{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T17:46:43Z","timestamp":1793123203087,"version":"4.5.0"},"publisher-location":"New York, NY, USA","reference-count":35,"publisher":"ACM","license":[{"start":{"date-parts":[[2005,8,22]],"date-time":"2005-08-22T00:00:00Z","timestamp":1124668800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2005,8,22]]},"DOI":"10.1145\/1080091.1080118","type":"proceedings-article","created":{"date-parts":[[2005,11,7]],"date-time":"2005-11-07T12:34:39Z","timestamp":1131366879000},"page":"217-228","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":409,"title":["Mining anomalies using traffic feature distributions"],"prefix":"10.1145","author":[{"given":"Anukool","family":"Lakhina","sequence":"first","affiliation":[{"name":"Boston University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mark","family":"Crovella","sequence":"additional","affiliation":[{"name":"Boston University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christophe","family":"Diot","sequence":"additional","affiliation":[{"name":"Intel Research, Cambridge, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2005,8,22]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Abilene Network Operations Center Weekly Reports. At http:\/\/www.abilene.iu.edu\/routages.cgi.]]  Abilene Network Operations Center Weekly Reports. At http:\/\/www.abilene.iu.edu\/routages.cgi.]]"},{"key":"e_1_3_2_1_2_1","unstructured":"Arbor Networks. At http:\/\/www.arbornetworks.com\/.]]  Arbor Networks. At http:\/\/www.arbornetworks.com\/.]]"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637210"},{"key":"e_1_3_2_1_4_1","volume-title":"USENIX LISA","author":"Brutlag J.","year":"2000","unstructured":"J. Brutlag . Aberrant behavior detection in timeseries for network monitoring . In USENIX LISA , New Orleans , December 2000 .]] J. Brutlag. Aberrant behavior detection in timeseries for network monitoring. In USENIX LISA, New Orleans, December 2000.]]"},{"key":"e_1_3_2_1_5_1","unstructured":"Cisco NetFlow. At www.cisco.com\/warp\/public\/732\/Tech\/netflow\/.]]  Cisco NetFlow. At www.cisco.com\/warp\/public\/732\/Tech\/netflow\/.]]"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"key":"e_1_3_2_1_7_1","author":"Dunia R.","year":"1998","unstructured":"R. Dunia and S. J. Qin . A subspace approach to multidimensional fault identification and reconstruction. American Institute of Chemical Engineers (AIChE) Journal, pages 1813--1831 , 1998 .]] R. Dunia and S. J. Qin. A subspace approach to multidimensional fault identification and reconstruction. American Institute of Chemical Engineers (AIChE) Journal, pages 1813--1831, 1998.]]","journal-title":"American Institute of Chemical Engineers (AIChE) Journal, pages 1813--1831"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/863955.863972"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2003.1194894"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/90.929850"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/863955.863968"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/511446.511485"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1080\/00401706.1979.10489779"},{"key":"e_1_3_2_1_14_1","volume-title":"Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy","author":"Jung J.","year":"2004","unstructured":"J. Jung , V. Paxson , A. Berger , and H. Balakrishnan . Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy , May 2004 .]] J. Jung, V. Paxson, A. Berger, and H. Balakrishnan. Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy, May 2004.]]"},{"key":"e_1_3_2_1_15_1","unstructured":"Juniper Traffic Sampling. At www.juniper.net\/techpubs\/software\/junos\/junos60\/swconfig60-policy\/html\/sampling-overview.html.]]  Juniper Traffic Sampling. At www.juniper.net\/techpubs\/software\/junos\/junos60\/swconfig60-policy\/html\/sampling-overview.html.]]"},{"key":"e_1_3_2_1_16_1","first-page":"105","volume-title":"Towards a standardized notation and terminology in multiway analysis. J. of Chemometrics","author":"Kiers H. A. L.","year":"2000","unstructured":"H. A. L. Kiers . Towards a standardized notation and terminology in multiway analysis. J. of Chemometrics , pages 105 -- 122 , 2000 .]] H. A. L. Kiers. Towards a standardized notation and terminology in multiway analysis. J. of Chemometrics, pages 105--122, 2000.]]"},{"key":"e_1_3_2_1_17_1","volume-title":"Distributed Worm Signature Detection. In Usenix Security Symposium","author":"Kim H.-A.","year":"2004","unstructured":"H.-A. Kim and B. Karp . Autograph: Toward Automated , Distributed Worm Signature Detection. In Usenix Security Symposium , San Diego , August 2004 .]] H.-A. Kim and B. Karp. Autograph: Toward Automated, Distributed Worm Signature Detection. In Usenix Security Symposium, San Diego, August 2004.]]"},{"key":"e_1_3_2_1_18_1","volume-title":"IEEE\/IFIP Network Operations and Management Symposium","author":"Kim M.-S.","year":"2004","unstructured":"M.-S. Kim , H.-J. Kang , S.-C. Hung , S.-H. Chung , and J. W. Hong . A Flow-based Method for Abnormal Network Traffic Detection . In IEEE\/IFIP Network Operations and Management Symposium , Seoul , April 2004 .]] M.