{"id":"https://openalex.org/W4415783324","doi":"https://doi.org/10.3389/fcomp.2025.1676362","title":"Anomaly detection in netflow traffic: workflow for dataset preparation and analysis","display_name":"Anomaly detection in netflow traffic: workflow for dataset preparation and analysis","publication_year":2025,"publication_date":"2025-11-03","ids":{"openalex":"https://openalex.org/W4415783324","doi":"https://doi.org/10.3389/fcomp.2025.1676362"},"language":"en","primary_location":{"id":"doi:10.3389/fcomp.2025.1676362","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fcomp.2025.1676362","pdf_url":"https://public-pages-files-2025.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2025.1676362/pdf","source":{"id":"https://openalex.org/S4210211086","display_name":"Frontiers in Computer Science","issn_l":"2624-9898","issn":["2624-9898"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computer Science","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://public-pages-files-2025.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2025.1676362/pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5062072881","display_name":"Evita Roponena","orcid":"https://orcid.org/0000-0002-0309-4730"},"institutions":[{"id":"https://openalex.org/I201787326","display_name":"Riga Technical University","ror":"https://ror.org/00twb6c09","country_code":"LV","type":"education","lineage":["https://openalex.org/I201787326"]}],"countries":["LV"],"is_corresponding":true,"raw_author_name":"Evita Roponena","raw_affiliation_strings":["Institute of Information Technology, Riga Technical University, Riga, Latvia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Technology, Riga Technical University, Riga, Latvia","institution_ids":["https://openalex.org/I201787326"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091399998","display_name":"Inese Po\u013caka","orcid":"https://orcid.org/0000-0002-9892-7765"},"institutions":[{"id":"https://openalex.org/I201787326","display_name":"Riga Technical University","ror":"https://ror.org/00twb6c09","country_code":"LV","type":"education","lineage":["https://openalex.org/I201787326"]}],"countries":["LV"],"is_corresponding":false,"raw_author_name":"Inese Po\u013caka","raw_affiliation_strings":["Institute of Information Technology, Riga Technical University, Riga, Latvia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Technology, Riga Technical University, Riga, Latvia","institution_ids":["https://openalex.org/I201787326"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5120227027","display_name":"Ja \u0304 nis Grabis","orcid":null},"institutions":[{"id":"https://openalex.org/I201787326","display_name":"Riga Technical University","ror":"https://ror.org/00twb6c09","country_code":"LV","type":"education","lineage":["https://openalex.org/I201787326"]}],"countries":["LV"],"is_corresponding":false,"raw_author_name":"Ja\u00af nis Grabis","raw_affiliation_strings":["Institute of Information Technology, Riga Technical University, Riga, Latvia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Technology, Riga Technical University, Riga, Latvia","institution_ids":["https://openalex.org/I201787326"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5062072881"],"corresponding_institution_ids":["https://openalex.org/I201787326"],"apc_list":{"value":1285,"currency":"USD","value_usd":1285},"apc_paid":{"value":1285,"currency":"USD","value_usd":1285},"fwci":0.6625,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.75924067,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"7","issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.44110000133514404,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.44110000133514404,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.15929999947547913,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.09640000015497208,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.9531000256538391},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7275000214576721},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6402999758720398},{"id":"https://openalex.org/keywords/reliability","display_name":"Reliability (semiconductor)","score":0.5267000198364258},{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.5170000195503235},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4499000012874603},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4311000108718872},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4077000021934509}],"concepts":[{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.9531000256538391},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7498999834060669},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7275000214576721},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6402999758720398},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6284999847412109},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.5267000198364258},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.5170000195503235},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4499000012874603},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4311000108718872},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4077000021934509},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.40689998865127563},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.3950999975204468},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.36160001158714294},{"id":"https://openalex.org/C67363961","wikidata":"https://www.wikidata.org/wiki/Q5268834","display_name":"Information