{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T06:17:24Z","timestamp":1778221044769,"version":"3.51.4"},"reference-count":65,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T00:00:00Z","timestamp":1778198400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T00:00:00Z","timestamp":1778198400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Universidad Carlos III"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Netw Syst Manage"],"published-print":{"date-parts":[[2026,7]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The increasing complexity and volume of modern network traffic, specifically within the context of encrypted Domain Name System (DNS) protocols, particularly DNS over HTTPS (DoH), pose significant challenges to traditional traffic analysis methods, making it difficult to discern legitimate activity from covert or malicious communications. This paper explores the intrinsic self-similarity and long-term memory properties of encrypted DNS traffic, employing multiple statistical methods for Hurst parameter estimation. By comparing benign and malicious traffic, we uncover distinct temporal structures, revealing the heightened predictability and persistence of malicious traffic. Furthermore, our entropy analysis quantifies packet inter-arrival randomness, providing additional discriminatory insights. Based on these findings, we propose an anomaly detector founded exclusively on these statistical features, demonstrating that they are sufficient to robustly differentiate malicious from benign traffic. These findings significantly enhance the understanding of how long-range dependencies and variations in unpredictability can be leveraged to enhance network security protocols and improve the detection of hidden threats within encrypted channels.<\/jats:p>","DOI":"10.1007\/s10922-026-10069-y","type":"journal-article","created":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T04:54:48Z","timestamp":1778216088000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Unveiling Hidden Patterns: Self-Similarity and Entropy for Robust Encrypted DNS Traffic Security"],"prefix":"10.1007","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6068-6233","authenticated-orcid":false,"given":"Marta","family":"Moure-Garrido","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4635-722X","authenticated-orcid":false,"given":"Carlos","family":"Garcia-Rubio","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1788-890X","authenticated-orcid":false,"given":"Celeste","family":"Campo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,5,8]]},"reference":[{"issue":"1","key":"10069_CR1","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/90.282603","volume":"2","author":"WE Leland","year":"1994","unstructured":"Leland, W.E., Taqqu, M.S., Willinger, W., Wilson, D.V.: On the self-similar nature of ethernet traffic (extended version). IEEE\/ACM Trans. Netw. 2(1), 1\u201315 (1994)","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"10069_CR2","volume-title":"On the Relevance of Self-similarity in Network Traffic Prediction","author":"M Ghaderi","year":"2003","unstructured":"Ghaderi, M.: On the Relevance of Self-similarity in Network Traffic Prediction. University of Waterloo, School of Computer Science, Waterloo (2003)"},{"key":"10069_CR3","doi-asserted-by":"crossref","unstructured":"Dobrescu, R., Dobrescu, M., Hossu, D., Taralunga, S.: Using internet traffic self-similarity for detection of network anomalies. In: 2008 11th International Conference on Optimization of Electrical and Electronic Equipment, pp. 81\u201386. IEEE (2008)","DOI":"10.1109\/OPTIM.2008.4602461"},{"key":"10069_CR4","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109910","volume":"234","author":"M Moure-Garrido","year":"2023","unstructured":"Moure-Garrido, M., Campo, C., Garcia-Rubio, C.: Real time detection of malicious DoH traffic using statistical analysis. Comput. Netw. 234, 109910 (2023)","journal-title":"Comput. Netw."