{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T03:17:35Z","timestamp":1740107855540,"version":"3.37.3"},"reference-count":41,"publisher":"Springer Science and Business Media LLC","issue":"22","license":[{"start":{"date-parts":[[2019,1,18]],"date-time":"2019-01-18T00:00:00Z","timestamp":1547769600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Soft Comput"],"published-print":{"date-parts":[[2019,11]]},"DOI":"10.1007\/s00500-018-03750-1","type":"journal-article","created":{"date-parts":[[2019,1,18]],"date-time":"2019-01-18T09:21:22Z","timestamp":1547803282000},"page":"11947-11965","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["WebHound: a data-driven intrusion detection from real-world web access logs"],"prefix":"10.1007","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6914-5046","authenticated-orcid":false,"given":"Te-En","family":"Wei","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hahn-Ming","family":"Lee","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Albert B.","family":"Jeng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hemank","family":"Lamba","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christos","family":"Faloutsos","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,1,18]]},"reference":[{"key":"3750_CR1","doi-asserted-by":"crossref","unstructured":"Akoglu L, McGlohon M, Faloutsos C (2010) Oddball: spotting anomalies in weighted graphs. In: Pacific-Asia conference on knowledge discovery and data mining. Springer, pp 410\u2013421","DOI":"10.1007\/978-3-642-13672-6_40"},{"issue":"3","key":"3750_CR2","doi-asserted-by":"publisher","first-page":"626","DOI":"10.1007\/s10618-014-0365-y","volume":"29","author":"L Akoglu","year":"2015","unstructured":"Akoglu L, Tong H, Koutra D (2015) Graph based anomaly detection and description: a survey. Data Min Knowl Discov 29(3):626\u2013688","journal-title":"Data Min Knowl Discov"},{"key":"3750_CR3","unstructured":"Braue D (2015) Cybercrime not \u201csolvable\u201d, requires data-based harm minimisation. \n                    http:\/\/www.cso.com.au\/article\/565596\/cybercrimeHrB-solvable-requires-data-based-harm-minimisation\/HrB\n                    \n                  . Accessed 5 Feb 2015"},{"key":"3750_CR4","doi-asserted-by":"crossref","unstructured":"Breunig MM, Kriegel H-P, Ng RT, Sander J (2000) LOF: identifying density-based local outliers. In: ACM sigmod record, vol 29. ACM, pp 93\u2013104","DOI":"10.1145\/335191.335388"},{"issue":"3","key":"3750_CR5","doi-asserted-by":"publisher","first-page":"15","DOI":"10.1145\/1541880.1541882","volume":"41","author":"V Chandola","year":"2009","unstructured":"Chandola V, Banerjee A, Kumar V (2009) Anomaly detection: a survey. ACM Comput Surv (CSUR) 41(3):15","journal-title":"ACM Comput Surv (CSUR)"},{"key":"3750_CR6","doi-asserted-by":"crossref","unstructured":"Cheng W, Zhang K, Chen H, Jiang G, Chen Z, Wang W (2016) Ranking causal anomalies via temporal and dynamical analysis on vanishing correlations. In: Proceedings of the ACM SIGKDD international conference on knowledge discovery and data mining (SIGKDD)","DOI":"10.1145\/2939672.2939765"},{"issue":"3","key":"3750_CR7","first-page":"273","volume":"20","author":"C Cortes","year":"1995","unstructured":"Cortes C, Vapnik V (1995) Support-vector networks. Mach Learn 20(3):273\u2013297","journal-title":"Mach Learn"},{"key":"3750_CR8","unstructured":"Darktrace. \n                    https:\/\/www.darktrace.com\/en\/"},{"key":"3750_CR9","first-page":"85","volume":"38","author":"M Mauro Di","year":"2018","unstructured":"Di Mauro M, Di Sarno C (2018) Improving siem capabilities through an enhanced probe for encrypted skype traffic detection. J Inf Secur Appl 38:85\u201395","journal-title":"J Inf Secur Appl"},{"key":"3750_CR10","unstructured":"Elasticsearch. \n                    https:\/\/www.elastic.co\/products\/elasticsearch"},{"key":"3750_CR11","unstructured":"Elkan C (2003) Using the triangle inequality to accelerate k-means. In: ICML, pp 147\u2013153"},{"key":"3750_CR12","unstructured":"Filtering SQL injection from classic ASP. \n                    https:\/\/blogs.iis.net\/nazim\/filtering-sql-injection-from-classic-asp"},{"issue":"2","key":"3750_CR13","first-page":"8","volume":"8","author":"Y Ge","year":"2014","unstructured":"Ge Y, Jiang G, Ding M, Xiong H (2014) Ranking metric anomaly in invariant networks. ACM Trans Knowl Discov Data (TKDD) 8(2):8","journal-title":"ACM Trans Knowl Discov Data (TKDD)"},{"key":"3750_CR14","unstructured":"Goh V (2016) The anatomy of large-scale cyber attacks. \n                    http:\/\/www.cso.com.au\/article\/606694\/anatomy-large-scale-cyber-attacks\/\n                    \n                  . Accessed 13 Sept 2016"},{"issue":"5","key":"3750_CR15","doi-asserted-by":"publisher","first-page":"403","DOI":"10.1007\/BF02163027","volume":"14","author":"GH Golub","year":"1970","unstructured":"Golub GH, Reinsch C (1970) Singular value decomposition and least squares solutions. Numerische mathematik 14(5):403\u2013420","journal-title":"Numerische mathematik"},{"issue":"2","key":"3750_CR16","first-page":"35","volume":"11","author":"M Gunestas","year":"2016","unstructured":"Gunestas M, Bilgin Z (2016) Log analysis using temporal logic and reconstruction approach: web server case. J Digit Forensics Secur Law JDFSL 11(2):35","journal-title":"J Digit Forensics Secur Law JDFSL"},{"key":"3750_CR17","doi-asserted-by":"publisher","first-page":"576","DOI":"10.1016\/B978-012088469-8\/50052-8","volume-title":"Proceedings 2004 VLDB Conference","author":"Zolt\u00e1n Gy\u00f6ngyi","year":"2004","unstructured":"Gy\u00f6ngyi Z, Garcia-Molina H, Pedersen J (2004) Combating web spam with trustrank. In: Proceedings of the thirtieth international conference on very large data bases, vol 30. VLDB Endowment, pp 576\u2013587"},{"key":"3750_CR18","doi-asserted-by":"crossref","unstructured":"Henderson K, Eliassi-Rad T, Faloutsos C, Akoglu L, Li L, Maruhashi K, Prakash BA, Tong H (2010) Metric forensics: a multi-level approach for mining volatile graphs. In: Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM, pp 163\u2013172","DOI":"10.1145\/1835804.1835828"},{"key":"3750_CR19","doi-asserted-by":"publisher","first-page":"194","DOI":"10.1016\/j.jnca.2013.02.021","volume":"37","author":"D Hoplaros","year":"2014","unstructured":"Hoplaros D, Tari Z, Khalil I (2014) Data summarization for network traffic monitoring. J Netw Comput Appl 37:194\u2013205","journal-title":"J Netw Comput Appl"},{"key":"3750_CR20","unstructured":"Http status codes. \n                    http:\/\/www.restapitutorial.com\/httpstatuscodes.html"},{"key":"3750_CR21","doi-asserted-by":"crossref","unstructured":"Jaeger D, Ussath M, Cheng F, Meinel C (2015) Multi-step attack pattern detection on normalized event logs. In: 2015 IEEE 2nd international conference on cyber security and cloud computing (CSCloud). IEEE, pp 390\u2013398","DOI":"10.1109\/CSCloud.2015.26"},{"issue":"4","key":"3750_CR22","doi-asserted-by":"publisher","first-page":"312","DOI":"10.1109\/TDSC.2006.52","volume":"3","author":"G Jiang","year":"2006","unstructured":"Jiang G, Chen H, Yoshihira K (2006) Modeling and tracking of transaction flow dynamics for fault detection in complex systems. IEEE Trans Dependable Secure Comput 3(4):312\u2013326","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"3750_CR23","doi-asserted-by":"publisher","first-page":"292","DOI":"10.1016\/j.jnca.2013.09.014","volume":"40","author":"D Jiang","year":"2014","unstructured":"Jiang D, Xu Z, Zhang P, Zhu T (2014) A transform domain-based anomaly detection approach to network-wide traffic. J Netw Comput Appl 40:292\u2013306","journal-title":"J Netw Comput Appl"},{"issue":"1","key":"3750_CR24","doi-asserted-by":"publisher","first-page":"135","DOI":"10.1137\/S0036144503424786","volume":"47","author":"AN Langville","year":"2005","unstructured":"Langville AN, Meyer CD (2005) A survey of eigenvector methods for web information retrieval. SIAM Rev 47(1):135\u2013161","journal-title":"SIAM Rev"},{"issue":"1","key":"3750_CR25","doi-asserted-by":"publisher","first-page":"16","DOI":"10.1016\/j.jnca.2012.09.004","volume":"36","author":"H-J Liao","year":"2013","unstructured":"Liao H-J, Lin C-HR, Lin Y-C, Tung K-Y (2013) Intrusion detection system: a comprehensive review. J Netw Comput Appl 36(1):16\u201324","journal-title":"J Netw Comput Appl"},{"key":"3750_CR26","doi-asserted-by":"crossref","unstructured":"Liu C, Yan X, Yu H, Han J, Philip SY (2005) Mining behavior graphs for\u201c backtrace\u201d of noncrashing bugs. In: SDM. SIAM, pp 286\u2013297","DOI":"10.1137\/1.9781611972757.26"},{"key":"3750_CR27","unstructured":"Malkin R (2016) Fighting the growing threat of DDoS attacks down under. \n                    http:\/\/www.cso.com.au\/article\/606693\/fighting-growing-threat-ddos-attacks-down-under\/\n                    \n                  . Accessed 13 Sept 2016"},{"key":"3750_CR28","first-page":"139","volume":"2","author":"L\u00a0M