{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,16]],"date-time":"2026-10-16T06:43:55Z","timestamp":1792133035342,"version":"4.4.0"},"reference-count":108,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100004955","name":"Austrian Research Promotion Agency (FFG) IKT der Zukunft research project synERGY","doi-asserted-by":"publisher","award":["855457"],"award-info":[{"award-number":["855457"]}],"id":[{"id":"10.13039\/501100004955","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2020]]},"DOI":"10.1109\/comst.2020.2989695","type":"journal-article","created":{"date-parts":[[2020,4,22]],"date-time":"2020-04-22T20:21:49Z","timestamp":1587586909000},"page":"2064-2103","source":"Crossref","is-referenced-by-count":37,"title":["Why are My Flows Different? A Tutorial on Flow Exporters"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5253-1784","authenticated-orcid":false,"given":"Gernot","family":"Vormayr","sequence":"first","affiliation":[{"name":"Institute of Telecommunications, TU Wien, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Joachim","family":"Fabini","sequence":"additional","affiliation":[{"name":"Institute of Telecommunications, TU Wien, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5391-467X","authenticated-orcid":false,"given":"Tanja","family":"Zseby","sequence":"additional","affiliation":[{"name":"Institute of Telecommunications, TU Wien, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","author":"lucente","year":"2008","journal-title":"Pmacct Steps Forward Interface Counters"},{"key":"ref38","article-title":"ARGUS ?2.0.1 IPFX BOF presentation","author":"bullard","year":"2001","journal-title":"Proc Internet Eng Task Force"},{"key":"ref33","author":"connell","year":"2018","journal-title":"Clerk"},{"key":"ref32","year":"2018","journal-title":"nProbe"},{"key":"ref31","year":"2018","journal-title":"SQLite"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4180"},{"key":"ref37","author":"zander","year":"2018","journal-title":"Network Measurement and Accounting Meter (NETMATE)"},{"key":"ref36","year":"2018","journal-title":"Netdude"},{"key":"ref35","first-page":"33","article-title":"Design and implementation of netdude, a framework for packet trace manipulation","author":"kreibich","year":"2004","journal-title":"Proc Annu Conf USENIX Ann Tech Conf"},{"key":"ref34","author":"ostermann","year":"2018","journal-title":"tcptrace"},{"key":"ref28","author":"bullard","year":"2018","journal-title":"Audit Record Generation and Utilization System (ARGUS)"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5655"},{"key":"ref29","author":"phaal","year":"2004","journal-title":"SFlow Version 5"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2009.10.021"},{"key":"ref22","first-page":"1","article-title":"Artificial intelligence and intrusion detection: Current and future directions","volume":"10","author":"frank","year":"1994","journal-title":"Proc 17th Nat Comput Security Conf"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/RISP.1990.63859"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2016.03.012"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2014.2320577"},{"key":"ref101","year":"2019","journal-title":"Packages—The Go Programming Language Build Version go1 12 5"},{"key":"ref26","year":"2007","journal-title":"Netflow services solutions guide"},{"key":"ref100","year":"2019","journal-title":"Function Index (The GNU C Library)"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2012.2187305"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2996758.2996768"},{"key":"ref51","article-title":"Discriminators for use in flow-based classification","author":"moore","year":"2005"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/1656274.1656278"},{"key":"ref58","author":"ferreira","year":"2018","journal-title":"Curated Research on Network Traffic Analysis"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1929"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CIS.2015.105"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2013.022713.120250"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CISDA.2009.5356534"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2006.883010"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/1163593.1163596"},{"key":"ref40","author":"lucente","year":"2018","journal-title":"PMACCT"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2014.2321898"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1587\/transcom.E94.B.2190"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1272"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2014.2364743"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3917"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098163"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2063"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5101"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/1452520.1452539"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2018.8487396"},{"key":"ref48","author":"trammel","year":"2018","journal-title":"Quality of Flow (QoF)"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2016.7906980"},{"key":"ref42","author":"trammel","year":"2018","journal-title":"Yet Another Flowmeter (YAF)"},{"key":"ref41","year":"2018","journal-title":"Vermont—VERsatile MONitoring Tool"},{"key":"ref44","year":"2018","journal-title":"Vermont—VERsatile MONitoring Tool |Issue #53 |Exceptions With Default Example File"},{"key":"ref43","author":"mcgrew","year":"2018","journal-title":"Joy—A Package for Capturing and Analyzing Network Flow Data and Intraflow Data for Network Research Forensics and Security