{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,12]],"date-time":"2026-02-12T10:01:12Z","timestamp":1770890472857,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":43,"publisher":"ACM","funder":[{"name":"National Natural Science Foundation of China","award":["62132009, 62221003"],"award-info":[{"award-number":["62132009, 62221003"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3744800","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:32:38Z","timestamp":1763854358000},"page":"1589-1603","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["FlowSentry: Accelerating NetFlow-based DDoS Detection"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-5568-9823","authenticated-orcid":false,"given":"Xiaoyu","family":"He","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9413-4461","authenticated-orcid":false,"given":"Xiaohui","family":"Xie","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8639-3818","authenticated-orcid":false,"given":"Xin","family":"Wang","sequence":"additional","affiliation":[{"name":"Stony Brook University, Stony Brook, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7991-2915","authenticated-orcid":false,"given":"Lei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2163-2723","authenticated-orcid":false,"given":"Kun","family":"Xie","sequence":"additional","affiliation":[{"name":"Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-6576-460X","authenticated-orcid":false,"given":"Lin","family":"Chen","sequence":"additional","affiliation":[{"name":"China Telecom Cybersecurity Technology Co.,Ltd., Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5171-739X","authenticated-orcid":false,"given":"Yong","family":"Cui","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","first-page":"719","volume-title":"Proceedings of the 19th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association","author":"Agarwal Anup","year":"2022","unstructured":"Anup Agarwal, Zaoxing Liu, and Srinivasan Seshan. 2022. HeteroSketch: Coordinating network-wide monitoring in heterogeneous and dynamic networks. In Proceedings of the 19th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, Renton, WA, 719-741."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3544216.3544263"},{"key":"e_1_3_2_1_3_1","unstructured":"Paul Almasan Krzysztof Rusek Shihan Xiao et al. 2023. Leveraging Spatial and Temporal Correlations for Network Traffic Compression. arXiv:2301.08962"},{"key":"e_1_3_2_1_4_1","first-page":"1093","volume-title":"Proceedings of the 26th USENIX Security Symposium. USENIX Association","author":"Antonakakis Manos","year":"2017","unstructured":"Manos Antonakakis, Tim April, Michael Bailey, et al. 2017. Understanding the Mirai Botnet. In Proceedings of the 26th USENIX Security Symposium. USENIX Association, Vancouver, BC, 1093-1110."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24067"},{"key":"e_1_3_2_1_6_1","first-page":"3345","volume-title":"Proceedings of the 30th USENIX Security Symposium. USENIX Association","author":"Bock Kevin","year":"2021","unstructured":"Kevin Bock, Abdulrahman Alaraj, Yair Fax, et al. 2021. Weaponizing middleboxes for TCP reflected amplification. In Proceedings of the 30th USENIX Security Symposium. USENIX Association, Vancouver, BC, 3345-3361."},{"key":"e_1_3_2_1_7_1","first-page":"1521","volume-title":"Proceedings of the 20th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association","author":"Buhler Tobias","year":"2023","unstructured":"Tobias Buhler, Romain Jacob, Ingmar Poese, and Laurent Vanbever. 2023. Enhancing Global Network Monitoring with Magnifier. In Proceedings of the 20th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, Boston, MA, 1521-1539."},{"key":"e_1_3_2_1_8_1","volume-title":"Cisco IOS NetFlow Configuration Guide. Cisco Systems. Retrieved","year":"2025","unstructured":"Cisco. [n.d.]. Cisco IOS NetFlow Configuration Guide. Cisco Systems. Retrieved in June 2025 from https:\/\/www.cisco.com\/c\/en\/us\/products\/ios-nx-os-software\/iosnetflow\/index.html."