{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,15]],"date-time":"2026-06-15T01:56:46Z","timestamp":1781488606234,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":19,"publisher":"ACM","license":[{"start":{"date-parts":[[2008,10,20]],"date-time":"2008-10-20T00:00:00Z","timestamp":1224460800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2008,10,20]]},"DOI":"10.1145\/1452520.1452539","type":"proceedings-article","created":{"date-parts":[[2008,10,22]],"date-time":"2008-10-22T12:25:44Z","timestamp":1224678344000},"page":"151-156","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":225,"title":["An empirical evaluation of entropy-based traffic anomaly detection"],"prefix":"10.1145","author":[{"given":"George","family":"Nychis","sequence":"first","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Vyas","family":"Sekar","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David G.","family":"Andersen","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hyong","family":"Kim","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hui","family":"Zhang","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2008,10,20]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Snort. http:\/\/www.snort.org.  Snort. http:\/\/www.snort.org."},{"key":"e_1_3_2_1_2_1","unstructured":"Argus. http:\/\/qosient.com\/argus\/.  Argus. http:\/\/qosient.com\/argus\/."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637210"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177101"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2003.1194894"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2004.1301325"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080173.1080176"},{"key":"e_1_3_2_1_8_1","unstructured":"Kazaa. www.kazaa.com.  Kazaa. www.kazaa.com."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1005686.1005709"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080118"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/1140277.1140295"},{"key":"e_1_3_2_1_12_1","volume-title":"Proc. of IEEE Symposium on Security and Privacy","author":"Lee W.","year":"2001"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/1016978.1016980"},{"key":"e_1_3_2_1_14_1","unstructured":"Cisco Netflow. http:\/\/www.cisco.com\/warp\/public\/732\/Tech\/nmp\/netflow\/index.shtml.  Cisco Netflow. http:\/\/www.cisco.com\/warp\/public\/732\/Tech\/nmp\/netflow\/index.shtml."},{"key":"e_1_3_2_1_16_1","first-page":"3176","author":"Phaal P.","year":"2001","journal-title":"RFC"},{"key":"e_1_3_2_1_17_1","first-page":"5103","author":"Trammell B.","year":"2008","journal-title":"RFC"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/WETICE.2005.35"},{"key":"e_1_3_2_1_19_1","volume-title":"Proc. of IEEE ICNP","author":"Xu J.","year":"2002"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080112"}],"event":{"name":"IMC08: Internet Measurement Conference","location":"Vouliagmeni Greece","acronym":"IMC08","sponsor":["SIGMETRICS ACM Special Interest Group on Measurement and Evaluation","SIGCOMM ACM Special Interest Group on Data Communication","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the 8th ACM SIGCOMM conference on Internet measurement"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1452520.1452539","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1452520.1452539","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:56:34Z","timestamp":1750254994000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1452520.1452539"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,10,20]]},"references-count":19,"alternative-id":["10.1145\/1452520.1452539","10.1145\/1452520"],"URL":"https:\/\/doi.org\/10.1145\/1452520.1452539","relation":{},"subject":[],"published":{"date-parts":[[2008,10,20]]},"assertion":[{"value":"2008-10-20","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}