},{"key":"10069_CR5","doi-asserted-by":"crossref","unstructured":"Williams, M., Morales, R., Johnson, K., Martinez, G., Bennett, J.: Entropy-based network traffic analysis for efficient ransomware detection. Authorea Preprints (2024)","DOI":"10.36227\/techrxiv.172840776.66718131\/v1"},{"issue":"4","key":"10069_CR6","doi-asserted-by":"publisher","first-page":"219","DOI":"10.1145\/1030194.1015492","volume":"34","author":"A Lakhina","year":"2004","unstructured":"Lakhina, A., Crovella, M., Diot, C.: Diagnosing network-wide traffic anomalies. ACM SIGCOMM Comput. Commun. Rev. 34(4), 219\u2013230 (2004)","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"10069_CR7","doi-asserted-by":"crossref","unstructured":"Siby, S., Juarez, M., Diaz, C., Vallina-Rodriguez, N., Troncoso, C.: Encrypted dns\u2013> privacy? a traffic analysis perspective. arXiv preprint (2019). arXiv:1906.09682","DOI":"10.14722\/ndss.2020.24301"},{"issue":"3","key":"10069_CR8","doi-asserted-by":"publisher","first-page":"1143","DOI":"10.1109\/TR.2020.3023257","volume":"70","author":"D Tang","year":"2020","unstructured":"Tang, D., Feng, Y., Zhang, S., Qin, Z.: FR-RED: Fractal residual based real-time detection of the LDoS attack. IEEE Trans. Reliab. 70(3), 1143\u20131157 (2020)","journal-title":"IEEE Trans. Reliab."},{"key":"10069_CR9","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1007\/s10922-005-9000-y","volume":"13","author":"Y Bhole","year":"2005","unstructured":"Bhole, Y., Popescu, A.: Measurement and analysis of http traffic. J. Netw. Syst. Manage. 13, 357\u2013371 (2005)","journal-title":"J. Netw. Syst. Manage."},{"issue":"1","key":"10069_CR10","doi-asserted-by":"publisher","first-page":"770","DOI":"10.1061\/TACEAT.0006518","volume":"116","author":"HE Hurst","year":"1951","unstructured":"Hurst, H.E.: Long-term storage capacity of reservoirs. Trans. Am. Soc. Civ. Eng. 116(1), 770\u2013799 (1951)","journal-title":"Trans. Am. Soc. Civ. Eng."},{"issue":"4","key":"10069_CR11","first-page":"591","volume":"129","author":"HE Hurst","year":"1965","unstructured":"Hurst, H.E.: Long term storage. An experimental study. R Stat. Soc. J. Ser. Gen. 129(4), 591\u2013593 (1965)","journal-title":"R Stat. Soc. J. Ser. Gen."},{"key":"10069_CR12","doi-asserted-by":"crossref","unstructured":"Beran, J., Sherman, R., Taqqu, M.S., Willinger, W.: Long-range dependence in variable-bit-rate video traffic. IEEE Trans. Commun. 43(2\/3\/4), 1566\u20131579 (1995)","DOI":"10.1109\/26.380206"},{"key":"10069_CR13","doi-asserted-by":"crossref","unstructured":"Crovella, M.E., Bestavros, A.: Self-similarity in world wide web traffic: evidence and possible causes. In: Proceedings of the 1996 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, pp. 160\u2013169 (1996)","DOI":"10.1145\/233013.233038"},{"issue":"1","key":"10069_CR14","doi-asserted-by":"publisher","first-page":"71","DOI":"10.1109\/90.554723","volume":"5","author":"W Willinger","year":"1997","unstructured":"Willinger, W., Taqqu, M.S., Sherman, R., Wilson, D.V.: Self-similarity through high-variability: statistical analysis of Ethernet LAN traffic at the source level. IEEE\/ACM Trans. Netw. 5(1), 71\u201386 (1997)","journal-title":"IEEE\/ACM Trans. Netw."},{"issue":"4","key":"10069_CR15","doi-asserted-by":"publisher","first-page":"422","DOI":"10.1137\/1010093","volume":"10","author":"BB Mandelbrot","year":"1968","unstructured":"Mandelbrot, B.B., Van Ness, J.W.: Fractional brownian motions, fractional noises and applications. SIAM Rev. 10(4), 422\u2013437 (1968)","journal-title":"SIAM Rev."