{"id":"https://openalex.org/W4405444728","doi":"https://doi.org/10.3390/fi16120470","title":"Characterising Payload Entropy in Packet Flows\u2014Baseline Entropy Analysis for Network Anomaly Detection","display_name":"Characterising Payload Entropy in Packet Flows\u2014Baseline Entropy Analysis for Network Anomaly Detection","publication_year":2024,"publication_date":"2024-12-16","ids":{"openalex":"https://openalex.org/W4405444728","doi":"https://doi.org/10.3390/fi16120470"},"language":"en","primary_location":{"id":"doi:10.3390/fi16120470","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi16120470","pdf_url":"https://www.mdpi.com/1999-5903/16/12/470/pdf?version=1734341610","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1999-5903/16/12/470/pdf?version=1734341610","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5078916182","display_name":"Anthony J. Kenyon","orcid":"https://orcid.org/0000-0003-2249-2184"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Anthony Kenyon","raw_affiliation_strings":["Hyperscalar Ltd., High Wycombe HP22 4LW, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hyperscalar Ltd., High Wycombe HP22 4LW, UK","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056865979","display_name":"Lipika Deka","orcid":"https://orcid.org/0000-0001-8986-884X"},"institutions":[{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Lipika Deka","raw_affiliation_strings":["School of Computer Science and Informatics, De Montfort University, Leicester LE1 9BH, UK"],"raw_orcid":"https://orcid.org/0000-0001-8986-884X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Informatics, De Montfort University, Leicester LE1 9BH, UK","institution_ids":["https://openalex.org/I66943878"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5055283205","display_name":"David Elizondo","orcid":"https://orcid.org/0000-0002-7398-5870"},"institutions":[{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"David Elizondo","raw_affiliation_strings":["School of Computer Science and Informatics, De Montfort University, Leicester LE1 9BH, UK"],"raw_orcid":"https://orcid.org/0000-0002-7398-5870","affiliations":[{"raw_affiliation_string":"School of Computer Science and Informatics, De Montfort University, Leicester LE1 9BH, UK","institution_ids":["https://openalex.org/I66943878"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5056865979"],"corresponding_institution_ids":["https://openalex.org/I66943878"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1782},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1782},"fwci":0.8664,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.75206213,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"16","issue":"12","first_page":"470","last_page":"470"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8424235582351685},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7139431238174438},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6171494722366333},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.5776617527008057},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.5146892666816711},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.5133734941482544},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.40804269909858704},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.35334452986717224},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3514060378074646},{"id":"https://openalex.org/keywords/geology","display_name":"Geology","score":0.08079397678375244},{"id":"https://openalex.org/keywords/physics","display_name":"Physics","score":0.06958681344985962}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8424235582351685},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7139431238174438},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6171494722366333},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.5776617527008057},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.5146892666816711},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.5133734941482544},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.40804269909858704},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.35334452986717224},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3514060378074646},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.08079397678375244},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.06958681344985962},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C111368507","wikidata":"https://www.wikidata.org/wiki/Q43518","display_name":"Oceanography","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/fi16120470","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi16120470","pdf_url":"https://www.mdpi.com/1999-5903/16/12/470/pdf?version=1734341610","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:2b01e2819c924d50901b390678bfb29e","is_oa":true,"landing_page_url":"https://doaj.org/article/2b01e2819c924d50901b390678bfb29e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet, Vol 