{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,25]],"date-time":"2026-10-25T20:25:42Z","timestamp":1792959942425,"version":"4.5.0"},"publisher-location":"New York, NY, USA","reference-count":40,"publisher":"ACM","license":[{"start":{"date-parts":[[2017,8,13]],"date-time":"2017-08-13T00:00:00Z","timestamp":1502582400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2017,8,13]]},"DOI":"10.1145\/3097983.3098163","type":"proceedings-article","created":{"date-parts":[[2017,8,4]],"date-time":"2017-08-04T14:35:54Z","timestamp":1501857354000},"page":"1723-1732","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":278,"title":["Machine Learning for Encrypted Malware Traffic Classification"],"prefix":"10.1145","author":[{"given":"Blake","family":"Anderson","sequence":"first","affiliation":[{"name":"Cisco Systems, Inc., San Jose, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"McGrew","sequence":"additional","affiliation":[{"name":"Cisco Systems, Inc., San Jose, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2017,8,13]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Identifying Encrypted Malware Traffic with Contextual Flow Data ACM Workshop on Artificial Intelligence and Security (AISec). 35--46","author":"Anderson Blake","year":"2016","unstructured":"Blake Anderson and David McGrew 2016 . Identifying Encrypted Malware Traffic with Contextual Flow Data ACM Workshop on Artificial Intelligence and Security (AISec). 35--46 . Blake Anderson and David McGrew 2016. Identifying Encrypted Malware Traffic with Contextual Flow Data ACM Workshop on Artificial Intelligence and Security (AISec). 35--46."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Blake Anderson Subharthi Paul and David McGrew. 2016. Deciphering Malware's Use of TLS (without Decryption) ArXiv e-prints.  Blake Anderson Subharthi Paul and David McGrew. 2016. Deciphering Malware's Use of TLS (without Decryption) ArXiv e-prints.","DOI":"10.1007\/s11416-017-0306-6"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"crossref","unstructured":"Mike Belshe Roberto Peon and Martin Thomson. 2015. Hypertext Transfer Protocol Version 2 (HTTP\/2). RFC 7540 (Proposed Standard). (2015). showURL%http:\/\/www.ietf.org\/rfc\/rfc7540.txt  Mike Belshe Roberto Peon and Martin Thomson. 2015. Hypertext Transfer Protocol Version 2 (HTTP\/2). RFC 7540 (Proposed Standard). (2015). showURL%http:\/\/www.ietf.org\/rfc\/rfc7540.txt","DOI":"10.17487\/RFC7540"},{"key":"e_1_3_2_1_4_1","volume-title":"Support Vector Machines Under Adversarial Label Noise Asian Conference on Machine Learning. 97--112","author":"Biggio Battista","year":"2011","unstructured":"Battista Biggio , Blaine Nelson , and Pavel Laskov . 2011 . Support Vector Machines Under Adversarial Label Noise Asian Conference on Machine Learning. 97--112 . Battista Biggio, Blaine Nelson, and Pavel Laskov. 2011. Support Vector Machines Under Adversarial Label Noise Asian Conference on Machine Learning. 97--112."},{"key":"e_1_3_2_1_5_1","unstructured":"Battista Biggio Blaine Nelson and Pavel Laskov. 2012. Poisoning Attacks against Support Vector Machines International Conference on Machine Learning (ICML). 1807--1814.  Battista Biggio Blaine Nelson and Pavel Laskov. 2012. Poisoning Attacks against Support Vector Machines International Conference on Machine Learning (ICML). 1807--1814."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420969"},{"key":"e_1_3_2_1_7_1","first-page":"1","article-title":"Pattern Recognition","volume":"128","author":"Bishop Christopher","year":"2006","unstructured":"Christopher Bishop . 2006 . Pattern Recognition . Machine Learning Vol. 128 (2006), 1 -- 58 . Christopher Bishop. 2006. Pattern Recognition. Machine Learning Vol. 128 (2006), 1--58.","journal-title":"Machine Learning"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"crossref","unstructured":"Simon Blake-Wilson Nelson Bolyard Vipul Gupta Chris Hawk and Bodo Moeller 2006. Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS). RFC 4492 (Informational). (2006). showURL%http:\/\/www.ietf.org\/rfc\/rfc4492.txt  Simon Blake-Wilson Nelson Bolyard Vipul Gupta Chris Hawk and Bodo Moeller 2006. Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS). RFC 4492 (Informational). (2006). showURL%http:\/\/www.ietf.org\/rfc\/rfc4492.txt","DOI":"10.17487\/rfc4492"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_3_2_1_10_1","volume-title":"Classification and Regression Trees","author":"Breiman Leo","unstructured":"Leo Breiman , Jerome Friedman , Charles J Stone , and Richard A Olshen 1984. Classification and Regression Trees . CRC press . Leo Breiman, Jerome Friedman, Charles J Stone, and Richard A Olshen 1984. Classification and Regression Trees. CRC press."},{"key":"e_1_3_2_1_11_1","volume-title":"Finding Hidden Threats by Decrypting SSL","author":"Butler J Michael","year":"2013","unstructured":"J Michael Butler . 2013. Finding Hidden Threats by Decrypting SSL . SANS Institute ( 2013 ). J Michael Butler. 2013. Finding Hidden Threats by Decrypting SSL. SANS Institute (2013)."},{"key":"e_1_3_2_1_12_1","volume-title":"showURL%https:\/\/github.com\/fchollet\/kerasshownoteAccessed: 2017-04--19","author":"Chollet Franccois","year":"2017","unstructured":"Franccois Chollet . 2017. Keras. ( 2017 ). showURL%https:\/\/github.com\/fchollet\/kerasshownoteAccessed: 2017-04--19 . Franccois Chollet. 2017. Keras. (2017). showURL%https:\/\/github.com\/fchollet\/kerasshownoteAccessed: 2017-04--19."},{"key":"e_1_3_2_1_13_1","unstructured":"Cisco Talos. 2017. IP Blacklist Feed. (2017). showURL%http:\/\/www.talosintel.com\/feeds\/ip-filter.blfshownoteAccessed: 2017-04--19.  Cisco Talos. 2017. IP Blacklist Feed. (2017). showURL%http:\/\/www.talosintel.com\/feeds\/ip-filter.blfshownoteAccessed: 2017-04--19."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"crossref","unstructured":"Benoit Claise. 2004. Cisco Systems NetFlow Services Export Version 9. RFC 3954 (Informational). (2004). showURL%http:\/\/www.ietf.org\/rfc\/rfc3954.txt  Benoit Claise. 2004. Cisco Systems NetFlow Services Export Version 9. RFC 3954 (Informational). (2004). showURL%http:\/\/www.ietf.org\/rfc\/rfc3954.txt","DOI":"10.17487\/rfc3954"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"crossref","unstructured":"Benoit Claise Brian Trammell and Paul Aitken. 2013. Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. RFC 7011 (Proposed Standard). (2013). showURL%http:\/\/www.ietf.org\/rfc\/rfc7011.txt  Benoit Claise Brian Trammell and Paul Aitken. 2013. Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. RFC 7011 (Proposed Standard). (2013). showURL%http:\/\/www.ietf.org\/rfc\/rfc7011.txt","DOI":"10.17487\/rfc7012"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF00994018"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"issue":"2","key":"e_1_3_2_1_18_1","first-page":"5246","volume":"1","author":"Dierks Tim","year":"2008","unstructured":"Tim Dierks and Eric Rescorla 2008 . The Transport Layer Security (TLS) Protocol Version 1 . 2 . RFC 5246 (Proposed Standard). (2008). showURL%http:\/\/www.ietf.org\/rfc\/rfc5246.txt Tim Dierks and Eric Rescorla 2008. The Transport Layer Security (TLS) Protocol Version 1.2. RFC 5246 (Proposed Standard). (2008). showURL%http:\/\/www.ietf.org\/rfc\/rfc5246.txt","journal-title":"The Transport Layer Security (TLS) Protocol Version"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2347736.2347755"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/34.589207"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.5555\/1390681.1442794"},{"key":"e_1_3_2_1_22_1","volume-title":"The Elements of Statistical Learning","author":"Friedman Jerome","unstructured":"Jerome Friedman , Trevor Hastie , and Robert Tibshirani . 2001. The Elements of Statistical Learning . Springer . Jerome Friedman, Trevor Hastie, and Robert Tibshirani. 2001. The Elements of Statistical Learning. Springer."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.18637\/jss.v033.i01"},{"key":"e_1_3_2_1_24_1","volume-title":"BotMiner: Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection. USENIX Security Symposium. 139--154","author":"Gu Guofei","year":"2008","unstructured":"Guofei Gu , Roberto Perdisci , Junjie Zhang , and Wenke Lee 2008 . BotMiner: Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection. USENIX Security Symposium. 139--154 . Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee 2008. BotMiner: Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection. USENIX Security Symposium. 139--154."},{"key":"e_1_3_2_1_25_1","unstructured":"Matt Harrigan. 2016. Machine Learning is not the Answer to Better Network Security. (2016). showURL%https:\/\/techcrunch.com\/2016\/02\/29\/machine-learning-is-not-the-answer-to-better-network-security\/shownoteAccessed: 2017-04--19.  Matt Harrigan. 