{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,21]],"date-time":"2025-12-21T07:11:53Z","timestamp":1766301113534,"version":"3.37.3"},"reference-count":46,"publisher":"Springer Science and Business Media LLC","issue":"3-4","license":[{"start":{"date-parts":[[2023,10,3]],"date-time":"2023-10-03T00:00:00Z","timestamp":1696291200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2023,10,3]],"date-time":"2023-10-03T00:00:00Z","timestamp":1696291200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Ann. Telecommun."],"published-print":{"date-parts":[[2024,4]]},"DOI":"10.1007\/s12243-023-00991-6","type":"journal-article","created":{"date-parts":[[2023,10,3]],"date-time":"2023-10-03T06:02:20Z","timestamp":1696312940000},"page":"241-256","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["A data infrastructure for heterogeneous telemetry adaptation: application to Netflow-based cryptojacking detection"],"prefix":"10.1007","volume":"79","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8863-1875","authenticated-orcid":false,"given":"Alejandro A.","family":"Moreno-Sancho","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2849-9782","authenticated-orcid":false,"given":"Antonio","family":"Pastor","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8573-127X","authenticated-orcid":false,"given":"Ignacio D.","family":"Martinez-Casanueva","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7691-0030","authenticated-orcid":false,"given":"Daniel","family":"Gonz\u00e1lez-S\u00e1nchez","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9591-0928","authenticated-orcid":false,"given":"Luis Bellido","family":"Triana","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2023,10,3]]},"reference":[{"key":"991_CR1","unstructured":"Zhang D, He M, Wang X, Tehranipoor M (2017) Dynamically obfuscated scan for protecting IPs against scan-based attacks throughout supply chain. In: 2017 IEEE 35th VLSI Test symposium (VTS). pp 1\u20136"},{"key":"991_CR2","unstructured":"Heinbockel WJ, Laderman ER, Serrao GJ (2017) Supply chain attacks and resiliency mitigations. In: Guidance for system security engineers"},{"key":"991_CR3","unstructured":"H H2020 Fishy, a coordinated framework for cyber resilient supply chain systems. [Online]. Available: https:\/\/fishy-project.eu\/"},{"key":"991_CR4","doi-asserted-by":"crossref","unstructured":"Pastor A, Mozo A, Lopez DR, Folgueira J, Kapodistria A (2018) The Mouseworld, a security traffic analysis lab based on NFV\/SDN. In: Proceedings of the 13th international conference on availability, reliability and security, ARES 2018. Association for Computing Machinery New York, NY, USA","DOI":"10.1145\/3230833.3233283"},{"key":"991_CR5","doi-asserted-by":"crossref","unstructured":"Moreno-Sancho AA, Pastor A, Martinez-Casanueva ID, Gonz\u00e1lez-S\u00e1nchez D, Triana LB (2023) A data infrastructure for heterogeneous telemetry adaptation. application to Netflow-based cryptojacking detection. In: 2023 26th conference on innovation in clouds, internet and networks and workshops (ICIN). pp 105\u2013112","DOI":"10.1109\/ICIN56760.2023.10073490"},{"key":"991_CR6","unstructured":"FISHY (2022) D6.2 it-1 fishy release validated. In: A coordinated framework for cyber resilient supply chain systems over complex ICT infrastructures"},{"key":"991_CR7","unstructured":"H.\u00a0H2020 Palantir, practical autonomous cyberhealth for resilient SMEs & microenterprises.