{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,5,9]],"date-time":"2025-05-09T16:01:13Z","timestamp":1746806473124,"version":"3.40.5"},"reference-count":37,"publisher":"Springer Science and Business Media LLC","issue":"2-3","license":[{"start":{"date-parts":[[2016,8,1]],"date-time":"2016-08-01T00:00:00Z","timestamp":1470009600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100001659","name":"Deutsche Forschungsgemeinschaft","doi-asserted-by":"publisher","award":["SCHE540\/12-2"],"award-info":[{"award-number":["SCHE540\/12-2"]}],"id":[{"id":"10.13039\/501100001659","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mach Learn"],"published-print":{"date-parts":[[2016,9]]},"DOI":"10.1007\/s10994-016-5581-9","type":"journal-article","created":{"date-parts":[[2016,8,1]],"date-time":"2016-08-01T16:55:33Z","timestamp":1470070533000},"page":"385-410","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Learning to control a structured-prediction decoder for detection of HTTP-layer DDoS attackers"],"prefix":"10.1007","volume":"104","author":[{"given":"Uwe","family":"Dick","sequence":"first","affiliation":[]},{"given":"Tobias","family":"Scheffer","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2016,8,1]]},"reference":[{"key":"5581_CR1","unstructured":"Amza, C., Cecchet, E., Chanda, A., Cox, A., Elnikety, S., Gil, R., Marguerite, J., Rajamani, K., & Zwaenepoel, W. (2002). Bottleneck characterization of dynamic web site benchmarks. Technical report TR-02-391, Rice University."},{"issue":"4","key":"5581_CR2","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1016\/j.cose.2010.12.004","volume":"30","author":"D Ariu","year":"2011","unstructured":"Ariu, D., Tronci, R., & Giacinto, G. (2011). HMMPayl: An intrusion detection system based on hidden Markov models. Computers & Security, 30(4), 221\u2013241.","journal-title":"Computers & Security"},{"key":"5581_CR3","doi-asserted-by":"crossref","DOI":"10.1007\/978-93-86279-38-5","volume-title":"Stochastic approximation: A dynamical systems viewpoint","author":"VS Borka","year":"2008","unstructured":"Borka, V. S. (2008). Stochastic approximation: A dynamical systems viewpoint. Cambridge: Cambridge University Press."},{"issue":"2","key":"5581_CR4","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1137\/S0363012997331639","volume":"38","author":"VS Borkar","year":"2000","unstructured":"Borkar, V. S., & Meyn, S. P. (2000). The ODE method for convergence of stochastic approximation and reinforcement learning. SIAM Journal on Control and Optimization, 38(2), 447\u2013469.","journal-title":"SIAM Journal on Control and Optimization"},{"key":"5581_CR5","first-page":"4","volume":"2","author":"JR Doppa","year":"2013","unstructured":"Doppa, J. R., Fern, A., & Tadepalli, P. (2013). HC-search: Learning heuristics and cost functions for structured prediction. AAAI, 2, 4.","journal-title":"AAAI"},{"key":"5581_CR6","doi-asserted-by":"crossref","unstructured":"Doppa, J. R., Fern, A., & Tadepalli, P. (2014a). HC-search: A learning framework for search-based structured prediction. Journal of Artificial Intelligence Research, 50(1), 369\u2013407.","DOI":"10.1613\/jair.4212"},{"key":"5581_CR7","unstructured":"Doppa, J. R., Fern, A., & Tadepalli, P. (2014b). Structured prediction via output space search. The Journal of Machine Learning Research, 15(1), 1317\u20131350."},{"key":"5581_CR8","doi-asserted-by":"crossref","unstructured":"D\u00fcssel, P., Gehl, C., Laskov, P., & Rieck, K. (2008). Incorporation of application layer protocol syntax into anomaly detection. In International Conference on Information Systems Security, pages 188\u2013202. Springer.","DOI":"10.1007\/978-3-540-89862-7_17"},{"key":"5581_CR9","doi-asserted-by":"crossref","unstructured":"Finley, T., & Joachims, T. (2008). Training structural SVMs when exact inference is intractable. In Proceedings of the International Conference on Machine Learning.","DOI":"10.1145\/1390156.1390195"},{"key":"5581_CR10","doi-asserted-by":"crossref","unstructured":"Gharibian, F., & Ghorbani, A. A., (2007). Comparative study of supervised machine learning techniques for intrusion detection. In IEEE Annual Conference on Communication Networks and Services Research, pages 350\u2013358.","DOI":"10.1109\/CNSR.2007.22"},{"key":"5581_CR11","doi-asserted-by":"crossref","first-page":"235","DOI":"10.1613\/jair.3623","volume":"46","author":"N G\u00f6rnitz","year":"2013","unstructured":"G\u00f6rnitz, N., Kloft, M., Rieck, K., & Brefeld, U. (2013). Toward supervised anomaly detection. Journal of Artificial Intelligence Research, 46, 235\u2013262.","journal-title":"Journal of Artificial Intelligence Research"},{"key":"5581_CR12","first-page":"1471","volume":"5","author":"E Greensmith","year":"2004","unstructured":"Greensmith, E., Bartlett, P. L., & Baxter, J. (2004). Variance reduction techniques for gradient estimates in reinforcement learning. The Journal of Machine Learning Research, 5, 1471\u20131530.","journal-title":"The Journal of Machine Learning Research"},{"key":"5581_CR13","unstructured":"Hazan, T., & Urtasun. R. (2010). Approximated structured prediction for learning large scale graphical models. arxiv:1006.2899 ."