{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,8]],"date-time":"2026-03-08T23:53:04Z","timestamp":1773013984200,"version":"3.50.1"},"reference-count":34,"publisher":"Springer Science and Business Media LLC","issue":"3-4","license":[{"start":{"date-parts":[[2019,11,8]],"date-time":"2019-11-08T00:00:00Z","timestamp":1573171200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2019,11,8]],"date-time":"2019-11-08T00:00:00Z","timestamp":1573171200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"name":"National Natural Science Foundation of China under Grant","award":["61602114"],"award-info":[{"award-number":["61602114"]}]},{"name":"CERNET Innovation Project","award":["NGII20170406"],"award-info":[{"award-number":["NGII20170406"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["CCF Trans. Netw."],"published-print":{"date-parts":[[2019,12]]},"DOI":"10.1007\/s42045-019-00023-9","type":"journal-article","created":{"date-parts":[[2019,11,8]],"date-time":"2019-11-08T15:20:27Z","timestamp":1573226427000},"page":"153-171","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["IP backbone traffic behavior characteristic spectrum composing and role mining"],"prefix":"10.1007","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8377-5877","authenticated-orcid":false,"given":"Xiaodong","family":"Zang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jian","family":"Gong","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Siyi","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoyan","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yun","family":"Yang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,11,8]]},"reference":[{"issue":"1","key":"23_CR1","first-page":"145","volume":"33","author":"L Chen","year":"2012","unstructured":"Chen, L., Gong, J.: Fast application-level traffic classification using NetFlow records. J. Commun. 33(1), 145\u2013152 (2012)","journal-title":"J. Commun."},{"issue":"12","key":"23_CR2","doi-asserted-by":"publisher","first-page":"1649","DOI":"10.1109\/TPDS.2007.1111","volume":"18","author":"Y Chen","year":"2007","unstructured":"Chen, Y., Hwang, K., Ku, W.S.: Collaborative Detection of DDoS attacks over multiple network domains. IEEE Trans. Parallel Distrib. Syst. 18(12), 1649\u20131662 (2007)","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"issue":"4","key":"23_CR3","first-page":"476","volume":"36","author":"S Cui","year":"2017","unstructured":"Cui, S., Li, W., Yi, L., Li, C., Zhu, L., Jiang, Z.: A bibliometrical analysis of status on animal behavior in China. Acta Theriol Sin 36(4), 476\u2013484 (2017)","journal-title":"Acta Theriol Sin"},{"key":"23_CR4","unstructured":"Fayaz, S.K., Tobioka, Y., Sekar, V.: Bohatei: flexible and elastic DDoS defense. In: USENIX, pp.\u00a0817\u2013832 (2015)"},{"key":"23_CR5","doi-asserted-by":"crossref","unstructured":"Ga\u00f1\u00e1n, C., Cetin, O., van Eeten, M.: An empirical analysis of ZeuS C&C lifetime. In: Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security (ASIA CCS '15), pp 97\u2013108. ACM, New York (2015)","DOI":"10.1145\/2714576.2714579"},{"issue":"4","key":"23_CR6","first-page":"1010","volume":"28","author":"J Gong","year":"2017","unstructured":"Gong, J., Zang, X.D., Su, Q., Hu, X.Y., Xu, J.: Survey of network security situation awareness. J. Softw. 28(4), 1010\u20131026 (2017)","journal-title":"J. Softw."},{"key":"23_CR7","doi-asserted-by":"crossref","unstructured":"Grill, M., Nikolaev, I., Valeros, V., Rehak, M.: Detecting DGA malware using NetFlow. In: IFIP\/IEEE International Symposium on Integrated Network Management, pp.\u00a01304\u20131309 (2015)","DOI":"10.1109\/INM.2015.7140486"},{"issue":"4","key":"23_CR8","doi-asserted-by":"publisher","first-page":"1284","DOI":"10.1109\/TNET.2012.2226603","volume":"21","author":"Y Himura","year":"2013","unstructured":"Himura, Y., Fukuda, K., Cho, K., Borgnat, P., Abry, P., Esaki, H.: Synoptic graphlet: bridging the gap between supervised and unsupervised profiling of host-level network traffic. IEEE\/ACM Trans. Netw. 21(4), 1284\u20131297 (2013)","journal-title":"IEEE\/ACM Trans. Netw."},{"issue":"4","key":"23_CR9","doi-asserted-by":"publisher","first-page":"2242","DOI":"10.1109\/COMST.2015.2457491","volume":"17","author":"N Hoque","year":"2015","unstructured":"Hoque, N., Bhattacharyya, D.K., Kalita, J.K.: Botnet in DDoS attacks: trends and challenges. IEEE Commun. Surv. Tutor. 