{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T14:14:04Z","timestamp":1760710444034,"version":"3.37.3"},"reference-count":35,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2021,1,11]],"date-time":"2021-01-11T00:00:00Z","timestamp":1610323200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,11]],"date-time":"2021-01-11T00:00:00Z","timestamp":1610323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62072322"],"award-info":[{"award-number":["62072322"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61873177"],"award-info":[{"award-number":["61873177"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Liaoning Provincial Universities\u2019 Fundamental Scientific Research Projects","award":["LQN201707"],"award-info":[{"award-number":["LQN201707"]}]},{"name":"Liaoning Provincial Natural Science Foundation of China","award":["20180550014","20180550916"],"award-info":[{"award-number":["20180550014","20180550916"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Peer-to-Peer Netw. Appl."],"published-print":{"date-parts":[[2021,5]]},"DOI":"10.1007\/s12083-020-01036-8","type":"journal-article","created":{"date-parts":[[2021,1,11]],"date-time":"2021-01-11T13:47:10Z","timestamp":1610372830000},"page":"1401-1413","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["A novel spread estimation based abnormal flow detection in high-speed networks"],"prefix":"10.1007","volume":"14","author":[{"given":"Xiaofei","family":"Bu","sequence":"first","affiliation":[]},{"given":"Yu-E","family":"Sun","sequence":"additional","affiliation":[]},{"given":"Yang","family":"Du","sequence":"additional","affiliation":[]},{"given":"Xiaocan","family":"Wu","sequence":"additional","affiliation":[]},{"given":"Boyu","family":"Zhang","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2768-6607","authenticated-orcid":false,"given":"He","family":"Huang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2021,1,11]]},"reference":[{"issue":"3","key":"1036_CR1","doi-asserted-by":"publisher","first-page":"270","DOI":"10.1145\/859716.859719","volume":"21","author":"C Estan","year":"2003","unstructured":"Estan C, Varghese G (2003) New Directions in Traffic Measurement and Accounting: Focusing on the Elephants, Ignoring the Mice. ACM Trans Comput Syst 21(3):270\u2013313","journal-title":"ACM Trans Comput Syst"},{"key":"1036_CR2","doi-asserted-by":"crossref","unstructured":"Heule S, Nunkesser M, Hall A (2013) HyperLogLog in Practice: Algorithmic Engineering of a State of the Art Cardinality Estimation Algorithm. In: Proceedings of EDBT, pp 683\u2013692","DOI":"10.1145\/2452376.2452456"},{"key":"1036_CR3","doi-asserted-by":"crossref","unstructured":"Lieven P, Scheuermann B (2010) High-Speed Per-Flow Traffic Measurement with Probabilistic Multiplicity Counting. In: Proceedings of IEEE INFOCOM, pp 1\u20139","DOI":"10.1109\/INFCOM.2010.5461921"},{"key":"1036_CR4","doi-asserted-by":"crossref","unstructured":"Yoon M, Li T, Chen S, Peir J (2009) Fit a Spread Estimator in Small Memory. In: Proceedings of IEEE INFOCOM, pp 504\u2013512","DOI":"10.1109\/INFCOM.2009.5061956"},{"key":"1036_CR5","doi-asserted-by":"publisher","first-page":"125754","DOI":"10.1109\/ACCESS.2019.2938977","volume":"7","author":"M Yoon","year":"2019","unstructured":"Yoon M, Kim Y J (2019) Address Block Counting Using Two-Tier Cardinality Estimation. IEEE Access 7:125754\u2013125761","journal-title":"IEEE