Monitoring"},{"key":"ref73","year":"2018","journal-title":"Libtins—Packet Crafting and Sniffing Library"},{"key":"ref72","year":"2018","journal-title":"WAND Network Research Group"},{"key":"ref71","first-page":"38","article-title":"Programming with libpcap-sniffing the network from our own application","volume":"3","author":"garcia","year":"2008","journal-title":"Hakin9-Computer Security Magazine"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2424887"},{"key":"ref76","year":"2018","journal-title":"Scapy project"},{"key":"ref77","year":"2018","journal-title":"Dpkt"},{"key":"ref74","year":"2018","journal-title":"PcapPlusPlus"},{"key":"ref75","year":"2018","journal-title":"Pcap4J—A Java Library for Capturing Crafting and Sending Packets"},{"key":"ref78","author":"connell","year":"2018","journal-title":"GoPacket"},{"key":"ref79","year":"2018","journal-title":"Wireshark—Go Deep"},{"key":"ref60","year":"2018","journal-title":"Tshark—The Wireshark Network Analyzer"},{"key":"ref62","year":"2018","journal-title":"TCPDUMP\/LIBPCAP public repository"},{"key":"ref61","year":"2018","journal-title":"Jpcap—A Network Packet Capture Library"},{"key":"ref63","author":"tuexen","year":"2018","journal-title":"PCAP Next Generation File Format Specification"},{"key":"ref64","year":"2005","journal-title":"ERF types reference guide version 21"},{"key":"ref65","author":"kleen","year":"2017","journal-title":"Packet—Packet Interface on Device Level Packet(7) Manual Page Linux 4 16"},{"key":"ref66","year":"2016","journal-title":"BPF—Berkeley Packet Filter BPF(4) Manual Page FreeBSD 12 0"},{"key":"ref67","year":"2018","journal-title":"Raw Sockets—Windows Applications |Microsoft Docs"},{"key":"ref68","year":"2018","journal-title":"PF_RING—Ntop"},{"key":"ref2","first-page":"1","article-title":"Yaf: Yet another flowmeter","author":"inacio","year":"2010","journal-title":"Proc 24th Int'l Conf LISA"},{"key":"ref69","year":"2018","journal-title":"DPDK—Data Plane Development Kit"},{"key":"ref1","first-page":"1","article-title":"Vermont—A versatile monitoring toolkit for IPFIX and PSAMP","author":"lampert","year":"2006","journal-title":"IEEE IST Workshop on Monitoring Attack Detection and Mitigation"},{"key":"ref95","year":"2017"},{"key":"ref108","year":"2018","journal-title":"MAWI Packet Traces"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8259"},{"key":"ref107","first-page":"263","article-title":"Traffic data repository at the WIDE project","author":"cho","year":"2000","journal-title":"Proc USENIX Annu Techn Conf"},{"key":"ref93","year":"2019","journal-title":"Map (Java Platform SE8)"},{"key":"ref106","author":"vormayr","year":"2019","journal-title":"Go flow"},{"key":"ref92","year":"2019","journal-title":"Effective GO—The GO Programming language Build version go1 12 5"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1145\/3097766.3097771"},{"key":"ref91","year":"2020","journal-title":"The Python Standard Library—Python 3 7 3 Documentation"},{"key":"ref104","author":"ferreira","year":"2018","journal-title":"NTARC Specification (Version v3 0 0)"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-84800-070-4"},{"key":"ref103","year":"2018","journal-title":"Libfixbuf"},{"key":"ref102","year":"1999","journal-title":"JSON"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/360680.360694"},{"key":"ref99","article-title":"Date and time on the Internet: Timestamps","author":"newman","year":"2002"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1080\/00401706.1962.10490022"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1990.10475311"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3954"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3697"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5103"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7011"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7014"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5102"},{"key":"ref16","article-title":"Transmission control protocol","year":"1981"},{"key":"ref82","year":"2018","journal-title":"WinPcap"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.17487\/rfc0768"},{"key":"ref81","year":"2019","journal-title":"Capture File Format Reference"},{"key":"ref18","year":"2018","journal-title":"Internet Assigned Numbers Authority (IANA) IP Flow Information Export (IPFIX) Entities"},{"key":"ref84","article-title":"Internet protocol","year":"1981"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2010.032210.00054"},{"key":"ref83","year":"2018","journal-title":"Npcap Windows Packet Capture Library&Driver"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/2185376.2185382"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1918"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4443"},{"key":"ref86","article-title":"Internet control message protocol","author":"postel","year":"1981"},{"key":"ref87","doi-asserted-by":"crossref","first-page":"342","DOI":"10.1108\/10650740810921484","article-title":"Detection of malicious traffic on back-bone links via packet header analysis","volume":"25","author":"olovsson","year":"2008","journal-title":"Campus-Wide Inform Syst"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2003"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/9173582\/09076310.pdf?arnumber=9076310","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,5,5]],"date-time":"2023-05-05T17:46:23Z","timestamp":1683308783000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9076310\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020]]},"references-count":108,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/comst.2020.2989695","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020]]}}}