{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T15:51:31Z","timestamp":1775145091272,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":66,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T00:00:00Z","timestamp":1715558400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"State Key Laboratory of Mathematical Engineering and Advanced Computing"},{"name":"National Natural Science Foundation of China","award":["62227805, 62072398, 62172405"],"award-info":[{"award-number":["62227805, 62072398, 62172405"]}]},{"name":"Fok Ying-Tung Education Foundation for Young Teachers in the Higher Education Institutions of China","award":["No.20193218210004"],"award-info":[{"award-number":["No.20193218210004"]}]},{"name":"Natural Science Foundation of Jiangsu Province","award":["BK20220075"],"award-info":[{"award-number":["BK20220075"]}]},{"name":"Open Foundation of Henan Key Laboratory of Cyberspace Situation Awareness","award":["HNTS2022001"],"award-info":[{"award-number":["HNTS2022001"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,5,13]]},"DOI":"10.1145\/3589334.3645407","type":"proceedings-article","created":{"date-parts":[[2024,5,8]],"date-time":"2024-05-08T07:08:13Z","timestamp":1715152093000},"page":"1608-1619","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":29,"title":["Trident: A Universal Framework for Fine-Grained and Class-Incremental Unknown Traffic Detection"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1455-4330","authenticated-orcid":false,"given":"Ziming","family":"Zhao","sequence":"first","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2195-0799","authenticated-orcid":false,"given":"Zhaoxuan","family":"Li","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, CAS, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1252-2303","authenticated-orcid":false,"given":"Zhuoxue","family":"Song","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2268-7416","authenticated-orcid":false,"given":"Wenhao","family":"Li","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, CAS, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6087-8243","authenticated-orcid":false,"given":"Fan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]}],"member":"320","published-online":{"date-parts":[[2024,5,13]]},"reference":[{"key":"e_1_3_2_2_1_1","first-page":"792","volume-title":"Balkema and Laurens De Haan. Residual life time at great age. The Annals of probability","author":"August","year":"1974","unstructured":"August A. Balkema and Laurens De Haan. Residual life time at great age. The Annals of probability, pages 792--804, 1974."},{"key":"e_1_3_2_2_2_1","first-page":"805","volume-title":"IEEE Symposium on Security and Privacy","author":"Barbero Federico","year":"2022","unstructured":"Federico Barbero, Feargus Pendlebury, Fabio Pierazzi, et al. Transcending TRANSCEND: revisiting malware classification in the presence of concept drift. In IEEE Symposium on Security and Privacy, pages 805--823. IEEE, 2022."},{"key":"e_1_3_2_2_3_1","volume-title":"Flowlens: Enabling efficient flow classification for ml-based network security applications","author":"Diogo Barradas","year":"2021","unstructured":"Diogo Barradas et al. Flowlens: Enabling efficient flow classification for ml-based network security applications. In NDSS. The Internet Society, 2021."},{"key":"e_1_3_2_2_4_1","volume-title":"Empirical evaluation of gated recurrent neural networks on sequence modeling. CoRR, abs\/1412.3555","author":"Chung Junyoung","year":"2014","unstructured":"Junyoung Chung, \u00c7aglar G\u00fcl\u00e7ehre, et al. Empirical evaluation of gated recurrent neural networks on sequence modeling. CoRR, abs\/1412.3555, 2014."},{"key":"e_1_3_2_2_5_1","first-page":"1283","volume-title":"CCS","author":"Du Min","year":"2019","unstructured":"Min Du, Zhi Chen, Chang Liu, Rajvardhan Oak, and Dawn Song. Lifelong anomaly detection through unlearning. In CCS, pages 1283--1297. ACM, 2019."