\u201d [Online]. Available: https:\/\/www.palantir-project.eu\/"},{"key":"991_CR8","doi-asserted-by":"crossref","unstructured":"Claise B (2004) Cisco systems Netflow services export version 9. RFC 3954, RFC Editor, 10","DOI":"10.17487\/rfc3954"},{"key":"991_CR9","doi-asserted-by":"crossref","unstructured":"Soni S, Bhushan B (2019) Use of machine learning algorithms for designing efficient cyber security solutions. In: 2019 2nd international conference on intelligent computing, instrumentation and control technologies (ICICICT), vol\u00a01. pp 1496\u20131501","DOI":"10.1109\/ICICICT46008.2019.8993253"},{"key":"991_CR10","doi-asserted-by":"crossref","unstructured":"Geneiatakis D, Kozik R, Pawlicki M, Chora\u015b M (2018) Cost-sensitive distributed machine learning for Netflow-based botnet activity detection. Secur Commun Netw","DOI":"10.1155\/2018\/8753870"},{"issue":"2","key":"991_CR11","doi-asserted-by":"publisher","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","volume":"18","author":"AL Buczak","year":"2016","unstructured":"Buczak AL, Guven E (2016) A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun Surv Tutor 18(2):1153\u20131176","journal-title":"IEEE Commun Surv Tutor"},{"key":"991_CR12","unstructured":"Delplace A, Hermoso S, Anandita K (2020) Cyber attack detection thanks to machine learning algorithms"},{"key":"991_CR13","doi-asserted-by":"crossref","unstructured":"Campazas-Vega A, Crespo-Mart\u00ednez IS, Guerrero-Higueras AM, Fern\u00e1ndez-Llamas C (2020) Flow-data gathering using Netflow sensors for fitting malicious-traffic detection models. Sensors 20:24","DOI":"10.3390\/s20247294"},{"key":"991_CR14","doi-asserted-by":"publisher","first-page":"117","DOI":"10.1007\/978-3-030-72802-1_9","volume-title":"Big data technologies and applications","author":"M Sarhan","year":"2021","unstructured":"Sarhan M, Layeghy S, Moustafa N, Portmann M (2021) Netflow datasets for machine learning-based network intrusion detection systems. In: Deze Z, Huang H, Hou R, Rho S, Chilamkurti N (eds) Big data technologies and applications. Springer International Publishing, Cham, pp 117\u2013135"},{"key":"991_CR15","unstructured":"Cisco (2019) Netflow switching enhancements feature module. [Online] Available: https:\/\/web.archive.org\/web\/20091221041522http:\/\/www.cisco.com\/en\/US\/docs\/ios\/11_2\/feature\/guide\/netflow.html Accessed 21 Dec 2019"},{"key":"991_CR16","unstructured":"Cisco (2011) Netflow version 9 flow-record format. [Online]. Available: https:\/\/www.cisco.com\/en\/US\/technologies\/tk648\/tk362\/technologies_white_paper09186a00800a3db9.html. Accessed: March 2022"},{"key":"991_CR17","doi-asserted-by":"crossref","unstructured":"Enns R, Bjorklund M, Schoenwaelder J, Bierman A (2011) Network configuration protocol (NETCONF). RFC 6241, RFC Editor","DOI":"10.17487\/rfc6241"},{"key":"991_CR18","doi-asserted-by":"crossref","unstructured":"Bjorklund M (2010) YANG - a data modeling language for the network configuration protocol (NETCONF). RFC 6020, RFC Editor","DOI":"10.17487\/rfc6020"},{"key":"991_CR19","unstructured":"YangModels (2020) YANG vendor Cisco xr 622. [Online] Available: https:\/\/github.com\/YangModels\/yang\/tree\/main\/vendor\/cisco\/xr\/622 Accessed 2017"},{"key":"991_CR20","unstructured":"Cisco (2015) Cisco-ios-xr-traffmon-netflow-cfg.\u201d [Online]. Available: https:\/\/github.com\/YangModels\/yang\/tree\/main\/vendor\/cisco\/xr\/622 Accessed 19 Nov 2015"},{"key":"991_CR21","doi-asserted-by":"crossref","unstructured":"Gonz\u00e1lez-S\u00e1nchez D, Martinez-Casanueva ID, Pastor A, Triana LB, Zamarro CPM, Sancho AAM, Cambronero DF, Lopez D (2022) Model-driven network monitoring using Netflow applied to threat detection. In: 2022 IEEE 8th International conference on network softwarization (NetSoft). pp 450\u2013455","DOI":"10.1109\/NetSoft54395.2022.9844107"},{"issue":"5","key":"991_CR22","first-page":"321","volume":"7","author":"P O\u2019Kane","year":"2018","unstructured":"O\u2019Kane P, Sezer S, Carlin D (2018) Evolution of ransomware. IET. Networks 7(5):321\u2013327","journal-title":"Networks"},{"key":"991_CR23","unstructured":"Symantec