{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,7]],"date-time":"2026-07-07T20:12:51Z","timestamp":1783455171362,"version":"3.55.0"},"reference-count":113,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/OAPA.html"}],"funder":[{"name":"Department of Homeland Security Network Security Deployment Division","award":["HSSA01-13-C-2709"],"award-info":[{"award-number":["HSSA01-13-C-2709"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2016]]},"DOI":"10.1109\/comst.2015.2494502","type":"journal-article","created":{"date-parts":[[2015,10,26]],"date-time":"2015-10-26T18:48:27Z","timestamp":1445885307000},"page":"1153-1176","source":"Crossref","is-referenced-by-count":2539,"title":["A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection"],"prefix":"10.1109","volume":"18","author":[{"given":"Anna L.","family":"Buczak","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Erhan","family":"Guven","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1002\/1098-111X(200008)15:8<687::AID-INT1>3.0.CO;2-X"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2008.06.001"},{"key":"ref33","first-page":"10","article-title":"A novel network intrusion detection system (NIDS) based on signatures search of data mining","author":"zhengbing","year":"0","journal-title":"Proc 1st Int Conf Forensic Appl Techn Telecommun Inf Multimedia Workshop (e-Forensics &#x2018;08)"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30220-6_2"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1016\/S0019-9958(65)90241-X"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/273244.273257"},{"key":"ref37","author":"baralis","year":"2008","journal-title":"Generalized Itemset Discovery by Means of Opportunistic Aggregation"},{"key":"ref36","year":"2014","journal-title":"Politecnico di Torino Analyzer 3 0"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2008.12.011"},{"key":"ref34","first-page":"212","article-title":"Using data mining to discover signatures in network-based intrusion detection","author":"han","year":"0","journal-title":"Proc IEEE Comput Graph Appl"},{"key":"ref28","first-page":"579","article-title":"Network-based intrusion detection using neural networks","volume":"12","author":"bivens","year":"2002","journal-title":"Intell Eng Syst Artificial Neural Networks"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(00)00140-7"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/170035.170072"},{"key":"ref20","author":"stolfo","year":"2014","journal-title":"Kdd Cup 1999 Data Set"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1016\/0893-6080(89)90020-8"},{"key":"ref21","first-page":"1","article-title":"A detailed analysis of the KDD Cup 1999 data set","author":"tavallaee","year":"0","journal-title":"Proc IEEE Symp Comput Intell Secur Defense Appl"},{"key":"ref24","first-page":"443","article-title":"Artificial neural networks for misuse detection","author":"cannady","year":"0","journal-title":"Proc 1998 Nat Inf Syst Secur Conf"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1037\/h0042519"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2007.03.025"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046699"},{"key":"ref100","article-title":"Flame: A low-level anomaly modeling engine","author":"brauckhoff","year":"0","journal-title":"Proc Conf Cyber Security Exper Test"},{"key":"ref25","year":"2015","journal-title":"IBM"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1117\/12.775886"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-7597-2_10"},{"key":"ref59","first-page":"148","article-title":"Experiments with a new boosting algorithm","volume":"96","author":"freund","year":"0","journal-title":"Proc 13th Int Conf Mach Learn"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/MCAS.2006.1688199"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/2584679"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2584679"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45248-5_10"},{"key":"ref54","author":"quinlan","year":"1993","journal-title":"C4 5 Programs for Machine Learning"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/BF00116251"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/775047.775103"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-94-011-5014-9_11"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.08.003"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2008.080406"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2009.06.019"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2010.032210.00054"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/240455.240464"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1038\/30918"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1023\/A:1024600519144"},{"key":"ref9","first-page":"13","article-title":"The CRISP-DM model: The new blueprint for data mining","volume":"5","author":"shearer","year":"2000","journal-title":"J Data Warehousing"},{"key":"ref46","author":"jain","year":"1988","journal-title":"Algorithms for clustering data"},{"key":"ref45","first-page":"704","article-title":"A Na&#x00EF;ve Bayes approach for detecting coordinated attacks","author":"benferhat","year":"0","journal-title":"Proc 32nd Annu IEEE Int Comput Software Appl Conf"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1177\/104649647100200201"},{"key":"ref47","first-page":"333","article-title":"Unsupervised anomaly detection in network intrusion detection using clusters","volume":"38","author":"leung","year":"0","journal-title":"Proc 28th Australas Conf Comput Sci"},{"key":"ref42","first-page":"967","article-title":"Using machine learning techniques to identify botnet traffic","author":"livadas","year":"0","journal-title":"Proc 31st IEEE Conf Local Comput Netw"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4757-3502-4"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2003.1254306"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2007.379535"},{"key":"ref73","first-page":"1","article-title":"Using genetic algorithms for network intrusion detection","author":"li","year":"0","journal-title":"Proc U S Dept Energy Cyber Secur Group 2004 Train Conf"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1016\/0167-2789(86)90240-X"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/4235.585892"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ICNN.1995.488968"},{"key":"ref76","first-page":"26","article-title":"Rule-based network intrusion detection using genetic algorithms","volume":"18","author":"khan","year":"2011","journal-title":"Int J Comput Appl"},{"key":"ref77","author":"jolliffe","year":"2002","journal-title":"Principal Component Analysis"},{"key":"ref74","first-page":"328","article-title":"Evolutionary design of intrusion detection programs","volume":"4","author":"abraham","year":"2007","journal-title":"Int