{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,28]],"date-time":"2025-10-28T18:37:13Z","timestamp":1761676633166,"version":"3.41.0"},"reference-count":29,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017,12]]},"DOI":"10.1109\/apsipa.2017.8282154","type":"proceedings-article","created":{"date-parts":[[2018,2,14]],"date-time":"2018-02-14T20:31:33Z","timestamp":1518640293000},"page":"864-872","source":"Crossref","is-referenced-by-count":14,"title":["Detection and classification of malicious patterns in network traffic using Benford's law"],"prefix":"10.1109","author":[{"given":"Liuying","family":"Sun","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"T. S.","family":"Anthony","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ho Zhe","family":"Xia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiageng","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuzhe","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yidan","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"journal-title":"The detection of income tax evasion through an analysis of digital frequencies[J]","year":"1992","author":"nigrini","key":"ref10"},{"key":"ref11","first-page":"169","article-title":"Benford's law for natural and synthetic images [C]","author":"acebo","year":"2005","journal-title":"Proceedings of the First Eurographics conference on Computational Aesthetics in Graphics Visualization and Imaging"},{"key":"ref12","first-page":"730","article-title":"Detecting doubly compressed JPEG images by using mode based first digit features[C]","author":"li","year":"2008","journal-title":"Multimedia Signal Processing 2008 IEEE 10th Workshop"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1186\/1687-6180-2012-190"},{"key":"ref14","first-page":"77230j","article-title":"Estimating JPEG2000 compression for image forensics using Benford's Law[C]","author":"qadir","year":"2010","journal-title":"SPIE Photonics Europe"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1117\/12.704723"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1029\/2010GL044830"},{"journal-title":"Agreement of drug discovery data with Benford's law[J]","year":"2013","author":"orita","key":"ref17"},{"key":"ref18","article-title":"A Bibliography of Publications about Benford's Law, Heaps' Law, and Zipf's Law[J]","author":"beebe","year":"2017","journal-title":"Net"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1214\/11-PS175"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.12.012"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"key":"ref3","doi-asserted-by":"crossref","first-page":"1106","DOI":"10.1288\/00005537-198709000-00020","article-title":"Perichondrial attached double cartilage block: a better alternative to the PORP[J]","volume":"97","author":"luetje","year":"1987","journal-title":"The Laryngoscope"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1030083.1030086"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/90.330413"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2007.02.001"},{"key":"ref8","first-page":"551","article-title":"The law of anomalous numbers[J]","author":"benford","year":"1938","journal-title":"Proceedings of the American Philosophical Society"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.2307\/2369148"},{"journal-title":"Network Intrusion Detection and Prevention Concepts and Techniques","year":"2009","author":"ghorbani","key":"ref2"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1214\/ss\/1177009869"},{"journal-title":"Intrusion Detection and Correlation Challenges and Solutions","year":"2004","author":"kruegel","key":"ref1"},{"key":"ref20","article-title":"An empirical study on TCP flow interarrival time distribution for normal and anomalous traffic[J]","author":"arshadi","year":"2014","journal-title":"International Journal of Communication Systems"},{"key":"ref22","article-title":"Flow Size Difference","author":"iorliam","year":"2016","journal-title":"Can Make a Difference Detecting Malicious TCP Network Flows Based on Benford's Law[J] arXiv preprint"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/KBEI.2015.7436057"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"journal-title":"Internet sevurity dictionary","year":"2002","author":"phoha","key":"ref23"},{"journal-title":"The Tao of Network Security Monitoring Beyond Intrusion Detection","year":"2004","author":"bejtlich","key":"ref26"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2011.5990529"}],"event":{"name":"2017 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC)","start":{"date-parts":[[2017,12,12]]},"location":"Kuala Lumpur","end":{"date-parts":[[2017,12,15]]}},"container-title":["2017 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8270695\/8281978\/08282154.pdf?arnumber=8282154","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T21:05:22Z","timestamp":1751403922000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/8282154\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,12]]},"references-count":29,"URL":"https:\/\/doi.org\/10.1109\/apsipa.2017.8282154","relation":{},"subject":[],"published":{"date-parts":[[2017,12]]}}}