{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,12]],"date-time":"2026-10-12T18:58:46Z","timestamp":1791831526657,"version":"4.3.4"},"reference-count":52,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"11","license":[{"start":{"date-parts":[[2013,11,1]],"date-time":"2013-11-01T00:00:00Z","timestamp":1383264000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2013,11]]},"DOI":"10.1109\/tifs.2013.2279800","type":"journal-article","created":{"date-parts":[[2013,8,27]],"date-time":"2013-08-27T18:01:30Z","timestamp":1377626490000},"page":"1775-1789","source":"Crossref","is-referenced-by-count":102,"title":["Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study"],"prefix":"10.1109","volume":"8","author":[{"given":"Zhenxin","family":"Zhan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Maochao","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shouhuai","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","article-title":"A systematic characterization of im threats using honeypots","author":"polakis","year":"2010","journal-title":"Proc NDSS"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2010.06.004"},{"key":"ref33","article-title":"Empirical analysis and statistical modeling of attack processes based on honeypots","author":"ka\ufffdniche","year":"2007","journal-title":"CoRR"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-36584-8_7"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029216"},{"key":"ref30","first-page":"79","article-title":"Extracting inter-arrival time based behaviour from honeypot traffic using cliques","author":"almotairi","year":"2007","journal-title":"Proc of 5th Australian Digital Forensics Conference"},{"key":"ref37","first-page":"967","article-title":"Using machine learning techniques to identify botnet traffic","author":"livadas","year":"2006","journal-title":"Proc IEEE LCN Workshop on Network Security (WoNS'2006)"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_1"},{"key":"ref35","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1007\/978-3-540-30143-1_3","article-title":"Honeystat: Local worm detection using honeypots","author":"dagon","year":"2004","journal-title":"Proc Symp Recent Advances in Intrusion Detection (RAID'04)"},{"key":"ref34","first-page":"39","article-title":"A dos resilient flow-level intrusion detection approach for high-speed networks","author":"gao","year":"2006","journal-title":"Proc IEEE Int Conf Distributed Computing Systems (ICDCS'06)"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICIMP.2009.9"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2010.2086445"},{"key":"ref29","first-page":"21","article-title":"Internet attack knowledge discovery via clusters and cliques of attack traces","volume":"1","author":"clark","year":"2006","journal-title":"Journal of Information Assurance and Security"},{"key":"ref2","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1214\/ss\/1177010131","article-title":"Self-similarity in high-speed packet traffic: Analysis and modeling of ethernet traffic measurements","volume":"10","author":"willinger","year":"1995","journal-title":"Statist Sci"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1561\/0900000004"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1198\/00401700152672573"},{"key":"ref22","first-page":"1360","article-title":"High time-resolution measurement and analysis of lan traffic: Implications for lan interconnection","author":"leland","year":"1991","journal-title":"Proc INFOCOM"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/90.282603"},{"key":"ref24","author":"resnick","year":"2007","journal-title":"Heavy-Tail Phenomena Probabilistic and Statistical Modeling"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/90.554723"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1142\/S0129065712500050"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-010-0144-2"},{"key":"ref50","first-page":"163","article-title":"An evening with berferd, in which a cracker is lured, endured, and studied","author":"cheswick","year":"1992","journal-title":"Proc Winter Usenix Conf"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1142\/S0218348X95000692"},{"key":"ref52","article-title":"Estimators for long range dependence: An empirical study","author":"rea","year":"2009","journal-title":"arXiv 0901 0762v1"},{"key":"ref10","first-page":"1","article-title":"Flow-based worm detection using correlated honeypot logs","author":"dressler","year":"2007","journal-title":"Proc 2007 ITG-GI Conf Communication in Distributed Systems (KiVS)"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_29"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/972374.972384"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2010.032210.00054"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/NPC.2008.82"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33483-2"},{"key":"ref15","author":"peter","year":"2002","journal-title":"Introduction to Time Series and Forecasting"},{"key":"ref16","doi-asserted-by":"crossref","first-page":"165","DOI":"10.1007\/11856214_9","article-title":"The nepenthes platform: An efficient approach to collect malware","author":"baecher","year":"2006","journal-title":"Proc 9th Int'l Symp Recent Advances in Intrusion Detection (RAID 06)"},{"key":"ref17","author":"shorak","year":"1986","journal-title":"Empirical Processes with Applications to Statistics"},{"key":"ref18","author":"d'agostino","year":"1986","journal-title":"Tests Based on EDF Statistics"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.2307\/2287539"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1162\/003465304323023886"},{"key":"ref3","author":"beran","year":"1994","journal-title":"Statistics for Long-Memory Processes"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-9892.2010.00717.x"},{"key":"ref5","author":"qu","year":"2010","journal-title":"A Test Against Spurious Long Memory"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/18.650984"},{"key":"ref7","doi-asserted-by":"crossref","DOI":"10.1007\/978-0-387-75959-3","author":"cryer","year":"2008","journal-title":"Time Series Analysis with Applications in R"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2011.5990710"},{"key":"ref9","volume":"1","author":"daley","year":"2002","journal-title":"An Introduction to the Theory of Point Processes"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028794"},{"key":"ref45","first-page":"27","article-title":"An empirical study of clustering behavior of spammers and groupbased anti-spam strategies","author":"li","year":"2006","journal-title":"Proc Third Conf Email and AntiSpam (CEAS'06)"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/2254756.2254821"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879149"},{"key":"ref42","article-title":"Detecting targeted attacks using shadow honeypots","author":"anagnostakis","year":"2005","journal-title":"Proc Usenix Security Symp"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2006.09.005"},{"key":"ref44","article-title":"Long-range dependence analysis of control and data planes network traffic","author":"assadhan","year":"2008","journal-title":"Proc Saudi Int Innovation Conf (SIIC'08)"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/3468.935051"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/6609092\/06587320.pdf?arnumber=6587320","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,11,29]],"date-time":"2021-11-29T20:45:12Z","timestamp":1638218712000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6587320\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,11]]},"references-count":52,"journal-issue":{"issue":"11"},"URL":"https:\/\/doi.org\/10.1109\/tifs.2013.2279800","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2013,11]]}}}