{"id":"https://openalex.org/W2127575210","doi":"https://doi.org/10.3233/jcs-2004-12201","title":"Coordinated Internet attacks: responding to attack complexity","display_name":"Coordinated Internet attacks: responding to attack complexity","publication_year":2004,"publication_date":"2004-02-01","ids":{"openalex":"https://openalex.org/W2127575210","doi":"https://doi.org/10.3233/jcs-2004-12201","mag":"2127575210"},"language":"en","primary_location":{"id":"doi:10.3233/jcs-2004-12201","is_oa":false,"landing_page_url":"https://doi.org/10.3233/jcs-2004-12201","pdf_url":null,"source":{"id":"https://openalex.org/S106992369","display_name":"Journal of Computer Security","issn_l":"0926-227X","issn":["0926-227X","1875-8924"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318577","host_organization_name":"IOS Press","host_organization_lineage":["https://openalex.org/P4310318577"],"host_organization_lineage_names":["IOS Press"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017966769","display_name":"Dirk Ourston","orcid":null},"institutions":[{"id":"https://openalex.org/I4388482719","display_name":"Applied Research Laboratories, The University of Texas at Austin","ror":"https://ror.org/053wph561","country_code":null,"type":"facility","lineage":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"id":"https://openalex.org/I86519309","display_name":"The University of Texas at Austin","ror":"https://ror.org/00hj54h04","country_code":"US","type":"education","lineage":["https://openalex.org/I86519309"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Dirk Ourston","raw_affiliation_strings":["Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","E-mail:","Fax: 512-490-4254"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","institution_ids":["https://openalex.org/I86519309"]},{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","institution_ids":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"raw_affiliation_string":"E-mail:","institution_ids":[]},{"raw_affiliation_string":"Fax: 512-490-4254","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007217630","display_name":"Sara Matzner","orcid":null},"institutions":[{"id":"https://openalex.org/I4388482719","display_name":"Applied Research Laboratories, The University of Texas at Austin","ror":"https://ror.org/053wph561","country_code":null,"type":"facility","lineage":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"id":"https://openalex.org/I86519309","display_name":"The University of Texas at Austin","ror":"https://ror.org/00hj54h04","country_code":"US","type":"education","lineage":["https://openalex.org/I86519309"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sara Matzner","raw_affiliation_strings":["Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","E-mail:","Fax: 512-490-4254"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","institution_ids":["https://openalex.org/I86519309"]},{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","institution_ids":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"raw_affiliation_string":"E-mail:","institution_ids":[]},{"raw_affiliation_string":"Fax: 512-490-4254","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021305741","display_name":"William Stump","orcid":null},"institutions":[{"id":"https://openalex.org/I4388482719","display_name":"Applied Research Laboratories, The University of Texas at Austin","ror":"https://ror.org/053wph561","country_code":null,"type":"facility","lineage":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"id":"https://openalex.org/I86519309","display_name":"The University of Texas at Austin","ror":"https://ror.org/00hj54h04","country_code":"US","type":"education","lineage":["https://openalex.org/I86519309"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"William Stump","raw_affiliation_strings":["Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","E-mail:","Fax: 512-490-4254"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","institution_ids":["https://openalex.org/I86519309"]},{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","institution_ids":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"raw_affiliation_string":"E-mail:","institution_ids":[]},{"raw_affiliation_string":"Fax: 512-490-4254","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5108259620","display_name":"Bryan Hopkins","orcid":null},"institutions":[{"id":"https://openalex.org/I4388482719","display_name":"Applied Research Laboratories, The University of Texas at Austin","ror":"https://ror.org/053wph561","country_code":null,"type":"facility","lineage":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"id":"https://openalex.org/I86519309","display_name":"The University of Texas at Austin","ror":"https://ror.org/00hj54h04","country_code":"US","type":"education","lineage":["https://openalex.org/I86519309"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bryan Hopkins","raw_affiliation_strings":["Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","E-mail:","Fax: 512-490-4254"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ;, , ,","institution_ids":["https://openalex.org/I86519309"]},{"raw_affiliation_string":"Applied Research Laboratories, The University of Texas at Austin, P.O. Box 8029, Austin, TX 78713-8029, USA Tel.: ; Fax: ; E-mail: ourston@arlut.utexas.edu, matzner@arlut.utexas.edu, stump@arlut.utexas.edu, bhopkins@arlut.utexas.edu","institution_ids":["https://openalex.org/I4388482719","https://openalex.org/I86519309"]},{"raw_affiliation_string":"E-mail:","institution_ids":[]},{"raw_affiliation_string":"Fax: 512-490-4254","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5017966769"],"corresponding_institution_ids":["https://openalex.org/I4388482719","https://openalex.org/I86519309"],"apc_list":null,"apc_paid":null,"fwci":2.017,"has_fulltext":false,"cited_by_count":29,"citation_normalized_percentile":{"value":0.90310621,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":96},"biblio":{"volume":"12","issue":"2","first_page":"165","last_page":"190"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8278800249099731},{"id":"https://openalex.org/keywords/hidden-markov-model","display_name":"Hidden Markov