},{"key":"e_1_3_2_1_9_1","volume-title":"DDoS threat report for 2024 Q4. Retrieved","year":"2025","unstructured":"Cloudflare. [n.d.]. DDoS threat report for 2024 Q4. Retrieved in June 2025 from https:\/\/radar.cloudflare.com\/reports\/ddos-2024-q4\/."},{"key":"e_1_3_2_1_10_1","volume-title":"2023 DDoS Threat Intelligence Report. Retrieved","author":"Juniper CORERO","year":"2025","unstructured":"CORERO and Juniper. [n.d.]. 2023 DDoS Threat Intelligence Report. Retrieved in June 2025 from https:\/\/www.juniper.net\/content\/dam\/www\/assets\/analystreports\/us\/en\/2023\/corero-ddos-threat-intelligence-report.pdf."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jalgor.2003.12.001"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.01.002"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484585"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.23080"},{"key":"e_1_3_2_1_15_1","first-page":"940","volume-title":"Proceedings of the 2021 ACM Conference on Computer and Communications Security (CCS). ACM","author":"Griffioen Harm","unstructured":"Harm Griffioen, Kris Oosthoek, Paul van der Knaap, and Christian Doerr. 2021. Scan, test, execute: Adversarial tactics in amplification DDoS attacks. In Proceedings of the 2021 ACM Conference on Computer and Communications Security (CCS). ACM, Seoul, South Korea, 940-954."},{"key":"e_1_3_2_1_16_1","first-page":"760","volume-title":"Proceedings of the 2022 Internet Measurement Conference (IMC). ACM","author":"Heinrich Tiago","unstructured":"Tiago Heinrich, Carlos A. Maziero, Newton C. Will, and Rafael R. Obelheiro. 2022. How DRDoS attacks vary across the globe?. In Proceedings of the 2022 Internet Measurement Conference (IMC). ACM, Nice, France, 760-761."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/CNSM.2013.6727841"},{"key":"e_1_3_2_1_18_1","first-page":"1771","volume-title":"Proceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association","author":"Hsieh Kevin","year":"2024","unstructured":"Kevin Hsieh, MikeWong, Santiago Segarra, Sathiya Kumaran Mani, Trevor Eberl, Anatoliy Panasyuk, Ravi Netravali, Ranveer Chandra, and Srikanth Kandula. 2024. NetVigil: Robust and Low-Cost Anomaly Detection for East-West Data Center Security. In Proceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, Santa Clara, CA, 1771-1789."},{"key":"e_1_3_2_1_19_1","volume-title":"NetStream Feature Guide","year":"2025","unstructured":"Huawei. [n.d.]. NetStream Feature Guide. Huawei Technologies Co., Ltd. Retrieved in June 2025 from https:\/\/support.huawei.com\/enterprise\/en\/doc\/EDOC1000178174\/986bf11e\/overview-of-netstream."},{"key":"e_1_3_2_1_20_1","volume-title":"Global DDoS Attack Status and Trend Analysis","year":"2023","unstructured":"Huawei. 2023. Global DDoS Attack Status and Trend Analysis in 2023. Huawei Technologies Co., Ltd. Retrieved in June 2025 from https:\/\/e.huawei.com\/en\/material\/networking\/security\/0c561b8fd2d342999cd402bcecf6d452."},{"key":"e_1_3_2_1_21_1","volume-title":"Juniper Networks. Retrieved","author":"Overview Flow","year":"2025","unstructured":"Juniper. [n.d.]. J-Flow Overview. Juniper Networks. Retrieved in June 2025 from https:\/\/www.juniper.net\/documentation\/us\/en\/software\/junos\/flowmonitoring\/topics\/concept\/flowmonitoring-definitions-solutions.html."},{"key":"e_1_3_2_1_22_1","first-page":"127","volume-title":"Proceedings of the 2013 IEEE Symposium on Security and Privacy (S&P). IEEE","author":"Kang Min Suk","unstructured":"Min Suk Kang, Soo Bum Lee, and Virgil D. Gligor. 2013. The Crossfire Attack. In Proceedings of the 2013 IEEE Symposium on Security and Privacy (S&P). IEEE, San Francisco, CA, 127-141."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2024.3391396"},{"key":"e_1_3_2_1_24_1","first-page":"75","volume-title":"Proceedings of the 2003 ACM SIGCOMM Conference. ACM","author":"Kuzmanovic Aleksandar","unstructured":"Aleksandar Kuzmanovic and Edward W. Knightly. 2003. Low-rate TCP-targeted denial of service attacks: the shrew vs. the mice and elephants. In Proceedings of the 2003 ACM SIGCOMM Conference. ACM, Karlsruhe, Germany, 75-86."