{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T17:16:39Z","timestamp":1790702199767,"version":"4.1.0"},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2023,4,17]],"date-time":"2023-04-17T00:00:00Z","timestamp":1681689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2023,4,17]],"date-time":"2023-04-17T00:00:00Z","timestamp":1681689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Sci. China Inf. Sci."],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1007\/s11432-021-3545-0","type":"journal-article","created":{"date-parts":[[2023,4,20]],"date-time":"2023-04-20T05:09:33Z","timestamp":1681967373000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Towards real-time ML-based DDoS detection via cost-efficient window-based feature extraction"],"prefix":"10.1007","volume":"66","author":[{"given":"Haibin","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yi","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenbing","family":"Yao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ke","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qi","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2023,4,17]]},"reference":[{"key":"3545_CR1","unstructured":"Antonakakis M, April T, Bailey M, et al. Understanding the mirai botnet. In: Proceedings of the 26th USENIX Security Symposium (USENIX Security), 2017. 1093\u20131110"},{"key":"3545_CR2","doi-asserted-by":"publisher","first-page":"1838","DOI":"10.1109\/TIFS.2018.2805600","volume":"13","author":"J Zheng","year":"2018","unstructured":"Zheng J, Li Q, Gu G, et al. Realtime DDoS defense using COTS SDN switches via adaptive correlation analysis. IEEE Trans Inform Forensic Secur, 2018, 13: 1838\u20131853","journal-title":"IEEE Trans Inform Forensic Secur"},{"key":"3545_CR3","doi-asserted-by":"publisher","first-page":"559","DOI":"10.1109\/TIFS.2017.2758754","volume":"13","author":"C Wang","year":"2017","unstructured":"Wang C, Miu T T N, Luo X, et al. SkyShield: a sketch-based defense system against application layer DDoS attacks. IEEE Trans Inform Forensic Secur, 2017, 13: 559\u2013573","journal-title":"IEEE Trans Inform Forensic Secur"},{"key":"3545_CR4","unstructured":"Xiao B, Chen W, He Y, et al. An active detecting method against SYN flooding attack. In: Proceedings of the 11th IEEE International Conference on Parallel and Distributed Systems (ICPADS), 2005. 709\u2013715"},{"key":"3545_CR5","doi-asserted-by":"crossref","unstructured":"Kambourakis G, Moschos T, Geneiatakis D, et al. Detecting DNS amplification attacks. In: Proceeding of International Workshop on Critical Information Infrastructures Security, Berlin, 2007. 185\u2013196","DOI":"10.1007\/978-3-540-89173-4_16"},{"key":"3545_CR6","doi-asserted-by":"crossref","unstructured":"Sun C, Liu B, Shi L. Efficient and low-cost hardware defense against DNS amplification attacks. In: Proceedings of IEEE Global Telecommunications Conference (GLOBECOM), 2008. 1\u20135","DOI":"10.1109\/GLOCOM.2008.ECP.397"},{"key":"3545_CR7","doi-asserted-by":"crossref","unstructured":"Chen Y W, Sheu J P, Kuo Y C, et al. Design and implementation of IoT DDoS attacks detection system based on machine learning. In: Proceedings of IEEE European Conference on Networks and Communications (EuCNC), 2020. 122\u2013127","DOI":"10.1109\/EuCNC48522.2020.9200909"},{"key":"3545_CR8","doi-asserted-by":"crossref","unstructured":"Wani A R, Rana Q P, Saxena U, et al. Analysis and detection of DDoS attacks on cloud computing environment using machine learning techniques. In: Proceedings of Amity International Conference on Artificial Intelligence (AICAI), 2019. 870\u2013875","DOI":"10.1109\/AICAI.2019.8701238"},{"key":"3545_CR9","doi-asserted-by":"crossref","unstructured":"Degirmencioglu A, Erdogan H T, Mizani M A, et al. A classification approach for adaptive mitigation of SYN flood attacks: preventing performance loss due to SYN flood attacks. In: Proceedings of IEEE\/IFIP Network Operations and Management Symposium, 2016. 1109\u20131112","DOI":"10.1109\/NOMS.2016.7502971"},{"key":"3545_CR10","unstructured":"Radware. DDoS protection & DDoS mitigation solutions. 