{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T22:42:22Z","timestamp":1772750542782,"version":"3.50.1"},"reference-count":50,"publisher":"Springer Science and Business Media LLC","issue":"5-6","license":[{"start":{"date-parts":[[2017,11,16]],"date-time":"2017-11-16T00:00:00Z","timestamp":1510790400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100004919","name":"King Abdulaziz City for Science and Technology","doi-asserted-by":"publisher","award":["11-INF1658-04"],"award-info":[{"award-number":["11-INF1658-04"]}],"id":[{"id":"10.13039\/501100004919","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Pers Ubiquit Comput"],"published-print":{"date-parts":[[2019,11]]},"DOI":"10.1007\/s00779-017-1096-z","type":"journal-article","created":{"date-parts":[[2017,11,15]],"date-time":"2017-11-15T22:13:56Z","timestamp":1510784036000},"page":"777-791","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":15,"title":["Hybrid multicriteria fuzzy classification of network traffic patterns, anomalies, and protocols"],"prefix":"10.1007","volume":"23","author":[{"given":"F.","family":"Al-Obeidat","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6279-9776","authenticated-orcid":false,"given":"E.-S. M.","family":"El-Alfy","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2017,11,16]]},"reference":[{"key":"1096_CR1","unstructured":"Cup KDD (1999) Dataset for network-based intrusion detection systems. Available on: \nhttp:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html"},{"key":"1096_CR2","first-page":"2184","volume":"220","author":"S Abt","year":"2013","unstructured":"Abt S, Wener S, Baier H (2013) Performance evaluation of classification and feature selection algorithms for netflow-based protocol recognition. GI-Jahrestagung 220:2184\u20132197","journal-title":"GI-Jahrestagung"},{"issue":"2","key":"1096_CR3","first-page":"403","volume":"92","author":"G Al-Naymat","year":"2016","unstructured":"Al-Naymat G, Al-Kasassbeh M, Abu-Samhadanh N, Sakr S (2016) Classification of voip and non-voip traffic using machine learning approaches. J Theoretical Appl Inf Tech 92(2):403","journal-title":"J Theoretical Appl Inf Tech"},{"key":"1096_CR4","doi-asserted-by":"crossref","unstructured":"Aljawarneh S, Aldwairi M, Yassein MB (2017) Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model. Journal of Computational Science. (in press)","DOI":"10.1016\/j.jocs.2017.03.006"},{"key":"1096_CR5","doi-asserted-by":"crossref","unstructured":"Alshammari R, Zincir-Heywood AN (2009) Machine learning based encrypted traffic classification: Identifying ssh and skype. In: IEEE Symposium on Computational Intelligence for Security and Defense Applications, vol. 9, pp 289\u2013296","DOI":"10.1109\/CISDA.2009.5356534"},{"issue":"1","key":"1096_CR6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.jksus.2010.08.004","volume":"24","author":"H Altwaijry","year":"2012","unstructured":"Altwaijry H, Algarny S (2012) Bayesian based intrusion detection system. J King Saud Univ - Comput Inf Sci 24(1):1\u20136","journal-title":"J King Saud Univ - Comput Inf Sci"},{"issue":"4","key":"1096_CR7","doi-asserted-by":"publisher","first-page":"2875","DOI":"10.3233\/JIFS-169230","volume":"32","author":"MM Baig","year":"2017","unstructured":"Baig MM, Awais MM, El-Alfy ESM (2017) A multiclass cascade of artificial neural network for network intrusion detection. J Intell Fuzzy Syst 32(4):2875\u20132883","journal-title":"J Intell Fuzzy Syst"},{"key":"1096_CR8","doi-asserted-by":"crossref","unstructured":"Bakhshi T, Ghita B (2016) On internet traffic classification: A two-phased machine learning approach. Journal of Computer Networks and Communications 2016","DOI":"10.1155\/2016\/2048302"},{"key":"1096_CR9","doi-asserted-by":"crossref","unstructured":"Barker