{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,15]],"date-time":"2026-09-15T02:20:21Z","timestamp":1789438821767,"version":"build-2803163510"},"reference-count":37,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2016,9,20]],"date-time":"2016-09-20T00:00:00Z","timestamp":1474329600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"U.S. NSF CAREER","award":["CNS-0844983"],"award-info":[{"award-number":["CNS-0844983"]}]},{"name":"NSF of China research","award":["61328203"],"award-info":[{"award-number":["61328203"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Auton. Adapt. Syst."],"published-print":{"date-parts":[[2016,9,20]]},"abstract":"<jats:p>\n            Traditional network anomaly detection involves developing models that rely on packet inspection. However, increasing network speeds and use of encrypted protocols make per-packet inspection unsuited for today\u2019s networks. One method of overcoming this obstacle is aggregating packet header information and performing flow-based analysis where data flow patterns are examined rather than deep packet inspection. Many existing approaches are special purpose limited to detecting specific behavior. Also, the data reduction inherent in identifying anomalous flows hinders alert correlation. In this article, we propose and develop a dynamic anomaly detection approach for augmented network flows. We sketch network state during flow creation, enabling general-purpose threat detection. We describe an efficient flow augmentation approach based on the count-min sketch that provides per-flow-, per-node-, and per-network-level statistics parallel to flow record generation. We design and develop a support vector machine-based adaptive anomaly detection and correlation mechanism, which is capable of aggregating alerts without\n            <jats:italic>a priori<\/jats:italic>\n            alert classification and evolving models online. We further develop a lightweight evolving alert aggregation method and combine it with a confidence forwarding mechanism identifying a small percentage predictions for additional processing. We show effectiveness of our methods on both enterprise and backbone traces. Experimental results demonstrate its ability to maintain high accuracy without the need for offline training.\n          <\/jats:p>","DOI":"10.1145\/2934686","type":"journal-article","created":{"date-parts":[[2016,9,21]],"date-time":"2016-09-21T12:42:46Z","timestamp":1474461766000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":9,"title":["Online Adaptive Anomaly Detection for Augmented Network Flows"],"prefix":"10.1145","volume":"11","author":[{"given":"Dennis","family":"Ippoliti","sequence":"first","affiliation":[{"name":"University of Colorado, Colorado Springs, CO, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Changjun","family":"Jiang","sequence":"additional","affiliation":[{"name":"Tongji University, China, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhijun","family":"Ding","sequence":"additional","affiliation":[{"name":"Tongji University, China, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaobo","family":"Zhou","sequence":"additional","affiliation":[{"name":"University of Colorado, Colorado Springs, Austin Bluffs Pkwy, CO"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2016,9,20]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"2014. LBNL\/ICSI Enterprise Tracing Project. Retrieved from http:\/\/www.icir.org\/enterprise-tracing\/.  2014. LBNL\/ICSI Enterprise Tracing Project. Retrieved from http:\/\/www.icir.org\/enterprise-tracing\/."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2012.2187306"},{"key":"e_1_2_1_3_1","volume-title":"Proc. of IEEE Global Telecommunications Conference (GLOBECOM).","author":"Cascarano N.","unstructured":"N. Cascarano , A. Este , F. Gringoli , F. Risso , and L. Salgarelli . 2009. An experimental evaluation of the computational cost of a DPI traffic classifier . In Proc. of IEEE Global Telecommunications Conference (GLOBECOM). N. Cascarano, A. Este, F. Gringoli, F. Risso, and L. Salgarelli. 2009. An experimental evaluation of the computational cost of a DPI traffic classifier. In Proc. of IEEE Global Telecommunications Conference (GLOBECOM)."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"e_1_2_1_5_1","volume-title":"Proc. USENIX Annual Technical Conference (ATC).","author":"Cho K.","unstructured":"K. Cho , K. Mitsuya , and A. Kato . 