Access"},{"key":"1036_CR6","doi-asserted-by":"publisher","first-page":"61728","DOI":"10.1109\/ACCESS.2018.2876154","volume":"6","author":"J Jeong","year":"2018","unstructured":"Jeong J, Naqvi S M A, Yoon M (2018) Accurate and Communication-Efficient Detection of Widespread Events. IEEE Access 6:61728\u201361734","journal-title":"IEEE Access"},{"issue":"1","key":"1036_CR7","doi-asserted-by":"publisher","first-page":"121","DOI":"10.1145\/1384529.1375472","volume":"36","author":"Y Lu","year":"2008","unstructured":"Lu Y, Montanari A, Prabhakar B, Dharmapurikar S, Kabbani A (2008) Counter Braids: A Novel Counter Architecture for per-Flow Measurement. ACM SIGMETRICS Perform Eval Rev 36(1):121\u2013132","journal-title":"ACM SIGMETRICS Perform Eval Rev"},{"key":"1036_CR8","doi-asserted-by":"crossref","unstructured":"Zhou Y, Zhou Y, Chen M, Xiao Q, Chen S (2016) Highly Compact Virtual Counters for Per-Flow Traffic Measurement through Register Sharing. In: Proceedings of IEEE GLOBECOM, pp 1\u20136","DOI":"10.1109\/GLOCOM.2016.7841873"},{"key":"1036_CR9","doi-asserted-by":"crossref","unstructured":"Zhou Y, Zhou Y, Chen S, Youlin Zhang (2017) Per-flow counting for big network data stream over sliding windows. In: Proceedings of IEEE\/ACM IWQoS, pp 1\u201310","DOI":"10.1109\/IWQoS.2017.7969118"},{"key":"1036_CR10","doi-asserted-by":"crossref","unstructured":"Zhou Y, Zhou Y, Chen S, Zhang Y (2018) Highly Compact Virtual Active Counters for Per-flow Traffic Measurement. In: Proceedings of IEEE INFOCOM, pp 1\u20139","DOI":"10.1109\/INFOCOM.2018.8485804"},{"key":"1036_CR11","doi-asserted-by":"crossref","unstructured":"Wang S, Wang S, Zhou D, Yang Y, Zhang W, Huang T, Huo R, Liu Y (2020) Large-scale and rapid flow size estimation for improving flow scheduling. In: IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pp 1141\u20131146","DOI":"10.1109\/INFOCOMWKSHPS50562.2020.9163019"},{"key":"1036_CR12","doi-asserted-by":"crossref","unstructured":"Yang T, Gao S, Sun Z, Wang Y, Shen Y, Li X (2019Dec) Diamond sketch: Accurate per-flow measurement for big streaming data. IEEE Trans Parallel Distrib Syst 30(12):2650\u20132662","DOI":"10.1109\/TPDS.2019.2923772"},{"issue":"1","key":"1036_CR13","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1145\/1341431.1341433","volume":"38","author":"X Dimitropoulos","year":"2008","unstructured":"Dimitropoulos X, Hurley P, Kind A (2008) Probabilistic Lossy Counting: An Efficient Algorithm for Finding Heavy Hitters. ACM SIGCOMM Comput Commun Rev 38(1):5","journal-title":"ACM SIGCOMM Comput Commun Rev"},{"key":"1036_CR14","doi-asserted-by":"crossref","unstructured":"Zhang Y, Singh S, Sen S, Duffield N, Lund C (2004) Online Identification of Hierarchical Heavy Hitters: Algorithms, Evaluation, and Applications. In: Proceedings of ACM IMC, pp 101\u2013114","DOI":"10.1145\/1028788.1028802"},{"key":"1036_CR15","doi-asserted-by":"crossref","unstructured":"Liu Z, Manousis A, Vorsanger G, Sekar V, Braverman V (2016) One Sketch to Rule Them All: Rethinking Network Flow Monitoring with UnivMon. In: Proceedings of ACM SIGCOMM, pp 101\u2013114","DOI":"10.1145\/2934872.2934906"},{"key":"1036_CR16","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1145\/3366699","volume":"3","author":"Y Zhou","year":"2019","unstructured":"Zhou Y, Zhang Y, Ma C, Chen S, Odegbile O O (2019) Generalized sketch families for network traffic measurement. Proc ACM Meas Anal Comput Syst 3:3","journal-title":"Proc ACM Meas Anal