{"id":"https://openalex.org/W2096494031","doi":"https://doi.org/10.1186/1687-417x-2014-5","title":"How can sliding HyperLogLog and EWMA detect port scan attacks in IP traffic?","display_name":"How can sliding HyperLogLog and EWMA detect port scan attacks in IP traffic?","publication_year":2014,"publication_date":"2014-02-07","ids":{"openalex":"https://openalex.org/W2096494031","doi":"https://doi.org/10.1186/1687-417x-2014-5","mag":"2096494031"},"language":"en","primary_location":{"id":"doi:10.1186/1687-417x-2014-5","is_oa":true,"landing_page_url":"https://doi.org/10.1186/1687-417x-2014-5","pdf_url":"https://link.springer.com/content/pdf/10.1186/1687-417X-2014-5.pdf","source":{"id":"https://openalex.org/S5820498","display_name":"EURASIP Journal on Information Security","issn_l":"1687-4161","issn":["1687-4161","1687-417X","2510-523X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EURASIP Journal on Information Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://link.springer.com/content/pdf/10.1186/1687-417X-2014-5.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5013567133","display_name":"Yousra Chabchoub","orcid":"https://orcid.org/0000-0003-0772-1698"},"institutions":[{"id":"https://openalex.org/I122941322","display_name":"Institut Sup\u00e9rieur d'\u00c9lectronique de Paris","ror":"https://ror.org/00yw34h52","country_code":"FR","type":"education","lineage":["https://openalex.org/I122941322"]}],"countries":["FR"],"is_corresponding":true,"raw_author_name":"Yousra Chabchoub","raw_affiliation_strings":["ISEP, 21 rue d\u2019assas, Paris, 75006, France","[ISEP, Paris, France]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ISEP, 21 rue d\u2019assas, Paris, 75006, France","institution_ids":["https://openalex.org/I122941322"]},{"raw_affiliation_string":"[ISEP, Paris, France]","institution_ids":["https://openalex.org/I122941322"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068533827","display_name":"Raja Chiky","orcid":null},"institutions":[{"id":"https://openalex.org/I122941322","display_name":"Institut Sup\u00e9rieur d'\u00c9lectronique de Paris","ror":"https://ror.org/00yw34h52","country_code":"FR","type":"education","lineage":["https://openalex.org/I122941322"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Raja Chiky","raw_affiliation_strings":["ISEP, 21 rue d\u2019assas, Paris, 75006, France","[ISEP, Paris, France]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ISEP, 21 rue d\u2019assas, Paris, 75006, France","institution_ids":["https://openalex.org/I122941322"]},{"raw_affiliation_string":"[ISEP, Paris, France]","institution_ids":["https://openalex.org/I122941322"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5086057292","display_name":"Bet\u00fcl Do\u011fan","orcid":null},"institutions":[{"id":"https://openalex.org/I122941322","display_name":"Institut Sup\u00e9rieur d'\u00c9lectronique de Paris","ror":"https://ror.org/00yw34h52","country_code":"FR","type":"education","lineage":["https://openalex.org/I122941322"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Betul Dogan","raw_affiliation_strings":["ISEP, 21 rue d\u2019assas, Paris, 75006, France","[ISEP, Paris, France]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ISEP, 21 rue d\u2019assas, Paris, 75006, France","institution_ids":["https://openalex.org/I122941322"]},{"raw_affiliation_string":"[ISEP, Paris, France]","institution_ids":["https://openalex.org/I122941322"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5013567133"],"corresponding_institution_ids":["https://openalex.org/I122941322"],"apc_list":{"value":1040,"currency":"USD","value_usd":1040},"apc_paid":{"value":1040,"currency":"USD","value_usd":1040},"fwci":0.3643,"has_fulltext":true,"cited_by_count":32,"citation_normalized_percentile":{"value":0.72976922,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":"2014","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9936000108718872,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8327716588973999},{"id":"https://openalex.org/keywords/ewma-chart","display_name":"EWMA chart","score":0.7627052068710327},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7062238454818726},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5421186089515686},{"id":"https://openalex.org/keywords/flooding","display_name":"Flooding (psychology)","score":0.5376978516578674},{"id":"https://openalex.org/keywords/port","display_name":"Port (circuit theory)","score":0.5364758372306824},{"id":"https://openalex.org/keywords/probabilistic-logic","display_name":"Probabilistic logic","score":0.46918416023254395},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.46123433113098145},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.4469633102416992},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.3971750736236572},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3824732005596161},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.17191657423973083},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.13954034447669983},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.13376972079277039}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8327716588973999},{"id":"https://openalex.org/C74746147","wikidata":"https://www.wikidata.org/wiki/Q5324652","display_name":"EWMA chart","level":4,"score":0.7627052068710327},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7062238454818726},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5421186089515686},{"id":"https://openalex.org/C186594467","wikidata":"https://www.wikidata.org/wiki/Q1429176","display_name":"Flooding (psychology)","level":2,"score":0.5376978516578674},{"id":"https://openalex.org/C32802771","wikidata":"https://www.wikidata.org/wiki/Q2443617","display_name":"Port (circuit