{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,27]],"date-time":"2026-02-27T15:45:02Z","timestamp":1772207102389,"version":"3.50.1"},"reference-count":41,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2022,4,28]],"date-time":"2022-04-28T00:00:00Z","timestamp":1651104000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,4,28]],"date-time":"2022-04-28T00:00:00Z","timestamp":1651104000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"funder":[{"name":"National Key Research and Development Program of China","award":["No. 2018YFB0204301"],"award-info":[{"award-number":["No. 2018YFB0204301"]}]},{"name":"National Key Research and Development Program of China","award":["No. 2018YFB0805004"],"award-info":[{"award-number":["No. 2018YFB0805004"]}]},{"DOI":"10.13039\/501100001809","name":"National Nature Science Foundation of China","doi-asserted-by":"crossref","award":["No.62072466"],"award-info":[{"award-number":["No.62072466"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"National Nature Science Foundation of China","doi-asserted-by":"crossref","award":["No.U1811462"],"award-info":[{"award-number":["No.U1811462"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"NUDT Grants","award":["No. ZK19-38"],"award-info":[{"award-number":["No. ZK19-38"]}]},{"name":"ARC DECR","award":["No. DE210101458"],"award-info":[{"award-number":["No. DE210101458"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["World Wide Web"],"published-print":{"date-parts":[[2022,9]]},"DOI":"10.1007\/s11280-022-01057-8","type":"journal-article","created":{"date-parts":[[2022,4,28]],"date-time":"2022-04-28T08:03:14Z","timestamp":1651132994000},"page":"2139-2161","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["FlowSpectrum: a concrete characterization scheme of network traffic behavior for anomaly detection"],"prefix":"10.1007","volume":"25","author":[{"given":"Luming","family":"Yang","sequence":"first","affiliation":[]},{"given":"Shaojing","family":"Fu","sequence":"additional","affiliation":[]},{"given":"Xuyun","family":"Zhang","sequence":"additional","affiliation":[]},{"given":"Shize","family":"Guo","sequence":"additional","affiliation":[]},{"given":"Yongjun","family":"Wang","sequence":"additional","affiliation":[]},{"given":"Chi","family":"Yang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,4,28]]},"reference":[{"key":"1057_CR1","unstructured":"Abadi, M., Barham, P., Chen, J., Chen, Z., Davis, A., Dean, J., Devin, M., Ghemawat, S., Irving, G., Isard, M., et\u00a0al.: Tensorflow: A system for large-scale machine learning. In: 12th USENIX symposium on operating systems design and implementation (OSDI 16), pp. 265\u2013283 (2016)"},{"key":"1057_CR2","unstructured":"Bouzida, Y., Cuppens, F., Cuppens-Boulahia, N., Gombault, S.: Efficient intrusion detection using principal component analysis. In: 3\u00e9me Conf\u00e9rence sur la S\u00e9curit\u00e9 et Architectures R\u00e9seaux (SAR), La Londe, France, pp. 381\u2013395 (2004)"},{"key":"1057_CR3","doi-asserted-by":"crossref","unstructured":"Chen, Y., Ashizawa, N., Yean, S., Yeo, C.K., Yanai, N.: Self-organizing map assisted deep autoencoding gaussian mixture model for intrusion detection. In: 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC), pp. 1\u20136. IEEE (2021)","DOI":"10.1109\/CCNC49032.2021.9369451"},{"key":"1057_CR4","doi-asserted-by":"crossref","unstructured":"Chen, Y., Ashizawa, N., Yeo, C.K., Yanai, N., Yean, S.: Multi-scale self-organizing map assisted deep autoencoding gaussian mixture model for unsupervised intrusion detection. Knowledge-Based Systems p. 107086 (2021)","DOI":"10.1016\/j.knosys.2021.107086"},{"key":"1057_CR5","doi-asserted-by":"crossref","unstructured":"Chen, Y., Zhang, J., Yeo, C.K.: Network anomaly detection using federated deep autoencoding gaussian mixture model. In: International Conference on Machine Learning for Networking, pp. 1\u201314. Springer (2019)","DOI":"10.1007\/978-3-030-45778-5_1"},{"key":"1057_CR6","doi-asserted-by":"crossref","unstructured":"Chen, Z., He, K., Li, J., Geng, Y.: Seq2img: A sequence-to-image based approach towards ip traffic classification using convolutional neural networks. In: 2017 IEEE International Conference on Big Data (big data), pp. 1271\u20131276. IEEE (2017)","DOI":"10.1109\/BigData.2017.8258054"},{"issue":"2","key":"1057_CR7","doi-asserted-by":"publisher","first-page":"2042","DOI":"10.1016\/j.asoc.2010.07.002","volume":"11","author":"E