Comput Syst"},{"issue":"5","key":"1036_CR17","doi-asserted-by":"publisher","first-page":"2098","DOI":"10.1109\/TNET.2019.2940705","volume":"27","author":"R Cohen","year":"2019","unstructured":"Cohen R, Nezri Y (2019) Cardinality estimation in a virtualized network device using online machine learning. IEEE\/ACM Trans Netw 27(5):2098\u20132110","journal-title":"IEEE\/ACM Trans Netw"},{"issue":"12","key":"1036_CR18","doi-asserted-by":"publisher","first-page":"2327","DOI":"10.1109\/JSAC.2006.884032","volume":"24","author":"A Kumar","year":"2006","unstructured":"Kumar A, Xu J, Wang J (2006) Space-Code Bloom Filter for Efficient Per-Flow Traffic Measurement. IEEE J Sel Areas Commun 24(12):2327\u20132339","journal-title":"IEEE J Sel Areas Commun"},{"issue":"1","key":"1036_CR19","doi-asserted-by":"publisher","first-page":"155","DOI":"10.1145\/1012888.1005707","volume":"32","author":"F Hao","year":"2004","unstructured":"Hao F, Kodialam M, Lakshman T V (2004) ACCEL-RATE: A Faster Mechanism for Memory Efficient per-Flow Traffic Estimation. ACM SIGMETRICS Perform Eval Rev 32(1):155\u2013166","journal-title":"ACM SIGMETRICS Perform Eval Rev"},{"issue":"1","key":"1036_CR20","doi-asserted-by":"publisher","first-page":"303","DOI":"10.1109\/SURV.2013.052213.00046","volume":"16","author":"MH Bhuyan","year":"2014","unstructured":"Bhuyan M H, Bhattacharyya D K, Kalita J K (2014) Network Anomaly Detection: Methods, Systems and Tools. IEEE Commun Surv Tutorials 16(1):303\u2013336","journal-title":"IEEE Commun Surv Tutorials"},{"issue":"3","key":"1036_CR21","doi-asserted-by":"publisher","first-page":"343","DOI":"10.1109\/SURV.2010.032210.00054","volume":"12","author":"A Sperotto","year":"2010","unstructured":"Sperotto A, Schaffrath G, Sadre R, Morariu C, Pras A, Stiller B (2010) An Overview of IP Flow-Based Intrusion Detection. IEEE Commun Surv Tutorials 12(3):343\u2013356","journal-title":"IEEE Commun Surv Tutorials"},{"issue":"10","key":"1036_CR22","doi-asserted-by":"publisher","first-page":"1840","DOI":"10.1109\/JSAC.2006.877139","volume":"24","author":"Q Zhao","year":"2006","unstructured":"Zhao Q, Xu J, Kumar A (2006) Detection of Super Sources and Destinations in High-Speed Networks: Algorithms, Analysis and Evaluation. IEEE J Sel Areas Commun 24 (10):1840\u2013 1852","journal-title":"IEEE J Sel Areas Commun"},{"key":"1036_CR23","doi-asserted-by":"crossref","unstructured":"Xiao Q, Qiao Y, Zhen M, Chen S (2014) Estimating the Persistent Spreads in High-Speed Networks. In: Proceedings of IEEE ICNP, pp 131\u2013142","DOI":"10.1109\/ICNP.2014.33"},{"key":"1036_CR24","doi-asserted-by":"crossref","unstructured":"Huang H, Sun Y, Chen S, Tang S, Han K, Yuan J, Yang W (2018) You Can Drop but You Can\u2019t Hide: K-persistent Spread Estimation in High-speed Networks. In: Proceedings of IEEE INFOCOM, pp 1889\u20131897","DOI":"10.1109\/INFOCOM.2018.8485998"},{"key":"1036_CR25","unstructured":"Marold A, Lieven P, Scheuermann B (2011) Distributed Probabilistic Network Traffic Measurements. In: Proceedings of KiVS, vol 17. Schloss Dagstuhl\u2013Leibniz-Zentrum fuer Informatik, pp 133\u2013144"},{"issue":"5","key":"1036_CR26","doi-asserted-by":"publisher","first-page":"1253","DOI":"10.1109\/TNET.2010.2080285","volume":"19","author":"M Yoon","year":"2011","unstructured":"Yoon M, Li T, Chen S, Peir J (2011) Fit a Compact Spread Estimator in Small High-Speed Memory. IEEE\/ACM Trans Netw 19(5):1253\u20131264","journal-title":"IEEE\/ACM