{"id":"https://openalex.org/W7150834367","doi":"https://doi.org/10.48550/arxiv.2604.02379","title":"Cardinality is Not Enough: Super Host Detection via Segmented Cardinality Estimation","display_name":"Cardinality is Not Enough: Super Host Detection via Segmented Cardinality Estimation","publication_year":2026,"publication_date":"2026-04-01","ids":{"openalex":"https://openalex.org/W7150834367","doi":"https://doi.org/10.48550/arxiv.2604.02379"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.02379","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02379","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.02379","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081740569","display_name":"Yilin Zhao","orcid":"https://orcid.org/0000-0001-7203-227X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Yilin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133051359","display_name":"Jiawei Huang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Jiawei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101310947","display_name":"Xianshi Su","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Su, Xianshi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133036579","display_name":"Weihe Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Weihe","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133035985","display_name":"Xin Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Xin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133024028","display_name":"Yan Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031225045","display_name":"Jiacheng Xie","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xie, Jiacheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083406768","display_name":"Qichen Su","orcid":"https://orcid.org/0000-0002-1738-4325"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Su, Qichen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133005348","display_name":"Jin Ye","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ye, Jin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027239963","display_name":"Wanchun Jiang","orcid":"https://orcid.org/0000-0001-5067-321X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Wanchun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133056176","display_name":"Jianxin Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Jianxin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8384000062942505,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8384000062942505,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.02710000053048134,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.02070000022649765,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cardinality","display_name":"Cardinality (data modeling)","score":0.8985999822616577},{"id":"https://openalex.org/keywords/subnet","display_name":"Subnet","score":0.6769999861717224},{"id":"https://openalex.org/keywords/prefix","display_name":"Prefix","score":0.6682000160217285},{"id":"https://openalex.org/keywords/hash-function","display_name":"Hash function","score":0.5764999985694885},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5738000273704529},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.41670000553131104},{"id":"https://openalex.org/keywords/locality-sensitive-hashing","display_name":"Locality-sensitive hashing","score":0.34850001335144043},{"id":"https://openalex.org/keywords/hamming-distance","display_name":"Hamming distance","score":0.3427000045776367}],"concepts":[{"id":"https://openalex.org/C87117476","wikidata":"https://www.wikidata.org/wiki/Q362383","display_name":"Cardinality (data modeling)","level":2,"score":0.8985999822616577},{"id":"https://openalex.org/C21099817","wikidata":"https://www.wikidata.org/wiki/Q7631721","display_name":"Subnet","level":2,"score":0.6769999861717224},{"id":"https://openalex.org/C141603448","wikidata":"https://www.wikidata.org/wiki/Q134830","display_name":"Prefix","level":2,"score":0.6682000160217285},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.600600004196167},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.5764999985694885},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5738000273704529},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4487999975681305},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.41670000553131104},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.41269999742507935},{"id":"https://openalex.org/C74270461","wikidata":"https://www.wikidata.org/wiki/Q1625299","display_name":"Locality-sensitive hashing","level":4,"score":0.34850001335144043},{"id":"https://openalex.org/C193319292","wikidata":"https://www.wikidata.org/wiki/Q272172","display_name":"Hamming distance","level":2,"score":0.3427000045776367},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.3073999881744385},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.3037000000476837},{"id":"https://openalex.org/C38349280","wikidata":"https://www.wikidata.org/wiki/Q1434290","display_name":"Flow (mathematics)","level":2,"score":0.29499998688697815},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.2825999855995178},{"id":"https://openalex.org/C49781872","wikidata":"https://www.wikidata.org/wiki/Q1045555","display_name":"Maximum likelihood","level":2,"score":0.2806999981403351},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.2689000070095062},{"id":"https://openalex.org/C142853389","wikidata":"https://www.wikidata.org/wiki/Q744778","display_name":"Association (psychology)","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C147224247","wikidata":"https://www.wikidata.org/wiki/Q885373","display_name":"Bloom filter","level":2,"score":0.25839999318122864},{"id":"https://openalex.org/C116058348","wikidata":"https://www.wikidata.org/wiki/Q846912","display_name":"Universal hashing","level":5,"score":0.25130000710487366},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.2502000033855438}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.02379","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02379","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.02379","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02379","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7127595543861389}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Accurately":[0],"detecting":[1],"super":[2,53],"host":[3,54],"that":[4,48,101],"establishes":[5],"connections":[6,35],"to":[7,40,108,121,141,144],"a":[8,49,96,103],"large":[9],"number":[10,32],"of":[11,24,33,113],"distinct":[12,34],"peers":[13],"is":[14],"significant":[15],"for":[16],"mitigating":[17],"web":[18,25],"attacks":[19],"and":[20,69,116],"ensuring":[21],"high":[22,65,86],"quality":[23],"service.":[26],"Existing":[27],"sketch-based":[28],"approaches":[29,75],"estimate":[30],"the":[31,46,60],"called":[36],"flow":[37,78],"cardinality":[38,79,98,118],"according":[39],"full":[41],"IP":[42,114],"addresses,":[43,115],"while":[44],"ignoring":[45],"fact":[47],"malicious":[50],"or":[51],"victim":[52],"often":[55],"communicates":[56],"with":[57],"hosts":[58],"within":[59,119],"same":[61],"subnet,":[62,81],"resulting":[63],"in":[64,80],"false":[66],"positive":[67],"rates":[68],"low":[70],"accuracy.":[71],"Though":[72],"hierarchical-structure":[73],"based":[74],"could":[76],"capture":[77],"they":[82],"inherently":[83],"suffer":[84],"from":[85],"memory":[87,127,150],"usage.":[88],"To":[89],"address":[90],"these":[91],"limitations,":[92],"we":[93],"propose":[94],"SegSketch,":[95],"segmented":[97],"estimation":[99],"approach":[100],"employs":[102],"lightweight":[104],"halved-segment":[105],"hashing":[106],"strategy":[107],"infer":[109],"common":[110],"prefix":[111],"lengths":[112],"estimates":[117],"subnet":[120],"enhance":[122],"detection":[123],"accuracy":[124],"under":[125,148],"constrained":[126],"size.":[128],"Experiments":[129],"driven":[130],"by":[131,139],"real-world":[132],"traces":[133],"demonstrate":[134],"that,":[135],"SegSketch":[136],"improves":[137],"F1-Score":[138],"up":[140],"8.04x":[142],"compared":[143],"state-of-the-art":[145],"solutions,":[146],"particularly":[147],"small":[149],"budgets.":[151]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-04-07T00:00:00"}