{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,2]],"date-time":"2026-05-02T14:58:38Z","timestamp":1777733918682,"version":"3.51.4"},"reference-count":34,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2015,10]]},"DOI":"10.1109\/milcom.2015.7357464","type":"proceedings-article","created":{"date-parts":[[2015,12,17]],"date-time":"2015-12-17T16:54:21Z","timestamp":1450371261000},"page":"330-335","source":"Crossref","is-referenced-by-count":22,"title":["Malware traffic detection using tamper resistant features"],"prefix":"10.1109","author":[{"given":"Z.","family":"Berkay Celik","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Robert J.","family":"Walls","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Patrick","family":"McDaniel","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ananthram","family":"Swami","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref33","author":"jolliffe","year":"2002","journal-title":"Principal Component Analysis"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2013.6755058"},{"key":"ref31","article-title":"Detecting anomalous latent classes in a batch of network traffic flows","author":"fatih","year":"2014","journal-title":"Proc Information Sciences and Systems (CISS)"},{"key":"ref30","author":"ross quinlan","year":"2014","journal-title":"C4 5 Programs for Machine Learning"},{"key":"ref34","article-title":"Some methods for classification and analysis of multivariate observations","author":"macqueen","year":"1967","journal-title":"Mathematical Statistics and Probability"},{"key":"ref10","article-title":"Salting public traces with attack traffic to test flow classifiers","author":"berkay celik","year":"2011","journal-title":"Proc Cyber Security Experimentation and Test (CSET)"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2011.110810"},{"key":"ref12","article-title":"Identifying applications for intrusion detection systems","author":"burns","year":"2012","journal-title":"US Patent"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2013.6703693"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420969"},{"key":"ref15","article-title":"Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detection","author":"gu","year":"2008","journal-title":"Proc Usenix Security Symposium"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23269"},{"key":"ref17","article-title":"Discriminators for use in flow-based classification","author":"moore","year":"2005","journal-title":"Queen Mary and Westfield College Department of Computer Science"},{"key":"ref18","article-title":"Efficient application identification and the temporal and spatial stability of classification schema","author":"wei","year":"2009","journal-title":"Computer Networks"},{"key":"ref19","article-title":"Feature selection for high-dimensional data: A fast correlation-based filter solution","author":"yu","year":"2003","journal-title":"Proc International Conference on Machine Learning"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2013.12.016"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref27","article-title":"Estimating the support of a high-dimensional distribution","author":"bernhard","year":"2001","journal-title":"Neural Computation"},{"key":"ref3","article-title":"Execscent: Mining for new c&c domains in live networks with adaptive control protocol templates","author":"nelms","year":"2013","journal-title":"Proc Usenix Security Symposium"},{"key":"ref6","article-title":"Behavioral clustering of http-based malware and signature generation using malicious network traces","author":"perdisci","year":"2010","journal-title":"Proc Networked Systems Design and Implementation"},{"key":"ref29","article-title":"Scikit-learn: Machine learning in python","year":"2011","journal-title":"The Journal of Machine Learning Research"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41284-4_8"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2010.032210.00054"},{"key":"ref7","article-title":"Automatically generating models for botnet detection","author":"wurzinger","year":"2009","journal-title":"Proc European Symposium on Research in Computer Security (ESORICS)"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.08.003"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2011.5971980"},{"key":"ref1","article-title":"Jackstraws: Picking command and control connections from bot traffic","author":"jacob","year":"2011","journal-title":"Proc Usenix Security Symposium"},{"key":"ref20","year":"0","journal-title":"Internet Assigned Numbers Authority (IANA)"},{"key":"ref22","author":"trammell","year":"2013","journal-title":"Specification of the ip flow information export (ipfix) protocol for the exchange of flow information rfc 7011 (internet standard) internet engineering task force"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/MLSP.2012.6349793"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"ref23","author":"barbosa","year":"2010","journal-title":"Sim-pleweb\/university of twente traffic traces data repository Technical report Centre for Telematics and Information Technology University of Twente"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.17"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.12.012"}],"event":{"name":"MILCOM 2015 - 2015 IEEE Military Communications Conference","location":"Tampa, FL, USA","start":{"date-parts":[[2015,10,26]]},"end":{"date-parts":[[2015,10,28]]}},"container-title":["MILCOM 2015 - 2015 IEEE Military Communications Conference"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/7347040\/7357245\/07357464.pdf?arnumber=7357464","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,3,24]],"date-time":"2017-03-24T20:51:38Z","timestamp":1490388698000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/7357464\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,10]]},"references-count":34,"URL":"https:\/\/doi.org\/10.1109\/milcom.2015.7357464","relation":{},"subject":[],"published":{"date-parts":[[2015,10]]}}}