J, Hannay P, Szewczyk P (2011) Using traffic analysis to identify the second generation onion router. In: Proceedings IFIP 9th International Conference on Embedded and Ubiquitous Computing, pp 72\u201378","DOI":"10.1109\/EUC.2011.76"},{"issue":"1","key":"1096_CR10","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/S0377-2217(99)00192-7","volume":"125","author":"N Belacel","year":"2000","unstructured":"Belacel N (2000) Multicriteria assignment method proaftn: Methodology and medical application. Eur J Oper Res 125(1):175\u2013183","journal-title":"Eur J Oper Res"},{"issue":"1\u20133","key":"1096_CR11","doi-asserted-by":"publisher","first-page":"201","DOI":"10.1016\/S0933-3657(00)00086-5","volume":"21","author":"N Belacel","year":"2001","unstructured":"Belacel N, Boulassel M (2001) Multicriteria fuzzy assignment method: A useful tool to assist medical diagnosis. Artif Intell Med 21(1\u20133):201\u2013207","journal-title":"Artif Intell Med"},{"issue":"6","key":"1096_CR12","doi-asserted-by":"publisher","first-page":"652","DOI":"10.1089\/tmj.2005.11.652","volume":"11","author":"N Belacel","year":"2005","unstructured":"Belacel N, Wang Q, Richard R (2005) Web-integration of PROAFTN methodology for acute leukemia diagnosis. Telemedicine J e-Health 11(6):652\u2013659","journal-title":"Telemedicine J e-Health"},{"issue":"5","key":"1096_CR13","doi-asserted-by":"publisher","first-page":"5947","DOI":"10.1016\/j.eswa.2010.11.028","volume":"38","author":"V Bol\u00f3n-Canedo","year":"2011","unstructured":"Bol\u00f3n-Canedo V, S\u00e1nchez-Maro\u00f1o N, Alonso-Betanzos A (2011) Feature selection and classification in multiple class datasets: An application to KDD cup 99 dataset. Expert Syst Appl 38(5):5947\u20135957","journal-title":"Expert Syst Appl"},{"key":"1096_CR14","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1007\/978-3-662-45670-5_8","volume-title":"Applications and Techniques in Information Security","author":"Zigang Cao","year":"2014","unstructured":"Cao Z, Xiong G, Zhao Y, Li Z, Guo L (2014) A survey on encrypted traffic classification. In: International Conference on Applications and Techniques in Information Security, pp 73\u201381"},{"issue":"3","key":"1096_CR15","doi-asserted-by":"publisher","first-page":"401","DOI":"10.1007\/s10922-013-9293-1","volume":"23","author":"V Carela-Espa\u00f1ol","year":"2015","unstructured":"Carela-Espa\u00f1ol V, Barlet-Ros P, Mula-Valls O, Sol\u00e9-Pareta J. (2015) An autonomic traffic classification system for network operation and management. J Netw Syst Manag 23(3):401\u2013419","journal-title":"J Netw Syst Manag"},{"issue":"1","key":"1096_CR16","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1109\/TIFS.2015.2478741","volume":"11","author":"M Conti","year":"2016","unstructured":"Conti M, Mancini LV, Spolaor R, Verde NV (2016) Analyzing android encrypted network traffic to identify user actions. IEEE Trans Inf Forensics Secur 11(1):114\u2013125","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"1","key":"1096_CR17","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1109\/MNET.2012.6135854","volume":"26","author":"A Dainotti","year":"2012","unstructured":"Dainotti A, Pescape A, Claffy KC (2012) Issues and future directions in traffic classification. IEEE Netw 26(1):35\u201340","journal-title":"IEEE Netw"},{"issue":"4","key":"1096_CR18","doi-asserted-by":"publisher","first-page":"713","DOI":"10.1016\/j.eswa.2005.05.002","volume":"29","author":"O Depren","year":"2005","unstructured":"Depren O, Topallar M, Anarim E, Ciliz MK (2005) An intelligent intrusion detection system (ids) for anomaly and misuse detection in computer networks. Expert Syst Appl 29(4):713\u2013722","journal-title":"Expert Syst