{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T04:46:19Z","timestamp":1782362779492,"version":"3.54.5"},"publisher-location":"Cham","reference-count":40,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319279978","type":"print"},{"value":"9783319279985","type":"electronic"}],"license":[{"start":{"date-parts":[[2015,1,1]],"date-time":"2015-01-01T00:00:00Z","timestamp":1420070400000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2015]]},"DOI":"10.1007\/978-3-319-27998-5_7","type":"book-chapter","created":{"date-parts":[[2016,1,29]],"date-time":"2016-01-29T11:08:51Z","timestamp":1454065731000},"page":"105-126","source":"Crossref","is-referenced-by-count":7,"title":["A Characterization of Cybersecurity Posture from Network Telescope Data"],"prefix":"10.1007","author":[{"given":"Zhenxin","family":"Zhan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Maochao","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shouhuai","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2016,1,30]]},"reference":[{"key":"7_CR1","doi-asserted-by":"crossref","unstructured":"Allman, M., Paxson, V., Terrell, J.: A brief history of scanning. In: Proceedings of ACM IMC 2007, pp. 77\u201382 (2007)","DOI":"10.1145\/1298306.1298316"},{"key":"7_CR2","doi-asserted-by":"crossref","unstructured":"Armstrong, J.S.: Principles of Forecasting: A Handbook for Researchers and Practitioners, vol. 30. Springer, New York (2001)","DOI":"10.1007\/978-0-306-47630-3"},{"key":"7_CR3","doi-asserted-by":"crossref","unstructured":"Bailey, M., Cooke, E., Jahanian, F., Myrick, A., Sinha, S.: Practical darknet measurement. In: Proceedings of 2006 Annual Conference on Information Sciences and Systems, pp. 1496\u20131501 (2006)","DOI":"10.1109\/CISS.2006.286376"},{"issue":"4","key":"7_CR4","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1109\/MSP.2005.106","volume":"3","author":"M Bailey","year":"2005","unstructured":"Bailey, M., Cooke, E., Jahanian, F., Watson, D.: The blaster worm: then and now. IEEE Secur. Priv. 3(4), 26\u201331 (2005)","journal-title":"IEEE Secur. Priv."},{"key":"7_CR5","unstructured":"Bailey, M., Cooke, E., Jahanian, F., Nazario, J., Watson, D., et al.: The internet motion sensor-a distributed blackhole monitoring system. In: Proceedings of NDSS 2005 (2005)"},{"key":"7_CR6","series-title":"Advances in Information Security","doi-asserted-by":"publisher","first-page":"71","DOI":"10.1007\/978-1-4419-0140-8_5","volume-title":"Cyber Situational Awareness","author":"P Barford","year":"2010","unstructured":"Barford, P., Chen, Y., Goyal, A., Li, Z., Paxson, V., Yegneswaran, V.: Employing honeynets for network situational awareness. In: Jajodia, S., Liu, P., Swarup, V., Wang, C. (eds.) Cyber Situational Awareness. Advances in Information Security, vol. 46, pp. 71\u2013102. Springer, New York (2010)"},{"key":"7_CR7","doi-asserted-by":"crossref","unstructured":"Brownlee, N.: One-way traffic monitoring with iatmon. In: Proceedings of PAM 2012, pp. 179\u2013188 (2012)","DOI":"10.1007\/978-3-642-28537-0_18"},{"issue":"8","key":"7_CR8","doi-asserted-by":"publisher","first-page":"1481","DOI":"10.1109\/49.464717","volume":"13","author":"K Claffy","year":"1995","unstructured":"Claffy, K., Braun, H., Polyzos, G.: A parameterizable methodology for internet traffic flow profiling. IEEE J. Sel. Areas Commun. 13(8), 1481\u20131494 (1995)","journal-title":"IEEE J. Sel. Areas Commun."},{"issue":"4","key":"7_CR9","doi-asserted-by":"publisher","first-page":"661","DOI":"10.1137\/070710111","volume":"51","author":"A Clauset","year":"2009","unstructured":"Clauset, A., Shalizi, C.R., Newman, M.E.J.: Power-law distributions in empirical data. SIAM Rev. 51(4), 661\u2013703 (2009)","journal-title":"SIAM Rev."},{"key":"7_CR10","doi-asserted-by":"crossref","unstructured":"Cooke, E., Bailey, M., Mao, Z.M., Watson, D., Jahanian, F., McPherson, D.: Toward understanding distributed blackhole placement. In: Proceedings of ACM Worm 2004, pp. 54\u201364 (2004)","DOI":"10.1145\/1029618.1029627"},{"key":"7_CR11","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-75959-3","volume-title":"Time Series Analysis With Applications in R","author":"J Cryer","year":"2008","unstructured":"Cryer, J., Chan, K.: Time Series Analysis With Applications in R. Springer, New York (2008)"},{"key":"7_CR12","doi-asserted-by":"crossref","unstructured":"Dainotti, A., King, A., Claffy, K., Papale, F., Pescap\u00e8, A.: Analysis of a \u201c\/0\u201d stealth scan from a botnet. In: Proceedings of ACM IMC 2012, pp. 1\u201314 (2012)","DOI":"10.1145\/2398776.2398778"},{"issue":"4","key":"7_CR13","doi-asserted-by":"publisher","first-page":"987","DOI":"10.2307\/1912773","volume":"50","author":"RF Engle","year":"1982","unstructured":"Engle, R.F.: Autoregressive conditional heteroscedasticity with estimates of the variance of united kingdom inflation. Econometrica: J. Econometric Soc. 50(4), 987\u20131007 (1982)","journal-title":"Econometrica: J. Econometric Soc."