{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,29]],"date-time":"2025-10-29T03:32:00Z","timestamp":1761708720510,"version":"3.28.0"},"reference-count":20,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2011,10]]},"DOI":"10.1109\/ldav.2011.6092312","type":"proceedings-article","created":{"date-parts":[[2011,12,6]],"date-time":"2011-12-06T21:00:47Z","timestamp":1323205247000},"page":"15-22","source":"Crossref","is-referenced-by-count":8,"title":["Atypical behavior identification in large-scale network traffic"],"prefix":"10.1109","author":[{"given":"Daniel M.","family":"Best","sequence":"first","affiliation":[]},{"given":"Ryan P.","family":"Hafen","sequence":"additional","affiliation":[]},{"given":"Bryan K.","family":"Olsen","sequence":"additional","affiliation":[]},{"given":"William A.","family":"Pike","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"19","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.18"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.1145\/1357054.1357286"},{"key":"18","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1109\/ICHIT.2008.249"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495939"},{"key":"13","first-page":"15","article-title":"The NIDES statistical component: Description and justification","volume":"39","author":"javitz","year":"1993","journal-title":"Contract"},{"key":"14","first-page":"19","article-title":"A few thoughts on cognitive overload","volume":"1","author":"kirsh","year":"2000","journal-title":"Intellectica"},{"key":"11","doi-asserted-by":"publisher","DOI":"10.2307\/2986349"},{"key":"12","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1007\/978-3-540-85933-8_16","article-title":"Existence plots: A low-resolution time series for port behavior analysis","volume":"1","author":"janies","year":"2008","journal-title":"Visualization for Computer Security"},{"journal-title":"Stealthwatch","year":"0","key":"3"},{"journal-title":"Exploratory Data Analysis","year":"1977","author":"tukey","key":"20"},{"journal-title":"Peakflow","year":"0","key":"2"},{"journal-title":"Netezza TwinFin\ufffd Data Sheet","year":"0","key":"1"},{"key":"10","first-page":"143","article-title":"VIAssist: Visual analytics for cyber defense. In Technologies for Homeland Security, 2009","author":"goodall","year":"2009","journal-title":"HST'09 IEEE Conference on"},{"key":"7","doi-asserted-by":"publisher","DOI":"10.1145\/129888.129894"},{"key":"6","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"key":"5","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"4","first-page":"447","article-title":"Detecting fraud in the real world","volume":"45","author":"cahill","year":"2004","journal-title":"Computing Reviews"},{"key":"9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78243-8_1"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177729756"}],"event":{"name":"2011 IEEE Symposium on Large Data Analysis and Visualization (LDAV)","start":{"date-parts":[[2011,10,23]]},"location":"Providence, RI, USA","end":{"date-parts":[[2011,10,24]]}},"container-title":["2011 IEEE Symposium on Large Data Analysis and Visualization"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/6083212\/6092173\/06092312.pdf?arnumber=6092312","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,20]],"date-time":"2017-06-20T10:53:18Z","timestamp":1497955998000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6092312\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,10]]},"references-count":20,"URL":"https:\/\/doi.org\/10.1109\/ldav.2011.6092312","relation":{},"subject":[],"published":{"date-parts":[[2011,10]]}}}