{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,20]],"date-time":"2026-04-20T14:58:39Z","timestamp":1776697119136,"version":"3.51.2"},"reference-count":26,"publisher":"Springer Science and Business Media LLC","issue":"7","license":[{"start":{"date-parts":[[2016,11,24]],"date-time":"2016-11-24T00:00:00Z","timestamp":1479945600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"name":"the National Science and Technology Support Program","award":["No. 2012BAH46B02"],"award-info":[{"award-number":["No. 2012BAH46B02"]}]},{"name":"the Strategic Priority Research Program of the Chinese Academy of Sciences","award":["No. XDA06030200"],"award-info":[{"award-number":["No. XDA06030200"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Supercomput"],"published-print":{"date-parts":[[2017,7]]},"DOI":"10.1007\/s11227-016-1924-3","type":"journal-article","created":{"date-parts":[[2016,11,24]],"date-time":"2016-11-24T07:18:36Z","timestamp":1479971916000},"page":"3053-3064","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["A network attack forensic platform against HTTP evasive behavior"],"prefix":"10.1007","volume":"73","author":[{"given":"Zhen","family":"Li","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haiqing","family":"Pan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenhao","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fei","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zigang","family":"Cao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gang","family":"Xiong","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2016,11,24]]},"reference":[{"issue":"1","key":"1924_CR1","doi-asserted-by":"crossref","first-page":"131","DOI":"10.5176\/2010-2283_1.1.22","volume":"1","author":"V Urias","year":"2010","unstructured":"Urias V, Young J, Hatcher S (2010) Implications of cloud computing on digital forensics. GSTF Int J Comput 1(1):131\u2013137","journal-title":"GSTF Int J Comput"},{"key":"1924_CR2","first-page":"104","volume":"11","author":"D Stiawan","year":"2015","unstructured":"Stiawan D, Idris MY, Abdullah AH (2015) Penetration testing and network auditing: Linux. J Inf Process Syst (JIPS) 11:104\u2013115","journal-title":"J Inf Process Syst (JIPS)"},{"key":"1924_CR3","doi-asserted-by":"crossref","first-page":"242","DOI":"10.1007\/978-3-642-28537-0_24","volume":"7192","author":"F Schneider","year":"2012","unstructured":"Schneider F, Ager B, Maier G, Feldmann A, Uhlig S (2012) Pitfalls in HTTP traffic measurements and analysis. Passiv Act Meas 7192:242\u2013251","journal-title":"Passiv Act Meas"},{"key":"1924_CR4","unstructured":"VRT Labs (2014) Content-type mismatch. \n                        https:\/\/labs.snort.org\/papers\/contentmi-smatch.html"},{"key":"1924_CR5","unstructured":"FireEye (2015) APT30 and the mechanics of a long-running cyber espionage operation. \n                        https:\/\/www2.fireeye.com\/rs\/fireye\/images\/rpt-apt30.pdf"},{"key":"1924_CR6","unstructured":"Operation Poisoned Helmand (2014) \n                        https:\/\/www.threatconnect.com\/operation-poisoned-helmand\/"},{"key":"1924_CR7","unstructured":"Snort (2016). \n                        http:\/\/www.snort.org\/"},{"key":"1924_CR8","doi-asserted-by":"crossref","unstructured":"Khamphakdee N, Benjamas N, Saiyod S (2014) Improving intrusion detection system based on snort rules for network probe attack detection. In: 2nd International Conference on Information and Communication Technology (ICoICT), pp 69\u201374","DOI":"10.1109\/ICoICT.2014.6914042"},{"issue":"1\/2","key":"1924_CR9","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1016\/j.diin.2010.02.003","volume":"7","author":"ES Pilli","year":"2010","unstructured":"Pilli ES, Joshi RC, Niyogi R (2010) Network forensic frameworks: survey and research challenges. Digit Investig 7(1\/2):14\u201327","journal-title":"Digit Investig"},{"issue":"Suppl 1","key":"1924_CR10","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.diin.2015.01.005","volume":"12","author":"D Gugelmann","year":"2015","unstructured":"Gugelmann D, Gasser F, Ager B, Lenders V (2015) Hviz: Http(s) traffic aggregation and visualization for network forensics. Digit Investig 12(Suppl 1):1\u201311","journal-title":"Digit Investig"},{"key":"1924_CR11","unstructured":"Mukkamala S, Sung AH (2003) Identifying significant features for network forensic analysis using artificial intelligence techniques. Int J Digit Evid IJDE 1(4):1\u201317"},{"key":"1924_CR12","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1007\/s11416-015-0247-x","volume":"12","author":"A Boukhtouta","year":"2016","unstructured":"Boukhtouta A, Mokhov S-A, Lakhdari N-E, Debbabi M, Paquet J (2016) Network