{"id":"https://openalex.org/W4311118514","doi":"https://doi.org/10.1145/3555050.3569121","title":"Xatu","display_name":"Xatu","publication_year":2022,"publication_date":"2022-11-30","ids":{"openalex":"https://openalex.org/W4311118514","doi":"https://doi.org/10.1145/3555050.3569121"},"language":"en","primary_location":{"id":"doi:10.1145/3555050.3569121","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3555050.3569121","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on emerging Networking EXperiments and Technologies","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100301744","display_name":"Zhiying Xu","orcid":null},"institutions":[{"id":"https://openalex.org/I2801851002","display_name":"Harvard University Press","ror":"https://ror.org/006v7bf86","country_code":"US","type":"other","lineage":["https://openalex.org/I136199984","https://openalex.org/I2801851002"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiying Xu","raw_affiliation_strings":["Harvard University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Harvard University","institution_ids":["https://openalex.org/I2801851002"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036768727","display_name":"Sivaramakrishnan Ramanathan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sivaramakrishnan Ramanathan","raw_affiliation_strings":["USC/Meta"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"USC/Meta","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062546146","display_name":"Alexander M. Rush","orcid":"https://orcid.org/0000-0002-9900-1606"},"institutions":[{"id":"https://openalex.org/I205783295","display_name":"Cornell University","ror":"https://ror.org/05bnh6r87","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295"]},{"id":"https://openalex.org/I4405261073","display_name":"Cornell Tech","ror":"https://ror.org/04qscbg47","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295","https://openalex.org/I4405261073"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Alexander Rush","raw_affiliation_strings":["Cornell Tech"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cornell Tech","institution_ids":["https://openalex.org/I205783295","https://openalex.org/I4405261073"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103177278","display_name":"Jelena Mirkovi\u0107","orcid":"https://orcid.org/0000-0001-7462-8747"},"institutions":[{"id":"https://openalex.org/I4210103999","display_name":"Integrated Systems Incorporation (United States)","ror":"https://ror.org/01et00j38","country_code":"US","type":"company","lineage":["https://openalex.org/I4210103999"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jelena Mirkovic","raw_affiliation_strings":["USC/ISI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"USC/ISI","institution_ids":["https://openalex.org/I4210103999"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5035157838","display_name":"Minlan Yu","orcid":"https://orcid.org/0000-0002-2381-0212"},"institutions":[{"id":"https://openalex.org/I2801851002","display_name":"Harvard University Press","ror":"https://ror.org/006v7bf86","country_code":"US","type":"other","lineage":["https://openalex.org/I136199984","https://openalex.org/I2801851002"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Minlan Yu","raw_affiliation_strings":["Harvard University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Harvard University","institution_ids":["https://openalex.org/I2801851002"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"17"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7910585403442383},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.743809700012207},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.7319115996360779},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.7123764157295227},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.5645817518234253},{"id":"https://openalex.org/keywords/term","display_name":"Term (time)","score":0.48468926548957825},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.48314231634140015},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4471130073070526},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2613285183906555},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.15268325805664062}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7910585403442383},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.743809700012207},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.7319115996360779},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.7123764157295227},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.5645817518234253},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.48468926548957825},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.48314231634140015},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4471130073070526},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2613285183906555},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.15268325805664062},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3555050.3569121","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3555050.3569121","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on