{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,10]],"date-time":"2025-12-10T08:41:35Z","timestamp":1765356095014,"version":"3.37.3"},"reference-count":72,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2018,2,1]],"date-time":"2018-02-01T00:00:00Z","timestamp":1517443200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"funder":[{"name":"State of Maryland, TEDCO (MII)","award":["01140-002"],"award-info":[{"award-number":["01140-002"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Syst. Man Cybern, Syst."],"published-print":{"date-parts":[[2018,2]]},"DOI":"10.1109\/tsmc.2016.2600405","type":"journal-article","created":{"date-parts":[[2016,9,7]],"date-time":"2016-09-07T18:12:00Z","timestamp":1473271920000},"page":"207-223","source":"Crossref","is-referenced-by-count":22,"title":["Queryable Semantics to Detect Cyber-Attacks: A Flow-Based Detection Approach"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4337-1488","authenticated-orcid":false,"given":"Ahmed F.","family":"AlEroud","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"George","family":"Karabatis","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.08.003"},{"journal-title":"Softflowd A Flow-based Network Traffic Analyser","year":"2013","author":"miller","key":"ref71"},{"journal-title":"Netresec Network forensics and network security monitoring","year":"2013","key":"ref70"},{"article-title":"Contextual information fusion for the detection of cyber attack","year":"2014","author":"aleroud","key":"ref39"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74255-5_42"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/S0378-7206(03)00029-6"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2008.141"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SKG.2008.55"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.12.003"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/98.626984"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SKG.2008.26"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.4018\/jdm.2007010103"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-10562-3_3"},{"key":"ref60","first-page":"172","article-title":"Intrusion detection based on distance combination","author":"beauquier","year":"2007","journal-title":"Proc World Acad Sci Eng Technol"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972788.22"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2008.119"},{"key":"ref63","first-page":"24","article-title":"Assessment of discretization techniques for relevant pattern discovery from gene expression data","author":"pensa","year":"2004","journal-title":"Proc 4th ACM SIGKDD Workshop Data Min Bioinformat (SIGKDD)"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOMW.2014.6849281"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511626630"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2013.04.005"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2012.6284294"},{"key":"ref66","doi-asserted-by":"crossref","first-page":"193","DOI":"10.3233\/FI-1993-182-408","article-title":"Selected algorithms of machine learning from examples","volume":"18","author":"grzymala-busse","year":"1993","journal-title":"Fundamenta Informaticae"},{"key":"ref29","first-page":"510","article-title":"SAFEM: Scalable analysis of flows with entropic measures and SVM","author":"fran\u00e7ois","year":"2012","journal-title":"Proc IEEE Netw Operat Manage Symp (NOMS)"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/DRCN.2009.5339986"},{"journal-title":"Performance Characterization & Improvement of Snort as an IDS","year":"2006","author":"sen","key":"ref68"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04968-2_4"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2014.10.002"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-0140-8"},{"key":"ref20","first-page":"139","article-title":"BotMiner: Clustering analysis of network traffic for protocol-and structure-independent botnet detection","author":"gu","year":"2008","journal-title":"Proc 17th Conf Security Symp"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/1090191.1080118"},{"key":"ref21","first-page":"862","article-title":"A first look at HTTP (S) intrusion detection using NetFlow\/IPFIX","author":"toorn","year":"2015","journal-title":"Proc IFIP\/IEEE Int Symp Integr Netw Manag"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2015.05.019"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-012-1263-0"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CEC.2011.5949798"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2016.7472465"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.11"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2005.1532071"},{"key":"ref59","first-page":"1","article-title":"An integrated cyber security monitoring system using correlation-based techniques","author":"wu","year":"2009","journal-title":"Proc IEEE Int Conf Syst Syst Eng (SoSE)"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2014.2336610"},{"journal-title":"AEntropy Relative Entropy and Mutual Information Elements of Information Theory","year":"2012","author":"cover","key":"ref57"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2004.06.016"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2011.06.013"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/1851275.1851215"},{"key":"ref53","article-title":"Context-based intrusion detection using snort, nessus and bugtraq databases","author":"massicotte","year":"2005","journal-title":"Proc Int?l Conf Privacy Security and Trust (PST)"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/1314257.1314273"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2011.5720582"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3917"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SERE.2013.16"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5101"},{"key":"ref13","first-page":"39","article-title":"A DoS resilient flow-level intrusion detection approach for high-speed networks","author":"gao","year":"2006","journal-title":"Proc 26th IEEE Int Conf Distrib Comput Syst (ICDCS)"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/WETICE.2005.35"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2006.142"},{"key":"ref16","first-page":"1","article-title":"Flow-based worm detection using correlated honeypot logs","author":"dressler","year":"2007","journal-title":"Proc ITG-GI Conf Commun Distrib Syst (KiVS)"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74320-0_15"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2015.7140486"},{"key":"ref19","first-page":"7","article-title":"Wide-scale botnet detection and characterization","author":"karasaridis","year":"2007","journal-title":"Proceedings of the 1st Conference on Hot Topics in Understanding Botnets"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2015.7165965"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2010.032210.00054"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04989-7_13"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICSC.2014.29"},{"journal-title":"Compromised Web Servers to Build Ssh Brute Force Botnet","year":"2010","author":"constantin","key":"ref8"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45474-8_4"},{"key":"ref49","first-page":"381","article-title":"Efficient intrusion detection using principal component analysis","author":"bouzida","year":"2004","journal-title":"Proc 3rd Conf Security Netw Architect"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30633-4_13"},{"article-title":"A probabilistic-based framework for INFOSEC alert correlation","year":"2005","author":"qin","key":"ref46"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICHIT.2006.253599"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/IWIA.2005.3"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/KIMAS.2003.1245102"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/IFITA.2009.34"},{"key":"ref41","first-page":"18","article-title":"Intrusion detection systems using decision trees and support vector machines","volume":"2","author":"peddabachigari","year":"2004","journal-title":"Int J Appl Sci Comput"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2007.03.025"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1903"}],"container-title":["IEEE Transactions on Systems, Man, and Cybernetics: Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6221021\/8259030\/07562536.pdf?arnumber=7562536","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,7]],"date-time":"2022-07-07T22:06:09Z","timestamp":1657231569000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/7562536\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,2]]},"references-count":72,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tsmc.2016.2600405","relation":{},"ISSN":["2168-2216","2168-2232"],"issn-type":[{"type":"print","value":"2168-2216"},{"type":"electronic","value":"2168-2232"}],"subject":[],"published":{"date-parts":[[2018,2]]}}}