Trans Netw"},{"key":"1036_CR27","doi-asserted-by":"crossref","unstructured":"Huang H, Sun Y-E, Ma C, Chen S, Zhou Y, Yang W, Tang S, Xu H, Qiao Y (2020) An efficient k-persistent spread estimator for traffic measurement in high-speed networks. IEEE\/ACM Trans Networking","DOI":"10.1109\/TNET.2020.2982003"},{"key":"1036_CR28","doi-asserted-by":"crossref","unstructured":"Xiao Q, Chen S, Chen M, Ling Y (2015) Hyper-Compact Virtual Estimators for Big Network Data Based on Register Sharing. In: Proceedings of ACM SIGMETRICS, pp 417\u2013428","DOI":"10.1145\/2745844.2745870"},{"issue":"1","key":"1036_CR29","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3084452","volume":"1","author":"Y Zhou","year":"2017","unstructured":"Zhou Y, Zhou Y, Chen M, Chen S (2017) Persistent Spread Measurement for Big Network Data Based on Register Intersection. Proc ACM Measur Anal Comput Syst 1(1):1\u201329","journal-title":"Proc ACM Measur Anal Comput Syst"},{"key":"1036_CR30","unstructured":"Cisco sampled netflow. http:\/\/www.cisco.com"},{"key":"1036_CR31","doi-asserted-by":"crossref","unstructured":"Mai J, Chuah C-N, Sridharan A, Ye T, Zang H (2006) Is Sampled Data Sufficient for Anomaly Detection?. In: Proceedings of ACM IMC, pp 165\u2013176","DOI":"10.1145\/1177080.1177102"},{"issue":"3","key":"1036_CR32","doi-asserted-by":"publisher","first-page":"270","DOI":"10.1145\/859716.859719","volume":"21","author":"C Estan","year":"2003","unstructured":"Estan C, Varghese G (2003) New Directions in Traffic Measurement and Accounting: Focusing on the Elephants, Ignoring the Mice. ACM Trans Comput Syst 21(3):270\u2013313","journal-title":"ACM Trans Comput Syst"},{"key":"1036_CR33","doi-asserted-by":"crossref","unstructured":"Mo Z, Qiao Y, Chen S, Li T (2014) Highly compact virtual maximum likelihood sketches for counting big network data. In: Proceedings of Allerton, pp 1188\u20131195","DOI":"10.1109\/ALLERTON.2014.7028590"},{"key":"1036_CR34","doi-asserted-by":"crossref","unstructured":"Sun Y, Huang H, Ma C, Chen S, Du Y, Xiao Q (2020) Online Spread Estimation with Non-duplicate Samplingv","DOI":"10.1109\/INFOCOM41043.2020.9155525"},{"key":"1036_CR35","unstructured":"CAIDA The CAIDA UCSD Anonymized Internet Traces 2016. http:\/\/www.caida.org\/data\/passive\/passive_2016_dataset.xml, Accessed July 28, 2019"}],"container-title":["Peer-to-Peer Networking and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12083-020-01036-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s12083-020-01036-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12083-020-01036-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,4,14]],"date-time":"2021-04-14T12:29:06Z","timestamp":1618403346000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s12083-020-01036-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,1,11]]},"references-count":35,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2021,5]]}},"alternative-id":["1036"],"URL":"https:\/\/doi.org\/10.1007\/s12083-020-01036-8","relation":{},"ISSN":["1936-6442","1936-6450"],"issn-type":[{"type":"print","value":"1936-6442"},{"type":"electronic","value":"1936-6450"}],"subject":[],"published":{"date-parts":[[2021,1,11]]},"assertion":[{"value":"21 July 2020","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 November 2020","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 January 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}