},{"issue":"4","key":"5581_CR14","doi-asserted-by":"crossref","first-page":"507","DOI":"10.1007\/s00778-006-0002-5","volume":"16","author":"L Khan","year":"2007","unstructured":"Khan, L., Awad, M., & Thuraisingham, B. (2007). A new intrusion detection system using support vector machines and hierarchical clustering. International Journal on Very Large Databases, 16(4), 507\u2013521.","journal-title":"International Journal on Very Large Databases"},{"issue":"1","key":"5581_CR15","first-page":"3681","volume":"13","author":"M Kloft","year":"2012","unstructured":"Kloft, M., & Laskov, P. (2012). Security analysis of online centroid anomaly detection. Journal of Machine Learning Research, 13(1), 3681\u20133724.","journal-title":"Journal of Machine Learning Research"},{"issue":"18","key":"5581_CR16","doi-asserted-by":"crossref","first-page":"13492","DOI":"10.1016\/j.eswa.2012.07.009","volume":"39","author":"L Koc","year":"2012","unstructured":"Koc, L., Mazzuchi, T. A., & Sarkani, S. (2012). A network intrusion detection system based on a hidden na\u00efve Bayes multiclass classifier. Expert Systems with Applications, 39(18), 13492\u201313500.","journal-title":"Expert Systems with Applications"},{"key":"5581_CR17","unstructured":"Lafferty, J., McCallum, A., & Pereira, F. (2001). Conditional random fields: probabilistic models for segmenting and labeling sequence data. In Proceedings of the International Conference on Machine Learning."},{"key":"5581_CR18","doi-asserted-by":"crossref","unstructured":"Liu, H., & Chang, K. (2011). Defending systems against tilt DDoS attacks. In Proceedings of the International Conference on Telecommunication Systems, Services, and Applications.","DOI":"10.1109\/TSSA.2011.6095400"},{"issue":"1","key":"5581_CR19","doi-asserted-by":"crossref","first-page":"424","DOI":"10.1016\/j.eswa.2011.07.032","volume":"39","author":"Y Li","year":"2012","unstructured":"Li, Y., Xia, J., Zhang, S., Yan, J., Ai, X., & Dai, K. (2012). An efficient intrusion detection system based on support vector machines and gradually feature removal method. Expert Systems with Applications, 39(1), 424\u2013430.","journal-title":"Expert Systems with Applications"},{"key":"5581_CR20","first-page":"2777","volume":"10","author":"LK Mc Dowell","year":"2009","unstructured":"Mc Dowell, L. K., Gupta, K. M., & Aha, D. W. (2009). Cautious collective classification. The Journal of Machine Learning Research, 10, 2777\u20132836.","journal-title":"The Journal of Machine Learning Research"},{"key":"5581_CR21","unstructured":"Neville, J., & Jensen, D. (2000). Iterative classification in relational data. In Proc. AAAI-2000 Workshop on Learning Statistical Models from Relational Data."},{"issue":"1","key":"5581_CR22","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1016\/j.jnca.2005.06.003","volume":"30","author":"S Peddabachigari","year":"2007","unstructured":"Peddabachigari, S., Abraham, A., Grosan, C., & Thomas, J. (2007). Modeling intrusion detection system using hybrid intelligent systems. Journal of Network and Computer Applications, 30(1), 114\u2013132.","journal-title":"Journal of Network and Computer Applications"},{"issue":"1","key":"5581_CR23","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1145\/1216370.1216373","volume":"39","author":"T Peng","year":"2007","unstructured":"Peng, T., Leckie, C., & Ramamohanarao, K. (2007). Survey of network-based defense mechanisms countering the DoS and DDoS problems. ACM Computing Surveys, 39(1), 3.","journal-title":"ACM Computing Surveys"},{"issue":"4","key":"5581_CR24","doi-asserted-by":"crossref","first-page":"682","DOI":"10.1016\/j.neunet.2008.02.003","volume":"21","author":"J Peters","year":"2008","unstructured":"Peters, J., & Schaal, S. (2008). Reinforcement learning of motor skills with policy gradients. Neural networks, 21(4), 