{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T13:41:52Z","timestamp":1726062112062},"publisher-location":"Cham","reference-count":37,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030369378"},{"type":"electronic","value":"9783030369385"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-36938-5_28","type":"book-chapter","created":{"date-parts":[[2019,12,10]],"date-time":"2019-12-10T00:04:11Z","timestamp":1575936251000},"page":"456-471","update-policy":"http:\/\/dx.doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Tell Them from Me: An Encrypted Application Profiler"],"prefix":"10.1007","author":[{"given":"Mohammad","family":"Mamun","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rongxing","family":"Lu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Manon","family":"Gaudet","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,12,10]]},"reference":[{"issue":"6","key":"28_CR1","doi-asserted-by":"publisher","first-page":"1326","DOI":"10.1016\/j.comnet.2010.12.002","volume":"55","author":"R Alshammari","year":"2011","unstructured":"Alshammari, R., Zincir-Heywood, A.N.: Can encrypted traffic be identified without port numbers. Comput. Netw. 55(6), 1326\u20131350 (2011)","journal-title":"Comput. Netw."},{"issue":"3","key":"28_CR2","first-page":"1","volume":"108","author":"A Cufoglu","year":"2014","unstructured":"Cufoglu, A.: User profiling-a short review. Int. J. Comput. Appl. 108(3), 1\u20139 (2014)","journal-title":"Int. J. Comput. Appl."},{"key":"28_CR3","doi-asserted-by":"crossref","unstructured":"Alshammari, R., Zincir-Heywood, A.N.: Investigating two different approaches for encrypted traffic classification. In: Privacy, Security and Trust (2008)","DOI":"10.1109\/PST.2008.15"},{"issue":"3","key":"28_CR4","doi-asserted-by":"publisher","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","volume":"27","author":"CE Shannon","year":"1948","unstructured":"Shannon, C.E.: A mathematical theory of communication. Bell Syst. Tech. J. 27(3), 379\u2013423 (1948)","journal-title":"Bell Syst. Tech. J."},{"issue":"4","key":"28_CR5","doi-asserted-by":"publisher","first-page":"547","DOI":"10.1145\/321356.321363","volume":"13","author":"GJ Chaitin","year":"1966","unstructured":"Chaitin, G.J.: On the length of programs for computing finite binary sequences. J. ACM (JACM) 13(4), 547\u2013569 (1966)","journal-title":"J. ACM (JACM)"},{"key":"28_CR6","unstructured":"Carroll, J.M., Sun, Y.: The Binary Derivative Test for the Appearance of Randomness and its use as a Noise Filter (1998)"},{"key":"28_CR7","doi-asserted-by":"crossref","unstructured":"Chen, T., Guestrin, C.: Xgboost: a scalable tree boosting system. In: International Conference on Knowledge Discovery and Data Mining, pp. 785\u2013794. ACM (2016)","DOI":"10.1145\/2939672.2939785"},{"key":"28_CR8","unstructured":"Whonix: A High Security Method of Surfing the Internet. \nhttps:\/\/www.whonix.org\/"},{"key":"28_CR9","unstructured":"nDPI, Open and Extensible LGPLv3 Deep Packet Inspection Library. \nhttp:\/\/www.ntop.orgproductsndpi\/"},{"key":"28_CR10","doi-asserted-by":"crossref","unstructured":"Dyer, K.P., et al.: Peek-a-boo, i still see you: why efficient traffic analysis countermeasures fail. In: IEEE Security and Privacy, pp. 332\u2013346 (2012)","DOI":"10.1109\/SP.2012.28"},{"key":"28_CR11","unstructured":"Wireshark sample captures. \nhttp:\/\/wiki.wireshark.org\/SampleCaptures"},{"key":"28_CR12","doi-asserted-by":"crossref","unstructured":"Karagiannis, T., et al.: BLINK: multilevel traffic classification in the dark. In: SIGCOMM 2005, Philadelphia, USA, 21\u201326 August 2005","DOI":"10.1145\/1080091.1080119"},{"key":"28_CR13","doi-asserted-by":"crossref","unstructured":"Moore, A.W., Zuev, D.: Internet traffic classification using Bayesian analysis techniques. In: SIGMETRIC 2005, Banff, Canada, 6\u201310 June 