{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,23]],"date-time":"2025-12-23T00:28:40Z","timestamp":1766449720835,"version":"3.28.0"},"reference-count":20,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013,10]]},"DOI":"10.1109\/cnsm.2013.6727841","type":"proceedings-article","created":{"date-parts":[[2014,1,31]],"date-time":"2014-01-31T23:39:14Z","timestamp":1391211554000},"page":"227-234","source":"Crossref","is-referenced-by-count":32,"title":["Towards real-time intrusion detection for NetFlow and IPFIX"],"prefix":"10.1109","author":[{"given":"Rick","family":"Hofstede","sequence":"first","affiliation":[]},{"given":"Vaclav","family":"Bartos","sequence":"additional","affiliation":[]},{"given":"Anna","family":"Sperotto","sequence":"additional","affiliation":[]},{"given":"Aiko","family":"Pras","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"19","first-page":"139","article-title":"Aberrant behavior detection in time series for network monitoring","author":"brutlag","year":"2000","journal-title":"Proceedings of the 14th Conference on Systems Administration LISA 2000"},{"key":"17","first-page":"1530","article-title":"Detecting sYN flooding attacks","volume":"3","author":"wang","year":"2002","journal-title":"INFOCOM 2002 Twenty-First Annual Joint Conference of the IEEE Computer and Communications Societies"},{"key":"18","article-title":"Application of forecasting techniques and control charts for traffic anomaly detection","author":"munz","year":"2008","journal-title":"Proceedings of the 19th ITC Specialist Seminar on Network Usage and Traffic"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2005.09.008"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1002\/qre.493"},{"journal-title":"White Paper","article-title":"Introduction to cisco iOS netFlow-A technical overview","year":"2012","key":"13"},{"journal-title":"Flow-inactive-timeout-Technical Documentation","year":"2012","key":"14"},{"key":"11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30633-4_13"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2012.6211908"},{"journal-title":"Can A DDoS Break the Internet? Sure Just Not All of It","year":"2013","key":"3"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2012.031512.110146"},{"journal-title":"Firm Is Accused of Sending Spam and Fight Jams Internet","year":"2013","key":"2"},{"year":"2013","key":"1"},{"key":"10","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2007.374774"},{"key":"7","article-title":"Specification of the iP flow information export protocol","author":"claise","year":"2008","journal-title":"RFC 5101 (Standards Track) Internet Engineering Task Force"},{"key":"6","article-title":"Architecture for iP flow information export","author":"sadasivan","year":"2009","journal-title":"RFC 5470 (Informational) Internet Engineering Task Force"},{"key":"5","article-title":"Cisco systems netFlow services export version 9","author":"claise","year":"2004","journal-title":"RFC 3954 (Informational) Internet Engineering Task Force"},{"journal-title":"DDoS and Security Reports The Arbor Networks Security Blog","year":"2012","key":"4"},{"key":"9","first-page":"599","article-title":"A flow-based method for abnormal network traffic detection","volume":"1","author":"kim","year":"2004","journal-title":"IEEE Network Operations and Management Symposium NOMS 2004"},{"key":"8","first-page":"326","article-title":"Network attack detection at flow level","author":"galtsev","year":"2011","journal-title":"Proceedings of the 11th International Conference and 4th International Conference on Smart Spaces and Next Neneration Wired\/Wireless Networking NEW2AN'11\/ruSMART'11"}],"event":{"name":"2013 9th International Conference on Network and Service Management (CNSM)","start":{"date-parts":[[2013,10,14]]},"location":"Zurich, Switzerland","end":{"date-parts":[[2013,10,18]]}},"container-title":["Proceedings of the 9th International Conference on Network and Service Management (CNSM 2013)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6713382\/6727796\/06727841.pdf?arnumber=6727841","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,3,22]],"date-time":"2017-03-22T22:07:34Z","timestamp":1490220454000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6727841\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,10]]},"references-count":20,"URL":"https:\/\/doi.org\/10.1109\/cnsm.2013.6727841","relation":{},"subject":[],"published":{"date-parts":[[2013,10]]}}}