model","score":0.7436637282371521},{"id":"https://openalex.org/keywords/decision-tree","display_name":"Decision tree","score":0.7129164338111877},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5999395847320557},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5430294275283813},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5215516090393066},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4749370217323303},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.46596741676330566},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.44543954730033875},{"id":"https://openalex.org/keywords/tree","display_name":"Tree (set theory)","score":0.4339463412761688},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.0804336667060852},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.06483921408653259}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8278800249099731},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.7436637282371521},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.7129164338111877},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5999395847320557},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5430294275283813},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5215516090393066},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4749370217323303},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.46596741676330566},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.44543954730033875},{"id":"https://openalex.org/C113174947","wikidata":"https://www.wikidata.org/wiki/Q2859736","display_name":"Tree (set theory)","level":2,"score":0.4339463412761688},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0804336667060852},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.06483921408653259},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3233/jcs-2004-12201","is_oa":false,"landing_page_url":"https://doi.org/10.3233/jcs-2004-12201","pdf_url":null,"source":{"id":"https://openalex.org/S106992369","display_name":"Journal of Computer Security","issn_l":"0926-227X","issn":["0926-227X","1875-8924"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318577","host_organization_name":"IOS Press","host_organization_lineage":["https://openalex.org/P4310318577"],"host_organization_lineage_names":["IOS Press"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6100000143051147,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W129457532","https://openalex.org/W162146437","https://openalex.org/W200042785","https://openalex.org/W1536719366","https://openalex.org/W1536864280","https://openalex.org/W1543388142","https://openalex.org/W1566768828","https://openalex.org/W1582506709","https://openalex.org/W1583975142","https://openalex.org/W1589835178","https://openalex.org/W1912982817","https://openalex.org/W1966454457","https://openalex.org/W2028276885","https://openalex.org/W2073165180","https://openalex.org/W2084416457","https://openalex.org/W2096942889","https://openalex.org/W2105594594","https://openalex.org/W2108867737","https://openalex.org/W2123504579","https://openalex.org/W2129860818","https://openalex.org/W2147169507","https://openalex.org/W2160929103","https://openalex.org/W2170335877","https://openalex.org/W2795859624","https://openalex.org/W2942804451","https://openalex.org/W2966207845","https://openalex.org/W3148186152"],"related_works":["https://openalex.org/W2364370872","https://openalex.org/W2053269318","https://openalex.org/W2025614924","https://openalex.org/W2294335174","https://openalex.org/W2097963413","https://openalex.org/W1591475660","https://openalex.org/W2001275470","https://openalex.org/W2073996508","https://openalex.org/W2122022187","https://openalex.org/W2115529843"],"abstract_inverted_index":{"This":[0,188],"paper":[1],"examines":[2],"the":[3,57,60,95,129,139,169,172,182,193],"issues":[4],"involved":[5,97],"with":[6,118],"responding":[7],"to":[8,31,40,55,67,106,166],"complex":[9],"Internet":[10],"attacks.":[11],"Such":[12],"attacks":[13],"characteristically":[14],"occur":[15],"in":[16,27,46],"stages":[17,35],"over":[18,138,150,161],"extended":[19],"periods":[20],"of":[21,59,82,100,103,108,171,184,202],"time":[22],"and":[23,48,126,143],"allow":[24],"specific":[25],"actions":[26],"a":[28,88,146,203],"particular":[29,204],"stage":[30],"be":[32,37,52],"interchangeable.":[33],"The":[34,157,175],"can":[36,51],"extremely":[38],"difficult":[39],"correlate":[41],"because":[42],"they":[43],"are":[44,207],"separated":[45],"time,":[47],"these":[49,78],"effects":[50],"deliberately":[53],"obscured":[54],"achieve":[56],"goals":[58],"attacker.":[61],"We":[62],"have":[63,197],"chosen":[64],"an":[65,133],"approach":[66],"intrusion":[68],"detection":[69],"using":[70],"Hidden":[71],"Markov":[72],"Models":[73],"(HMMs)":[74],"that":[75,93,99,107,192],"explicitly":[76],"addresses":[77],"issues.":[79],"As":[80],"part":[81],"our":[83],"research":[84],"we":[85],"also":[86,179],"developed":[87],"methodology":[89],"for":[90],"labeling":[91,101,109],"examples":[92,105,186,201],"reduced":[94],"effort":[96],"from":[98],"thousands":[102],"training":[104,155,185],"less":[110],"than":[111],"two":[112,119],"hundred":[113],"feature":[114],"values.":[115],"When":[116],"compared":[117],"classic":[120],"machine":[121],"learning":[122],"algorithms,":[123],"decision":[124,140,162],"trees":[125,163],"neural":[127,151],"nets,":[128,152],"HMM":[130,158,176,194],"algorithm":[131,195],"provides":[132],"approximately":[134],"five-%":[135],"performance":[136,159,177],"advantage":[137,149,160,178],"tree":[141],"algorithm,":[142],"at":[144,153],"least":[145],"thirty":[147],"%":[148],"all":[154],"levels.":[156],"is":[164],"shown":[165],"increase":[167],"as":[168,181],"complexity":[170],"attack":[173,205],"increases.":[174],"increases":[180],"number":[183],"decreases.":[187],"last":[189],"result":[190],"indicates":[191],"may":[196],"additional":[198],"benefit":[199],"when":[200],"type":[206],"rare.":[208]},"counts_by_year":[{"year":2019,"cited_by_count":1},{"year":2017,"cited_by_count":1},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":2},{"year":2013,"cited_by_count":2},{"year":2012,"cited_by_count":2}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}