},{"key":"e_1_3_2_2_6_1","first-page":"1285","volume-title":"CCS","author":"Du Min","year":"2017","unstructured":"Min Du, Feifei Li, et al. Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In CCS, pages 1285--1298. ACM, 2017."},{"key":"e_1_3_2_2_7_1","first-page":"226","volume-title":"KDD","author":"Martin Ester","year":"1996","unstructured":"Martin Ester et al. A density-based algorithm for discovering clusters in large spatial databases with noise. In KDD, pages 226--231. AAAI Press, 1996."},{"key":"e_1_3_2_2_8_1","volume-title":"M-trends reports: Insights into today's breaches and cyber attacks. https:\/\/content.fireeye.com\/m-trends\/rpt-m-trends-2020","year":"2020","unstructured":"FireEye. M-trends reports: Insights into today's breaches and cyber attacks. https:\/\/content.fireeye.com\/m-trends\/rpt-m-trends-2020, 2020."},{"key":"e_1_3_2_2_9_1","volume-title":"Cse-cic-ids2018 on aws. [EB\/OL]","author":"Canadian Institute for Cybersecurity.","year":"2018","unstructured":"Canadian Institute for Cybersecurity. Cse-cic-ids2018 on aws. [EB\/OL], 2018. https:\/\/www.unb.ca\/cic\/datasets\/ids-2018.html Accessed November 27, 2020."},{"key":"e_1_3_2_2_10_1","volume-title":"Intrusion detection evaluation dataset (cicids2017). [EB\/OL]","author":"Canadian Institute for Cybersecurity.","year":"2018","unstructured":"Canadian Institute for Cybersecurity. Intrusion detection evaluation dataset (cicids2017). [EB\/OL], 2018. https:\/\/www.unb.ca\/cic\/datasets\/ids-2017.html Accessed November 27, 2020."},{"key":"e_1_3_2_2_11_1","volume-title":"Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis","author":"Chuanpu Fu","year":"2023","unstructured":"Chuanpu Fu et al. Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis. In NDSS. The Internet Society, 2023."},{"key":"e_1_3_2_2_12_1","first-page":"3431","volume-title":"CCS","author":"Fu Chuanpu","year":"2021","unstructured":"Chuanpu Fu, Qi Li, Meng Shen, and Ke Xu. Realtime robust malicious traffic detection via frequency domain analysis. In CCS, pages 3431--3446. ACM, 2021."},{"key":"e_1_3_2_2_13_1","series-title":"Proceedings of Machine Learning Research","first-page":"2083","volume-title":"ICML","author":"Gao Hongyang","year":"2019","unstructured":"Hongyang Gao and Shuiwang Ji. Graph u-nets. In ICML, volume 97 of Proceedings of Machine Learning Research, pages 2083--2092. PMLR, 2019."},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1080\/00401706.1993.10485040"},{"key":"e_1_3_2_2_15_1","volume-title":"Anomaly detection in the openworld: Normality shift detection, explanation, and adaptation","author":"Dongqi Han","year":"2023","unstructured":"Dongqi Han et al. Anomaly detection in the openworld: Normality shift detection, explanation, and adaptation. In NDSS. The Internet Society, 2023."},{"key":"e_1_3_2_2_16_1","first-page":"3197","volume-title":"CCS","author":"Han Dongqi","year":"2021","unstructured":"Dongqi Han, Zhiliang Wang, et al. DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applications. In CCS, pages 3197--3217. ACM, 2021."},{"key":"e_1_3_2_2_17_1","volume-title":"A k-means clustering algorithm. Journal of the royal statistical society. series c (applied statistics), 28(1):100--108","author":"Hartigan John A","year":"1979","unstructured":"John A Hartigan and Manchek AWong. A k-means clustering algorithm. Journal of the royal statistical society. series c (applied statistics), 28(1):100--108, 1979."},{"key":"e_1_3_2_2_18_1","first-page":"3366","volume-title":"CCS","author":"Holland Jordan","year":"2021","unstructured":"Jordan Holland, Paul Schmitt, Nick Feamster, and Prateek Mittal. New directions in automated traffic analysis. In CCS, pages 3366--3383. ACM, 2021."