{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T21:56:55Z","timestamp":1775080615803,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":25,"publisher":"ACM","license":[{"start":{"date-parts":[[2015,3,4]],"date-time":"2015-03-04T00:00:00Z","timestamp":1425427200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CAREER CNS-0953638"],"award-info":[{"award-number":["CAREER CNS-0953638"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000183","name":"Army Research Office","doi-asserted-by":"publisher","award":["YIP W911NF-14-1-0535"],"award-info":[{"award-number":["YIP W911NF-14-1-0535"]}],"id":[{"id":"10.13039\/100000183","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2015,3,4]]},"DOI":"10.1145\/2713579.2713583","type":"proceedings-article","created":{"date-parts":[[2015,2,23]],"date-time":"2015-02-23T16:02:15Z","timestamp":1424707335000},"page":"37-42","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":21,"title":["Visualizing Traffic Causality for Analyzing Network Anomalies"],"prefix":"10.1145","author":[{"given":"Hao","family":"Zhang","sequence":"first","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}]},{"given":"Maoyuan","family":"Sun","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}]},{"given":"Danfeng (Daphne)","family":"Yao","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}]},{"given":"Chris","family":"North","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}]}],"member":"320","published-online":{"date-parts":[[2015,3,4]]},"reference":[{"key":"e_1_3_2_1_1_1","first-page":"95","volume-title":"ITC'11","author":"Asai H.","year":"2011","unstructured":"H. Asai , K. Fukuda , and H. Esaki . Traffic Causality Graphs: Profiling network applications through temporal and spatial causality of ows . In ITC'11 , pages 95 -- 102 , 2011 . H. Asai, K. Fukuda, and H. Esaki. Traffic Causality Graphs: Profiling network applications through temporal and spatial causality of ows. In ITC'11, pages 95--102, 2011."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850805"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016905"},{"key":"e_1_3_2_1_4_1","first-page":"117","volume-title":"OSDI'08","author":"Chen X.","unstructured":"X. Chen , M. Zhang , Z. M. Mao , and P. Bahl . Automating network application dependency discovery: Experiences, limitations, and new solutions . In OSDI'08 , pages 117 -- 130 . X. Chen, M. Zhang, Z. M. Mao, and P. Bahl. Automating network application dependency discovery: Experiences, limitations, and new solutions. In OSDI'08, pages 117--130."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2006.30"},{"key":"e_1_3_2_1_6_1","unstructured":"D3.js: a JavaScript library to display given digital data into graphic dynamic forms. http:\/\/d3js.org.  D3.js: a JavaScript library to display given digital data into graphic dynamic forms. http:\/\/d3js.org."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2005.18"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2009.5270349"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2009.5375543"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1298306.1298349"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2006.261438"},{"key":"e_1_3_2_1_12_1","volume-title":"NDSS'05","author":"King S. T.","year":"2005","unstructured":"S. T. King , Z. M. Mao , D. G. Lucchetti , and P. M. Chen . Enriching intrusion alerts through multi-host causality . In NDSS'05 , 2005 . S. T. King, Z. M. Mao, D. G. Lucchetti, and P. M. Chen. Enriching intrusion alerts through multi-host causality. In NDSS'05, 2005."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029232"},{"key":"e_1_3_2_1_14_1","first-page":"143","volume-title":"NSDI'10","author":"Li Z.","year":"2010","unstructured":"Z. Li , M. Zhang , Z. Zhu , Y. Chen , A. G. Greenberg , and Y.-M. Wang . WebProphet : Automating performance prediction for web services . In NSDI'10 , pages 143 -- 158 , 2010 . Z. Li, M. Zhang, Z. Zhu, Y. Chen, A. G. Greenberg, and Y.-M. Wang. WebProphet: Automating performance prediction for web services. In NSDI'10, pages 143--158, 2010."},{"key":"e_1_3_2_1_15_1","unstructured":"Malware domain list. http:\/\/www.malwaredomainlist.com.  Malware domain list. http:\/\/www.malwaredomainlist.com."},{"key":"e_1_3_2_1_16_1","unstructured":"Suspicious domains from SANS institute. https:\/\/isc.sans.edu\/suspicious_domains.html.  Suspicious domains from SANS institute. https:\/\/isc.sans.edu\/suspicious_domains.html."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2011.144"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/2495253.2495528"},{"key":"e_1_3_2_1_19_1","first-page":"1","volume-title":"IFIP Networking Conference","author":"Xie G.","year":"2013","unstructured":"G. Xie , M. Iliofotou , T. Karagiannis , M. Faloutsos , and Y. Jin . ReSurf: Reconstructing web-surfing activity from network traffic . In IFIP Networking Conference , pages 1 -- 9 , 2013 . G. Xie, M. Iliofotou, T. Karagiannis, M. Faloutsos, and Y. Jin. ReSurf: Reconstructing web-surfing activity from network traffic. In IFIP Networking Conference, pages 1--9, 2013."},{"key":"e_1_3_2_1_20_1","first-page":"57","volume-title":"NSS'11","author":"Xu K.","unstructured":"K. Xu , D. Yao , Q. Ma , and A. Crowell . Detecting infection onset with behavior-based policies . In NSS'11 , pages 57 -- 64 . K. Xu, D. Yao, Q. Ma, and A. Crowell. Detecting infection onset with behavior-based policies. In NSS'11, pages 57--64."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2435349.2435366"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1363686.1363976"},{"key":"e_1_3_2_1_23_1","unstructured":"ZeuS tracker domain blocklist. https:\/\/zeustracker.abuse.ch\/blocklist.php.  ZeuS tracker domain blocklist. https:\/\/zeustracker.abuse.ch\/blocklist.php."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2012.15"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2590296.2590309"}],"event":{"name":"CODASPY'15: Fifth ACM Conference on Data and Application Security and Privacy","location":"San Antonio Texas USA","acronym":"CODASPY'15","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2015 ACM International Workshop on International Workshop on Security and Privacy Analytics"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2713579.2713583","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2713579.2713583","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T19:04:23Z","timestamp":1750273463000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2713579.2713583"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,3,4]]},"references-count":25,"alternative-id":["10.1145\/2713579.2713583","10.1145\/2713579"],"URL":"https:\/\/doi.org\/10.1145\/2713579.2713583","relation":{},"subject":[],"published":{"date-parts":[[2015,3,4]]},"assertion":[{"value":"2015-03-04","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}