{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,23]],"date-time":"2026-04-23T15:00:05Z","timestamp":1776956405076,"version":"3.51.4"},"publisher-location":"Berlin, Heidelberg","reference-count":33,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642048425","type":"print"},{"value":"9783642048432","type":"electronic"}],"license":[{"start":{"date-parts":[[2009,1,1]],"date-time":"2009-01-01T00:00:00Z","timestamp":1230768000000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2009]]},"DOI":"10.1007\/978-3-642-04843-2_32","type":"book-chapter","created":{"date-parts":[[2009,9,28]],"date-time":"2009-09-28T16:40:50Z","timestamp":1254156050000},"page":"297-308","source":"Crossref","is-referenced-by-count":19,"title":["Detecting Network Anomalies Using CUSUM and EM Clustering"],"prefix":"10.1007","author":[{"given":"Wei","family":"Lu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hengjian","family":"Tong","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"32_CR1","unstructured":"Anderson, J.P.: Computer Security Threat Monitoring and Surveillance. Technical Report, James P. Anderson Co., Fort Washington, Pennsylvania (1999)"},{"key":"32_CR2","doi-asserted-by":"publisher","first-page":"222","DOI":"10.1109\/TSE.1987.232894","volume":"2","author":"D.E. Denning","year":"1987","unstructured":"Denning, D.E.: An Intrusion Detection Model. IEEE Transactions on Software Engineering\u00a02, 222\u2013232 (1987)","journal-title":"IEEE Transactions on Software Engineering"},{"issue":"3","key":"32_CR3","doi-asserted-by":"publisher","first-page":"186","DOI":"10.1145\/357830.357849","volume":"3","author":"S. Axelsson","year":"2000","unstructured":"Axelsson, S.: The Base-Rate Fallacy and the Difficulty of Intrusion Detection. ACM Transactions on Information and System Security (TISSEC)\u00a03(3), 186\u2013201 (2000)","journal-title":"ACM Transactions on Information and System Security (TISSEC)"},{"key":"32_CR4","doi-asserted-by":"crossref","unstructured":"Barreno, M., Nelson, B., Sears, R., Joseph, A.D., Tygarcan, J.D.: Can Machine Learning be Secure? In: Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, pp. 16\u201325 (2006)","DOI":"10.1145\/1128817.1128824"},{"issue":"4","key":"32_CR5","doi-asserted-by":"crossref","first-page":"403","DOI":"10.3233\/IDA-2004-8406","volume":"8","author":"M. Sabhnani","year":"2004","unstructured":"Sabhnani, M., Serpen, G.: Analysis of a Computer Security Dataset: Why Machine Learning Algorithms Fail on KDD Dataset for Misuse Detection. Intelligent Data Analysis\u00a08(4), 403\u2013415 (2004)","journal-title":"Intelligent Data Analysis"},{"issue":"12","key":"32_CR6","doi-asserted-by":"publisher","first-page":"3448","DOI":"10.1016\/j.comnet.2007.02.001","volume":"51","author":"A. Patcha","year":"2007","unstructured":"Patcha, A., Park, J.M.: An Overview of Anomaly Detection Techniques: Existing Solutions and Latest Technologies Trends. Computer Networks: The International Journal of Computer and Telecommunications Networking\u00a051(12), 3448\u20133470 (2007)","journal-title":"Computer Networks: The International Journal of Computer and Telecommunications Networking"},{"key":"32_CR7","unstructured":"Barbarra, D., Couto, J., Jajodia, S., Popyack, L., Wu, N.: ADAM: Detecting Intrusions by Data Mining. In: Proceedings of the 2001 IEEE, Workshop on Information Assurance and Security, West Point, NY (June 2001)"},{"key":"32_CR8","unstructured":"Lunt, T.F., Tamaru, A., Gilham, F., Jagannathm, R., Jalali, C., Neumann, P.G., Javitz, H.S., Valdes, A., Garvey, T.D.: A Real-time Intrusion Detection Expert System (IDES). Technical Report, Computer Science