},{"issue":"1","key":"10069_CR16","doi-asserted-by":"publisher","first-page":"67","DOI":"10.1214\/ss\/1177010131","volume":"10","author":"W Willinger","year":"1995","unstructured":"Willinger, W., Taqqu, M.S., Leland, W.E., Wilson, D.V.: Self-similarity in high-speed packet traffic: analysis and modeling of Ethernet traffic measurements. Stat. Sci. 10(1), 67\u201385 (1995)","journal-title":"Stat. Sci."},{"issue":"5","key":"10069_CR17","doi-asserted-by":"publisher","first-page":"629","DOI":"10.1109\/90.803379","volume":"7","author":"M Grossglauser","year":"1999","unstructured":"Grossglauser, M., Bolot, J.-C.: On the relevance of long-range dependence in network traffic. IEEE\/ACM Trans. Networking 7(5), 629\u2013640 (1999)","journal-title":"IEEE\/ACM Trans. Networking"},{"issue":"4","key":"10069_CR18","doi-asserted-by":"publisher","first-page":"1358","DOI":"10.1109\/TIM.2010.2084711","volume":"60","author":"T Akg\u00fcl","year":"2010","unstructured":"Akg\u00fcl, T., Baykut, S., Erol-Kantarci, M., Oktug, S.F.: Periodicity-based anomalies in self-similar network traffic flow measurements. IEEE Trans. Instrum. Meas. 60(4), 1358\u20131366 (2010)","journal-title":"IEEE Trans. Instrum. Meas."},{"key":"10069_CR19","unstructured":"Park, K., Kim, G., Crovella, M.: On the relationship between file sizes, transport protocols, and self-similar network traffic. In: Proceedings of 1996 International Conference on Network Protocols (ICNP-96), pp. 171\u2013180 (1996). IEEE"},{"issue":"7","key":"10069_CR20","doi-asserted-by":"publisher","first-page":"297","DOI":"10.1109\/LCOMM.2002.801327","volume":"6","author":"Q Liang","year":"2002","unstructured":"Liang, Q.: Ad hoc wireless network traffic-self-similarity and forecasting. IEEE Commun. Lett. 6(7), 297\u2013299 (2002)","journal-title":"IEEE Commun. Lett."},{"issue":"5","key":"10069_CR21","doi-asserted-by":"publisher","first-page":"1837","DOI":"10.3390\/en15051837","volume":"15","author":"M Moure-Garrido","year":"2022","unstructured":"Moure-Garrido, M., Campo, C., Garcia-Rubio, C.: Entropy-based anomaly detection in household electricity consumption. Energies 15(5), 1837 (2022)","journal-title":"Energies"},{"issue":"12","key":"10069_CR22","doi-asserted-by":"publisher","first-page":"380","DOI":"10.3390\/electronics7120380","volume":"7","author":"C Garcia-Rubio","year":"2018","unstructured":"Garcia-Rubio, C., D\u00edaz Redondo, R.P., Campo, C., Fern\u00e1ndez Vilas, A.: Using entropy of social media location data for the detection of crowd dynamics anomalies. Electronics 7(12), 380 (2018)","journal-title":"Electronics"},{"key":"10069_CR23","doi-asserted-by":"crossref","unstructured":"Gu, Y., McCallum, A., Towsley, D.: Detecting anomalies in network traffic using maximum entropy estimation. In: Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, pp. 32\u201332 (2005)","DOI":"10.1145\/1330107.1330148"},{"key":"10069_CR24","doi-asserted-by":"crossref","unstructured":"Nychis, G., Sekar, V., Andersen, D.G., Kim, H., Zhang, H.: An empirical evaluation of entropy-based traffic anomaly detection. In: Proceedings of the 8th ACM SIGCOMM Conference on Internet Measurement. IMC \u201908, pp. 151\u2013156. Association for Computing Machinery, New York (2008)","DOI":"10.1145\/1452520.1452539"},{"issue":"6","key":"10069_CR25","doi-asserted-by":"publisher","first-page":"42","DOI":"10.1109\/MCG.2015.97","volume":"35","author":"F Zhou","year":"2015","unstructured":"Zhou, F., Huang, W., Zhao, Y., Shi, Y., Liang, X., Fan, X.: ENTVis: A visual analytic tool for entropy-based network traffic anomaly detection. IEEE Comput. Graphics Appl. 35(6), 42\u201350 (2015)","journal-title":"IEEE Comput. Graphics Appl."