2021. https:\/\/www.radware.com\/solutions\/ddos-protection\/"},{"key":"3545_CR11","doi-asserted-by":"publisher","first-page":"660","DOI":"10.1109\/21.97458","volume":"21","author":"S R Safavian","year":"1991","unstructured":"Safavian S R, Landgrebe D. A survey of decision tree classifier methodology. IEEE Trans Syst Man Cybern, 1991, 21: 660\u2013674","journal-title":"IEEE Trans Syst Man Cybern"},{"key":"3545_CR12","first-page":"1063","volume":"13","author":"G Biau","year":"2012","unstructured":"Biau G. Analysis of a random forests model. J Mach Learning Res, 2012, 13: 1063\u20131095","journal-title":"J Mach Learning Res"},{"key":"3545_CR13","unstructured":"Rish I. An empirical study of the naive Bayes classifier. In: Proceedings of IJCAI Workshop on Empirical Methods in Artificial Intelligence, 2001. 41\u201346"},{"key":"3545_CR14","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1145\/997150.997156","volume":"34","author":"J Mirkovic","year":"2004","unstructured":"Mirkovic J, Reiher P. A taxonomy of DDoS attack and DDoS defense mechanisms. SIGCOMM Comput Commun Rev, 2004, 34: 39\u201353","journal-title":"SIGCOMM Comput Commun Rev"},{"key":"3545_CR15","unstructured":"Karimazad R, Faraahi A. An anomaly-based method for DDoS attacks detection using RBF neural networks. In: Proceedings of the International Conference on Network and Electronics Engineering (ICNEE), 2011. 44\u201348"},{"key":"3545_CR16","unstructured":"Osanaiye O, Choo K K, Dlodlo M. Analysing feature selection and classification techniques for DDoS detection in cloud. In: Proceedings of Southern Africa Telecommunication, 2016. 198\u2013203"},{"key":"3545_CR17","doi-asserted-by":"crossref","unstructured":"Barati M, Abdullah A, Udzir N I, et al. Distributed denial of service detection using hybrid machine learning technique. In: Proceedings of International Symposium on Biometrics and Security Technologies (ISBAST), 2014. 268\u2013273","DOI":"10.1109\/ISBAST.2014.7013133"},{"key":"3545_CR18","doi-asserted-by":"crossref","unstructured":"Wang W, Gombault S. Efficient detection of DDoS attacks with important attributes. In: Proceedings of International Conference on Risks and Security of Internet and Systems (CRiSIS), 2008. 61\u201367","DOI":"10.1109\/CRISIS.2008.4757464"},{"key":"3545_CR19","doi-asserted-by":"crossref","unstructured":"Braga R, Mota E, Passito A. Lightweight DDoS flooding attack detection using NOX\/OpenFlow. In: Proceedings of IEEE Local Computer Network Conference (LCN), 2010. 408\u2013415","DOI":"10.1109\/LCN.2010.5735752"},{"key":"3545_CR20","doi-asserted-by":"crossref","unstructured":"Korczynski M, Janowski L, Duda A. An accurate sampling scheme for detecting SYN flooding attacks and portscans. In: Proceedings of IEEE International Conference on Communications (ICC), 2011. 1\u20135","DOI":"10.1109\/icc.2011.5962593"},{"key":"3545_CR21","unstructured":"Huawei. HUAWEI: configuring the device to capture packets. 2021. https:\/\/support.huawei.com\/enterprise\/en\/doc\/EDOC1100112354\/bd0e10ad\/configuring-the-device-to-capture-packets"},{"key":"3545_CR22","unstructured":"Cisco. Cisco: configure packet capture on Cisco SCE 8000. 2021. https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/service-exchange\/service-control-operating-system-software\/200464-Packet-caputre-on-Cisco-SCE-8000.html"},{"key":"3545_CR23","first-page":"436","volume":"7","author":"M Alkasassbeh","year":"2016","unstructured":"Alkasassbeh M, Al-Naymat G, Hassanat A, et al. Detecting distributed denial of service attacks using data mining techniques. Int J Adv Comput Sci Appl, 2016, 7: 436\u2013445","journal-title":"Int J Adv Comput Sci Appl"},{"key":"3545_CR24","doi-asserted-by":"crossref","unstructured":"Seufert S, O\u2019Brien D. Machine learning for automatic defence against distributed denial of service attacks. In: Proceedings of IEEE International Conference on Communications (ICC), 2007. 1217\u20131222","DOI":"10.1109\/ICC.2007.206"},{"key":"3545_CR25","doi-asserted-by":"crossref","unstructured":"Tsiatsikas Z, Geneiatakis D, Kambourakis G, et al. Realtime DDoS detection in sip ecosystems: machine learning tools of the trade. In: Proceedings of International Conference on Network and System Security (NSS), 2016. 