2016. Machine Learning is not the Answer to Better Network Security. (2016). showURL%https:\/\/techcrunch.com\/2016\/02\/29\/machine-learning-is-not-the-answer-to-better-network-security\/shownoteAccessed: 2017-04--19."},{"key":"e_1_3_2_1_26_1","unstructured":"Geoffrey E Hinton Nitish Srivastava Alex Krizhevsky Ilya Sutskever and Ruslan R Salakhutdinov. 2012. Improving Neural Networks by Preventing Co-Adaptation of Feature Detectors ArXiv e-prints.  Geoffrey E Hinton Nitish Srivastava Alex Krizhevsky Ilya Sutskever and Ruslan R Salakhutdinov. 2012. Improving Neural Networks by Preventing Co-Adaptation of Feature Detectors ArXiv e-prints."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1038\/nature14539"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081870.1081950"},{"key":"e_1_3_2_1_29_1","volume-title":"Enhanced Telemetry for Encrypted Threat Analytics IEEE ICNP Workshop on Machine Learning in Computer Networks (NetworkML). 1--6.","author":"McGrew David","year":"2016","unstructured":"David McGrew and Blake Anderson 2016 . Enhanced Telemetry for Encrypted Threat Analytics IEEE ICNP Workshop on Machine Learning in Computer Networks (NetworkML). 1--6. David McGrew and Blake Anderson 2016. Enhanced Telemetry for Encrypted Threat Analytics IEEE ICNP Workshop on Machine Learning in Computer Networks (NetworkML). 1--6."},{"key":"e_1_3_2_1_30_1","unstructured":"David McGrew Blake Anderson Bill Hudson and Philip Perricone 2017. Joy. https:\/\/github.com\/cisco\/joy. (2017).  David McGrew Blake Anderson Bill Hudson and Philip Perricone 2017. Joy. https:\/\/github.com\/cisco\/joy. (2017)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1071690.1064220"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"e_1_3_2_1_34_1","unstructured":"Eric Rescorla. 2017. The Transport Layer Security (TLS) Protocol Version 1.3 (draft 20). Intended Status: Standards Track. (2017). showURL%https:\/\/tools.ietf.org\/html\/draft-ietf-tls-tls13--20  Eric Rescorla. 2017. The Transport Layer Security (TLS) Protocol Version 1.3 (draft 20). Intended Status: Standards Track. (2017). showURL%https:\/\/tools.ietf.org\/html\/draft-ietf-tls-tls13--20"},{"key":"e_1_3_2_1_35_1","volume-title":"Snort - Lightweight Intrusion Detection for Networks USENIX Large Installation System Administration Conference (LISA). 229--238","author":"Roesch Martin","year":"1999","unstructured":"Martin Roesch . 1999 . Snort - Lightweight Intrusion Detection for Networks USENIX Large Installation System Administration Conference (LISA). 229--238 . Martin Roesch. 1999. Snort - Lightweight Intrusion Detection for Networks USENIX Large Installation System Administration Conference (LISA). 229--238."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"crossref","unstructured":"Florian Tegeler Xiaoming Fu Giovanni Vigna and Christopher Kruegel 2012. Botfinder: Finding Bots in Network Traffic without Deep Packet Inspection ACM International Conference on Emerging Networking Experiments and Technologies (Co-NEXT). 349--360.  Florian Tegeler Xiaoming Fu Giovanni Vigna and Christopher Kruegel 2012. Botfinder: Finding Bots in Network Traffic without Deep Packet Inspection ACM International Conference on Emerging Networking Experiments and Technologies (Co-NEXT). 349--360.","DOI":"10.1145\/2413176.2413217"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/1163593.1163596"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/4235.585893"}],"event":{"name":"KDD '17: The 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","location":"Halifax NS Canada","acronym":"KDD '17","sponsor":["SIGMOD ACM Special Interest Group on Management of Data","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data"]},"container-title":["Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3097983.3098163","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3097983.3098163","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:30:02Z","timestamp":1750203002000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3097983.3098163"}},"subtitle":["Accounting for Noisy Labels and Non-Stationarity"],"short-title":[],"issued":{"date-parts":[[2017,8,13]]},"references-count":40,"alternative-id":["10.1145\/3097983.3098163","10.1145\/3097983"],"URL":"https:\/\/doi.org\/10.1145\/3097983.3098163","relation":{},"subject":[],"published":{"date-parts":[[2017,8,13]]},"assertion":[{"value":"2017-08-13","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}