},{"issue":"4","key":"10069_CR26","doi-asserted-by":"publisher","first-page":"2367","DOI":"10.3390\/e17042367","volume":"17","author":"P Berezi\u0144ski","year":"2015","unstructured":"Berezi\u0144ski, P., Jasiul, B., Szpyrka, M.: An entropy-based network anomaly detection method. Entropy 17(4), 2367\u20132408 (2015)","journal-title":"Entropy"},{"issue":"1","key":"10069_CR27","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-024-00249-1","volume":"7","author":"H Yu","year":"2024","unstructured":"Yu, H., Yang, W., Cui, B., Sui, R., Wu, X.: Renyi entropy-driven network traffic anomaly detection with dynamic threshold. Cybersecurity 7(1), 1\u201313 (2024)","journal-title":"Cybersecurity"},{"key":"10069_CR28","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1007\/s10922-024-09847-3","volume":"32","author":"C Kondaiah","year":"2024","unstructured":"Kondaiah, C., Alwyn, P., Routhu, R., Rao, S., Pais, A.R., Rao, R.S.: Enhanced malicious traffic detection in encrypted communication using tls features and a multi-class classifier ensemble. J. Netw. Syst. Manage. 32, 76 (2024)","journal-title":"J. Netw. Syst. Manage."},{"issue":"4","key":"10069_CR29","doi-asserted-by":"publisher","first-page":"82","DOI":"10.1007\/s10922-025-09963-8","volume":"33","author":"H Rezaei","year":"2025","unstructured":"Rezaei, H., Taheri, R., Jordanov, I., Shojafar, M.: Federated rnn for intrusion detection system in iot environment under adversarial attack. J. Netw. Syst. Manage. 33(4), 82 (2025)","journal-title":"J. Netw. Syst. Manage."},{"key":"10069_CR30","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10922-025-09917-0","volume":"33","author":"MM Shafi","year":"2025","unstructured":"Shafi, M.M., Lashkari, A.H., Roudsari, A.H.: Toward generating a large scale intrusion detection dataset and intruders behavioral profiling using network and transportation layers traffic flow analyzer (ntlflowlyzer). J. Netw. Syst. Manage. 33, 1\u201349 (2025)","journal-title":"J. Netw. Syst. Manage."},{"key":"10069_CR31","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10922-025-09926-z","volume":"33","author":"P Wang","year":"2025","unstructured":"Wang, P., Song, Y., Wang, X., Guo, X.: Dift: A diffusion-transformer for intrusion detection of iot with imbalanced learning. J. Netw. Syst. Manage. 33, 1\u201324 (2025)","journal-title":"J. Netw. Syst. Manage."},{"key":"10069_CR32","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10922-024-09842-8","volume":"32","author":"DR Arikkat","year":"2024","unstructured":"Arikkat, D.R., Vinod, P., Rehiman, K.A.R., Rasheed, R.A., Conti, M.: Xaitrafficintell: Interpretable cyber threat intelligence for darknet traffic analysis. J. Netw. Syst. Manage. 32, 1\u201333 (2024)","journal-title":"J. Netw. Syst. Manage."},{"key":"10069_CR33","doi-asserted-by":"crossref","unstructured":"Koumar, J., Pesek, J., Jerabek, K., \u010cejka, T.: Towards building network outlier detection system for network traffic monitoring. In: NOMS 2025-2025 IEEE Network Operations and Management Symposium, pp. 1\u20136. IEEE (2025)","DOI":"10.1109\/NOMS57970.2025.11073727"},{"issue":"5","key":"10069_CR34","doi-asserted-by":"publisher","first-page":"355","DOI":"10.1002\/nem.1901","volume":"25","author":"P Velan","year":"2015","unstructured":"Velan, P., \u010cerm\u00e1k, M., \u010celeda, P., Dra\u0161ar, M.: A survey of methods for encrypted traffic classification and analysis. Int. J. Netw. Manage 25(5), 355\u2013374 (2015)","journal-title":"Int. J. Netw. Manage"},{"key":"10069_CR35","unstructured":"Huoh, T.-L., Luo, Y., Zhang, T.: Encrypted network traffic classification using a geometric learning model. In: 2021 IFIP\/IEEE International Symposium on Integrated Network Management (IM), pp. 376\u2013383. IEEE (2021)"},{"key":"10069_CR36","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10922-025-09930-3","volume":"33","author":"CY Lin","year":"2025","unstructured":"Lin, C.Y., Tseng, C.T., An, L.Y.: Employing federated semi-supervised learning for network traffic classification. J. Netw. Syst. Manage. 