126\u2013139","DOI":"10.1007\/978-3-319-46298-1_9"},{"key":"3545_CR26","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1023\/A:1022631118932","volume":"11","author":"R C Holte","year":"1993","unstructured":"Holte R C. Very simple classification rules perform well on most commonly used datasets. Machine Learn, 1993, 11: 63\u201390","journal-title":"Machine Learn"},{"key":"3545_CR27","doi-asserted-by":"publisher","first-page":"296","DOI":"10.1109\/72.80266","volume":"1","author":"D W Ruck","year":"1990","unstructured":"Ruck D W, Rogers S K, Kabrisky M, et al. The multilayer perceptron as an approximation to a Bayes optimal discriminant function. IEEE Trans Neural Netw, 1990, 1: 296\u2013298","journal-title":"IEEE Trans Neural Netw"},{"key":"3545_CR28","doi-asserted-by":"crossref","unstructured":"Zeng Z Q, Yu H B, Xu H R, et al. Fast training support vector machines using parallel sequential minimal optimization. In: Proceedings of IEEE International Conference on Intelligent System and Knowledge Engineering (ISKE), Xiamen, 2008. 997\u20131001","DOI":"10.1109\/ISKE.2008.4731075"},{"key":"3545_CR29","doi-asserted-by":"publisher","first-page":"586","DOI":"10.1109\/72.846731","volume":"11","author":"J Vesanto","year":"2000","unstructured":"Vesanto J, Alhoniemi E. Clustering of the self-organizing map. IEEE Trans Neural Netw, 2000, 11: 586\u2013600","journal-title":"IEEE Trans Neural Netw"},{"key":"3545_CR30","doi-asserted-by":"publisher","first-page":"123","DOI":"10.1007\/BF00058655","volume":"24","author":"L Breiman","year":"1996","unstructured":"Breiman L. Bagging predictors. Machine Learn, 1996, 24: 123\u2013140","journal-title":"Machine Learn"},{"key":"3545_CR31","doi-asserted-by":"crossref","unstructured":"Reynolds K, Kontostathis A, Edwards L. Using machine learning to detect cyberbullying. In: Proceedings of IEEE International Conference on Machine Learning and Applications and Workshops, 2011. 241\u2013244","DOI":"10.1109\/ICMLA.2011.152"},{"key":"3545_CR32","doi-asserted-by":"publisher","first-page":"595","DOI":"10.1016\/S0893-6080(05)80038-3","volume":"5","author":"M T Musavi","year":"1992","unstructured":"Musavi M T, Ahmed W, Chan K H, et al. On the training of radial basis function classifiers. Neural Networks, 1992, 5: 595\u2013603","journal-title":"Neural Networks"},{"key":"3545_CR33","doi-asserted-by":"publisher","first-page":"163","DOI":"10.1109\/MNET.011.2000265","volume":"35","author":"Y Zhao","year":"2021","unstructured":"Zhao Y, Xu K, Wang H Y, et al. Stability-based analysis and defense against backdoor attacks on edge computing services. IEEE Network, 2021, 35: 163\u2013169","journal-title":"IEEE Network"},{"key":"3545_CR34","doi-asserted-by":"publisher","first-page":"16933","DOI":"10.1109\/JIOT.2021.3079304","volume":"8","author":"Y Zhao","year":"2021","unstructured":"Zhao Y, Xu K, Wang H Y, et al. MEC-enabled hierarchical emotion recognition and perturbation-aware defense in smart cities. IEEE Internet Things J, 2021, 8: 16933\u201316945","journal-title":"IEEE Internet Things J"},{"key":"3545_CR35","doi-asserted-by":"crossref","unstructured":"Zhao Y, Qiao M N, Wang H Y, et al. TDFI: two-stage deep learning framework for friendship inference via multi-source information. In: Proceedings of IEEE INFOCOM, 2019. 1981\u20131989","DOI":"10.1109\/INFOCOM.2019.8737458"},{"key":"3545_CR36","doi-asserted-by":"crossref","unstructured":"Mirsky Y, Doitshman T, Elovici Y, et al. Kitsune: an ensemble of autoencoders for online network intrusion detection. In: Proceedings of Network and Distributed System Security Symposium (NDSS), San Diego, 2018. 