Appl"},{"key":"1096_CR19","doi-asserted-by":"crossref","unstructured":"El-Alfy ESM, Al-Obeidat FN (2015) Detecting cyber-attacks on wireless mobile networks using multicriterion fuzzy classifier with genetic attribute selection. Mobile Information Systems 2015","DOI":"10.1155\/2015\/585432"},{"key":"1096_CR20","doi-asserted-by":"crossref","unstructured":"Erman J, Arlitt M, Mahanti A (2006) Traffic classification using clustering algorithms. In: Proceedings SIGCOMM Workshop on Mining Network Data, pp 281\u2013286","DOI":"10.1145\/1162678.1162679"},{"issue":"14","key":"1096_CR21","doi-asserted-by":"publisher","first-page":"2476","DOI":"10.1016\/j.comnet.2009.05.003","volume":"53","author":"A Este","year":"2009","unstructured":"Este A, Gringoli F, Salgarelli L (2009) Support vector machines for tcp traffic classification. Comput Netw 53(14):2476\u20132490","journal-title":"Comput Netw"},{"key":"1096_CR22","unstructured":"Fayyad U, Irani K (1993) Multi-interval discretization of continuous-valued attributes for classification learning. In: XIII International Joint Conference on Artificial Intelligence (IJCAI93), pp 1022\u20131029"},{"key":"1096_CR23","doi-asserted-by":"crossref","unstructured":"Feng W, Zhang Q, Hu G, Huang JX (2013) Mining network data for intrusion detection through combining SVMs with ant colony networks. Future Generation Computer Systems","DOI":"10.1016\/j.future.2013.06.027"},{"key":"1096_CR24","doi-asserted-by":"crossref","unstructured":"Karagiannis T, Broido A, Faloutsos M et al (2004) Transport layer identification of p2p traffic. In: Proceedings of 4th ACM SIGCOMM Conference on Internet measurement, pp 121\u2013134","DOI":"10.1145\/1028788.1028804"},{"key":"1096_CR25","doi-asserted-by":"crossref","unstructured":"Kharrazi M, Sen S, Spatscheck O (2007) Towards real-time performance monitoring for encrypted traffic. In: Proceedings of SIGCOMM Workshop on Internet Network Management, pp 287\u2013292","DOI":"10.1145\/1321753.1321769"},{"key":"1096_CR26","doi-asserted-by":"crossref","unstructured":"Kim H, Claffy KC, Fomenkov M, Barman D, Faloutsos M, Lee K (2008) Internet traffic classification demystified: myths, caveats, and the best practices. In: Proceedings of ACM CoNEXT Conference, p 11","DOI":"10.1145\/1544012.1544023"},{"key":"1096_CR27","doi-asserted-by":"crossref","unstructured":"Kumano Y, Ata S, Nakamura N, Nakahira Y, Oka I (2014) Towards real-time processing for application identification of encrypted traffic. In: International Conference on Computing, Networking and Communications (ICNC), pp 136\u2013140","DOI":"10.1109\/ICCNC.2014.6785319"},{"key":"1096_CR28","doi-asserted-by":"publisher","first-page":"256","DOI":"10.1016\/j.proenv.2011.12.040","volume":"11","author":"W li","year":"2011","unstructured":"li W, Liu Z (2011) A method of SVM with normalization in intrusion detection. Procedia Environ Sci 11:256\u2013262. Part A","journal-title":"Procedia Environ Sci"},{"key":"1096_CR29","doi-asserted-by":"crossref","unstructured":"Li W, Moore A (2007) A machine learning approach for efficient traffic classification. In: Proc. 15th International Sympos. Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, pp 310\u2013317","DOI":"10.1109\/MASCOTS.2007.2"},{"key":"1096_CR30","unstructured":"Moore A, Zuev D, Crogan M (2005) Discriminators for use in flow-based classification. Tech. rep., Queen Mary and Westfield College, Department of Computer Science"},{"issue":"1","key":"1096_CR31","doi-asserted-by":"publisher","first-page":"50","DOI":"10.1145\/1071690.1064220","volume":"33","author":"Andrew W. Moore","year":"2005","unstructured":"Moore A, Zuev D (2005) Internet traffic classification using bayesian analysis techniques. In: ACM SIGMETRICS Performance Evaluation