C (2019) Internet security threat report 2019. [Online] Available: https:\/\/docs.broadcom.com\/doc\/istr-24-2019-en. Accessed: March 2022"},{"key":"991_CR24","unstructured":"Frankenfield J (2022) Mining pool. [Online] Available: https:\/\/www.investopedia.com\/terms\/m\/mining-pool.asp Accessed 15 Jan 2022"},{"key":"991_CR25","doi-asserted-by":"publisher","first-page":"126","DOI":"10.1016\/j.comcom.2021.02.016","volume":"171","author":"M Caprolu","year":"2021","unstructured":"Caprolu M, Raponi S, Oligeri G, Di Pietro R (2021) Cryptomining makes noise: detecting cryptojacking via machine learning. Comput Comm 171:126\u2013139","journal-title":"Comput Comm"},{"key":"991_CR26","doi-asserted-by":"publisher","first-page":"840","DOI":"10.1145\/3308558.3313665","volume-title":"The World Wide Web Conference, WWW \u201919","author":"A Kharraz","year":"2019","unstructured":"Kharraz A, Ma Z, Murley P, Lever C, Mason J, Miller A, Borisov N, Antonakakis M, Bailey M (2019) Outguard: detecting in-browser covert cryptocurrency mining in the wild. The World Wide Web Conference, WWW \u201919. Association for Computing Machinery, New York, NY, USA, pp 840\u2013852"},{"key":"991_CR27","doi-asserted-by":"crossref","unstructured":"Yulianto AD, Sukarno P, Warrdana AA, Makky MA (2019) Mitigation of cryptojacking attacks using taint analysis,\u201d In: 2019 4th International conference on information technology, information systems and electrical engineering (ICITISEE). pp 234\u2013238","DOI":"10.1109\/ICITISEE48480.2019.9003742"},{"key":"991_CR28","doi-asserted-by":"crossref","unstructured":"Tanana D (2020) Behavior-based detection of cryptojacking malware. In: 2020 Ural symposium on biomedical engineering, radioelectronics and information technology (USBEREIT). pp 0543\u20130545","DOI":"10.1109\/USBEREIT48449.2020.9117732"},{"key":"991_CR29","doi-asserted-by":"crossref","unstructured":"Mani G, Pasumarti V, Bhargava B, Vora FT, MacDonald J, King J, Kobes J (2020) Decrypto pro: deep learning based cryptomining malware detection using performance counters. In: 2020 IEEE International conference on autonomic computing and self-organizing systems (ACSOS). pp 109\u2013118","DOI":"10.1109\/ACSOS49614.2020.00032"},{"key":"991_CR30","doi-asserted-by":"crossref","unstructured":"Tahir R, Durrani S, Ahmed F, Saeed H, Zaffar F, Ilyas S (2019) The browsers strike back: countering cryptojacking and parasitic miners on the web. In: IEEE INFOCOM 2019 - IEEE Conference on computer communications. pp 703\u2013711","DOI":"10.1109\/INFOCOM.2019.8737360"},{"key":"991_CR31","unstructured":"Petrov I, Invernizzi L, Bursztein E (2020) CoinPolice: detecting hidden cryptojacking attacks with neural networks"},{"key":"991_CR32","doi-asserted-by":"crossref","unstructured":"Cunha Neto HN, Martin\u00a0Andreoni L, Fernandes NC, Mattos DMF (2020) MineCap: super incremental learning for detecting and blocking cryptocurrency mining on software-defined networking. Ann Telecommun","DOI":"10.1007\/s12243-020-00752-9"},{"key":"991_CR33","doi-asserted-by":"crossref","unstructured":"Rodriguez JDP, Posegga J (2018) RAPID: Resource and API-based detection against in-browser miners. In: Proceedings of the 34th annual computer security applications conference, ACSAC \u201918. Association for Computing Machinery, New York, NY, USA pp 313\u2013326","DOI":"10.1145\/3274694.3274735"},{"key":"991_CR34","doi-asserted-by":"crossref","unstructured":"Ning R, Wang C, Xin C, Li J, Zhu L, Wu H (2019) CapJack: capture in-browser crypto-jacking by deep capsule network through behavioral analysis. In: IEEE INFOCOM 2019 - IEEE conference on computer communications. pp 1873\u20131881","DOI":"10.1109\/INFOCOM.2019.8737381"},{"key":"991_CR35","doi-asserted-by":"crossref","unstructured":"Kelton