},{"key":"e_1_3_2_2_19_1","first-page":"1991","volume-title":"WWW","author":"Guodong","year":"2023","unstructured":"Guodong Huang et al. Efficient and low overhead website fingerprinting attacks and defenses based on TCP\/IP traffic. In WWW, pages 1991--1999. ACM, 2023."},{"key":"e_1_3_2_2_20_1","first-page":"119","volume-title":"The Annals of Statistics","author":"James Pickands","year":"1975","unstructured":"James Pickands III. Statistical inference using extreme order statistics. The Annals of Statistics, pages 119--131, 1975."},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2021.3127277"},{"key":"e_1_3_2_2_22_1","first-page":"625","volume-title":"USENIX Security Symposium","author":"Jordaney Roberto","year":"2017","unstructured":"Roberto Jordaney, Kumar Sharad, et al. Transcend: Detecting concept drift in malware classification models. In USENIX Security Symposium, pages 625--642. USENIX Association, 2017."},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2014.6848005"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.5220\/0006105602530262"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1198\/tech.2005.s297"},{"key":"e_1_3_2_2_26_1","first-page":"17","volume-title":"CCS","author":"Li Hongda","year":"2018","unstructured":"Hongda Li, Hongxin Hu, Guofei Gu, Gail-Joon Ahn, and Fuqiang Zhang. vnids: Towards elastic security with safe and efficient virtualization of network intrusion detection systems. In CCS, pages 17--34. ACM, 2018."},{"key":"e_1_3_2_2_27_1","first-page":"1","volume-title":"IEEE\/ACM Trans. Netw.","author":"Li Wenhao","year":"2022","unstructured":"Wenhao Li, Xiao-Yu Zhang, et al. Prograph: Robust network traffic identification with graph propagation. IEEE\/ACM Trans. Netw., pages 1--15, 2022."},{"key":"e_1_3_2_2_28_1","volume-title":"FARE: enabling fine-grained attack categorization under low-quality labeled data","author":"Junjie Liang","year":"2021","unstructured":"Junjie Liang et al. FARE: enabling fine-grained attack categorization under low-quality labeled data. In NDSS. The Internet Society, 2021."},{"key":"e_1_3_2_2_29_1","first-page":"633","volume-title":"WWW","author":"Lin Xinjie","year":"2022","unstructured":"Xinjie Lin, Gang Xiong, Gaopeng Gou, Zhen Li, Junzheng Shi, and Jing Yu. ETBERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification. In WWW, pages 633--642. ACM, 2022."},{"key":"e_1_3_2_2_30_1","first-page":"1171","volume-title":"INFOCOM","author":"Chang","year":"2019","unstructured":"Chang Liu et al. Fs-net: A flow sequence network for encrypted traffic classification. In INFOCOM, pages 1171--1179. IEEE, 2019."},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2008.17"},{"key":"e_1_3_2_2_32_1","first-page":"3829","volume-title":"USENIX Security Symposium","author":"Zaoxing","year":"2021","unstructured":"Zaoxing Liu et al. Jaqen: A high-performance switch-native approach for detecting and mitigating volumetric ddos attacks with programmable switches. In USENIX Security Symposium, pages 3829--3846. USENIX Association, 2021."},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3050605"},{"key":"e_1_3_2_2_34_1","first-page":"135","volume-title":"CCS","author":"Meng Dongyu","year":"2017","unstructured":"Dongyu Meng and Hao Chen. Magnet: A two-pronged defense against adversarial examples. In CCS, pages 135--147. ACM, 2017."},{"key":"e_1_3_2_2_35_1","volume-title":"Kitsune: An ensemble of autoencoders for online network intrusion detection","author":"Yisroel Mirsky","year":"2018","unstructured":"Yisroel Mirsky et al. Kitsune: An ensemble of autoencoders for online network intrusion detection. In NDSS. The Internet Society, 2018."},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2017.2691702"},{"key":"e_1_3_2_2_37_1","first-page":"2318","volume-title":"WWW","author":"Sanghak","year":"2023","unstructured":"Sanghak Oh et al. Appsniffer: Towards robust mobile app fingerprinting against VPN. In WWW, pages 2318--2328. ACM, 2023."