Review, vol 33, pp 50\u201360","journal-title":"ACM SIGMETRICS Performance Evaluation Review"},{"key":"1096_CR32","doi-asserted-by":"publisher","first-page":"784","DOI":"10.1016\/j.procs.2015.08.238","volume":"60","author":"N Namdev","year":"2015","unstructured":"Namdev N, Agrawal S, Silkari S (2015) Recent advancement in machine learning based internet traffic classification. Procedia Comput Sci 60:784\u2013791","journal-title":"Procedia Comput Sci"},{"issue":"2","key":"1096_CR33","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1504\/IJSN.2015.070421","volume":"10","author":"V Ndatinya","year":"2015","unstructured":"Ndatinya V, Xiao Z, Manepalli VR, Meng K, Xiao Y (2015) Network forensics analysis using wireshark. Int J Secur Netw 10(2):91\u2013106","journal-title":"Int J Secur Netw"},{"issue":"4","key":"1096_CR34","doi-asserted-by":"publisher","first-page":"56","DOI":"10.1109\/SURV.2008.080406","volume":"10","author":"T Nguyen","year":"2008","unstructured":"Nguyen T, Armitage G (2008) A survey of techniques for internet traffic classification using machine learning. IEEE Commun Surv Tutorials 10(4):56\u201376","journal-title":"IEEE Commun Surv Tutorials"},{"key":"1096_CR35","unstructured":"Okada Y, Ata S, Nakamura N, Nakahira Y, Oka I (2011) Comparisons of machine learning algorithms for application identification of encrypted traffic. In: 10th International Conf. Machine Learning and Applications and Workshops (ICMLA), vol 2, pp 358\u2013361"},{"key":"1096_CR36","doi-asserted-by":"crossref","unstructured":"Paredes-Oliva I, Castell-Uroz I, Barlet-Ros P, Dimitropoulos X, Sole-Pareta J (2012) Practical anomaly detection based on classifying frequent traffic patterns. In: IEEE Conf. Computer Communications Workshops, pp 49\u201354","DOI":"10.1109\/INFCOMW.2012.6193518"},{"key":"1096_CR37","volume-title":"C4.5: Programs for Machine Learning","author":"JR Quinlan","year":"1993","unstructured":"Quinlan JR (1993) C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers, San Mateo"},{"key":"1096_CR38","doi-asserted-by":"publisher","first-page":"77","DOI":"10.1613\/jair.279","volume":"4","author":"JR Quinlan","year":"1996","unstructured":"Quinlan JR (1996) Improved use of continuous attributes in c4.5. J Artif Intell Res 4:77\u201390","journal-title":"J Artif Intell Res"},{"issue":"3","key":"1096_CR39","first-page":"83","volume":"5","author":"K Singh","year":"2013","unstructured":"Singh K, Agrawal S, Sohi B (2013) A near real-time ip traffic classification using machine learning. Int J Intel Syst Appl 5(3):83","journal-title":"Int J Intel Syst Appl"},{"issue":"6","key":"1096_CR40","doi-asserted-by":"publisher","first-page":"451","DOI":"10.1016\/j.peva.2010.01.001","volume":"67","author":"M Soysal","year":"2010","unstructured":"Soysal M, Schmidt EG (2010) Machine learning algorithms for accurate flow-based network traffic classification: Evaluation and comparison. Perform Eval 67(6):451\u2013467","journal-title":"Perform Eval"},{"key":"1096_CR41","doi-asserted-by":"publisher","first-page":"123","DOI":"10.1007\/978-3-642-36784-7_6","volume-title":"Data Traffic Monitoring and Analysis","author":"Silvio Valenti","year":"2013","unstructured":"Valenti S, Rossi D, Dainotti A, Pescap\u00e8 A, Finamore A, Mellia M (2013) Reviewing traffic classification. In: Data Traffic Monitoring and Analysis, pp 123\u2013147"},{"issue":"5","key":"1096_CR42","doi-asserted-by":"publisher","first-page":"355","DOI":"10.1002\/nem.1901","volume":"25","author":"P Velan","year":"2015","unstructured":"Velan P, \u010aerm\u00e1k M, \u010aeleda P, Dras\u0307ar M (2015) A survey of methods for encrypted traffic classification and analysis. Int J Netw Manag 25(5):355\u2013374","journal-title":"Int J Netw Manag"},{"key":"1096_CR43","unstructured":"Vilela