C, Balasubramanian A, Raghavendra R, Srivatsa M (2020) Browser-based deep behavioral detection of web cryptomining with CoinSpy. In: Workshop on measurements, attacks, and defenses for the web (MADWeb) 2020. pp 1\u201312","DOI":"10.14722\/madweb.2020.23002"},{"key":"991_CR36","doi-asserted-by":"crossref","unstructured":"Li Z, Hou J, Wang H, Wang C, Kang C, Fu P (2019) Ethereum behavior analysis with Netflow data. In: 2019 20th Asia-Pacific network operations and management symposium (APNOMS). pp 1\u20136","DOI":"10.23919\/APNOMS.2019.8893121"},{"key":"991_CR37","doi-asserted-by":"crossref","unstructured":"Zayuelas i Mu\u00f1oz J, Su\u00e1rez-Varela J, Barlet-Ros P (2019) Detecting cryptocurrency miners with Netflow\/IPFIX network measurements. In: 2019 IEEE International symposium on measurements & networking (M &N). pp 1\u20136","DOI":"10.1109\/IWMN.2019.8804995"},{"key":"991_CR38","doi-asserted-by":"crossref","unstructured":"Pastor A, Mozo A, Vakaruk S, Canavese D, L\u00f3pez DR, Regano L, G\u00f3mez-Canaval S, Lioy A (2020) Detection of encrypted cryptomining malware connections with machine and deep learning. IEEE Access 8:158036\u2013158055","DOI":"10.1109\/ACCESS.2020.3019658"},{"key":"991_CR39","unstructured":"AS Foundation. Apache flink. [Online]. Available: https:\/\/flink.apache.org\/. Accessed May 2011"},{"key":"991_CR40","unstructured":"netsampler. Goflow2. [Online]. Available: https:\/\/github.com\/netsampler\/goflow2\/releases Accessed 26 May2021"},{"key":"991_CR41","unstructured":"OpenDaylight. Yang tools. [Online]. Available: https:\/\/docs.opendaylight.org\/en\/stable-sulfur\/developer-guides\/yang-tools.html"},{"key":"991_CR42","unstructured":"mbj4668. Pyang. [Online]. Available: https:\/\/github.com\/mbj4668\/pyang Accessed 14 Jan 2020"},{"key":"991_CR43","unstructured":"openconfig. ygot. [Online]. Available: https:\/\/github.com\/openconfig\/ygot. Accessed 11 June 2019"},{"key":"991_CR44","unstructured":"DIT-UPM G. SDA tool source code. [Online]. Available: https:\/\/github.com\/giros-dit\/semantic-data-aggregator. Accessed 30 June 2022"},{"key":"991_CR45","unstructured":"Qin J, Kruber N. Getting into low-latency gears with apache Flink - part one. [Online]. Available: https:\/\/flink.apache.org\/2022\/05\/18\/latency-part1.html. Accessed 18 May 2022"},{"key":"991_CR46","unstructured":"Polito. TStat (TCP statistic and analysis tool). [Online]. Available: http:\/\/tstat.polito.it\/. Accessed 30 May 2016"}],"container-title":["Annals of Telecommunications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12243-023-00991-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s12243-023-00991-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12243-023-00991-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,4,12]],"date-time":"2024-04-12T08:42:04Z","timestamp":1712911324000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s12243-023-00991-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,3]]},"references-count":46,"journal-issue":{"issue":"3-4","published-print":{"date-parts":[[2024,4]]}},"alternative-id":["991"],"URL":"https:\/\/doi.org\/10.1007\/s12243-023-00991-6","relation":{},"ISSN":["0003-4347","1958-9395"],"issn-type":[{"type":"print","value":"0003-4347"},{"type":"electronic","value":"1958-9395"}],"subject":[],"published":{"date-parts":[[2023,10,3]]},"assertion":[{"value":"2 May 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 July 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 October 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"The paper reflects only the authors\u2019 view. The commission is not responsible for any use that may be made of the information it contains.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclaimer"}}]}}