},{"key":"e_1_3_2_1_25_1","unstructured":"Qingyang Li Yihang Zhang Zhidong Jia Yannan Hu Lei Zhang Jianrong Zhang Yongming Xu Yong Cui Zongming Guo and Xinggong Zhang. 2024. DoLLM: How Large Language Models Understanding Network Flow Data to Detect Carpet Bombing DDoS. arXiv:2404.15766 [cs.NI]"},{"key":"e_1_3_2_1_26_1","first-page":"311","volume-title":"Proceedings of the 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association","author":"Li Yuliang","year":"2016","unstructured":"Yuliang Li, Rui Miao, Changhoon Kim, and Minlan Yu. 2016. FlowRadar: A Better NetFlow for Data Centers. In Proceedings of the 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, Santa Clara, CA, 311-324."},{"key":"e_1_3_2_1_27_1","first-page":"3829","volume-title":"Proceedings of the 30th USENIX Security Symposium. USENIX Association","author":"Liu Zaoxing","year":"2021","unstructured":"Zaoxing Liu, Hun Namkung, Georgios Nikolaidis, Jeongkeun Lee, Changhoon Kim, Xin Jin, Vladimir Braverman, Minlan Yu, and Vyas Sekar. 2021. Jaqen: A High-Performance Switch-Native Approach for Detecting and Mitigating Volumetric DDoS Attacks with Programmable Switches. In Proceedings of the 30th USENIX Security Symposium. USENIX Association, Vancouver, BC, 3829-3846."},{"key":"e_1_3_2_1_28_1","unstructured":"MaxMind Inc. [n.d.]. GeoIP Dataset Documentation. MaxMind Inc. Retrieved in 2025 from https:\/\/dev.maxmind.com\/geoip\/."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23204"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23081"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2019.8888419"},{"key":"e_1_3_2_1_32_1","first-page":"1101","volume-title":"Proceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association","author":"Somashekar Gagan","year":"2024","unstructured":"Gagan Somashekar, Karan Tandon, Anush Kini, Prithvi Ravi, Shubham Choudhary, Chiranjeeb Buragohain, and Aditya Akella. 2024. OPPerTune: Post-Deployment Configuration Tuning of Services Made Easy. In Proceedings of the 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, Santa Clara, CA, 1101-1120."},{"key":"e_1_3_2_1_33_1","first-page":"467","volume-title":"Proceedings of the 15th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association","author":"Tilmans Olivier","year":"2018","unstructured":"Olivier Tilmans, Tobias Buhler, Ingmar Poese, and Laurent Vanbever. 2018. Stroboscope: Declarative Network Monitoring on a Budget. In Proceedings of the 15th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, Renton, WA, 467-482."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3281411.3281433"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.05.009"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485385"},{"key":"e_1_3_2_1_37_1","volume-title":"MAWI Working Group Traffic Archive. Retrieved","author":"WIND.","year":"2025","unstructured":"WIND. [n.d.]. MAWI Working Group Traffic Archive. Retrieved in June 2025 from http:\/\/mawi.wide.ad.jp\/mawi\/."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3603269.3604850"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3230543.3230544"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2019.2933868"},{"key":"e_1_3_2_1_41_1","volume-title":"GitHub hit with the largest DDoS attack ever seen. Retrieved","year":"2025","unstructured":"ZDNet. [n.d.]. GitHub hit with the largest DDoS attack ever seen. Retrieved in June 2025 from https:\/\/www.zdnet.com\/article\/github-was-hit-with-the-largestddos-attack-ever-seen\/."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645407"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3386367.3431298"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3744800","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:07:29Z","timestamp":1766441249000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3744800"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":43,"alternative-id":["10.1145\/3719027.3744800","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3744800","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}