},{"issue":"7","key":"7_CR14","doi-asserted-by":"publisher","first-page":"1","DOI":"10.18637\/jss.v031.i07","volume":"31","author":"T Giorgino","year":"2009","unstructured":"Giorgino, T.: Computing and visualizing dynamic time warping alignments in R: the dtw package. J. Stat. Softw. 31(7), 1\u201324 (2009)","journal-title":"J. Stat. Softw."},{"key":"7_CR15","doi-asserted-by":"crossref","unstructured":"Glatz, E., Dimitropoulos, X.: Classifying internet one-way traffic. In: Proceedings of ACM IMC 2012, pp. 37\u201350 (2012)","DOI":"10.1145\/2398776.2398781"},{"issue":"5","key":"7_CR16","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1145\/1629607.1629610","volume":"39","author":"F Gringoli","year":"2009","unstructured":"Gringoli, F., Salgarelli, L., Dusi, M., Cascarano, N., Risso, F., Claffy, K.: Gt: picking up the truth from the ground for internet traffic. SIGCOMM Comput. Commun. Rev. 39(5), 12\u201318 (2009)","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"7_CR17","doi-asserted-by":"crossref","unstructured":"Hussain, A., Heidemann, J., Papadopoulos, C.: A framework for classifying denial of service attacks. In: Proceedings of ACM SIGCOMM 2003, pp. 99\u2013110 (2003)","DOI":"10.1145\/863965.863968"},{"issue":"1","key":"7_CR18","doi-asserted-by":"publisher","first-page":"51","DOI":"10.1145\/972374.972384","volume":"34","author":"C Kreibich","year":"2004","unstructured":"Kreibich, C., Crowcroft, J.: Honeycomb: creating intrusion detection signatures using honeypots. SIGCOMM Comput. Commun. Rev. 34(1), 51\u201356 (2004)","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"7_CR19","doi-asserted-by":"crossref","unstructured":"Lau, F., Rubin, S.H., Smith, M.H., Trajkovic, L.: Distributed denial of service attacks. In: Proceedings of 2000 IEEE International Conference on Systems, Man, and Cybernetics, vol. 3, pp. 2275\u20132280 (2000)","DOI":"10.1109\/ICSMC.2000.886455"},{"issue":"3","key":"7_CR20","doi-asserted-by":"publisher","first-page":"17","DOI":"10.1145\/1273445.1273448","volume":"37","author":"DJ Lee","year":"2007","unstructured":"Lee, D.J., Brownlee, N.: Passive measurement of one-way and two-way flow lifetimes. SIGCOMM Comput. Commun. Rev. 37(3), 17\u201328 (2007)","journal-title":"SIGCOMM Comput. Commun. Rev."},{"issue":"1","key":"7_CR21","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1109\/TIFS.2010.2086445","volume":"6","author":"Z Li","year":"2011","unstructured":"Li, Z., Goyal, A., Chen, Y., Paxson, V.: Towards situational awareness of large-scale botnet probing events. IEEE Trans. Inf. Forensics Secur. 6(1), 175\u2013188 (2011)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"3","key":"7_CR22","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1109\/MNET.2011.5772057","volume":"25","author":"Z Li","year":"2011","unstructured":"Li, Z., Goyal, A., Chen, Y., Kuzmanovic, A.: Measurement and diagnosis of address misconfigured p2p traffic. IEEE Netw. 25(3), 22\u201328 (2011)","journal-title":"IEEE Netw."},{"issue":"4","key":"7_CR23","doi-asserted-by":"publisher","first-page":"33","DOI":"10.1109\/MSECP.2003.1219056","volume":"1","author":"D Moore","year":"2003","unstructured":"Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the slammer worm. IEEE Secur. Priv. 1(4), 33\u201339 (2003)","journal-title":"IEEE Secur. Priv."},{"issue":"2","key":"7_CR24","doi-asserted-by":"publisher","first-page":"115","DOI":"10.1145\/1132026.1132027","volume":"24","author":"D Moore","year":"2006","unstructured":"Moore, D., Shannon, C., Brown, D., Voelker, G., Savage, S.: Inferring internet denial-of-service activity. ACM Trans. Comput. Syst. 24(2), 115\u2013139 (2006)","journal-title":"ACM Trans. Comput. Syst."