{"id":"https://openalex.org/W4416549421","doi":"https://doi.org/10.1145/3719027.3744800","title":"FlowSentry: Accelerating NetFlow-based DDoS Detection","display_name":"FlowSentry: Accelerating NetFlow-based DDoS Detection","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549421","doi":"https://doi.org/10.1145/3719027.3744800"},"language":null,"primary_location":{"id":"doi:10.1145/3719027.3744800","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744800","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3744800","source":null,"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3744800","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Xiaoyu He","orcid":"https://orcid.org/0009-0005-5568-9823"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyu He","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0005-5568-9823","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101977658","display_name":"Xiaohui Xie","orcid":"https://orcid.org/0000-0001-9413-4461"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaohui Xie","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-9413-4461","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100327844","display_name":"Xin Wang","orcid":"https://orcid.org/0000-0001-8639-3818"},"institutions":[{"id":"https://openalex.org/I59553526","display_name":"Stony Brook University","ror":"https://ror.org/05qghxh33","country_code":"US","type":"education","lineage":["https://openalex.org/I59553526"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xin Wang","raw_affiliation_strings":["Stony Brook University, Stony Brook, USA"],"raw_orcid":"https://orcid.org/0000-0001-8639-3818","affiliations":[{"raw_affiliation_string":"Stony Brook University, Stony Brook, USA","institution_ids":["https://openalex.org/I59553526"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100603173","display_name":"Lei Zhang","orcid":"https://orcid.org/0000-0001-7991-2915"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lei Zhang","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7991-2915","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062119492","display_name":"Kun Xie","orcid":"https://orcid.org/0000-0002-2163-2723"},"institutions":[{"id":"https://openalex.org/I16609230","display_name":"Hunan University","ror":"https://ror.org/05htk5m33","country_code":"CN","type":"education","lineage":["https://openalex.org/I16609230"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kun Xie","raw_affiliation_strings":["Hunan University, Changsha, China"],"raw_orcid":"https://orcid.org/0000-0002-2163-2723","affiliations":[{"raw_affiliation_string":"Hunan University, Changsha, China","institution_ids":["https://openalex.org/I16609230"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Lin Chen","orcid":"https://orcid.org/0009-0003-6576-460X"},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lin Chen","raw_affiliation_strings":["China Telecom Cybersecurity Technology Co.,Ltd., Beijing, China"],"raw_orcid":"https://orcid.org/0009-0003-6576-460X","affiliations":[{"raw_affiliation_string":"China Telecom Cybersecurity Technology Co.,Ltd., Beijing, China","institution_ids":["https://openalex.org/I4210136246"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5091090025","display_name":"Yong Cui","orcid":"https://orcid.org/0000-0002-5171-739X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yong Cui","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-5171-739X","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1589","last_page":"1603"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.741100013256073,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.741100013256073,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.1281999945640564,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.07590000331401825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.9550999999046326},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.83160001039505},{"id":"https://openalex.org/keywords/router","display_name":"Router","score":0.5475000143051147},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.4884999990463257},{"id":"https://openalex.org/keywords/trinoo","display_name":"Trinoo","score":0.4291999936103821},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.42910000681877136},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.40880000591278076},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.39160001277923584},{"id":"https://openalex.org/keywords/upstream","display_name":"Upstream (networking)","score":0.37290000915527344}],"concepts":[{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.9550999999046326},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.83160001039505},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7957000136375427},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.6090999841690063},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.5475000143051147},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.4884999990463257},{"id":"https://openalex.org/C43639116","wikidata":"https://www.wikidata.org/wiki/Q7843050","display_name":"Trinoo","level":5,"score":0.4291999936103821},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.42910000681877136},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.4122999906539917},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.40880000591278076},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.39160001277923584},{"id":"https://openalex.org/C191172861","wikidata":"https://www.wikidata.org/wiki/Q7899321","display_name":"Upstream (networking)","level":2,"score":0.37290000915527344},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.36250001192092896},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3483999967575073},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.34709998965263367},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3400000035762787},{"id":"https://openalex.org/C102392041","wikidata":"https://www.wikidata.org/wiki/Q592860","display_name":"Sliding