-S. Kim, H.-J. Kang, S.-C. Hung, S.-H. Chung, and J. W. Hong. A Flow-based Method for Abnormal Network Traffic Detection. In IEEE\/IFIP Network Operations and Management Symposium, Seoul, April 2004.]]"},{"key":"e_1_3_2_1_19_1","volume-title":"IEEE INFOCOM","author":"Kim S.","year":"2005","unstructured":"S. Kim and A. L. N. Reddy . A Study of Analyzing Network Traffic as Images in Real-Time . In IEEE INFOCOM , 2005 .]] S. Kim and A. L. N. Reddy. A Study of Analyzing Network Traffic as Images in Real-Time. In IEEE INFOCOM, 2005.]]"},{"key":"e_1_3_2_1_20_1","volume-title":"Networking","author":"Kim S.","year":"2004","unstructured":"S. Kim , A. L. N. Reddy , and M. Vannucci . Detecting Traffic Anomalies through Aggregate Analysis of Packet Header Data . In Networking , 2004 .]] S. Kim, A. L. N. Reddy, and M. Vannucci. Detecting Traffic Anomalies through Aggregate Analysis of Packet Header Data. In Networking, 2004.]]"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637242"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028813"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1015467.1015492"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1012888.1005697"},{"key":"e_1_3_2_1_26_1","volume-title":"Information-Theoretic Measures for Anomaly Detection. In IEEE Symposium on Security and Privacy","author":"Lee W.","year":"2001","unstructured":"W. Lee and D. Xiang . Information-Theoretic Measures for Anomaly Detection. In IEEE Symposium on Security and Privacy , Oakland, CA , May 2001 .]] W. Lee and D. Xiang. Information-Theoretic Measures for Anomaly Detection. In IEEE Symposium on Security and Privacy, Oakland, CA, May 2001.]]"},{"key":"e_1_3_2_1_27_1","unstructured":"Pathdiag: Network Path Diagnostic Tools. At http:\/\/www.psc.edu\/~web100\/pathdiag\/.]]  Pathdiag: Network Path Diagnostic Tools. At http:\/\/www.psc.edu\/~web100\/pathdiag\/.]]"},{"key":"e_1_3_2_1_28_1","volume-title":"Applications and Systems. In ICDE Tutorial","author":"Pei J.","year":"2004","unstructured":"J. Pei , S. J. Upadhyaya , F. Farooq , and V. Govindaraju . Data Mining for Intrusion Detection - Techniques , Applications and Systems. In ICDE Tutorial , 2004 .]] J. Pei, S. J. Upadhyaya, F. Farooq, and V. Govindaraju. Data Mining for Intrusion Detection - Techniques, Applications and Systems. In ICDE Tutorial, 2004.]]"},{"key":"e_1_3_2_1_29_1","unstructured":"Riverhead Networks. At http:\/\/www.riverhead.com\/.]]  Riverhead Networks. At http:\/\/www.riverhead.com\/.]]"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1005686.1005745"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/505202.505215"},{"key":"e_1_3_2_1_32_1","volume-title":"Fast Detection of Scanning Worm Infections. In Seventh International Symposium on Recent Advances in Intrusion Detection (RAID)","author":"Schechter S.","year":"2004","unstructured":"S. Schechter , J. Jung , and A. Berger . Fast Detection of Scanning Worm Infections. In Seventh International Symposium on Recent Advances in Intrusion Detection (RAID) , Sophia Antipolois, France , September 2004 .]] S. Schechter, J. Jung, and A. Berger. Fast Detection of Scanning Worm Infections. In Seventh International Symposium on Recent Advances in Intrusion Detection (RAID), Sophia Antipolois, France, September 2004.]]"},{"key":"e_1_3_2_1_33_1","unstructured":"SLAC Internet End-to-end Performance Monitoring (IEPM-BW project). At http:\/\/www-iepm.slac.stanford.edu\/bw\/.]]  SLAC Internet End-to-end Performance Monitoring (IEPM-BW project). At http:\/\/www-iepm.slac.stanford.edu\/bw\/.]]"},{"key":"e_1_3_2_1_34_1","author":"Thottan M.","year":"2003","unstructured":"M. Thottan and C. Ji . Anomaly Detection in IP Networks. IEEE Trans. Signal Processing (Special issue of Signal Processing in Networking), pages 2191--2204 , August 2003 .]] M. Thottan and C. Ji. Anomaly Detection in IP Networks. IEEE Trans. Signal Processing (Special issue of Signal Processing in Networking), pages 2191--2204, August 2003.]]","journal-title":"Anomaly Detection in IP Networks. IEEE Trans. Signal Processing (Special issue of Signal Processing in Networking), pages 2191--2204"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080112"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028802"}],"event":{"name":"SIGCOMM05: ACM SIGCOMM 2005 Conference","location":"Philadelphia Pennsylvania USA","acronym":"SIGCOMM05","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1080091.1080118","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1080091.1080118","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T12:08:26Z","timestamp":1750248506000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1080091.1080118"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2005,8,22]]},"references-count":35,"alternative-id":["10.1145\/1080091.1080118","10.1145\/1080091"],"URL":"https:\/\/doi.org\/10.1145\/1080091.1080118","relation":{"is-identical-to":[{"id-type":"doi","id":"10.1145\/1090191.1080118","asserted-by":"object"}]},"subject":[],"published":{"date-parts":[[2005,8,22]]},"assertion":[{"value":"2005-08-22","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}