2005","DOI":"10.1145\/1064212.1064220"},{"key":"28_CR14","doi-asserted-by":"crossref","unstructured":"Sen, S., Spatscheck, O., Wang, D.: Accurate, scalable in-network identification of P2P traffic using application signatures. In: WWW 2005, USA (2004)","DOI":"10.1145\/988672.988742"},{"key":"28_CR15","doi-asserted-by":"crossref","unstructured":"Zander, S., Nguyen, T., Armitage, G.: Automated traffic classification and application identification using machine learning. In: LCN 2005, Australia (2005)","DOI":"10.1109\/LCN.2005.35"},{"key":"28_CR16","first-page":"1157","volume":"3","author":"I Guyon","year":"2003","unstructured":"Guyon, I., Elisseeff, A.: An introduction to variable and feature selection. J. Mach. Learn. Res. 3, 1157\u20131182 (2003)","journal-title":"J. Mach. Learn. Res."},{"issue":"4","key":"28_CR17","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1145\/1282427.1282386","volume":"37","author":"Dario Bonfiglio","year":"2007","unstructured":"Bonfiglio, D., et al.: Revealing Skype traffic: when randomness plays with you. In: ACM SIGCOMM 2007, pp. 37\u201348. ACM Press, USA (2007)","journal-title":"ACM SIGCOMM Computer Communication Review"},{"issue":"4","key":"28_CR18","doi-asserted-by":"publisher","first-page":"207","DOI":"10.1145\/1402946.1402983","volume":"38","author":"Randy Smith","year":"2008","unstructured":"Smith, R., et al.: Deflating the big bang: fast and scalable deep packet inspection. In: ACM SIGCOMM 2008, pp. 207\u2013218. ACM Press, USA (2008)","journal-title":"ACM SIGCOMM Computer Communication Review"},{"key":"28_CR19","doi-asserted-by":"crossref","unstructured":"Zhang, H., Papadopoulos, C., Massey, D.: Detecting encrypted botnet traffic. In: INFOCOM Workshop. IEEE (2013)","DOI":"10.1109\/INFCOM.2013.6567180"},{"key":"28_CR20","doi-asserted-by":"crossref","unstructured":"Dorfinger, P., et al.: Entropy-based traffic filtering to support real-time Skype detection. In: ACM Wireless Communications and Mobile Computing (2010)","DOI":"10.1145\/1815396.1815568"},{"key":"28_CR21","unstructured":"Korczynski, M., Duda, A.: Markov chain fingerprinting to classify encrypted traffic. In: INFOCOM, 2014 Proceedings IEEE. IEEE (2014)"},{"key":"28_CR22","unstructured":"Sun, Q., et al.: Statistical identification of encrypted web browsing traffic. In: Proceedings 2002 IEEE Symposium on Security and Privacy. IEEE (2002)"},{"key":"28_CR23","unstructured":"Weber, M., et al.: A toolkit for detecting and analyzing malicious software. In: Proceedings of the 18th Annual Computer Security Applications Conference. IEEE (2002)"},{"key":"28_CR24","doi-asserted-by":"crossref","unstructured":"Lyda, R., Hamrock, J.: Using entropy analysis to find encrypted and packed malware. In: IEEE Security & Privacy, pp. 40\u201345 (2007)","DOI":"10.1109\/MSP.2007.48"},{"key":"28_CR25","unstructured":"Olivain, J., Goubault-Larrecq, J.: Detecting subverted cryptographic protocols by entropy checking. Laboratoire Specification et Verification, ENS Cachan, France, Research Report LSV-06-13 (2006)"},{"key":"28_CR26","unstructured":"Wagner, A., Plattner, B.: Entropy based worm and anomaly detection in fast IP networks. In: WETICE 2005: Proceedings of the 14th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprise, pp. 172\u2013177. IEEE Computer Society, Washington, DC (2005)"},{"key":"28_CR27","unstructured":"Quinlan, J.R.: C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers (1993). ISBN 1-55860-238-0"},{"issue":"1","key":"28_CR28","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1145\/1656274.1656278","volume":"11","author":"M Hall","year":"2009","unstructured":"Hall, M., et al.: The WEKA data mining software: an update. ACM SIGKDD Explor. Newsl. 11(1), 10\u201318 (2009)","journal-title":"ACM SIGKDD Explor. Newsl."