33, 1\u201330 (2025)","journal-title":"J. Netw. Syst. Manage."},{"key":"10069_CR37","doi-asserted-by":"publisher","first-page":"54668","DOI":"10.1109\/ACCESS.2022.3175497","volume":"10","author":"K Hynek","year":"2022","unstructured":"Hynek, K., Vekshin, D., Luxemburk, J., Cejka, T., Wasicek, A.: Summary of DNS over HTTPS abuse. IEEE Access 10, 54668\u201354680 (2022)","journal-title":"IEEE Access"},{"key":"10069_CR38","doi-asserted-by":"crossref","unstructured":"MontazeriShatoori, M., Davidson, L., Kaur, G., Habibi\u00a0Lashkari, A.: Detection of DoH tunnels using time-series classification of encrypted traffic. In: IEEE Intl. Conf. on Dependable, Autonomic and Secure Computing (DASC), pp. 63\u201370 (2020)","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026"},{"issue":"3","key":"10069_CR39","doi-asserted-by":"publisher","first-page":"47","DOI":"10.3390\/computers12030047","volume":"12","author":"AR Alzighaibi","year":"2023","unstructured":"Alzighaibi, A.R.: Detection of DoH traffic tunnels using deep learning for encrypted traffic classification. Computers 12(3), 47 (2023)","journal-title":"Computers"},{"key":"10069_CR40","doi-asserted-by":"publisher","first-page":"2339","DOI":"10.1109\/TIFS.2022.3183390","volume":"17","author":"T Zebin","year":"2022","unstructured":"Zebin, T., Rezvy, S., Luo, Y.: An explainable AI-based intrusion detection system for DNS over HTTPS (DoH) attacks. IEEE Trans. Inf. Forensics Secur. 17, 2339\u20132349 (2022)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10069_CR41","doi-asserted-by":"crossref","unstructured":"Singh, S.K., Roy, P.K.: Detecting malicious DNS over HTTPS traffic using machine learning. In: 2020 International Conference on Innovation and Intelligence for Informatics, Computing and Technologies (3ICT), pp. 1\u20136. IEEE (2020)","DOI":"10.1109\/3ICT51146.2020.9312004"},{"issue":"2","key":"10069_CR42","doi-asserted-by":"publisher","first-page":"1293","DOI":"10.1007\/s10207-023-00790-z","volume":"23","author":"S Niktabe","year":"2024","unstructured":"Niktabe, S., Lashkari, A.H., Sharma, D.P.: Detection, characterization, and profiling DoH malicious traffic using statistical pattern recognition. Int. J. Inf. Secur. 23(2), 1293\u20131316 (2024)","journal-title":"Int. J. Inf. Secur."},{"key":"10069_CR43","doi-asserted-by":"crossref","unstructured":"Jerabek, K., Koumar, J., Setinsk\u1ef3, J., Pesek, J.: Explainable anomaly detection in network traffic using llm. In: NOMS 2025-2025 IEEE Network Operations and Management Symposium, pp. 1\u20136. IEEE (2025)","DOI":"10.1109\/NOMS57970.2025.11073574"},{"issue":"2","key":"10069_CR44","doi-asserted-by":"publisher","first-page":"445","DOI":"10.1109\/TNSM.2019.2899085","volume":"16","author":"G Aceto","year":"2019","unstructured":"Aceto, G., Ciuonzo, D., Montieri, A., Pescap\u00e9, A.: Mobile encrypted traffic classification using deep learning: experimental evaluation, lessons learned, and challenges. IEEE Trans. Netw. Serv. Manage. 16(2), 445\u2013458 (2019)","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10069_CR45","doi-asserted-by":"crossref","unstructured":"Chen, Y., Wang, Y., Li, R., Xiao, Y., Liu, L., Li, J., Jia, Y., Gu, Z.: Trafficaudio: Audio representation for lightweight encrypted traffic classification in iot. IEEE Transactions on Network and Service Management (2026)","DOI":"10.1109\/TNSM.2026.3651599"},{"issue":"2","key":"10069_CR46","doi-asserted-by":"publisher","first-page":"2225","DOI":"10.1109\/TNSM.2025.3543903","volume":"22","author":"J Kotak","year":"2025","unstructured":"Kotak, J., Yankelev, I., Bibi, I., Elovici, Y., Shabtai, A.: VPN-encrypted network traffic classification using a time-series approach. IEEE Trans. Netw. Serv. Manage. 