2000. Traffic data repository at the WIDE project . In Proc. USENIX Annual Technical Conference (ATC). K. Cho, K. Mitsuya, and A. Kato. 2000. Traffic data repository at the WIDE project. In Proc. USENIX Annual Technical Conference (ATC)."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.8"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jalgor.2003.12.001"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.5555\/645839.670735"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1352664.1352675"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1982185.1982290"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2006.164"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2006.6"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2009.36"},{"key":"e_1_2_1_14_1","volume-title":"Proc. of IEEE International Conference on Computer Communications and Networks (ICCCN).","author":"Ippoliti D.","unstructured":"D. Ippoliti and X. Zhou . 2010. An adaptive growing hierarchical self organizing map for network intrusion detection . In Proc. of IEEE International Conference on Computer Communications and Networks (ICCCN). D. Ippoliti and X. Zhou. 2010. An adaptive growing hierarchical self organizing map for network intrusion detection. In Proc. of IEEE International Conference on Computer Communications and Networks (ICCCN)."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2012.09.004"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/MASCOTS.2014.60"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2010.07.032"},{"key":"e_1_2_1_18_1","volume-title":"Proc. of International Symposium on Neural Networks (ISNN).","author":"Ji Z.","unstructured":"Z. Ji , W. Y. Yang , S. Wu , and B. L. Lu . 2008. Encoding human knowledge for visual pattern recognition . In Proc. of International Symposium on Neural Networks (ISNN). Z. Ji, W. Y. Yang, S. Wu, and B. L. Lu. 2008. Encoding human knowledge for visual pattern recognition. In Proc. of International Symposium on Neural Networks (ISNN)."},{"key":"e_1_2_1_19_1","volume-title":"Proc. of IEEE Global Telecommunications Conference (GLOBECOM).","author":"Kanda Y.","unstructured":"Y. Kanda , K. Fukuda , and T. Sugawara . 2010. Evaluation of anomaly detection based on sketch and PCA . In Proc. of IEEE Global Telecommunications Conference (GLOBECOM). Y. Kanda, K. Fukuda, and T. Sugawara. 2010. Evaluation of anomaly detection based on sketch and PCA. In Proc. of IEEE Global Telecommunications Conference (GLOBECOM)."},{"key":"e_1_2_1_20_1","volume-title":"Proc. of IEEE\/IFIP Network Operations and Management Symposium (NOMS).","author":"Kim M. S.","unstructured":"M. S. Kim , H. J. Kong , S. C. Hong , S. H. Chung , and J. Hong . 2004. A flow-based method for abnormal network traffic detection . In Proc. of IEEE\/IFIP Network Operations and Management Symposium (NOMS). M. S. Kim, H. J. Kong, S. C. Hong, S. H. Chung, and J. Hong. 2004. A flow-based method for abnormal network traffic detection. In Proc. of IEEE\/IFIP Network Operations and Management Symposium (NOMS)."},{"key":"e_1_2_1_21_1","volume-title":"Proc. of International Conference Applied Cryptography and Network Security (ACNS).","author":"Lai H.","unstructured":"H. Lai , S. Cai , H. Huang , J. Xie , and H. Li . 2004. A parallel intrusion detection system for high-speed networks . In Proc. of International Conference Applied Cryptography and Network Security (ACNS). H. Lai, S. Cai, H. Huang, J. Xie, and H. Li. 2004. A parallel intrusion detection system for high-speed networks. In Proc. of International Conference Applied Cryptography and Network Security (ACNS)."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1090191.1080118"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177099"},{"key":"e_1_2_1_24_1","volume-title":"Proc. of International Joint Conference on Neural Networks (IJCNN).","author":"Nischenko I.","unstructured":"I. Nischenko and E. M. Jordaan . 2006. Confidence of SVM predictions using a strangeness measure . In Proc. of International Joint Conference on Neural Networks (IJCNN). I. Nischenko and E. M. Jordaan. 2006. Confidence of SVM predictions using a strangeness measure. In Proc. of International Joint Conference on Neural Networks (IJCNN)."},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2008.11.011"},{"key":"e_1_2_1_26_1","volume-title":"Fast Training of Support Vector Machines using Sequential Minimal Optimization. B. Advances in Kernel Methods - Support Vector Learning","author":"Platt J.","unstructured":"J. Platt . 