DW, Ferreira ET, Shinoda AA, de Souza Araujo NV, de Oliveira R, Nascimento VE (2014) A dataset for evaluating intrusion detection systems in ieee 802.11 wireless networks. In: IEEE Colombian Conf. Communications and Computing (COLCOM), pp 1\u20135"},{"issue":"7","key":"1096_CR44","doi-asserted-by":"publisher","first-page":"1021","DOI":"10.1007\/s00779-015-0874-8","volume":"19","author":"J Wang","year":"2015","unstructured":"Wang J, Kuang Q, Duan S (2015) A new online anomaly learning and detection for large-scale service of internet of thing. Pers Ubiquit Comput 19(7):1021\u20131031","journal-title":"Pers Ubiquit Comput"},{"issue":"3","key":"1096_CR45","doi-asserted-by":"publisher","first-page":"992","DOI":"10.1016\/j.jnca.2011.03.017","volume":"35","author":"Y Wang","year":"2012","unstructured":"Wang Y, Xiang Y, Zhou W, Yu S (2012) Generating regular expression signatures for network traffic classification in trusted network management. J Netw Comput Appl 35(3):992\u20131000","journal-title":"J Netw Comput Appl"},{"issue":"1","key":"1096_CR46","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.asoc.2009.06.019","volume":"10","author":"SX Wu","year":"2010","unstructured":"Wu SX, Banzhaf W (2010) The use of computational intelligence in intrusion detection systems: A review. Appl Soft Comput 10(1):1\u201335","journal-title":"Appl Soft Comput"},{"key":"1096_CR47","doi-asserted-by":"crossref","unstructured":"Xue Y, Wang D, Zhang L (2013) Traffic classification: Issues and challenges. In: Proc. IEEE International Conf. Computing, Networking and Communications (ICNC), pp 545\u2013549","DOI":"10.12720\/jcm.8.4.240-248"},{"issue":"2","key":"1096_CR48","doi-asserted-by":"publisher","first-page":"149","DOI":"10.1007\/s10796-008-9131-2","volume":"12","author":"R Yuan","year":"2010","unstructured":"Yuan R, Li Z, Guan X, Xu L (2010) An svm-based machine learning method for accurate internet traffic classification. Inf Syst Front 12(2):149\u2013156","journal-title":"Inf Syst Front"},{"key":"1096_CR49","doi-asserted-by":"crossref","unstructured":"Zander S, Nguyen T, Armitage G (2005) Automated traffic classification and application identification using machine learning. In: IEEE Conf. Local Computer Networks 30th Anniversary (LCN\u201905), pp 250\u2013257","DOI":"10.1109\/LCN.2005.35"},{"key":"1096_CR50","first-page":"321","volume-title":"Lecture Notes in Computer Science","author":"Denis Zuev","year":"2005","unstructured":"Zuev D, Moore A (2005) Traffic classification using a statistical approach. In: International Workshop on Passive and Active Network Measurement, pp 321\u2013324"}],"container-title":["Personal and Ubiquitous Computing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00779-017-1096-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s00779-017-1096-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00779-017-1096-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,11,19]],"date-time":"2019-11-19T04:07:46Z","timestamp":1574136466000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s00779-017-1096-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,11,16]]},"references-count":50,"journal-issue":{"issue":"5-6","published-print":{"date-parts":[[2019,11]]}},"alternative-id":["1096"],"URL":"https:\/\/doi.org\/10.1007\/s00779-017-1096-z","relation":{},"ISSN":["1617-4909","1617-4917"],"issn-type":[{"value":"1617-4909","type":"print"},{"value":"1617-4917","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,11,16]]},"assertion":[{"value":"20 August 2017","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"31 October 2017","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"16 November 2017","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}