{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,7]],"date-time":"2024-09-07T02:24:54Z","timestamp":1725675894460},"reference-count":36,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"DOI":"10.1109\/csac.2003.1254309","type":"proceedings-article","created":{"date-parts":[[2004,7,8]],"date-time":"2004-07-08T16:05:44Z","timestamp":1089302744000},"page":"46-55","source":"Crossref","is-referenced-by-count":34,"title":["Behavioral authentication of server flows"],"prefix":"10.1109","author":[{"given":"J.P.","family":"Early","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"C.E.","family":"Brodley","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"C.","family":"Rosenberg","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref33","article-title":"Sauver. Percentage of Total Internet2 Traffic Consisting of Kazaa\/Morpheus\/FastTrack-University of Oregon","author":"st","year":"0","journal-title":"Collaborative Computing in Higher Education Peer-to-Peer and Beyond Workshop"},{"journal-title":"Counter Hack A Step-by-Step Guide to Computer Attacks and Effective Defenses","year":"2002","author":"skoudis","key":"ref32"},{"journal-title":"Kazaa Media","article-title":"Sharman Networks Ltd","year":"0","key":"ref31"},{"key":"ref30","first-page":"1401","article-title":"A Brief Introduction to Boosting","author":"schapire","year":"1999","journal-title":"IJCAI"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/508185.508186"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.1997.646179"},{"journal-title":"Turbogold enterprise edition","article-title":"Stampede Technologies, Inc","year":"0","key":"ref34"},{"journal-title":"Flow Characterization for Intrusion Detection Technical report","year":"2000","author":"dunigan","key":"ref10"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1006\/inco.1995.1136"},{"key":"ref12","article-title":"E-mail's Backdoor Open to Spammers","author":"hansell","year":"2003","journal-title":"New York Times"},{"year":"0","key":"ref13"},{"year":"0","key":"ref14"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/191177.191183"},{"key":"ref16","doi-asserted-by":"crossref","first-page":"150","DOI":"10.1145\/288090.288122","article-title":"Temporal Sequence Learning and Data Reduction for Anomaly Detection","author":"lane","year":"1998","journal-title":"proceedings of the Fifth ACM Conference on Computer and Communications Security"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/322510.322526"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/382912.382914"},{"key":"ref19","article-title":"PHAD: Packet Header Anomaly Detection for Indentifying Hostile Network Traffic","author":"mahoney","year":"2001","journal-title":"Technical Report CS-2001–4"},{"article-title":"Data Mining Tools See5 and C5.0","year":"0","author":"quinlan","key":"ref28"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/382912.382923"},{"journal-title":"C4 5 Programs for Machine Learning","year":"1993","author":"quinlan","key":"ref27"},{"year":"0","key":"ref3","article-title":"RFC 793 - Transmission Control protocol"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/380995.380999"},{"article-title":"Snort - The Open Source Network Intrusion Detection System","year":"0","author":"roesch","key":"ref29"},{"key":"ref5","doi-asserted-by":"crossref","DOI":"10.1007\/978-1-4615-0953-0","author":"barbara","year":"2002","journal-title":"Applications of Data Mining in Computer Security"},{"year":"0","key":"ref8"},{"article-title":"ONCTec - List of Possible Trojan\/Backdoor Port Activity. ONCTek, llc","year":"0","author":"boxmeyer","key":"ref7"},{"year":"0","key":"ref2","article-title":"RFC 1700: Assigned Port Numbers"},{"article-title":"personal communication","year":"2003","author":"daniels","key":"ref9"},{"year":"0","key":"ref1","article-title":"1999 darpa intrusion detection evaluation data set"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CCGRID.2002.1017113"},{"article-title":"chkrootkit: A Tool that Locally Checks for Signs of a Rootkit","year":"0","author":"murilo","key":"ref22"},{"article-title":"Detecting Loadable Kernel Modules (LKM)","year":"0","author":"miller","key":"ref21"},{"year":"0","key":"ref24","article-title":"Captus Networks. Captus ips 4000 series"},{"journal-title":"Inc NetScreen-5000 Series","year":"0","key":"ref23"},{"key":"ref26","first-page":"353","article-title":"EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances","author":"porras","year":"1997","journal-title":"Proc 20th NIST-NCSC National Information Systems Security Conference"},{"year":"0","key":"ref25","article-title":"Packeteer, Inc. Packeteer PacketShaper"}],"event":{"name":"19th Annual Computer Security Applications Conference, 2003.","location":"Las Vegas, Nevada, USA"},"container-title":["19th Annual Computer Security Applications Conference, 2003. Proceedings."],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/8882\/28060\/01254309.pdf?arnumber=1254309","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,16]],"date-time":"2017-06-16T04:39:26Z","timestamp":1497587966000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/1254309\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[null]]},"references-count":36,"URL":"https:\/\/doi.org\/10.1109\/csac.2003.1254309","relation":{},"subject":[]}}