1998. Fast Training of Support Vector Machines using Sequential Minimal Optimization. B. Advances in Kernel Methods - Support Vector Learning , MIT Press . J. Platt. 1998. Fast Training of Support Vector Machines using Sequential Minimal Optimization. B. Advances in Kernel Methods - Support Vector Learning, MIT Press."},{"key":"e_1_2_1_27_1","volume-title":"Probabilistic Outputs for Support Vector Machines and Comparisons to Regularized Likelihood Methods. Advances in Large Margin Classifiers","author":"Platt J.","unstructured":"J. Platt . 1999. Probabilistic Outputs for Support Vector Machines and Comparisons to Regularized Likelihood Methods. Advances in Large Margin Classifiers , MIT Press . J. Platt. 1999. Probabilistic Outputs for Support Vector Machines and Comparisons to Regularized Likelihood Methods. Advances in Large Margin Classifiers, MIT Press."},{"key":"e_1_2_1_29_1","unstructured":"B. Scholkopf J. Platt J. Shawe-Taylor A. J. Smola and R. C. Williamson. 1999. Estimating the support of a high-dimensional distribution. In Technical Report Microsoft Research Redmond.  B. Scholkopf J. Platt J. Shawe-Taylor A. J. Smola and R. C. Williamson. 1999. Estimating the support of a high-dimensional distribution. In Technical Report Microsoft Research Redmond."},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2004.21"},{"key":"e_1_2_1_31_1","volume-title":"Proc. of International Symposium on Recent Advances in Intrusion Detection (RAID).","author":"Wang K.","unstructured":"K. Wang and S. Stolfo . 2004. Anomalous payload-based network intrusion detection . In Proc. of International Symposium on Recent Advances in Intrusion Detection (RAID). K. Wang and S. Stolfo. 2004. Anomalous payload-based network intrusion detection. In Proc. of International Symposium on Recent Advances in Intrusion Detection (RAID)."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/78922.78925"},{"key":"e_1_2_1_33_1","volume-title":"Proc. of Network and Distributed System Security Symposium (NDSS).","author":"White A.","unstructured":"A. White , S. Krishnan , M. Bailey , F. Monrose , and P. Parros . 2013. Clear and present data: Opaque traffic and its security implications for the future . In Proc. of Network and Distributed System Security Symposium (NDSS). A. White, S. Krishnan, M. Bailey, F. Monrose, and P. Parros. 2013. Clear and present data: Opaque traffic and its security implications for the future. In Proc. of Network and Distributed System Security Symposium (NDSS)."},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/1380422.1380425"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1636665.1636670"},{"key":"e_1_2_1_36_1","volume-title":"Proc. of IFIP International Information Security and Privacy Conference (SEC).","author":"Zhao D.","unstructured":"D. Zhao , I. Traore , A. Ghorbani , B. Sayed , S. Saad , and W. Lu . 2012. Peer-to-peer botnet detection based on flow intervals . In Proc. of IFIP International Information Security and Privacy Conference (SEC). D. Zhao, I. Traore, A. Ghorbani, B. Sayed, S. Saad, and W. Lu. 2012. Peer-to-peer botnet detection based on flow intervals. In Proc. of IFIP International Information Security and Privacy Conference (SEC)."},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2006.877139"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2010.07.032"}],"container-title":["ACM Transactions on Autonomous and Adaptive Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2934686","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2934686","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:39:47Z","timestamp":1750217987000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2934686"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,9,20]]},"references-count":37,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2016,9,20]]}},"alternative-id":["10.1145\/2934686"],"URL":"https:\/\/doi.org\/10.1145\/2934686","relation":{},"ISSN":["1556-4665","1556-4703"],"issn-type":[{"value":"1556-4665","type":"print"},{"value":"1556-4703","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,9,20]]},"assertion":[{"value":"2015-02-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2016-05-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2016-09-20","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}