1\u201315","DOI":"10.14722\/ndss.2018.23204"},{"key":"3545_CR37","doi-asserted-by":"publisher","first-page":"170301","DOI":"10.1007\/s11432-021-3463-9","volume":"65","author":"Y Zhao","year":"2022","unstructured":"Zhao Y, Xu K, Li Q, et al. Intelligent networking in adversarial environment: challenges and opportunities. Sci China Inf Sci, 2022, 65: 170301","journal-title":"Sci China Inf Sci"},{"key":"3545_CR38","doi-asserted-by":"publisher","first-page":"88","DOI":"10.1109\/MC.2020.2983711","volume":"53","author":"E Osterweil","year":"2020","unstructured":"Osterweil E, Stavrou A, Zhang L. 21 years of distributed denial-of service: current state of affairs. Computer, 2020, 53: 88\u201392","journal-title":"Computer"},{"key":"3545_CR39","doi-asserted-by":"crossref","unstructured":"Jin C, Wang H, Shin K G. Hop-count filtering: an effective defense against spoofed DDoS traffic. In: Proceedings of ACM Conference on Computer and Communications Security (CCS), 2003. 30\u201341","DOI":"10.1145\/948109.948116"},{"key":"3545_CR40","unstructured":"Song D X, Perrig A. Advanced and authenticated marking schemes for IP traceback. In: Proceedings IEEE International Conference on Computer Communications (INFOCOM), 2001. 878\u2013886"},{"key":"3545_CR41","doi-asserted-by":"crossref","unstructured":"Dietzel C, Wichtlhuber M, Smaragdakis G, et al. Stellar: network attack mitigation using advanced blackholing. In: Proceedings of International Conference on emerging Networking Experiments and Technologies (CoNEXT), 2018. 152\u2013164","DOI":"10.1145\/3281411.3281413"},{"key":"3545_CR42","doi-asserted-by":"crossref","unstructured":"Zhang M, Li G, Wang S, et al. Poseidon: mitigating volumetric DDoS attacks with programmable switches. In: Proceedings of Network and Distributed System Security Symposium (NDSS), San Diego, 2020. 1\u201318","DOI":"10.14722\/ndss.2020.24007"},{"key":"3545_CR43","unstructured":"Liu Z, Namkung H, Nikolaidis G, et al. Jaqen: a high-performance switch-native approach for detecting and mitigating volumetric DDoS attacks with programmable switches. In: Proceedings of USENIX Security Symposium (USENIX Security), 2021. 3829\u20133846"},{"key":"3545_CR44","doi-asserted-by":"crossref","unstructured":"Li Y, Li H, Lv Z, et al. Deterrence of intelligent DDoS via multi-hop traffic divergence. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security (CCS), 2021. 923\u2013939","DOI":"10.1145\/3460120.3484737"},{"key":"3545_CR45","doi-asserted-by":"crossref","unstructured":"Zhang X, Hsiao H C, Hasker G, et al. SCION: scalability, control, and isolation on next-generation networks. In: Proceedings of IEEE Symposium on Security and Privacy (S&P), 2011. 212\u2013227","DOI":"10.21236\/ADA579930"},{"key":"3545_CR46","doi-asserted-by":"crossref","unstructured":"Wu J, Bi J, Bagnulo M, et al. Source address validation improvement (SAVI) framework. RFC7039. 2013. https:\/\/datatracker.ietf.org\/doc\/html\/rfc7039","DOI":"10.17487\/rfc7039"},{"key":"3545_CR47","doi-asserted-by":"publisher","first-page":"2046","DOI":"10.1109\/SURV.2013.031413.00127","volume":"15","author":"S T Zargar","year":"2013","unstructured":"Zargar S T, Joshi J, Tipper D. A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks. IEEE Commun Surv Tutorials, 2013, 15: 2046\u20132069","journal-title":"IEEE Commun Surv Tutorials"}],"container-title":["Science China Information Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11432-021-3545-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11432-021-3545-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11432-021-3545-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,18]],"date-time":"2024-10-18T20:25:42Z","timestamp":1729283142000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11432-021-3545-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,17]]},"references-count":47,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2023,5]]}},"alternative-id":["3545"],"URL":"https:\/\/doi.org\/10.1007\/s11432-021-3545-0","relation":{},"ISSN":["1674-733X","1869-1919"],"issn-type":[{"value":"1674-733X","type":"print"},{"value":"1869-1919","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,4,17]]},"assertion":[{"value":"15 December 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 March 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 July 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 April 2023","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"152105"}}