emerging Networking EXperiments and Technologies","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3510305905","display_name":null,"funder_award_id":"CNS-1955422; CNS-1955487","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":45,"referenced_works":["https://openalex.org/W192498908","https://openalex.org/W1828175806","https://openalex.org/W1986497098","https://openalex.org/W1990818816","https://openalex.org/W2005931737","https://openalex.org/W2023882424","https://openalex.org/W2031434948","https://openalex.org/W2061133001","https://openalex.org/W2085802616","https://openalex.org/W2086325258","https://openalex.org/W2091614396","https://openalex.org/W2110691314","https://openalex.org/W2116261113","https://openalex.org/W2128038346","https://openalex.org/W2146189323","https://openalex.org/W2146467316","https://openalex.org/W2548080094","https://openalex.org/W2549994809","https://openalex.org/W2556331653","https://openalex.org/W2567172578","https://openalex.org/W2599337667","https://openalex.org/W2753669113","https://openalex.org/W2768883253","https://openalex.org/W2769411931","https://openalex.org/W2775132284","https://openalex.org/W2797742547","https://openalex.org/W2885125001","https://openalex.org/W2890165066","https://openalex.org/W2902983161","https://openalex.org/W2917037953","https://openalex.org/W2968248216","https://openalex.org/W2978612193","https://openalex.org/W2981280544","https://openalex.org/W2985610488","https://openalex.org/W3007418556","https://openalex.org/W3008207353","https://openalex.org/W3040389479","https://openalex.org/W3093635747","https://openalex.org/W3105750153","https://openalex.org/W3119160111","https://openalex.org/W3134111902","https://openalex.org/W3149990268","https://openalex.org/W3211494975","https://openalex.org/W4290991228","https://openalex.org/W6743493502"],"related_works":["https://openalex.org/W2360429410","https://openalex.org/W2204131204","https://openalex.org/W2383770723","https://openalex.org/W2898696280","https://openalex.org/W2921433547","https://openalex.org/W2958385475","https://openalex.org/W2783466926","https://openalex.org/W4286539397","https://openalex.org/W2370216173","https://openalex.org/W4256682929"],"abstract_inverted_index":{"Traditional":[0],"DDoS":[1,75],"attack":[2,10,51,85,115,171],"detection":[3,17,44,76,191],"monitors":[4],"volumetric":[5],"traffic":[6,102,158,185],"features":[7],"to":[8,36,67,139,168,181],"detect":[9,141],"onset.":[11],"To":[12,109],"reduce":[13,188],"false":[14,148],"positives,":[15],"such":[16],"is":[18],"often":[19],"conservative---raising":[20],"an":[21],"alert":[22,166],"only":[23],"after":[24],"a":[25,42,61,119,160],"sustained":[26],"period":[27],"of":[28,49,73,82,91],"observed":[29],"anomalous":[30,184],"behavior.":[31],"However,":[32],"contemporary":[33],"attacks":[34,142],"tend":[35],"be":[37,97],"short,":[38],"which":[39,123],"combined":[40],"with":[41],"long":[43],"delay":[45,192],"means":[46],"that":[47,63],"most":[48],"the":[50,56,69,89,176],"still":[52],"reaches":[53],"and":[54,71,88,127,150,186],"impacts":[55],"victim.":[57],"We":[58,78,134,154],"propose":[59,118],"Xatu,":[60],"system":[62],"utilizes":[64],"auxiliary":[65,83,112,132],"signals":[66,87,95,113],"improve":[68],"accuracy":[70],"timeliness":[72],"existing":[74,101],"systems.":[77],"explore":[79],"two":[80],"types":[81],"signals,":[84],"preparation":[86],"history":[90],"prior":[92],"attacks.":[93],"These":[94],"can":[96],"easily":[98],"mined":[99],"from":[100,130,159],"monitoring":[103],"systems":[104],"in":[105],"many":[106],"ISP":[107],"networks.":[108],"leverage":[110,136],"these":[111],"for":[114],"detection,":[116],"we":[117],"multi-timescale":[120],"LSTM":[121],"model,":[122],"derives":[124],"both":[125],"long-term":[126],"short-term":[128],"patterns":[129],"diverse":[131],"signals.":[133],"then":[135],"survival":[137],"analysis":[138],"quickly":[140],"when":[143],"they":[144],"occur":[145],"while":[146],"minimizing":[147],"positives":[149],"thus":[151],"scrubbing":[152],"costs.":[153],"evaluate":[155],"Xatu":[156,173],"on":[157],"large":[161],"ISP,":[162],"using":[163],"commercial":[164,177],"defense":[165,178],"data":[167],"label":[169],"prevalent":[170],"events.":[172],"would":[174,187],"help":[175],"scrub":[179],"up":[180],"44.1%":[182],"additional":[183],"its":[189],"median":[190],"by":[193],"9.5":[194],"minutes.1":[195]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-16T13:24:37.021932","created_date":"2022-12-23T00:00:00"}