Corchado","year":"2011","unstructured":"Corchado, E., Herrero, \u00c1.: Neural visualization of network traffic data for intrusion detection. Applied Soft Computing 11(2), 2042\u20132056 (2011)","journal-title":"Applied Soft Computing"},{"key":"1057_CR8","doi-asserted-by":"crossref","unstructured":"Draper-Gil, G., Lashkari, A.H., Mamun, M.S.I., Ghorbani, A.A.: Characterization of encrypted and vpn traffic using time-related. In: Proceedings of the 2nd International Conference on Information Systems Security and Privacy, pp. 407\u2013414 (2016)","DOI":"10.5220\/0005740704070414"},{"key":"1057_CR9","doi-asserted-by":"crossref","unstructured":"Elkhadir, Z., Chougdali, K., Benattou, M.: Intrusion detection system using pca and kernel pca methods. In: Proceedings of the Mediterranean Conference on Information & Communication Technologies 2015, pp. 489\u2013497. Springer (2016)","DOI":"10.1007\/978-3-319-30298-0_50"},{"key":"1057_CR10","doi-asserted-by":"crossref","unstructured":"Ferreira, D.C., V\u00e1zquez, F.I., Zseby, T.: Extreme dimensionality reduction for network attack visualization with autoencoders. In: 2019 International Joint Conference on Neural Networks (IJCNN), pp. 1\u201310. IEEE (2019)","DOI":"10.1109\/IJCNN.2019.8852056"},{"issue":"21","key":"1057_CR11","doi-asserted-by":"publisher","first-page":"5","DOI":"10.5120\/7470-0475","volume":"47","author":"A George","year":"2012","unstructured":"George, A., Vidyapeetham, A.: Anomaly detection based on machine learning dimensionality reduction using pca and classification using svm. International Journal of Computer Applications 47(21), 5\u20138 (2012)","journal-title":"International Journal of Computer Applications"},{"key":"1057_CR12","doi-asserted-by":"crossref","unstructured":"Haiyan, W., Haomin, Y., Xueming, L., Haijun, R.: Semi-supervised autoencoder: A joint approach of representation and classification. In: 2015 International Conference on Computational Intelligence and Communication Networks (CICN), pp. 1424\u20131430. IEEE (2015)","DOI":"10.1109\/CICN.2015.275"},{"issue":"5786","key":"1057_CR13","doi-asserted-by":"publisher","first-page":"504","DOI":"10.1126\/science.1127647","volume":"313","author":"GE Hinton","year":"2006","unstructured":"Hinton, G.E., Salakhutdinov, R.R.: Reducing the dimensionality of data with neural networks. Science 313(5786), 504\u2013507 (2006)","journal-title":"Science"},{"issue":"4\u20135","key":"1057_CR14","doi-asserted-by":"publisher","first-page":"411","DOI":"10.1016\/S0893-6080(00)00026-5","volume":"13","author":"A Hyv\u00e4rinen","year":"2000","unstructured":"Hyv\u00e4rinen, A., Oja, E.: Independent component analysis: Algorithms and applications. Neural Networks 13(4\u20135), 411\u2013430 (2000)","journal-title":"Neural Networks"},{"issue":"2","key":"1057_CR15","doi-asserted-by":"publisher","first-page":"133","DOI":"10.20532\/cit.2016.1002701","volume":"24","author":"ST Ikram","year":"2016","unstructured":"Ikram, S.T., Cherukuri, A.K.: Improving accuracy of intrusion detection model using pca and optimized svm. Journal of Computing and Information Technology 24(2), 133\u2013148 (2016)","journal-title":"Journal of Computing and Information Technology"},{"issue":"6","key":"1057_CR16","first-page":"265","volume":"2","author":"HM Imran","year":"2012","unstructured":"Imran, H.M., Abdullah, A.B., Hussain, M., Palaniappan, S., Ahmad, I.: Intrusions detection based on optimum features subset and efficient dataset selection. International Journal of Engineering and Innovative Technology 2(6), 265\u2013270 (2012)","journal-title":"International Journal of Engineering and Innovative Technology"},{"key":"1057_CR17","doi-asserted-by":"crossref","unstructured":"Javaid, A., Niyaz, Q., Sun, W., Alam, M.: A deep learning approach for network intrusion detection system. In: Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS), pp. 21\u201326 (2016)","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"1057_CR18","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1016\/j.jnca.2015.12.004","volume":"62","author":"SY Ji","year":"2016","unstructured":"Ji, S.Y., Jeong, B.K., Choi, S., Jeong, D.H.: A multi-level intrusion detection method for abnormal network behaviors. Journal of Network and Computer Applications 62, 9\u201317 (2016)","journal-title":"Journal of Network and Computer Applications"},{"issue":"3","key":"1057_CR19","doi-asserted-by":"publisher","first-page":"187","DOI":"10.1007\/BF02289233","volume":"23","author":"HF Kaiser","year":"1958","unstructured":"Kaiser, H.F.: The varimax criterion for analytic rotation in factor analysis. Psychometrika 23(3), 187\u2013200 (1958)","journal-title":"Psychometrika"},{"key":"1057_CR20","unstructured":"Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. arXiv:1412.6980 (2014)"},{"key":"1057_CR21","doi-asserted-by":"crossref","unstructured":"Korczy\u0144ski, M., Duda, A.: Markov chain fingerprinting to classify encrypted traffic. In: IEEE INFOCOM 2014-IEEE Conference on Computer Communications, pp. 781\u2013789. IEEE (2014)","DOI":"10.1109\/INFOCOM.2014.6848005"},{"key":"1057_CR22","doi-asserted-by":"crossref","unstructured":"Lashkari, A.H., Draper-Gil, G., Mamun, M.S.I., Ghorbani, A.A.: Characterization of tor traffic using time based features. In: International Conference on Information Systems Security and Privacy (ICISSP), pp. 253\u2013262 (2017)","DOI":"10.5220\/0005740704070414"},{"key":"1057_CR23","doi-asserted-by":"crossref","unstructured":"Liu, C., Cao, Z., Xiong, G., Gou, G., Yiu, S.M., He, L.: Mampf: Encrypted traffic classification based on multi-attribute markov probability fingerprints. In: 2018 IEEE\/ACM 26th International Symposium on Quality of Service (IWQoS), pp. 1\u201310. IEEE (2018)","DOI":"10.1109\/IWQoS.2018.8624124"},{"key":"1057_CR24","doi-asserted-by":"crossref","unstructured":"Liu, C., He, L., Xiong, G., Cao, Z., Li, Z.: Fs-net: A flow sequence network for encrypted traffic classification. In: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pp. 1171\u20131179. IEEE (2019)","DOI":"10.1109\/INFOCOM.2019.8737507"},{"issue":"4","key":"1057_CR25","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1145\/382912.382923","volume":"3","author":"J McHugh","year":"2000","unstructured":"McHugh, J.: Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Transactions on Information and System Security (TISSEC) 3(4), 262\u2013294 (2000)","journal-title":"ACM Transactions on Information and System Security (TISSEC)"},{"key":"1057_CR26","doi-asserted-by":"publisher","unstructured":"Pan, W., Cheng, G., Tang, Y.: Wenc: Https encrypted traffic classification using weighted ensemble learning and markov chain. In: 2017 IEEE Trustcom\/BigDataSE\/ICESS, pp. 50\u201357 (2017). https:\/\/doi.org\/10.1109\/Trustcom\/BigDataSE\/ICESS.2017.219","DOI":"10.1109\/Trustcom\/BigDataSE\/ICESS.2017.219"},{"issue":"4","key":"1057_CR27","doi-asserted-by":"publisher","first-page":"250","DOI":"10.1016\/j.dcan.2017.07.004","volume":"3","author":"Z Ruan","year":"2017","unstructured":"Ruan, Z., Miao, Y., Pan, L., Patterson, N., Zhang, J.: Visualization of big data security: A case study on the kdd99 cup data set. Digital Communications and Networks 3(4), 250\u2013259 (2017)","journal-title":"Digital Communications and Networks"},{"issue":"3","key":"1057_CR28","first-page":"197","volume":"2","author":"ACF Santos","year":"2011","unstructured":"Santos, A.C.F., da\u00a0Silva, J.D.S., de\u00a0S\u00e1\u00a0Silva, L., da\u00a0Costa\u00a0Sene, M.P.: Network traffic characterization based on time series analysis and computational intelligence. J. Computational Interdisciplinary Sciences 2(3), 197\u2013205 (2011)","journal-title":"J. Computational Interdisciplinary Sciences"},{"issue":"11","key":"1057_CR29","first-page":"1","volume":"31","author":"SS Sathya","year":"2011","unstructured":"Sathya, S.S., Ramani, R.G., Sivaselvi, K.: Discriminant analysis based feature selection in kdd intrusion dataset. International Journal of computer applications 31(11), 1\u20137 (2011)","journal-title":"International Journal of computer applications"},{"key":"1057_CR30","doi-asserted-by":"crossref","unstructured":"Shapira, T., Shavitt, Y.: Flowpic: Encrypted internet traffic classification is as easy as image recognition. In: IEEE INFOCOM 2019-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pp. 680\u2013687. IEEE (2019)","DOI":"10.1109\/INFCOMW.2019.8845315"},{"issue":"8","key":"1057_CR31","doi-asserted-by":"publisher","first-page":"1830","DOI":"10.1109\/TIFS.2017.2692682","volume":"12","author":"M Shen","year":"2017","unstructured":"Shen, M., Wei, M., Zhu, L., Wang, M.: Classification