{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,6]],"date-time":"2026-08-06T02:39:57Z","timestamp":1785983997280,"version":"3.56.0"},"reference-count":24,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2009,7]]},"DOI":"10.1109\/cisda.2009.5356528","type":"proceedings-article","created":{"date-parts":[[2009,12,24]],"date-time":"2009-12-24T18:27:59Z","timestamp":1261679279000},"page":"1-6","source":"Crossref","is-referenced-by-count":3736,"title":["A detailed analysis of the KDD CUP 99 data set"],"prefix":"10.1109","author":[{"given":"Mahbod","family":"Tavallaee","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ebrahim","family":"Bagheri","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Lu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ali A.","family":"Ghorbani","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref10","doi-asserted-by":"crossref","first-page":"267","DOI":"10.1007\/11555827_16","article-title":"Towards a theory of intrusion detection","volume":"3679","author":"di crescenzo","year":"2005","journal-title":"Lecture Notes in Computer Science"},{"key":"ref11","first-page":"15","article-title":"A framework for the evaluation of intrusion detection systems","author":"cardenas","year":"2006","journal-title":"Proceedings of IEEE Symposium on Security and Privacy (S&P)"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128834"},{"key":"ref13","doi-asserted-by":"crossref","first-page":"220","DOI":"10.1007\/978-3-540-45248-5_13","article-title":"An Analysis of the 1999 DARPA\/Lincoln Laboratory Evaluation Data for Network Anomaly Detection","author":"mahoney","year":"2003","journal-title":"Lecture Notes in Computer Science"},{"key":"ref14","article-title":"Intrusion detection with unlabeled data using clustering","author":"portnoy","year":"2001","journal-title":"Proceedings of ACM CSS Workshop on Data Mining Applied to Security Philadelphia"},{"key":"ref15","first-page":"333","article-title":"Unsupervised anomaly detection in network intrusion detection using clusters","volume":"38","author":"leung","year":"2005","journal-title":"Proceedings of the Twenty-eighth Australasian Conference on Computer Science"},{"key":"ref16","author":"quinlan","year":"1993","journal-title":"C4 5 Programs for Machine Learning"},{"key":"ref17","first-page":"338","article-title":"Estimating continuous distributions in Bayesian classifiers","author":"john","year":"1995","journal-title":"Proceedings of the Eleventh Conference on Uncertainty in Artificial Intelligence"},{"key":"ref18","article-title":"Scaling up the accuracy of naive-Bayes classifiers: A decision-tree hybrid","volume":"7","author":"kohavi","year":"1996","journal-title":"Proceedings of the Second International Conference on Knowledge Discovery and Data Mining"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/382912.382923"},{"key":"ref3","year":"2007","journal-title":"KDD Cup 1999"},{"key":"ref6","first-page":"1012","article-title":"Evaluating intrusion detection systems: The 1998 darpa off-line intrusion detection evaluation","volume":"2","author":"lippmann","year":"2000","journal-title":"DISCEX"},{"key":"ref5","first-page":"1130","article-title":"Cost-based modeling for fraud and intrusion detection: Results from the jam project","volume":"2","author":"stolfo","year":"2000","journal-title":"DISCEX"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/357830.357849"},{"key":"ref7","year":"2008","journal-title":"MIT Lincoln Labs 1998 DARPA Intrusion Detection Evaluation"},{"key":"ref2","first-page":"172","article-title":"A novel anomaly detection scheme based on principal component classifier","author":"shyu","year":"2003","journal-title":"Proceedings of the IEEE Foundations and New Directions of Data Mining Workshop in Conjunction with the Third IEEE International Conference on Data Mining (ICDM03)"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/185403.185412"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2001.924287"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1214\/aop\/1176990534"},{"key":"ref22","article-title":"LIBSVM: a library for support vector machines","author":"chang","year":"2001","journal-title":"Software Available at"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/72.80266"},{"key":"ref24","article-title":"Nsl-kdd data set for network-based intrusion detection systems","year":"2009"},{"key":"ref23","article-title":"Waikato environment for knowledge analysis (weka) version 3.5.7","year":"2008"}],"event":{"name":"2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA)","location":"Ottawa, ON, Canada","start":{"date-parts":[[2009,7,8]]},"end":{"date-parts":[[2009,7,10]]}},"container-title":["2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/5351161\/5356514\/05356528.pdf?arnumber=5356528","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,19]],"date-time":"2017-06-19T03:13:11Z","timestamp":1497841991000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/5356528\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,7]]},"references-count":24,"URL":"https:\/\/doi.org\/10.1109\/cisda.2009.5356528","relation":{},"subject":[],"published":{"date-parts":[[2009,7]]}}}