495304983","https://openalex.org/W1498585374","https://openalex.org/W1506124881","https://openalex.org/W1515180657","https://openalex.org/W1554596310","https://openalex.org/W1556507321","https://openalex.org/W1587979610","https://openalex.org/W1591333027","https://openalex.org/W1602380388","https://openalex.org/W1621186777","https://openalex.org/W1968519345","https://openalex.org/W1988918299","https://openalex.org/W1999427165","https://openalex.org/W1999448603","https://openalex.org/W2016559036","https://openalex.org/W2044384431","https://openalex.org/W2096030967","https://openalex.org/W2099321136","https://openalex.org/W2100846830","https://openalex.org/W2108513376","https://openalex.org/W2108867737","https://openalex.org/W2109662977","https://openalex.org/W2128116119","https://openalex.org/W2136561182","https://openalex.org/W2136695760","https://openalex.org/W2137928260","https://openalex.org/W2141200504","https://openalex.org/W2142595254","https://openalex.org/W2161830378","https://openalex.org/W2163034159","https://openalex.org/W2163277533","https://openalex.org/W2998778915","https://openalex.org/W4244728148","https://openalex.org/W4285719527","https://openalex.org/W4290757805","https://openalex.org/W6633128530","https://openalex.org/W6683996746"],"related_works":["https://openalex.org/W1975357770","https://openalex.org/W2066371588","https://openalex.org/W101962219","https://openalex.org/W3119537175","https://openalex.org/W2027184711","https://openalex.org/W4282824511","https://openalex.org/W2810356275","https://openalex.org/W2388600609","https://openalex.org/W3123215897","https://openalex.org/W2951146195"],"abstract_inverted_index":{"Although":[0],"network":[1,58],"intrusion":[2,37,184],"detection":[3],"systems":[4,172],"(IDSs)":[5],"have":[6,60],"been":[7,61],"studied":[8],"for":[9,72,81],"several":[10,180],"years,":[11],"their":[12],"operators":[13],"are":[14,264],"still":[15],"overwhelmed":[16],"by":[17,63],"a":[18,33,41,49,96,107,128,136,162,174,250],"large":[19,34],"number":[20,51,252],"of":[21,36,52,77,100,144,149,157,169,203,214,234,253],"false-positive":[22,75],"alerts.":[23,145],"In":[24],"this":[25,66],"work":[26,151],"we":[27,44,104,121,222,243],"study":[28],"the":[29,57,74,86,115,155,167,199,211,215,247],"following":[30],"problem:":[31],"from":[32,114,179],"archive":[35],"alerts":[38,102,120],"collected":[39,84],"in":[40,85,173,239],"production":[42,175],"network,":[43],"want":[45],"to":[46,110,131,154,165,225,267,270],"detect":[47,111],"with":[48,88],"small":[50,251],"false":[53,200,216],"positives":[54],"hosts":[55,113,133,238],"within":[56],"that":[59,134,198,245,261],"infected":[62,112,171,237,248,272],"malware.":[64],"Solving":[65],"problem":[67],"is":[68,152,206],"essential":[69],"not":[70],"only":[71],"reducing":[73],"rate":[76,202],"IDSs,":[78],"but":[79],"also":[80],"labeling":[82],"traces":[83],"wild":[87],"information":[89],"about":[90],"validated":[91,219],"security":[92,168],"incidents.":[93],"We":[94,160,196],"use":[95],"9-month":[97],"long":[98],"dataset":[99],"IDS":[101],"and":[103,192,208,229,260],"first":[105],"build":[106],"novel":[108],"heuristic":[109,126,205],"on":[116],"average":[117],"3":[118],"million":[119],"observe":[122],"per":[123],"day.":[124],"Our":[125],"uses":[127],"statistical":[129],"measure":[130],"find":[132,197,244],"exhibit":[135],"repeated":[137],"multi-stage":[138],"malicious":[139],"footprint":[140],"involving":[141],"specific":[142],"classes":[143],"A":[146],"significant":[147],"part":[148],"our":[150,158,204,220,226],"devoted":[153],"validation":[156],"heuristic.":[159],"conduct":[161],"complex":[163],"experiment":[164],"assess":[166],"suspected":[170],"environment":[176],"using":[177],"data":[178],"independent":[181],"sources,":[182],"including":[183],"alerts,":[185],"blacklists,":[186],"host":[187],"scanning":[188],"logs,":[189],"vulnerability":[190],"reports,":[191],"search":[193],"engine":[194],"queries.":[195],"positive":[201],"15%":[207],"analyze":[209],"in-depth":[210],"root":[212],"causes":[213],"positives.":[217],"Having":[218],"heuristic,":[221],"apply":[223],"it":[224],"entire":[227],"trace,":[228],"characterize":[230],"various":[231],"important":[232],"properties":[233],"9":[235],"thousand":[236],"total.":[240],"For":[241],"example,":[242],"among":[246],"hosts,":[249],"heavy":[254],"hitters":[255],"originate":[256],"most":[257],"outbound":[258],"attacks":[259],"future":[262],"infections":[263],"more":[265],"likely":[266],"occur":[268],"close":[269],"already":[271],"hosts.":[273]},"counts_by_year":[{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":3},{"year":2015,"cited_by_count":3},{"year":2014,"cited_by_count":2},{"year":2013,"cited_by_count":6}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}