window protocol","level":3,"score":0.3165999948978424},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.3149999976158142},{"id":"https://openalex.org/C192697461","wikidata":"https://www.wikidata.org/wiki/Q4045918","display_name":"OpenFlow","level":3,"score":0.3091999888420105},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3052999973297119},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.30469998717308044},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.3010999858379364},{"id":"https://openalex.org/C86726114","wikidata":"https://www.wikidata.org/wiki/Q5170211","display_name":"Core router","level":3,"score":0.28690001368522644},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.2800999879837036},{"id":"https://openalex.org/C109751979","wikidata":"https://www.wikidata.org/wiki/Q998767","display_name":"Failover","level":2,"score":0.27390000224113464},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.26330000162124634},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.26190000772476196},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.25839999318122864},{"id":"https://openalex.org/C63969886","wikidata":"https://www.wikidata.org/wiki/Q3536440","display_name":"Internet traffic","level":3,"score":0.25760000944137573}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3719027.3744800","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744800","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3744800","source":null,"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3719027.3744800","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744800","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3744800","source":null,"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7033924410","display_name":null,"funder_award_id":"62132009","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7488493096","display_name":null,"funder_award_id":"62221003","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416549421.pdf","grobid_xml":"https://content.openalex.org/works/W4416549421.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W1986497098","https://openalex.org/W2080234606","https://openalex.org/W2620580412","https://openalex.org/W2834288129","https://openalex.org/W2902611302","https://openalex.org/W2910074034","https://openalex.org/W2963197901","https://openalex.org/W2969998124","https://openalex.org/W2982682021","https://openalex.org/W3107424158","https://openalex.org/W3136284412","https://openalex.org/W3173170122","https://openalex.org/W3211494975","https://openalex.org/W4290991406","https://openalex.org/W4324007233","https://openalex.org/W4386396590","https://openalex.org/W4386694208","https://openalex.org/W4396599335","https://openalex.org/W4396757496"],"related_works":[],"abstract_inverted_index":{"Distributed":[0],"Denial":[1],"of":[2,9,184],"Service":[3,27],"(DDoS)":[4],"attacks":[5],"threaten":[6],"the":[7,74,79,83,105,125,138,169,174,197,217],"stability":[8],"online":[10],"services":[11],"by":[12,25,220],"overwhelming":[13],"them":[14],"with":[15],"excessive":[16],"traffic.":[17],"NetFlow-based":[18],"DDoS":[19,41,121],"detection":[20,33,38,51,117,198,213,218],"systems":[21,45],"are":[22],"widely":[23],"adopted":[24],"Internet":[26],"Providers":[28],"(ISPs)":[29],"in":[30,104,203],"upstream":[31],"multi-point":[32],"scenarios":[34],"to":[35,119,136,157,167,178,222,225],"provide":[36],"robust":[37],"for":[39,85,91,102],"volumetric":[40],"attacks.":[42],"However,":[43],"these":[44],"face":[46],"inherent":[47],"delays,":[48],"as":[49],"NetFlow":[50,75,116,140],"is":[52,100,150],"non-instantaneous\u2014routers":[53],"aggregate":[54],"and":[55,147],"summarize":[56],"flow":[57,161,192],"records":[58],"over":[59],"a":[60,95,114,132,151],"period":[61],"before":[62],"reporting,":[63],"which":[64,99],"impacts":[65],"timely":[66],"detection.":[67],"Existing":[68],"research":[69],"primarily":[70],"focuses":[71],"on":[72,131,189],"optimizing":[73],"reporting":[76],"mechanism":[77,155],"at":[78,124],"router":[80],"side.":[81,127],"Unfortunately,":[82],"need":[84],"either":[86],"software":[87],"or":[88],"hardware":[89],"upgrades":[90],"routers":[92],"would":[93],"incur":[94],"high":[96],"deployment":[97],"cost,":[98],"impractical":[101],"ISPs":[103],"short":[106],"term.":[107],"In":[108],"this":[109],"paper,":[110],"we":[111],"propose":[112],"FlowSentry,":[113],"novel":[115],"framework":[118],"accelerate":[120],"attack":[122],"identification":[123],"server":[126],"The":[128],"system":[129],"operates":[130],"dual-layer":[133],"filtering":[134,163],"paradigm":[135],"handle":[137],"high-frequency":[139],"records,":[141,193],"incorporating":[142],"two":[143],"core":[144],"technologies:":[145],"ADWindow":[146,149],"STAnalyzer.":[148],"sketch-based":[152],"sliding":[153],"window":[154],"designed":[156],"retain":[158],"possibly":[159],"anomalous":[160],"information,":[162],"out":[164],"benign":[165],"flows":[166],"reduce":[168],"computational":[170],"overhead.":[171],"STAnalyzer":[172],"leverages":[173],"cross-router":[175],"traffic":[176,187],"correlation":[177],"efficiently":[179],"infer":[180],"abnormal":[181],"growth":[182],"patterns":[183],"potential":[185],"malicious":[186],"based":[188],"partially":[190],"reported":[191],"thus":[194],"significantly":[195],"reducing":[196,216],"delay.":[199],"Our":[200],"extensive":[201],"experiments":[202],"simulated":[204],"backbone":[205],"network":[206],"environments":[207],"demonstrate":[208],"that":[209],"FlowSentry":[210],"achieves":[211],"better":[212],"accuracy":[214],"while":[215],"delay":[219],"up":[221],"65.63%":[223],"compared":[224],"existing":[226],"methods.":[227]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-11-23T00:00:00"}