Manevitz","year":"2001","unstructured":"Manevitz L\u00a0M, Yousef M (2001) One-class SVMs for document classification. J Mach Learn Res 2:139\u2013154","journal-title":"J Mach Learn Res"},{"issue":"8","key":"3750_CR29","doi-asserted-by":"publisher","first-page":"1844","DOI":"10.1109\/TIFS.2017.2692685","volume":"12","author":"V Matta","year":"2017","unstructured":"Matta V, Di Mauro M, Longo M (2017) Ddos attacks with randomized traffic innovation: botnet identification challenges and strategies. IEEE Trans Inf Forensics Secur 12(8):1844\u20131859","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"1","key":"3750_CR30","doi-asserted-by":"publisher","first-page":"42","DOI":"10.1016\/j.jnca.2012.05.003","volume":"36","author":"C Modi","year":"2013","unstructured":"Modi C, Patel D, Borisaniya B, Patel H, Patel A, Rajarajan M (2013) A survey of intrusion detection techniques in cloud. J Netw Comput Appl 36(1):42\u201357","journal-title":"J Netw Comput Appl"},{"key":"3750_CR31","unstructured":"Modsecurity: open source web application firewall. \n                    https:\/\/modsecurity.org\/"},{"key":"3750_CR32","unstructured":"Page L, Brin S, Motwani R, Winograd T (1999) The pagerank citation ranking: bringing order to the web. Technical report, Stanford InfoLab"},{"key":"3750_CR33","unstructured":"Public security log sharing site. \n                    http:\/\/log-sharing.dreamhosters.com\/"},{"key":"3750_CR34","unstructured":"Ray S, Turi RH (1999) Determination of number of clusters in k-means clustering and application in colour image segmentation. In: Proceedings of the 4th international conference on advances in pattern recognition and digital techniques (ICAPRDT\u201999)"},{"key":"3750_CR35","doi-asserted-by":"crossref","unstructured":"Rossi RA, Gallagher B, Neville J, Henderson K (2013) Modeling dynamic behavior in large evolving graphs. In: Proceedings of the sixth ACM international conference on Web search and data mining. ACM, pp 667\u2013676","DOI":"10.1145\/2433396.2433479"},{"key":"3750_CR36","unstructured":"Snort. \n                    https:\/\/www.snort.org\/"},{"key":"3750_CR37","unstructured":"SQL injection prevention cheat sheet. \n                    https:\/\/www.owasp.org\/index.php\/SQL_Injection_Prevention_Cheat_Sheet"},{"key":"3750_CR38","doi-asserted-by":"crossref","unstructured":"Sun J, Tao D, Faloutsos C (2006) Beyond streams and graphs: dynamic tensor analysis. In: Proceedings of the 12th ACM SIGKDD international conference on knowledge discovery and data mining. ACM, pp 374\u2013383","DOI":"10.1145\/1150402.1150445"},{"key":"3750_CR39","doi-asserted-by":"crossref","unstructured":"Sun X, Dai J, Liu P, Singhal A, Yen J (2016) Towards probabilistic identification of zero-day attack paths. In: 2016 IEEE conference on communications and network security (CNS). IEEE, pp 64\u201372","DOI":"10.1109\/CNS.2016.7860471"},{"key":"3750_CR40","doi-asserted-by":"crossref","unstructured":"Tao C, Ge Y, Song Q, Ge Y, Omitaomu OA (2014) Metric ranking of invariant networks with belief propagation. In: 2014 IEEE international conference on data mining. IEEE, pp 1001\u20131006","DOI":"10.1109\/ICDM.2014.74"},{"key":"3750_CR41","doi-asserted-by":"crossref","unstructured":"Tong H, Faloutsos C, Pan J-Y (2006) Fast random walk with restart and its applications","DOI":"10.1109\/ICDM.2006.70"}],"container-title":["Soft Computing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s00500-018-03750-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00500-018-03750-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00500-018-03750-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,1,17]],"date-time":"2020-01-17T19:10:08Z","timestamp":1579288208000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s00500-018-03750-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,1,18]]},"references-count":41,"journal-issue":{"issue":"22","published-print":{"date-parts":[[2019,11]]}},"alternative-id":["3750"],"URL":"https:\/\/doi.org\/10.1007\/s00500-018-03750-1","relation":{},"ISSN":["1432-7643","1433-7479"],"issn-type":[{"type":"print","value":"1432-7643"},{"type":"electronic","value":"1433-7479"}],"subject":[],"published":{"date-parts":[[2019,1,18]]},"assertion":[{"value":"18 January 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article doesn\u2019t contain any studies with human participates or animals performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}}]}}