{"id":"https://openalex.org/W2069198714","doi":"https://doi.org/10.4304/jsw.9.4.985-990","title":"Mining Web User Behaviors to Detect Application Layer DDoS Attacks","display_name":"Mining Web User Behaviors to Detect Application Layer DDoS Attacks","publication_year":2014,"publication_date":"2014-04-01","ids":{"openalex":"https://openalex.org/W2069198714","doi":"https://doi.org/10.4304/jsw.9.4.985-990","mag":"2069198714"},"language":"en","primary_location":{"id":"doi:10.4304/jsw.9.4.985-990","is_oa":false,"landing_page_url":"https://doi.org/10.4304/jsw.9.4.985-990","pdf_url":null,"source":{"id":"https://openalex.org/S114141714","display_name":"Journal of Software","issn_l":"1796-217X","issn":["1796-217X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318660","host_organization_name":"Academy Publisher","host_organization_lineage":["https://openalex.org/P4310318660"],"host_organization_lineage_names":["Academy Publisher"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Software","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5072270290","display_name":"Chuibi Huang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chuibi Huang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101790108","display_name":"Jinlin Wang","orcid":"https://orcid.org/0000-0003-1113-5835"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jinlin Wang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102784667","display_name":"Gang Wu","orcid":"https://orcid.org/0000-0002-8219-2282"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gang Wu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5049255575","display_name":"Jun Chen","orcid":"https://orcid.org/0000-0001-5944-8561"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jun Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6965,"has_fulltext":false,"cited_by_count":13,"citation_normalized_percentile":{"value":0.75452533,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"9","issue":"4","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.9335654973983765},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7636821269989014},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.6057831048965454},{"id":"https://openalex.org/keywords/application-layer","display_name":"Application layer","score":0.5830835103988647},{"id":"https://openalex.org/keywords/layer","display_name":"Layer (electronics)","score":0.4362673759460449},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.40592217445373535},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3486120104789734},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.336048424243927},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.16980451345443726},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.1672772467136383}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9335654973983765},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7636821269989014},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.6057831048965454},{"id":"https://openalex.org/C190793597","wikidata":"https://www.wikidata.org/wiki/Q189768","display_name":"Application layer","level":3,"score":0.5830835103988647},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.4362673759460449},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.40592217445373535},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3486120104789734},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.336048424243927},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.16980451345443726},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1672772467136383},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.0},{"id":"https://openalex.org/C178790620","wikidata":"https://www.wikidata.org/wiki/Q11351","display_name":"Organic chemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.4304/jsw.9.4.985-990","is_oa":false,"landing_page_url":"https://doi.org/10.4304/jsw.9.4.985-990","pdf_url":null,"source":{"id":"https://openalex.org/S114141714","display_name":"Journal of Software","issn_l":"1796-217X","issn":["1796-217X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318660","host_organization_name":"Academy Publisher","host_organization_lineage":["https://openalex.org/P4310318660"],"host_organization_lineage_names":["Academy Publisher"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Software","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W1978502884","https://openalex.org/W1983543414","https://openalex.org/W1999942143","https://openalex.org/W2035536878","https://openalex.org/W2042640362","https://openalex.org/W2061820436","https://openalex.org/W2063704824","https://openalex.org/W2106796827","https://openalex.org/W2113771737","https://openalex.org/W2123573631","https://openalex.org/W2124589355","https://openalex.org/W2125513999","https://openalex.org/W2125838338","https://openalex.org/W2153331007","https://openalex.org/W2155883880","https://openalex.org/W2167733259","https://openalex.org/W2170529556","https://openalex.org/W2170874246","https://openalex.org/W2917878349","https://openalex.org/W6677229590","https://openalex.org/W6678523554"],"related_works":["https://openalex.org/W2908108831","https://openalex.org/W2375951120","https://openalex.org/W3005836778","https://openalex.org/W2754163055","https://openalex.org/W2552641916","https://openalex.org/W4254515188","https://openalex.org/W2591571751","https://openalex.org/W2784282778","https://openalex.org/W2954653956","https://openalex.org/W2991861214"],"abstract_inverted_index":{"Distributed":[0],"Denial":[1],"of":[2,80,101,109,126,139],"Service":[3],"(DDoS)":[4],"attacks":[5,16,68],"have":[6],"caused":[7],"continuous":[8],"critical":[9],"threats":[10],"to":[11,62,75,96,115,135],"the":[12,21,32,44,64,77,81,86,98,107,110,116,124,127,137],"Internet":[13],"services.":[14],"DDoS":[15,25,47,67],"are":[17,29,39,133],"generally":[18],"conducted":[19,134],"at":[20],"network":[22],"layer.":[23],"Many":[24],"attack":[26],"detection":[27],"methods":[28],"focused":[30],"on":[31,57,85],"IP":[33],"and":[34,142],"TCP":[35],"layers.":[36],"However,":[37],"they":[38],"not":[40],"suitable":[41],"for":[42],"detecting":[43],"application":[45,65],"layer":[46,66],"attacks.":[48],"In":[49],"this":[50],"paper,":[51],"we":[52],"propose":[53],"a":[54],"scheme":[55],"based":[56],"web":[58,82,102],"user":[59],"browsing":[60,99],"behaviors":[61,100],"detect":[63],"(app-DDoS).":[69],"A":[70],"clustering":[71],"method":[72],"is":[73,94],"applied":[74],"extract":[76],"access":[78,87],"features":[79],"objects.":[83],"Based":[84],"features,":[88],"an":[89],"extended":[90],"hidden":[91,117],"semi-Markov":[92,118],"model":[93,119,141],"proposed":[95],"describe":[97],"user.":[103],"The":[104],"deviation":[105],"from":[106],"entropy":[108],"training":[111],"data":[112,129],"set":[113],"fitting":[114],"can":[120],"be":[121],"considered":[122],"as":[123],"abnormality":[125],"observed":[128],"set.":[130],"Finally":[131],"experiments":[132],"demonstrate":[136],"effectiveness":[138],"our":[140],"algorithm.":[143]},"counts_by_year":[{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":7},{"year":2017,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}