22(2), 2225\u20132242 (2025)","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10069_CR47","doi-asserted-by":"crossref","unstructured":"Pregardier, R.C., Bianchi, L.A., Garcia, V.F., Stiller, B., Silva, L.A., Dos\u00a0Santos, C.R.: Titan dga: Enhancing dga evasiveness through a transformer-based autoencoder and adversarial self-augmentation. In: 2025 21st International Conference on Network and Service Management (CNSM), pp. 1\u20139. IEEE (2025)","DOI":"10.23919\/CNSM67658.2025.11297533"},{"key":"10069_CR48","doi-asserted-by":"crossref","unstructured":"Li, G., Gao, Y., Ren, J., Chen, S.: Bpf-gnn: A multi-granularity feature extraction model using graph neural networks for encrypted traffic classification. IEEE Transactions on Network and Service Management (2026)","DOI":"10.1109\/TNSM.2026.3671203"},{"issue":"3","key":"10069_CR49","doi-asserted-by":"publisher","first-page":"3583","DOI":"10.1109\/TNSM.2024.3383851","volume":"21","author":"J Yang","year":"2024","unstructured":"Yang, J., Jiang, X., Lei, Y., Liang, W., Ma, Z., Li, S.: Mtsecurity: Privacy-preserving malicious traffic classification using graph neural network and transformer. IEEE Trans. Netw. Serv. Manage. 21(3), 3583\u20133597 (2024)","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10069_CR50","doi-asserted-by":"crossref","unstructured":"Latif-Mart\u00ednez, H., Vanerio, J., Casas, P., Su\u00e1rez-Varela, J., Cabellos-Aparicio, A., Barlet-Ros, P.: Tsgfm-graph neural networks for zero-shot time series forecasting in network monitoring. In: 2025 21st International Conference on Network and Service Management (CNSM), pp. 1\u20139. IEEE (2025)","DOI":"10.23919\/CNSM67658.2025.11297447"},{"key":"10069_CR51","doi-asserted-by":"crossref","unstructured":"Adjei, J.A., Zincir-Heywood, N., Heywood, M., Nandy, B., Seddigh, N.: Iot botnet detection with drift-aligned learning and dns-based c2 identification. In: 2025 21st International Conference on Network and Service Management (CNSM), pp. 1\u20137 (2025). IEEE","DOI":"10.23919\/CNSM67658.2025.11297569"},{"key":"10069_CR52","doi-asserted-by":"crossref","unstructured":"Beran, J.: Statistics for long-memory processes. Statistics for Long-Memory Processes, 1\u2013315 (2017)","DOI":"10.1201\/9780203738481-1"},{"issue":"1","key":"10069_CR53","doi-asserted-by":"publisher","first-page":"228","DOI":"10.1029\/WR005i001p00228","volume":"5","author":"BB Mandelbrot","year":"1969","unstructured":"Mandelbrot, B.B., Wallis, J.R.: Computer experiments with fractional gaussian noises: Part 1, averages and variances. Water Resour. Res. 5(1), 228\u2013241 (1969)","journal-title":"Water Resour. Res."},{"key":"10069_CR54","doi-asserted-by":"publisher","first-page":"271","DOI":"10.1007\/BF00532867","volume":"31","author":"BB Mandelbrot","year":"1975","unstructured":"Mandelbrot, B.B.: Limit theorems on the self-normalized range for weakly and strongly dependent processes. Zeitschrift f\u00fcr Wahrscheinlichkeitstheorie und verwandte Gebiete 31, 271\u2013285 (1975)","journal-title":"Zeitschrift f\u00fcr Wahrscheinlichkeitstheorie und verwandte Gebiete"},{"issue":"1","key":"10069_CR55","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1080\/00031305.1978.10479236","volume":"32","author":"R McGill","year":"1978","unstructured":"McGill, R., Tukey, J.W., Larsen, W.A.: Variations of box plots. Am. Stat. 32(1), 12\u201316 (1978)","journal-title":"Am. Stat."},{"key":"10069_CR56","unstructured":"Qian, B., Rasheed, K.: Hurst exponent and financial market predictability. In: Proceedings of the IASTED International Conference on Financial Engineering and Applications, Cambridge, pp. 203\u2013209 (2004)"},{"issue":"04","key":"10069_CR57","doi-asserted-by":"publisher","first-page":"785","DOI":"10.1142\/S0218348X95000692","volume":"3","author":"MS Taqqu","year":"1995","unstructured":"Taqqu, M.S., Teverovsky, V., Willinger, W.: Estimators for long-range dependence: an empirical study. Fractals 3(04), 785\u2013798 (1995)","journal-title":"Fractals"},{"key":"10069_CR58","doi-asserted-by":"crossref","unstructured":"Zhang, H., Shu, Y., Yang, O.: Estimation of Hurst parameter by variance-time plots. In: 1997 IEEE Pacific Rim Conference on Communications, Computers and Signal Processing, PACRIM. 