},{"key":"7_CR25","doi-asserted-by":"crossref","unstructured":"Moore, D., Shannon, C., Brown, J.: Code-red: a case study on the spread and victims of an Internet worm. In: Proceedings of ACM IMW 2002, pp. 273\u2013284 (2002)","DOI":"10.1145\/637201.637244"},{"key":"7_CR26","unstructured":"Moore, D., Shannon, C., Voelker, G.M., Savage, S.: Network telescopes, Technical report. Department of Computer Science and Engineering, University of California, San Diego (2004)"},{"key":"7_CR27","volume-title":"Applied linear statistical models","author":"J Neter","year":"1996","unstructured":"Neter, J., Kutner, M.H., Nachtsheim, C.J., Wasserman, W.: Applied linear statistical models, vol. 4. Irwin, Chicago (1996)"},{"key":"7_CR28","doi-asserted-by":"crossref","unstructured":"Pang, R., Yegneswaran, V., Barford, P., Paxson, V., Peterson, L.: Characteristics of internet background radiation. In: Proceedings of ACM IMC 2004, pp. 27\u201340 (2004)","DOI":"10.1145\/1028788.1028794"},{"key":"7_CR29","unstructured":"Provos, N.: A virtual honeypot framework. In: Proceedings of USENIX Security Symposium, pp. 1\u201314 (2004)"},{"issue":"4","key":"7_CR30","doi-asserted-by":"publisher","first-page":"46","DOI":"10.1109\/MSP.2004.59","volume":"2","author":"C Shannon","year":"2004","unstructured":"Shannon, C., Moore, D.: The spread of the witty worm. IEEE Secur. Priv. 2(4), 46\u201350 (2004)","journal-title":"IEEE Secur. Priv."},{"key":"7_CR31","unstructured":"CAIDA UCSD Network Telescope. http:\/\/www.caida.org\/"},{"key":"7_CR32","unstructured":"CAIDA UCSD Network Telescope. http:\/\/www.caida.org\/tools\/measurement\/corsaro\/docs\/plugins.html"},{"issue":"5","key":"7_CR33","doi-asserted-by":"publisher","first-page":"1396","DOI":"10.1109\/TNET.2011.2109009","volume":"19","author":"J Treurniet","year":"2011","unstructured":"Treurniet, J.: A network activity classification schema and its application to scan detection. IEEE\/ACM Trans. Netw. 19(5), 1396\u20131404 (2011)","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"7_CR34","doi-asserted-by":"publisher","DOI":"10.1002\/9780470644560","volume-title":"Analysis of Financial Time Series","author":"RS Tsay","year":"2010","unstructured":"Tsay, R.S.: Analysis of Financial Time Series. Wiley, New york (2010)"},{"key":"7_CR35","unstructured":"Weiler, N.: Honeypots for distributed denial-of-service attacks. In: Proceedings of IEEE Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises (WET-ICE 2002), pp. 109\u2013114 (2002)"},{"key":"7_CR36","doi-asserted-by":"crossref","unstructured":"Wustrow, E., Karir, M., Bailey, M., Jahanian, F., Huston, G.: Internet background radiation revisited. In: Proceedings of ACM IMC 2010, pp. 62\u201374 (2010)","DOI":"10.1145\/1879141.1879149"},{"key":"7_CR37","doi-asserted-by":"crossref","unstructured":"Yegneswaran, V., Giffin, J., Barford, P., Jha, S.: An architecture for generating semantic aware signatures. In: Proceedings of Usenix Security Symposium (2005)","DOI":"10.21236\/ADA449063"},{"key":"7_CR38","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"146","DOI":"10.1007\/978-3-540-30143-1_8","volume-title":"Recent Advances in Intrusion Detection","author":"V Yegneswaran","year":"2004","unstructured":"Yegneswaran, V., Barford, P., Plonka, D.: On the design and use of internet sinks for network abuse monitoring. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 146\u2013165. Springer, Heidelberg (2004)"},{"key":"7_CR39","doi-asserted-by":"crossref","unstructured":"Yegneswaran, V., Barford, P., Ullrich, J.: Internet intrusions: global characteristics and prevalence. In: Proceedings of ACM SIGMETRICS 2003, pp. 138\u2013147 (2003)","DOI":"10.1145\/781044.781045"},{"issue":"11","key":"7_CR40","doi-asserted-by":"publisher","first-page":"1775","DOI":"10.1109\/TIFS.2013.2279800","volume":"8","author":"Z Zhan","year":"2013","unstructured":"Zhan, Z., Xu, M., Xu, S.: Characterizing honeypot-captured cyber attacks: statistical framework and case study. IEEE Trans. Inf. Forensics Secur. 8(11), 1775\u20131789 (2013)","journal-title":"IEEE Trans. Inf. Forensics Secur."}],"container-title":["Lecture Notes in Computer Science","Trusted Systems"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-27998-5_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,1]],"date-time":"2025-06-01T07:56:55Z","timestamp":1748764615000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-27998-5_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015]]},"ISBN":["9783319279978","9783319279985"],"references-count":40,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-27998-5_7","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015]]}}}