},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70087-8_59"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24574-4_28"},{"key":"e_1_3_2_2_40_1","volume-title":"Amplification hell: Revisiting network protocols for ddos abuse","author":"Rossow Christian","year":"2014","unstructured":"Christian Rossow. Amplification hell: Revisiting network protocols for ddos abuse. In NDSS. The Internet Society, 2014."},{"key":"e_1_3_2_2_41_1","volume-title":"Silhouettes: a graphical aid to the interpretation and validation of cluster analysis. Journal of computational and applied mathematics, 20:53--65","author":"Rousseeuw Peter J","year":"1987","unstructured":"Peter J Rousseeuw. Silhouettes: a graphical aid to the interpretation and validation of cluster analysis. Journal of computational and applied mathematics, 20:53--65, 1987."},{"key":"e_1_3_2_2_42_1","first-page":"680","volume-title":"INFOCOM Workshops","author":"Tal","year":"2019","unstructured":"Tal Shapira et al. Flowpic: Encrypted internet traffic classification is as easy as image recognition. In INFOCOM Workshops, pages 680--687. IEEE, 2019."},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098144"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"e_1_3_2_2_45_1","article-title":"I2RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification","author":"Song Zhuoxue","year":"2023","unstructured":"Zhuoxue Song, Ziming Zhao, et al. I2RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification. IEEE Transactions on Dependable and Secure Computing, 2023.","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"e_1_3_2_2_46_1","first-page":"583","article-title":"A knowledge reuse framework for combining multiple partitions","volume":"3","author":"Strehl Alexander","year":"2002","unstructured":"Alexander Strehl and Joydeep Ghosh. Cluster ensembles - A knowledge reuse framework for combining multiple partitions. J. Mach. Learn. Res., 3:583--617, 2002.","journal-title":"J. Mach. Learn. Res."},{"key":"e_1_3_2_2_47_1","first-page":"3104","volume-title":"NIPS","author":"Sutskever Ilya","year":"2014","unstructured":"Ilya Sutskever, Oriol Vinyals, and Quoc V. Le. Sequence to sequence learning with neural networks. In NIPS, pages 3104--3112, 2014."},{"key":"e_1_3_2_2_48_1","volume-title":"FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic","author":"van Ede Thijs","year":"2020","unstructured":"Thijs van Ede et al. FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic. In NDSS. The Internet Society, 2020."},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN.2017.7899588"},{"key":"e_1_3_2_2_50_1","volume-title":"Symtcp: Eluding stateful deep packet inspection with automated discrepancy discovery","author":"Zhongjie Wang","year":"2020","unstructured":"Zhongjie Wang et al. Symtcp: Eluding stateful deep packet inspection with automated discrepancy discovery. In NDSS. The Internet Society, 2020."},{"key":"e_1_3_2_2_51_1","first-page":"3384","volume-title":"CCS","author":"Zhongjie","year":"2021","unstructured":"Zhongjie Wang et al. Themis: Ambiguity-aware network intrusion detection based on symbolic model comparison. In CCS, pages 3384--3399. ACM, 2021."},{"key":"e_1_3_2_2_52_1","series-title":"JMLR Workshop and Conference Proceedings","first-page":"478","volume-title":"ICML","author":"Xie Junyuan","year":"2016","unstructured":"Junyuan Xie, Ross B. Girshick, and Ali Farhadi. Unsupervised deep embedding for clustering analysis. In ICML, volume 48 of JMLR Workshop and Conference Proceedings, pages 478--487. JMLR.org, 2016."},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2016.2623950"},{"key":"e_1_3_2_2_54_1","volume-title":"Feature squeezing: Detecting adversarial examples in deep neural networks","author":"Xu Weilin","year":"2018","unstructured":"Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In NDSS. The Internet Society, 2018."