10 Years Networking the Pacific Rim, 1987\u20131997, vol. 2, pp. 883\u2013886. IEEE (1997)","DOI":"10.1109\/PACRIM.1997.620401"},{"issue":"11","key":"10069_CR59","doi-asserted-by":"publisher","first-page":"1380","DOI":"10.1109\/PROC.1981.12184","volume":"69","author":"SM Kay","year":"2005","unstructured":"Kay, S.M., Marple, S.L.: Spectrum analysis-a modern perspective. Proc. IEEE 69(11), 1380\u20131419 (2005)","journal-title":"Proc. IEEE"},{"key":"10069_CR60","doi-asserted-by":"crossref","unstructured":"Kuensch, H.R.: Statistical aspects of self-similar processes. In: Proceedings of the First World Congress of the Bernoulli Society, vol. 1, pp. 67\u201374. VNU Science Press, Utrecht (1987)","DOI":"10.1515\/9783112314227-005"},{"key":"10069_CR61","volume-title":"Elements of Information Theory","author":"TM Cover","year":"1999","unstructured":"Cover, T.M.: Elements of Information Theory. Wiley, New York (1999)"},{"issue":"2","key":"10069_CR62","doi-asserted-by":"publisher","first-page":"71","DOI":"10.3390\/entropy-e10020071","volume":"10","author":"Y Gao","year":"2008","unstructured":"Gao, Y., Kontoyiannis, I., Bienenstock, E.: Estimating the entropy of binary time series: methodology, some theory and a simulation study. Entropy 10(2), 71\u201399 (2008)","journal-title":"Entropy"},{"issue":"3","key":"10069_CR63","doi-asserted-by":"publisher","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","volume":"27","author":"CE Shannon","year":"1948","unstructured":"Shannon, C.E.: A mathematical theory of communication. The Bell Syst. Tech. J. 27(3), 379\u2013423 (1948)","journal-title":"The Bell Syst. Tech. J."},{"key":"10069_CR64","doi-asserted-by":"crossref","unstructured":"Moure-Garrido, M., Campo, C., Garcia-Rubio, C.: Detecting malicious use of DoH tunnels using statistical traffic analysis. In: Proceedings of the 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks, pp. 25\u201332 (2022)","DOI":"10.1145\/3551663.3558605"},{"key":"10069_CR65","first-page":"321","volume":"16","author":"NV Chawla","year":"2002","unstructured":"Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P.: Smote: synthetic minority over-sampling technique. J. Artif. Intel. Res 16, 321\u2013357 (2002)","journal-title":"J. Artif. Intel. Res"}],"container-title":["Journal of Network and Systems Management"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10922-026-10069-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10922-026-10069-y","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10922-026-10069-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T06:04:11Z","timestamp":1778220251000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10922-026-10069-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,8]]},"references-count":65,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2026,7]]}},"alternative-id":["10069"],"URL":"https:\/\/doi.org\/10.1007\/s10922-026-10069-y","relation":{},"ISSN":["1064-7570","1573-7705"],"issn-type":[{"value":"1064-7570","type":"print"},{"value":"1573-7705","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,8]]},"assertion":[{"value":"2 December 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 April 2026","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 April 2026","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 May 2026","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"90"}}