16, Iss 12, p 470 (2024)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/fi16120470","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi16120470","pdf_url":"https://www.mdpi.com/1999-5903/16/12/470/pdf?version=1734341610","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/8","score":0.47999998927116394,"display_name":"Decent work and economic growth"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4405444728.pdf","grobid_xml":"https://content.openalex.org/works/W4405444728.grobid-xml"},"referenced_works_count":30,"referenced_works":["https://openalex.org/W40890042","https://openalex.org/W1542497361","https://openalex.org/W1553465615","https://openalex.org/W1978021206","https://openalex.org/W1993704367","https://openalex.org/W1995875735","https://openalex.org/W1999120268","https://openalex.org/W2023031438","https://openalex.org/W2024550571","https://openalex.org/W2044125499","https://openalex.org/W2047167450","https://openalex.org/W2053550965","https://openalex.org/W2078396547","https://openalex.org/W2083485408","https://openalex.org/W2099137371","https://openalex.org/W2128026534","https://openalex.org/W2150423842","https://openalex.org/W2152125195","https://openalex.org/W2171622696","https://openalex.org/W2268383675","https://openalex.org/W2602876175","https://openalex.org/W2783245345","https://openalex.org/W2806076636","https://openalex.org/W2887605656","https://openalex.org/W3084110275","https://openalex.org/W3199888168","https://openalex.org/W4239856175","https://openalex.org/W4312360539","https://openalex.org/W4312374806","https://openalex.org/W6719054786"],"related_works":["https://openalex.org/W1535080110","https://openalex.org/W306312984","https://openalex.org/W857189463","https://openalex.org/W4288094128","https://openalex.org/W2979675132","https://openalex.org/W2790520092","https://openalex.org/W2383111961","https://openalex.org/W2365952365","https://openalex.org/W2352448290","https://openalex.org/W3160314615"],"abstract_inverted_index":{"The":[0],"accurate":[1],"and":[2,15,110,164,180,202],"timely":[3],"detection":[4,23],"of":[5,27,30,44,60,114,126],"cyber":[6],"threats":[7],"is":[8,24,54,98,119],"critical":[9],"to":[10,55,102,123,153],"keeping":[11],"our":[12,127],"online":[13],"economy":[14],"data":[16,118],"safe.":[17],"A":[18],"key":[19],"technique":[20],"in":[21,47,68,116],"early":[22],"the":[25,45,57,61,112,124,195],"classification":[26],"unusual":[28],"patterns":[29],"network":[31,140,162],"behaviour,":[32],"often":[33,71],"hidden":[34],"as":[35,75,90],"low-frequency":[36],"events":[37],"within":[38,63,190],"complex":[39],"time-series":[40],"packet":[41,117,151,176,182],"flows.":[42],"One":[43],"ways":[46],"which":[48],"such":[49],"anomalies":[50],"can":[51,70,187],"be":[52,188],"detected":[53],"analyse":[56,148],"information":[58,157],"entropy":[59,69,105,115,136,158,173,185],"payload":[62,135,156],"individual":[64],"packets,":[65],"since":[66],"changes":[67],"indicate":[72],"suspicious":[73],"activity\u2014such":[74],"whether":[76,83,96],"session":[77],"encryption":[78],"has":[79,87],"been":[80,88],"compromised,":[81],"or":[82],"a":[84,91],"plaintext":[85],"channel":[86],"co-opted":[89],"covert":[92],"channel.":[93],"To":[94],"decide":[95],"activity":[97],"anomalous,":[99],"we":[100,147,166],"need":[101],"compare":[103],"real-time":[104,179],"values":[106,159],"with":[107],"baseline":[108,155],"values,":[109],"while":[111],"analysis":[113,201],"not":[120],"particularly":[121],"new,":[122],"best":[125],"knowledge,":[128],"there":[129],"are":[130],"no":[131],"published":[132],"baselines":[133],"for":[134,160,171,199],"across":[137],"commonly":[138],"used":[139],"services.":[141],"We":[142],"offer":[143],"two":[144],"contributions:":[145],"(1)":[146],"several":[149],"large":[150],"datasets":[152],"establish":[154],"standard":[161],"services,":[163],"(2)":[165],"present":[167],"an":[168],"efficient":[169],"method":[170],"engineering":[172],"metrics":[174,186],"from":[175,178],"flows":[177],"offline":[181],"data.":[183],"Such":[184],"included":[189],"feature":[191,196],"subsets,":[192],"thus":[193],"making":[194],"set":[197],"richer":[198],"subsequent":[200],"machine":[203],"learning":[204],"applications.":[205]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}