17(4), 2242\u20132270 (2015)","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"23_CR10","doi-asserted-by":"crossref","unstructured":"Iliofotou, M., Gallagher, B., Eliassi-Rad, T., Xie, G., Faloutsos, M.: Profiling-by-association: a resilient traffic profiling solution for the internet backbone. In: Proceedings of the 6th International Conference, Philadelphia, Pennsylvania (2010)","DOI":"10.1145\/1921168.1921171"},{"key":"23_CR11","doi-asserted-by":"publisher","first-page":"99","DOI":"10.1016\/j.comnet.2016.02.012","volume":"100","author":"A Jakalan","year":"2016","unstructured":"Jakalan, A., Jian, G., Zhang, W., Qi, S.: Clustering and profiling ip hosts based on traffic behavior. Comput. Netw. 100, 99\u2013107 (2016a)","journal-title":"Comput. Netw."},{"key":"23_CR12","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1016\/j.comnet.2016.02.012","volume":"100","author":"A Jakalan","year":"2016","unstructured":"Jakalan, A., Gong, J., Su, Q., Hu, X., Abdelgder, A.M.S.: Social relationship discovery of IP addresses in the managed IP networks by observing traffic at network boundary. Comput. Netw. 100, 12\u201327 (2016b)","journal-title":"Comput. Netw."},{"issue":"18","key":"23_CR13","doi-asserted-by":"publisher","first-page":"3327","DOI":"10.1016\/j.comnet.2010.06.013","volume":"54","author":"H Jiang","year":"2010","unstructured":"Jiang, H., Ge, Z., Jin, S., Wang, J.: Network prefix-level traffic profiling: characterizing, modeling and evaluation. Comput. Netw. 54(18), 3327\u20133340 (2010)","journal-title":"Comput. Netw."},{"issue":"4","key":"23_CR14","doi-asserted-by":"publisher","first-page":"229","DOI":"10.1145\/1090191.1080119","volume":"35","author":"T Karagiannis","year":"2005","unstructured":"Karagiannis, T., Papagiannaki, K., Faloutsos, M.: BLINC: multilevel traffic classification in the dark. Proc. ACM SIGCOMM 35(4), 229\u2013240 (2005)","journal-title":"Proc. ACM SIGCOMM"},{"issue":"1","key":"23_CR15","first-page":"2","volume":"18","author":"N Kheir","year":"2013","unstructured":"Kheir, N.: Behavioral classification and detection of malware through HTTP user agent anomalies. J. Inf. Secur. Appl. 18(1), 2\u201313 (2013)","journal-title":"J. Inf. Secur. Appl."},{"key":"23_CR16","doi-asserted-by":"publisher","first-page":"14","DOI":"10.1016\/j.patrec.2017.11.004","volume":"101","author":"R Kozik","year":"2018","unstructured":"Kozik, R.: Distributing extreme learning machines with Apache Spark for NetFlow-based malware activity detection. Pattern Recognit. Lett. 101, 14\u201320 (2018)","journal-title":"Pattern Recognit. Lett."},{"key":"23_CR17","doi-asserted-by":"publisher","first-page":"188","DOI":"10.1007\/3-540-36233-9_15","volume":"2544","author":"P Krishna Reddy","year":"2002","unstructured":"Krishna Reddy, P., Kitsuregawa, M., Sreekanth, P., Srinivasa Rao, S.: A graph based approach to extract a neighborhood customer community for collaborative filtering. Databases Netw. Inf. Syst. 2544, 188\u2013200 (2002)","journal-title":"Databases Netw. Inf. Syst."},{"key":"23_CR18","unstructured":"Deri, L.: Open source VoIP traffic monitoring. http:\/\/131.114.21.22\/VoIP.pdfS.Retrieved Accessed 3 June 2012"},{"key":"23_CR19","doi-asserted-by":"crossref","unstructured":"Lee, D.J., Brownlee, N., Host measurement of network traffic. In: Telecommunication Networks and Applications Conference, pp.\u00a0282\u2013287 (2007)","DOI":"10.1109\/ATNAC.2007.4665236"},{"issue":"2","key":"23_CR20","doi-asserted-by":"publisher","first-page":"567","DOI":"10.1016\/j.jnca.2012.12.020","volume":"36","author":"B Li","year":"2013","unstructured":"Li, B., Springer, J., Bebis, G., Gunes, M.H.: A survey of network flow applications. J. Netw. Comput. Appl. 36(2), 567\u2013581 (2013)","journal-title":"J. Netw. Comput. Appl."},{"key":"23_CR21","doi-asserted-by":"publisher","first-page":"224","DOI":"10.1016\/j.comnet.2014.08.007","volume":"73","author":"AK Marnerides","year":"2014","unstructured":"Marnerides, A.K., Schaeffer-Filho, A., Mauthe, A.: Traffic anomaly diagnosis in Internet backbone networks: a survey. Comput. Netw. 73, 224\u2013243 (2014)","journal-title":"Comput. Netw."},{"issue":"3","key":"23_CR22","first-page":"663","volume":"26","author":"LH Miao","year":"2015","unstructured":"Miao, L.H., Ding, W., Yang, W.: Extracting and analyzing internet background radiation in live networks. J. Softw. 26(3), 663\u2013679 (2015)","journal-title":"J. Softw."