malware classification comparison using dpi and flow packet headers. Comput Virol Hacking Tech 12:69\u2013100","journal-title":"Comput Virol Hacking Tech"},{"key":"1924_CR13","doi-asserted-by":"crossref","unstructured":"Al-Mahrouqi A, Abdalla S, Kechad T (2015) Efficiency of network event logs as admissible digital evidence. In: Science and Information Conference","DOI":"10.1109\/SAI.2015.7237305"},{"key":"1924_CR14","doi-asserted-by":"crossref","unstructured":"Parry J, Hunter D, Radke K, Fidge C (2016) A network forensics tool for precise data packet capture and replay in cyber-physical systems. In: Australasian Computer Science Week Multiconference (ACSC2016)","DOI":"10.1145\/2843043.2843047"},{"issue":"3","key":"1924_CR15","first-page":"14","volume":"2","author":"AK Kaushik","year":"2010","unstructured":"Kaushik AK, Joshi RC (2010) Network forensic system for ICMP attacks. Int J Comput Appl 2(3):14\u201321","journal-title":"Int J Comput Appl"},{"key":"1924_CR16","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1016\/j.diin.2008.05.016","volume":"5","author":"M Cohen","year":"2008","unstructured":"Cohen M (2008) PyFlag\u2014an advanced network forensic framework. Digit Investig 5:112\u2013120","journal-title":"Digit Investig"},{"key":"1924_CR17","doi-asserted-by":"crossref","unstructured":"Giura P, Memon N (2010) NetStore: an efficient storage infrastructure for network forensics and monitoring. In: Proceedings of the 13th International Conference on Recent Advances in Intrusion Detection, Ottawa, Ontario, Canada, pp 15\u201317","DOI":"10.1007\/978-3-642-15512-3_15"},{"key":"1924_CR18","unstructured":"Vallentin M, Paxson V, Sommer R (2016) VAST: a unified platform for interactive network forensics. In: 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16), pp 345\u2013362"},{"key":"1924_CR19","doi-asserted-by":"crossref","unstructured":"Vallentin M, Charousset D, Schmidt TC, Paxson V, Wahlisch M (2014) Native actors: how to scale network forensics. In: Proc. of ACM SIGCOMM, Demo Session, New York, August 2014","DOI":"10.1145\/2619239.2631471"},{"key":"1924_CR20","doi-asserted-by":"crossref","unstructured":"Vadrevu P, Rahbarinia B, Perdisci R, Li K, Antonakakis M (2013) Measuring and detecting malware downloads in live network traffic. ESORICS\u201913, pp 556\u2013573","DOI":"10.1007\/978-3-642-40203-6_31"},{"key":"1924_CR21","doi-asserted-by":"crossref","unstructured":"Invernizzi L, Miskovic S, Torres R, Saha S, Lee S-J, Kruegel C, Vigna G (2014) Nazca: detecting malware distribution in large-scale networks. In: Proceedings of the ISOC Network and Distributed System Security Symposium","DOI":"10.14722\/ndss.2014.23269"},{"key":"1924_CR22","unstructured":"Huh J-H, Seo K (2016) Design and test bed experiments of server operation system using virtualization technology. Human-centric computing and information sciences (HCIS). Springer, Berlin, pp 1\u201321"},{"key":"1924_CR23","unstructured":"Comparison of antivirus software (2016) \n                        https:\/\/en.wikipedia.org\/wiki\/Compari-son_of_antivirus_software"},{"key":"1924_CR24","unstructured":"StatCounter. \n                        http:\/\/gs.statcounter.com\/#desktop-os-ww-monthly-201604-201604-bar"},{"key":"1924_CR25","unstructured":"VirusTotal (2015) \n                        https:\/\/en.wikipedia.org\/wiki\/Virus-Total"},{"issue":"1","key":"1924_CR26","doi-asserted-by":"crossref","first-page":"1","DOI":"10.3745\/JIPS.2014.10.1.001","volume":"10","author":"C Shahabi","year":"2014","unstructured":"Shahabi C, Kim S-H, Nocera L, Constantinou G, Lu Y, Cai Y-H, Medioni G, Nevatia R, Banaei-Kashani F (2014) Janus-multi source event detection and collection system for effective surveillance of criminal activity. J Inf Process Syst (JIPS) 10(1):1\u201322","journal-title":"J Inf Process Syst (JIPS)"}],"container-title":["The Journal of Supercomputing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s11227-016-1924-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-016-1924-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-016-1924-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,7,10]],"date-time":"2017-07-10T03:35:53Z","timestamp":1499657753000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s11227-016-1924-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,11,24]]},"references-count":26,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2017,7]]}},"alternative-id":["1924"],"URL":"https:\/\/doi.org\/10.1007\/s11227-016-1924-3","relation":{},"ISSN":["0920-8542","1573-0484"],"issn-type":[{"value":"0920-8542","type":"print"},{"value":"1573-0484","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,11,24]]}}}