Laboratory, SRI International, Menlo Park, USA (February 1992)"},{"key":"32_CR9","unstructured":"Anderson, D., Frivold, T., Tamaru, A., Valdes, A.: Next Generation Intrusion Detection Expert System (NIDES). Software Users Manual, Beta-Update release. Computer Science Laboratory, SRI International, Menlo Park, CA, USA, Technical Report SRI-CSL-95-0 (May 1994)"},{"key":"32_CR10","unstructured":"Porras, P., Neumann, P.: EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances. In: Proceedings of the 20th NIST-NCSC National Information Systems Security Conference, Baltimore, MD, USA, pp. 353\u2013365 (1997)"},{"key":"32_CR11","doi-asserted-by":"crossref","unstructured":"Tombini, E., Debar, H., M\u00e9, L., Ducass\u00e9, M.: A Serial Combination of Anomaly and Misuse IDSes Applied to HTTP traffic. In: Proceedings of the 20th Annual Computer Security Applications Conference, Tucson, AZ, USA (2004)","DOI":"10.1109\/CSAC.2004.4"},{"key":"32_CR12","doi-asserted-by":"crossref","unstructured":"Zhang, J., Zulkernine, M.: A Hybrid Network Intrusion Detection Technique using Random Forests. In: Proceedings of the 1st International Conference on Availability, Reliability and Security, pp. 262\u2013269. Vienna University of Technology (2006)","DOI":"10.1109\/ARES.2006.7"},{"key":"32_CR13","doi-asserted-by":"crossref","unstructured":"Peng, J., Feng, C., Rozenblit, J.W.: A Hybrid Intrusion Detection and Visualization System. In: Proceedings of the 13th Annual IEEE International Symposium and Workshop on Engineering of Computer Based Systems, pp. 505\u2013506 (2006)","DOI":"10.1109\/ECBS.2006.8"},{"key":"32_CR14","doi-asserted-by":"crossref","unstructured":"Depren, O., Topallar, M., Anarim, E., Ciliz, M.K.: An Intelligent Intrusion Detection System (IDS) for Anomaly and Misuse Detection in Computer Networks. Expert Systems with Applications\u00a029(4), 713\u2013722","DOI":"10.1016\/j.eswa.2005.05.002"},{"key":"32_CR15","doi-asserted-by":"crossref","unstructured":"Qin, M., Hwang, K., Cai, M., Chen, Y.: Hybrid Intrusion Detection with Weighted Signature Generation over Anomalous Internet Episodes. IEEE Transactions on Dependable and Secure Computing\u00a04(1), 41\u201355","DOI":"10.1109\/TDSC.2007.9"},{"key":"32_CR16","doi-asserted-by":"crossref","unstructured":"Xiang, C., Lim, S.M.: Design of Multiple-level Hybrid Classifier for Intrusion Detection System. In: Proceedings of the IEEE Workshop Machine Learning for Signal Processing, pp. 117\u2013122 (2005)","DOI":"10.1109\/MLSP.2005.1532885"},{"key":"32_CR17","doi-asserted-by":"crossref","unstructured":"Thames, J.L., Abler, R., Saad, A.: Hybrid Intelligent Systems for Network Security. In: Proceedings of the 44th ACM Annual Southeast Regional Conference, pp. 286\u2013289","DOI":"10.1145\/1185448.1185513"},{"issue":"1","key":"32_CR18","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1016\/j.jnca.2005.06.003","volume":"30","author":"S. Peddabachigari","year":"2007","unstructured":"Peddabachigari, S., Abraham, A., Grosan, C., Thomas, J.: Modeling Intrusion Detection System using Hybrid Intelligent Systems. Special issue on Network and Information Security: A Computational Intelligence Approach. Journal of Network and Computer Applications\u00a030(1), 114\u2013132 (2007)","journal-title":"Journal of Network and Computer Applications"},{"issue":"18","key":"32_CR19","doi-asserted-by":"publisher","first-page":"3799","DOI":"10.1016\/j.ins.2007.03.025","volume":"177","author":"T. Shon","year":"2007","unstructured":"Shon, T., Moon, J.: A Hybrid Machine Learning Approach to Network Anomaly Detection. International Journal on Information Sciences\u00a0177(18), 