},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3083422"},{"key":"e_1_3_2_2_56_1","first-page":"2327","volume-title":"USENIX Security Symposium","author":"Yang Limin","year":"2021","unstructured":"Limin Yang, Wenbo Guo, et al. CADE: detecting and explaining concept drift samples for security applications. In USENIX Security Symposium, pages 2327-- 2344. USENIX Association, 2021."},{"key":"e_1_3_2_2_57_1","volume-title":"What you see is not what the network infers: Detecting adversarial examples based on semantic contradiction","author":"Yang Yijun","year":"2022","unstructured":"Yijun Yang, Ruiyuan Gao, Yu Li, Qiuxia Lai, and Qiang Xu. What you see is not what the network infers: Detecting adversarial examples based on semantic contradiction. In NDSS. The Internet Society, 2022."},{"key":"e_1_3_2_2_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583227"},{"key":"e_1_3_2_2_59_1","volume-title":"et al. Poseidon: Mitigating Volumetric DDoS Attacks with Programmable Switches","author":"Zhang Menghao","year":"2020","unstructured":"Menghao Zhang, Guanyu Li, et al. Poseidon: Mitigating Volumetric DDoS Attacks with Programmable Switches. In NDSS. The Internet Society, 2020."},{"key":"e_1_3_2_2_60_1","article-title":"CMD: Co-analyzed IoT Malware Detection Beyond the Network Traffic Domain","author":"Ziming Zhao","year":"2023","unstructured":"Ziming Zhao et al. CMD: Co-analyzed IoT Malware Detection Beyond the Network Traffic Domain. IEEE Transactions on Mobile Computing, 2023.","journal-title":"IEEE Transactions on Mobile Computing"},{"key":"e_1_3_2_2_61_1","article-title":"Effective DDoS Mitigation via ML-Driven In-network Traffic Shaping","author":"Ziming Zhao","year":"2024","unstructured":"Ziming Zhao et al. Effective DDoS Mitigation via ML-Driven In-network Traffic Shaping. IEEE Transactions on Dependable and Secure Computing, 2024.","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"e_1_3_2_2_62_1","volume-title":"Comput. Secur.","author":"Zhao Ziming","year":"2023","unstructured":"Ziming Zhao, Zhaoxuan Li, et al. DDoS Family: A Novel Perspective for Massive Types of DDoS Attacks. Comput. Secur., 2023."},{"key":"e_1_3_2_2_63_1","article-title":"ERNN: Error-Resilient RNN for Encrypted Traffic Detection towards Network-Induced Phenomena","author":"Zhao Ziming","year":"2023","unstructured":"Ziming Zhao, Zhaoxuan Li, et al. ERNN: Error-Resilient RNN for Encrypted Traffic Detection towards Network-Induced Phenomena. IEEE Trans. Dependable Secur. Comput., 2023.","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"e_1_3_2_2_64_1","first-page":"3636","volume-title":"CCS","author":"Zhao Ziming","year":"2023","unstructured":"Ziming Zhao, Zhaoxuan Li, Tingting Li, et al. Poster: Detecting adversarial examples hidden under watermark perturbation via usable information theory. In CCS, pages 3636--3638. ACM, 2023."},{"key":"e_1_3_2_2_65_1","doi-asserted-by":"publisher","DOI":"10.1109\/RTSS59052.2023.00045"},{"key":"e_1_3_2_2_66_1","doi-asserted-by":"publisher","DOI":"10.1145\/3386367.3431311"}],"event":{"name":"WWW '24: The ACM Web Conference 2024","location":"Singapore Singapore","acronym":"WWW '24","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2024"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645407","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3589334.3645407","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:24:20Z","timestamp":1755822260000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645407"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,13]]},"references-count":66,"alternative-id":["10.1145\/3589334.3645407","10.1145\/3589334"],"URL":"https:\/\/doi.org\/10.1145\/3589334.3645407","relation":{},"subject":[],"published":{"date-parts":[[2024,5,13]]},"assertion":[{"value":"2024-05-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}