theory)","level":2,"score":0.5364758372306824},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.46918416023254395},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.46123433113098145},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.4469633102416992},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3971750736236572},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3824732005596161},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.17191657423973083},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.13954034447669983},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.13376972079277039},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C196985124","wikidata":"https://www.wikidata.org/wiki/Q1369242","display_name":"Control chart","level":3,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1186/1687-417x-2014-5","is_oa":true,"landing_page_url":"https://doi.org/10.1186/1687-417x-2014-5","pdf_url":"https://link.springer.com/content/pdf/10.1186/1687-417X-2014-5.pdf","source":{"id":"https://openalex.org/S5820498","display_name":"EURASIP Journal on Information Security","issn_l":"1687-4161","issn":["1687-4161","1687-417X","2510-523X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EURASIP Journal on Information Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1186/1687-417x-2014-5","is_oa":true,"landing_page_url":"https://doi.org/10.1186/1687-417x-2014-5","pdf_url":"https://link.springer.com/content/pdf/10.1186/1687-417X-2014-5.pdf","source":{"id":"https://openalex.org/S5820498","display_name":"EURASIP Journal on Information Security","issn_l":"1687-4161","issn":["1687-4161","1687-417X","2510-523X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EURASIP Journal on Information Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2096494031.pdf","grobid_xml":"https://content.openalex.org/works/W2096494031.grobid-xml"},"referenced_works_count":32,"referenced_works":["https://openalex.org/W988335224","https://openalex.org/W1510018940","https://openalex.org/W1516000955","https://openalex.org/W1576185228","https://openalex.org/W1585854823","https://openalex.org/W1744212210","https://openalex.org/W1962585671","https://openalex.org/W1982092405","https://openalex.org/W1988300964","https://openalex.org/W2004110412","https://openalex.org/W2009074175","https://openalex.org/W2029785340","https://openalex.org/W2041453110","https://openalex.org/W2044036264","https://openalex.org/W2044535354","https://openalex.org/W2051903196","https://openalex.org/W2114398364","https://openalex.org/W2116523794","https://openalex.org/W2143991132","https://openalex.org/W2144982963","https://openalex.org/W2145603835","https://openalex.org/W2157202423","https://openalex.org/W2157974502","https://openalex.org/W2169662797","https://openalex.org/W2170196582","https://openalex.org/W2313953460","https://openalex.org/W2497014164","https://openalex.org/W2798058877","https://openalex.org/W4205431151","https://openalex.org/W4229980202","https://openalex.org/W4248979535","https://openalex.org/W4292483811"],"related_works":["https://openalex.org/W2054331165","https://openalex.org/W2791338065","https://openalex.org/W4385626305","https://openalex.org/W1500481227","https://openalex.org/W3006395403","https://openalex.org/W4200608769","https://openalex.org/W4294551911","https://openalex.org/W2349145360","https://openalex.org/W1994311829","https://openalex.org/W2891397355"],"abstract_inverted_index":{"IP":[0,38,91,169],"networks":[1],"are":[2],"constantly":[3],"targeted":[4],"by":[5,77,146,241],"new":[6],"techniques":[7],"of":[8,10,30,59,71,87,103,143,204,218,221,227],"denial":[9],"service":[11,21],"attacks":[12,32,180],"(SYN":[13],"flooding,":[14,18],"port":[15,53,88,161,178],"scan,":[16],"UDP":[17],"etc),":[19],"causing":[20],"disruption":[22],"and":[23,154,191,209],"considerable":[24],"financial":[25],"damage.":[26],"The":[27,159,196],"on-line":[28,50,144],"detection":[29],"DoS":[31],"in":[33,46,90,106,110,234],"the":[34,69,85,100,130,141,177,216,219,237,242],"current":[35],"high-bit":[36],"rate":[37],"traffic":[39,170],"is":[40,57,75,97,126,165,233],"a":[41,64,79,94,120,148,182,199,211],"big":[42],"challenge.":[43],"We":[44],"propose":[45],"this":[47],"paper":[48],"an":[49],"algorithm":[51,135,197],"for":[52],"scan":[54,89,162,179],"detection.":[55],"It":[56,174],"composed":[58],"two":[60],"complementary":[61],"parts:":[62],"First,":[63],"probabilistic":[65],"counting":[66],"part,":[67],"where":[68],"number":[70,102,220],"distinct":[72],"destination":[73,104,222],"ports":[74,105,223],"estimated":[76,101],"adapting":[78],"method":[80,164],"called":[81],"\u2018sliding":[82],"HyperLogLog\u2019":[83],"to":[84,108,119,140],"context":[86,142],"traffic.":[92,122],"Second,":[93],"decisional":[95],"mechanism":[96],"performed":[98],"on":[99,129,215],"order":[107],"detect":[109],"real":[111,168],"time":[112,185],"any":[113,193],"behavior":[114],"that":[115,137],"could":[116],"be":[117],"related":[118],"malicious":[121],"This":[123],"latter":[124],"part":[125],"mainly":[127],"based":[128],"exponentially":[131],"weighted":[132],"moving":[133],"average":[134],"(EWMA)":[136],"we":[138],"adapted":[139],"analysis":[145],"adding":[147],"learning":[149],"step":[150],"(supposed":[151],"without":[152,192],"attacks)":[153],"improving":[155],"its":[156],"update":[157],"mechanism.":[158],"obtained":[160],"detecting":[163],"tested":[166],"against":[167],"containing":[171],"some":[172],"attacks.":[173],"detects":[175],"all":[176],"within":[181],"very":[183,200,212],"short":[184],"response":[186],"(of":[187],"about":[188,228],"30":[189],"s)":[190],"false":[194],"positive.":[195],"uses":[198],"small":[201],"total":[202],"memory":[203],"less":[205],"than":[206],"22":[207],"kb":[208],"has":[210],"good":[213],"accuracy":[214],"estimation":[217],"(a":[224],"relative":[225],"error":[226],"3.25":[229],"%":[230],"),":[231],"which":[232],"agreement":[235],"with":[236],"theoretical":[238],"bounds":[239],"provided":[240],"sliding":[243],"HyperLogLog":[244],"algorithm.":[245]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":6},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":5},{"year":2017,"cited_by_count":1}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}