of encrypted traffic with second-order markov chains and application attribute bigrams. IEEE Transactions on Information Forensics and Security 12(8), 1830\u20131843 (2017)","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"1057_CR32","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A.A.: A detailed analysis of the kdd cup 99 data set. In: 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1\u20136. IEEE (2009)","DOI":"10.1109\/CISDA.2009.5356528"},{"issue":"2","key":"1057_CR33","doi-asserted-by":"publisher","first-page":"443","DOI":"10.1162\/089976699300016728","volume":"11","author":"ME Tipping","year":"1999","unstructured":"Tipping, M.E., Bishop, C.M.: Mixtures of probabilistic principal component analyzers. Neural Computation 11(2), 443\u2013482 (1999)","journal-title":"Neural Computation"},{"key":"1057_CR34","doi-asserted-by":"crossref","unstructured":"Wang, W., Zhu, M., Wang, J., Zeng, X., Yang, Z.: End-to-end encrypted traffic classification with one-dimensional convolution neural networks. In: 2017 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 43\u201348. IEEE (2017)","DOI":"10.1109\/ISI.2017.8004872"},{"key":"1057_CR35","unstructured":"Wang, W., Zhu, M., Zeng, X., Ye, X., Sheng, Y.: Malware traffic classification using convolutional neural network for representation learning. In: 2017 International Conference on Information Networking (ICOIN), pp. 712\u2013717. IEEE (2017)"},{"key":"1057_CR36","doi-asserted-by":"crossref","unstructured":"Waskle, S., Parashar, L., Singh, U.: Intrusion detection system using pca with random forest approach. In: 2020 International Conference on Electronics and Sustainable Communication Systems (ICESC), pp. 803\u2013808. IEEE (2020)","DOI":"10.1109\/ICESC48915.2020.9155656"},{"key":"1057_CR37","doi-asserted-by":"crossref","unstructured":"Xu, X., Wang, X.: An adaptive network intrusion detection method based on pca and support vector machines. In: International Conference on Advanced Data Mining and Applications, pp. 696\u2013703. Springer (2005)","DOI":"10.1007\/11527503_82"},{"key":"1057_CR38","doi-asserted-by":"crossref","unstructured":"Yao, R., Liu, C., Zhang, L., Peng, P.: Unsupervised anomaly detection using variational auto-encoder based feature extraction. In: 2019 IEEE International Conference on Prognostics and Health Management (ICPHM), pp. 1\u20137. IEEE (2019)","DOI":"10.1109\/ICPHM.2019.8819434"},{"key":"1057_CR39","doi-asserted-by":"crossref","unstructured":"Yousefi-Azar, M., Varadharajan, V., Hamey, L., Tupakula, U.: Autoencoder-based feature learning for cyber security applications. In: 2017 International Joint Conference on Neural Networks (IJCNN), pp. 3854\u20133861. IEEE (2017)","DOI":"10.1109\/IJCNN.2017.7966342"},{"key":"1057_CR40","unstructured":"Zong, B., Song, Q., Min, M.R., Cheng, W., Lumezanu, C., Cho, D., Chen, H.: Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In: International Conference on Learning Representations (2018)"},{"key":"1057_CR41","doi-asserted-by":"crossref","unstructured":"Zong, W., Chow, Y.W., Susilo, W.: A 3d approach for the visualization of network intrusion detection data. In: 2018 International Conference on Cyberworlds (CW), pp. 308\u2013315. IEEE (2018)","DOI":"10.1109\/CW.2018.00064"}],"container-title":["World Wide Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-022-01057-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11280-022-01057-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-022-01057-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,10,6]],"date-time":"2022-10-06T06:20:55Z","timestamp":1665037255000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11280-022-01057-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4,28]]},"references-count":41,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2022,9]]}},"alternative-id":["1057"],"URL":"https:\/\/doi.org\/10.1007\/s11280-022-01057-8","relation":{},"ISSN":["1386-145X","1573-1413"],"issn-type":[{"value":"1386-145X","type":"print"},{"value":"1573-1413","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,4,28]]},"assertion":[{"value":"8 September 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 December 2021","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 April 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 April 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}