},{"key":"28_CR29","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"174","DOI":"10.1007\/3-540-59286-5_57","volume-title":"Machine Learning: ECML-95","author":"R Kohavi","year":"1995","unstructured":"Kohavi, R.: The power of decision tables. In: Lavrac, N., Wrobel, S. (eds.) ECML 1995. LNCS, vol. 912, pp. 174\u2013189. Springer, Heidelberg (1995). \nhttps:\/\/doi.org\/10.1007\/3-540-59286-5_57"},{"key":"28_CR30","unstructured":"RStudio, an integrated development environment (IDE)for R. \nhttp:\/\/www.rstudio.com\/"},{"key":"28_CR31","doi-asserted-by":"crossref","unstructured":"Sicker, D.C., Ohm, P., Grunwald, D.: Legal issues surrounding monitoring during network research. In: Proceedings of the 7th ACM SIGCOMM Conference on Internet Measurement, ser. IMC 2007, pp. 141\u2013148. ACM, New York (2007)","DOI":"10.1145\/1298306.1298307"},{"key":"28_CR32","unstructured":"Tcpdump packet analizer. \nhttp:\/\/www.tcpdump.org\/"},{"key":"28_CR33","doi-asserted-by":"crossref","unstructured":"Poo, D., Chng, B., Goh, J.-M.: A hybrid approach for user profiling. In: Proceedings of the 36th Annual Hawaii International Conference on System Sciences, pp. 9\u201313. IEEE (2003)","DOI":"10.1109\/HICSS.2003.1174242"},{"key":"28_CR34","unstructured":"Croll, G.J.: BiEntropy-The Approximate Entropy of a Finite Binary String. arXiv preprint \narXiv:1305.0954\n\n (2013)"},{"key":"28_CR35","doi-asserted-by":"crossref","unstructured":"Draper-Gil, G., et al.: Characterization of encrypted and VPN traffic using time-related features. In: Proceedings of the International Conference on Information Systems Security and Privacy (ICISSP 2016), Rome, Italy, pp. 407\u2013414 (2016)","DOI":"10.5220\/0005740704070414"},{"key":"28_CR36","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"282","DOI":"10.1007\/978-3-319-29814-6_23","volume-title":"Information and Communications Security","author":"MSI Mamun","year":"2016","unstructured":"Mamun, M.S.I., Ghorbani, A.A., Stakhanova, N.: An entropy based encrypted traffic classifier. In: Qing, S., Okamoto, E., Kim, K., Liu, D. (eds.) ICICS 2015. LNCS, vol. 9543, pp. 282\u2013294. Springer, Cham (2016). \nhttps:\/\/doi.org\/10.1007\/978-3-319-29814-6_23"},{"issue":"1","key":"28_CR37","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1023\/A:1010933404324","volume":"45","author":"L Breiman","year":"2001","unstructured":"Breiman, L.: Random forests. Mach. Learn. 45(1), 5\u201332 (2001)","journal-title":"Mach. Learn."}],"container-title":["Lecture Notes in Computer Science","Network and System Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-36938-5_28","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,12,10]],"date-time":"2019-12-10T00:07:52Z","timestamp":1575936472000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-36938-5_28"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030369378","9783030369385"],"references-count":37,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-36938-5_28","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"10 December 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"NSS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Network and System Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Sapporo","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Japan","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 December 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 December 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"13","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"nss2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/nsclab.org\/nss2019\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"89","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"36","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"7","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"40% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"2.8","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"7","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}