J Netw Secur"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2006.04.004"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1111\/j.0824-7935.2004.00247.x"},{"key":"ref79","article-title":"Extension of the limit theorems of probability theory to a sum of variables connected in a chain","volume":"1","author":"markov","year":"1971","journal-title":"Dynamic Probabilistic Systems"},{"key":"ref60","first-page":"945","article-title":"Boosting the area under the ROC curve","author":"long","year":"2007","journal-title":"Adv Neural Inf Process Syst"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2008.923876"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CNSR.2007.22"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1176347963"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2004.01.003"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420969"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1023\/A:1022602019183"},{"key":"ref68","author":"koza","year":"1992","journal-title":"Genetic Programming On the Programming of Computers by Means of Natural Selection"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.052213.00046"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.4249\/scholarpedia.1965"},{"key":"ref1","first-page":"125","article-title":"Cyber security challenges: Designing efficient intrusion detection systems and antivirus tools","author":"mukkamala","year":"2005","journal-title":"Enhancing Computer Security With Smart Technology"},{"key":"ref109","first-page":"226","article-title":"A density-based algorithm for discovering clusters in large spatial databases with noise","volume":"96","author":"ester","year":"1996","journal-title":"Knowl Discov Data Min"},{"key":"ref95","author":"vapnik","year":"2010","journal-title":"The Nature of Statistical Learning Theory"},{"key":"ref108","first-page":"307","article-title":"Fast discovery of association rules","volume":"12","author":"agrawal","year":"1996","journal-title":"Advances in Knowledge Discovery and Data Mining"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/ICEBE.2007.69"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/2.485891"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/967900.968048"},{"key":"ref106","doi-asserted-by":"crossref","first-page":"107","DOI":"10.1007\/s13042-011-0019-y","article-title":"Extreme learning machines: A survey","volume":"2","author":"guang-bin","year":"2011","journal-title":"Int J Mach Learn Cybern"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.1995.380415"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1145\/1327452.1327492"},{"key":"ref91","first-page":"420","article-title":"Na&#x00EF;ve Bayes vs. decision trees in intrusion detection systems","author":"amor","year":"0","journal-title":"Proc ACM Symp Appl Comput"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1145\/1143844.1143865"},{"key":"ref90","first-page":"258","article-title":"Network intrusion detection using Naive Bayes","volume":"7","author":"panda","year":"2007","journal-title":"Int J Comput Sci Netw Secur"},{"key":"ref103","author":"paxson","year":"2004","journal-title":"Bro 0 9"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-97610-0"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/PROC.1973.9030"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1023\/A:1009715923555"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-007-0281-3"},{"key":"ref98","first-page":"282","article-title":"Robust support vector machines for anomaly detection in computer security","author":"hu","year":"0","journal-title":"Proc 20th Int Conf Mach Learn"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20757-0_3"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2011.07.032"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2011.01.002"},{"key":"ref10","doi-asserted-by":"crossref","first-page":"60","DOI":"10.32614\/RJ-2009-010","article-title":"PMML an open standard for sharing models","volume":"1","author":"guazzelli","year":"2009","journal-title":"R Journal"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/1656274.1656278"},{"key":"ref12","year":"2000","journal-title":"R Core Team"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04441-0_70"},{"key":"ref14","author":"jacobson","year":"1989","journal-title":"The tcpdump manual page"},{"key":"ref15","author":"combs","year":"2014","journal-title":"Wireshark"},{"key":"ref16","year":"2014","journal-title":"The Source"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2010.12.004"},{"key":"ref17","author":"lyon","year":"2009","journal-title":"Nmap Network Scanning The Official Nmap Project Guide to Network Discovery and Security Scanning"},{"key":"ref81","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1007\/11856214_8","article-title":"Using Hidden markov models to evaluate the risks of intrusions: System architecture and model validation","author":"arnes","year":"2006","journal-title":"Lect Notes Comput Sci"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(00)00139-0"},{"key":"ref84","first-page":"1","article-title":"Maximum likelihood from incomplete data via the EM algorithm","author":"dempster","year":"1977","journal-title":"J Roy Statist Soc"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2000.821506"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/1167350.1167387"},{"key":"ref113","article-title":"Practical data hiding in TCP\/IP","volume":"2","author":"ahsan","year":"0","journal-title":"Proc ACM Multimedia Secur Workshop"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1090\/S0002-9904-1967-11751-8"},{"key":"ref89","author":"witten","year":"2011","journal-title":"Data Mining Practical Machine Learning Tools and Techniques"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/B978-1-55860-377-6.50023-2"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-12405-5_4"},{"key":"ref87","first-page":"120","article-title":"A data mining framework for building intrusion detection models","author":"lee","year":"0","journal-title":"Proc IEEE Symp Secur Privacy"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-003-0132-7"}],"container-title":["IEEE Communications Surveys &amp; Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/ieeexplore.ieee.org\/iel7\/9739\/7475979\/07307098.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/7475979\/07307098.pdf?arnumber=7307098","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,10,11]],"date-time":"2021-10-11T02:35:17Z","timestamp":1633919717000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/7307098\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"references-count":113,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/comst.2015.2494502","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016]]}}}