682\u2013697.","journal-title":"Neural networks"},{"key":"5581_CR25","doi-asserted-by":"crossref","unstructured":"Ranjan, S., Swaminathan, R., Uysal, M., & Knightley, E. (2006). DDoS-resilient scheduling to counter application layer attacks under imperfect detection. In Proceedings of IEEE INFOCOM.","DOI":"10.1109\/INFOCOM.2006.127"},{"key":"5581_CR26","doi-asserted-by":"publisher","unstructured":"Renuka Devi, S., & Yogesh, P. (2012). Detection of application layer DDsS attacks using information theory based metrics. Department of Information Science and Technology, College of Engineering Guindy doi: 10.5121\/csit.2012.2223 .","DOI":"10.5121\/csit.2012.2223"},{"key":"5581_CR27","unstructured":"Robertson, W. K., & Maggi, F. (2010). Effective anomaly detection with scarce training data. In Network and Distributed System Security Symposium."},{"key":"5581_CR28","unstructured":"Shi, T., Steinhardt, J., & Liang, P. (2015). Learning where to sample in structured prediction. In Proceedings of the Eighteenth International Conference on Artificial Intelligence and Statistics, pages 875\u2013884."},{"key":"5581_CR29","unstructured":"Sutton, R. S., Mcallester, D., Singh, S., Mansour, Y. (2000). Policy gradient methods for reinforcement learning with function approximation. In In Advances in Neural Information Processing Systems 12, pages 1057\u20131063. Cambridge, Massachusetts: MIT Press."},{"key":"5581_CR30","unstructured":"Taskar, B., Abbeel, P., & Koller, D. (2002). Discriminative probabilistic models for relational data. In Eighteenth Conference on Uncertainty in Artificial Intelligence."},{"key":"5581_CR31","unstructured":"Taskar, B., Guestrin, C., Koller, D. (2004). Max-margin markov networks. In Advances in Neural Information Processing Systems 16. Cambridge, Massachusetts: MIT Press."},{"key":"5581_CR32","unstructured":"Tsochantaridis, I., Joachims, T., Hofmann, T., & Altun, Y. (2005). Large margin methods for structured and interdependent output variables. Journal of Machine Learning Research, 6, 1453\u20131484."},{"key":"5581_CR33","unstructured":"Weiss, D., & Taskar, B. (2010). Structured prediction cascades. In International Conference on Artificial Intelligence and Statistics, pages 916\u2013923."},{"key":"5581_CR34","unstructured":"Wick, M., Rohanimanesh, K., Bellare, K., Culotta, A., & McCallum, A. (2011). Samplerank: Training factor graphs with atomic gradients. In Proceedings of the 28th International Conference on Machine Learning, pages 777\u2013784."},{"key":"5581_CR35","doi-asserted-by":"crossref","unstructured":"Wressnegger, C., Schwenk, G., Arp, D., & Rieck, K. (2013). A close look on n-grams in intrusion detection: Anomaly detection versus classification. In Proceedings of the ACM Workshop on Artificial Intelligence and Security, pages 67\u201376.","DOI":"10.1145\/2517312.2517316"},{"issue":"1","key":"5581_CR36","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1109\/TNET.2008.923716","volume":"17","author":"Y Xie","year":"2009","unstructured":"Xie, Y., & Yu, S. Z. (2009). A large-scale hidden semi-markov model for anomaly detection on user browsing behaviors. IEEE\/ACM Transactions on Networking, 17(1), 54\u201365.","journal-title":"IEEE\/ACM Transactions on Networking"},{"issue":"4","key":"5581_CR37","doi-asserted-by":"crossref","first-page":"2046","DOI":"10.1109\/SURV.2013.031413.00127","volume":"15","author":"ST Zargar","year":"2013","unstructured":"Zargar, S. T., Joshi, J., & Tipper, D. (2013). A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks. IEEE Communications Surveys & Tutorials, 15(4), 2046\u20132069.","journal-title":"IEEE Communications Surveys & Tutorials"}],"container-title":["Machine Learning"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-016-5581-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10994-016-5581-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-016-5581-9","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,4]],"date-time":"2022-07-04T17:21:27Z","timestamp":1656955287000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10994-016-5581-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,8,1]]},"references-count":37,"journal-issue":{"issue":"2-3","published-print":{"date-parts":[[2016,9]]}},"alternative-id":["5581"],"URL":"https:\/\/doi.org\/10.1007\/s10994-016-5581-9","relation":{},"ISSN":["0885-6125","1573-0565"],"issn-type":[{"type":"print","value":"0885-6125"},{"type":"electronic","value":"1573-0565"}],"subject":[],"published":{"date-parts":[[2016,8,1]]}}}