},{"key":"23_CR23","doi-asserted-by":"publisher","first-page":"385","DOI":"10.1016\/j.neucom.2015.04.101","volume":"172","author":"A Saied","year":"2016","unstructured":"Saied, A., Overill, R.E., Radzik, T.: Detection of known and unknown DDoS attacks using Artificial Neural Networks. Neurocomputing 172, 385\u2013393 (2016)","journal-title":"Neurocomputing"},{"key":"23_CR24","doi-asserted-by":"crossref","unstructured":"Schatzmann, D., M\u00fchlbauer, W., Spyropoulos, T., et al.: Digging into HTTPS: flow-based classification of webmail traffic. In: 10th ACM SIGCOMM Conference on Internet Measurement, pp 322\u2013327 (2010)","DOI":"10.1145\/1879141.1879184"},{"key":"23_CR25","doi-asserted-by":"publisher","first-page":"238","DOI":"10.1016\/j.cose.2017.05.009","volume":"70","author":"MFS Umer","year":"2017","unstructured":"Umer, M.F.S., Yaxin, M.B.: Flow-based intrusion detection: techniques and challenges. Comput. Secur. 70, 238\u2013254 (2017)","journal-title":"Comput. Secur."},{"key":"23_CR26","doi-asserted-by":"publisher","first-page":"238","DOI":"10.1016\/j.cose.2017.05.009","volume":"70","author":"MF Umer","year":"2017","unstructured":"Umer, M.F., Sher, M., Bi, Y.: Flow-based intrusion detection: techniques and challenges. Comput. Secur. 70, 238\u2013254 (2017)","journal-title":"Comput. Secur."},{"key":"23_CR27","unstructured":"Wei, S., Mirkovic, J., Kissel, E.: Profiling and clustering internet hosts. In: Proceedings of the International Conference on Data Mining, pp. 269\u2013275 (2006)"},{"key":"23_CR28","unstructured":"Weijie, G.: The parallel and implementation for network behavior observations system. (MS. Thesis), Southeast University, pp.\u00a03\u201320 (2010)"},{"issue":"03","key":"23_CR29","doi-asserted-by":"crossref","first-page":"253","DOI":"10.3724\/issn1000-3207-2005-3-253-6","volume":"29","author":"JQ Xiao","year":"2005","unstructured":"Xiao, J.Q., Wang, D.: Construction of behavioral spectrum of the Yangtze finless porpoise in captivity. Acta Hydrobiol. Sin. 29(03), 253\u2013258 (2005)","journal-title":"Acta Hydrobiol. Sin."},{"key":"23_CR30","doi-asserted-by":"crossref","unstructured":"Xu, K., Wang, F., Gu, L.: Network-aware behavior clustering of internet end hosts. In: INFOCOM, pp.\u00a02078\u20132086 (2011)","DOI":"10.1109\/INFCOM.2011.5935017"},{"issue":"3","key":"23_CR31","doi-asserted-by":"publisher","first-page":"931","DOI":"10.1109\/TNET.2013.2264634","volume":"22","author":"K Xu","year":"2014","unstructured":"Xu, K., Wang, F., Gu, L.: Behavior analysis of internet traffic via bipartite graphs and one-mode projections. IEEE\/ACM Trans. Netw. 22(3), 931\u2013942 (2014)","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"23_CR32","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1016\/j.cose.2013.04.007","volume":"39","author":"D Zhao","year":"2013","unstructured":"Zhao, D., Traore, I., Sayed, B., Lub, W., Saad, S., Ghorbani, A., Garant, D.: Botnet detection based on traffic behavior analysis and flow intervals. Comput. Secur. 39, 2\u201316 (2013a)","journal-title":"Comput. Secur."},{"key":"23_CR33","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1016\/j.cose.2013.04.007","volume":"39","author":"D Zhao","year":"2013","unstructured":"Zhao, D., Traore, I., Sayed, B., Wei, L., Saad, H., Ghorbani, A., Garant, D.: Botnet detection based on traffic behavior analysis and flow intervals. Comput. Secur. 39, 2\u201316 (2013b)","journal-title":"Comput. Secur."},{"key":"23_CR34","unstructured":"Zheng, D.L.: Behavioral ecologic research on several kinds of Africa herbivores in semi-nature. [Master Theisi], Shandong Normal University, pp.\u00a03\u201315 (2005)"}],"container-title":["CCF Transactions on Networking"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s42045-019-00023-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s42045-019-00023-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s42045-019-00023-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,26]],"date-time":"2024-07-26T15:17:20Z","timestamp":1722007040000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s42045-019-00023-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,11,8]]},"references-count":34,"journal-issue":{"issue":"3-4","published-print":{"date-parts":[[2019,12]]}},"alternative-id":["23"],"URL":"https:\/\/doi.org\/10.1007\/s42045-019-00023-9","relation":{},"ISSN":["2520-8462","2520-8470"],"issn-type":[{"value":"2520-8462","type":"print"},{"value":"2520-8470","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,11,8]]},"assertion":[{"value":"22 May 2018","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 October 2019","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 November 2019","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}