and Communications Technology","level":2,"score":0.32260000705718994},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.31049999594688416},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.2989000082015991},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2946999967098236},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.2937000095844269},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.27900001406669617},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.27720001339912415},{"id":"https://openalex.org/C2776666747","wikidata":"https://www.wikidata.org/wiki/Q1135322","display_name":"Modbus","level":3,"score":0.2678999900817871},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26089999079704285},{"id":"https://openalex.org/C111012933","wikidata":"https://www.wikidata.org/wiki/Q3137210","display_name":"Rough set","level":2,"score":0.2563999891281128}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3389/fcomp.2025.1676362","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fcomp.2025.1676362","pdf_url":"https://public-pages-files-2025.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2025.1676362/pdf","source":{"id":"https://openalex.org/S4210211086","display_name":"Frontiers in Computer Science","issn_l":"2624-9898","issn":["2624-9898"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computer Science","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:fd5e1617689d4ae893b0626ffef2c2c9","is_oa":true,"landing_page_url":"https://doaj.org/article/fd5e1617689d4ae893b0626ffef2c2c9","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Frontiers in Computer Science, Vol 7 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3389/fcomp.2025.1676362","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fcomp.2025.1676362","pdf_url":"https://public-pages-files-2025.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2025.1676362/pdf","source":{"id":"https://openalex.org/S4210211086","display_name":"Frontiers in Computer Science","issn_l":"2624-9898","issn":["2624-9898"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4415783324.pdf"},"referenced_works_count":18,"referenced_works":["https://openalex.org/W2011430131","https://openalex.org/W2166870846","https://openalex.org/W2281805729","https://openalex.org/W2296509296","https://openalex.org/W2466916924","https://openalex.org/W2778920369","https://openalex.org/W2789828921","https://openalex.org/W2924689635","https://openalex.org/W2945437145","https://openalex.org/W3001129757","https://openalex.org/W3003257820","https://openalex.org/W3120695945","https://openalex.org/W3217156894","https://openalex.org/W4309224780","https://openalex.org/W4318677156","https://openalex.org/W4376649286","https://openalex.org/W4385692127","https://openalex.org/W4404103229"],"related_works":[],"abstract_inverted_index":{"Information":[0],"and":[1,13,35,61,87,128,139,166,181,203,215],"communication":[2],"technology":[3],"(ICT)":[4],"is":[5,29,70],"crucial":[6,30],"for":[7,31,109,115,157,164,168],"maintaining":[8,32],"efficient":[9],"communications,":[10],"enhancing":[11],"processes,":[12],"enabling":[14],"digital":[15,33],"transformation.":[16],"As":[17],"ICT":[18,59],"becomes":[19],"increasingly":[20],"significant":[21],"in":[22,90,178],"our":[23],"everyday":[24],"lives,":[25],"ensuring":[26],"its":[27],"security":[28],"trust":[34],"resilience":[36],"against":[37],"evolving":[38],"cyber":[39],"threats.":[40],"These":[41],"technologies":[42],"generate":[43],"a":[44,71,107,111,119,182,194],"large":[45],"amount":[46],"of":[47,105,113,124,155,172,200,207,218],"data":[48],"that":[49,74,196],"should":[50],"be":[51,76],"analyzed":[52,127],"simultaneously":[53],"to":[54,57,78,101,184],"detect":[55,88],"threats":[56],"an":[58,103,170],"system":[60],"protect":[62],"the":[63,95,135,143,173,198,205,208,219],"sensitive":[64],"information":[65],"it":[66],"may":[67],"contain.":[68],"NetFlow":[69,116],"network":[72,80],"protocol":[73],"can":[75],"used":[77,177],"monitor":[79],"traffic,":[81],"collect":[82],"Internet":[83],"Protocol":[84],"(IP)":[85],"addresses,":[86],"anomalies":[89],"NetFlow.":[91],"The":[92,122,149],"article":[93],"follows":[94],"design":[96],"science":[97],"research":[98,180],"(DSR)":[99],"methodology":[100],"reach":[102],"objective":[104],"providing":[106],"methods":[108,161,176],"developing":[110],"set":[112],"features":[114,125,156,163],"analysis":[117],"with":[118,134],"machine":[120,159,187],"learning.":[121],"sets":[123,154],"were":[126],"validated":[129],"by":[130],"implementing":[131],"anomaly":[132,174],"detection":[133,175],"K-means":[136],"clustering":[137,165],"algorithm":[138],"time-series":[140],"forecasting":[141],"using":[142],"long":[144],"short-term":[145],"memory":[146],"(LSTM)":[147],"method.":[148],"study":[150,192],"provides":[151],"two":[152],"separate":[153],"both":[158,186,201],"learning":[160,188],"(24":[162],"14":[167],"LSTM),":[169],"overview":[171],"this":[179,191],"method":[183,195],"combine":[185],"approaches.":[189],"Furthermore,":[190],"introduces":[193],"integrates":[197],"outputs":[199],"models":[202],"evaluates":[204],"reliability":[206],"final":[209],"decision":[210],"based":[211],"on":[212],"Bayes'":[213],"theorem":[214],"previous":[216],"performance":[217],"models.":[220]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-08-03T07:22:36.454288","created_date":"2025-11-03T00:00:00"}