3799\u20133821 (2007)","journal-title":"International Journal on Information Sciences"},{"key":"32_CR20","unstructured":"Sabhnani, M.R., Serpen, G.: Application of Machine Learning Algorithms to KDD Intrusion Detection Dataset within Misuse Detection Context. In: Proceedings of International Conference on Machine Learning: Models, Technologies, and Applications, pp. 209\u2013215 (2003)"},{"key":"32_CR21","unstructured":"http:\/\/nsl.cs.unb.ca\/wei\/hybrid.htm"},{"key":"32_CR22","unstructured":"Wang, H.N., Zhang, D.L., Hin, K.G.: Detecting SYN flooding attacks. In: Proceedings of IEEE INFOCOM 2002 (June 2002)"},{"issue":"2","key":"32_CR23","doi-asserted-by":"publisher","first-page":"107","DOI":"10.1504\/IJICS.2008.018513","volume":"2","author":"W. Lu","year":"2008","unstructured":"Lu, W., Traore, I.: Unsupervised anomaly detection using an evolutionary extension of K-means algorithm. International Journal on Information and Computer Security\u00a02(2), 107\u2013139 (2008)","journal-title":"International Journal on Information and Computer Security"},{"key":"32_CR24","doi-asserted-by":"crossref","unstructured":"Peng, T., Leckie, C., Ramamohanarao, K.: Detecting distributed denial of service attacks using source IP address monitoring. Draft (November 2002)","DOI":"10.1007\/3-540-45067-X_19"},{"key":"32_CR25","unstructured":"http:\/\/www.ethereal.com\/docs\/man-pages\/editcap.1.html"},{"key":"32_CR26","unstructured":"http:\/\/www.wireshark.org\/docs\/man-pages\/tshark.html"},{"key":"32_CR27","unstructured":"http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html.kddcup"},{"key":"32_CR28","unstructured":"http:\/\/www.ll.mit.edu\/IST\/ideval\/data\/1998\/1998_data_index.html"},{"key":"32_CR29","doi-asserted-by":"crossref","unstructured":"Mahoney, M.V., Chan, P.K.: An analysis of the 1999 DARPA\/Lincoln Laboratory evaluation data for network anomaly detection. In: Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection, Pittsburgh, PA, USA, pp. 220\u2013237 (2003)","DOI":"10.1007\/978-3-540-45248-5_13"},{"issue":"4","key":"32_CR30","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1145\/382912.382923","volume":"3","author":"J. McHugh","year":"2000","unstructured":"McHugh, J.: Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory. ACM Transactions on Information and System Security\u00a03(4), 262\u2013294 (2000)","journal-title":"ACM Transactions on Information and System Security"},{"key":"32_CR31","doi-asserted-by":"crossref","unstructured":"Gaffney, J.E., Ulvila, J.W.: Evaluation of intrusion detectors: a decision theory Approach. In: Proceeding of IEEE Symposium on Security and Privacy, pp. 50\u201361 (2001)","DOI":"10.1109\/SECPRI.2001.924287"},{"key":"32_CR32","unstructured":"http:\/\/www.ll.mit.edu\/IST\/ideval\/data\/1999\/1999_data_index.html"},{"key":"32_CR33","doi-asserted-by":"crossref","unstructured":"Lu, W., Ghorbani, A.A.: Network anomaly detection based on wavelet analysis. EURASIP Journal on Advances in Signal Processing (2008) (in press)","DOI":"10.1155\/2009\/837601"}],"container-title":["Lecture Notes in Computer Science","Advances in Computation and Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-04843-2_32","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,22]],"date-time":"2019-05-22T22:02:27Z","timestamp":1558562547000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-04843-2_32"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009]]},"ISBN":["9783642048425","9783642048432"],"references-count":33,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-04843-2_32","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009]]}}}