{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T08:15:03Z","timestamp":1783152903475,"version":"3.54.6"},"publisher-location":"New York, NY, USA","reference-count":50,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,13]]},"DOI":"10.1145\/3774904.3792071","type":"proceedings-article","created":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T21:54:34Z","timestamp":1775771674000},"page":"6944-6955","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Cardinality is Not Enough: Super Host Detection via Segmented Cardinality Estimation"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-6781-8348","authenticated-orcid":false,"given":"Yilin","family":"Zhao","sequence":"first","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7578-4490","authenticated-orcid":false,"given":"Jiawei","family":"Huang","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-9601-5192","authenticated-orcid":false,"given":"Xianshi","family":"Su","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8516-0104","authenticated-orcid":false,"given":"Weihe","family":"Li","sequence":"additional","affiliation":[{"name":"The University of Edinburgh, Edinburgh, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-1569-4241","authenticated-orcid":false,"given":"Xin","family":"Li","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-7137-0258","authenticated-orcid":false,"given":"Yan","family":"Liu","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-3274-9301","authenticated-orcid":false,"given":"Jiacheng","family":"Xie","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-7361-343X","authenticated-orcid":false,"given":"Qichen","family":"Su","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8087-6333","authenticated-orcid":false,"given":"Jin","family":"Ye","sequence":"additional","affiliation":[{"name":"Guangxi University, Nanning, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5067-321X","authenticated-orcid":false,"given":"Wanchun","family":"Jiang","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1516-0480","authenticated-orcid":false,"given":"Jianxin","family":"Wang","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2026. SegSketch Repository. https:\/\/github.com\/Elaine-codebase\/SegSketch-Repository."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISAECT53699.2021.9668562"},{"key":"e_1_3_2_1_3_1","volume-title":"Proceedings of USENIX Security Symposium. 1093--1110","author":"Antonakakis Manos","year":"2017","unstructured":"Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J Alex Halderman, Luca Invernizzi, Michalis Kallitsis, et al. 2017. Understanding the mirai botnet. In Proceedings of USENIX Security Symposium. 1093--1110."},{"key":"e_1_3_2_1_4_1","unstructured":"Barefoot Networks. 2016. Barefoot's Tofino. https:\/\/barefootnetworks.com\/products\/brief-tofino."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098832"},{"key":"e_1_3_2_1_6_1","unstructured":"Catalin Cimpanu. 2019. Carpet-bombing ddos attack takes down south african isp for an entire day. https:\/\/www.zdnet.com\/article\/carpet-bombing-ddos-attack-takes-down-south-african-isp-for-an-entire-day\/."},{"key":"e_1_3_2_1_7_1","unstructured":"Center for Applied Internet Data Analysis. 2016. The CAIDA Anonymized Internet Traces Dataset. https:\/\/catalog.caida.org\/dataset\/passive_2016_pcap."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1007568.1007588"},{"key":"e_1_3_2_1_9_1","volume-title":"Finding hierarchical heavy hitters in streaming data. ACM Transactions on Knowledge Discovery from Data 1, 4","author":"Cormode Graham","year":"2008","unstructured":"Graham Cormode, Flip Korn, S Muthukrishnan, and Divesh Srivastava. 2008. Finding hierarchical heavy hitters in streaming data. ACM Transactions on Knowledge Discovery from Data 1, 4 (2008), 1--48."},{"key":"e_1_3_2_1_10_1","volume-title":"Michele Nogueira, Aldri Luiz Dos Santos, and Louren\u00e7o Alves Pereira.","author":"De Melo Leonardo Henrique","year":"2025","unstructured":"Leonardo Henrique De Melo, Gustavo de Carvalho Bertoli, Michele Nogueira, Aldri Luiz Dos Santos, and Louren\u00e7o Alves Pereira. 2025. Anomaly-Flow: A Multi-domain Federated Generative Adversarial Network for Distributed Denial-of-Service Detection. IEEE Network (2025), 1--1."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3073597"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM53939.2023.10229088"},{"key":"e_1_3_2_1_13_1","volume-title":"Proceedings of USENIX Security Symposium. 65--78","author":"Durumeric Zakir","year":"2014","unstructured":"Zakir Durumeric, Michael Bailey, and J Alex Halderman. 2014. An Internet-Wide view of Internet-Wide scanning. In Proceedings of USENIX Security Symposium. 65--78."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/948205.948225"},{"key":"e_1_3_2_1_15_1","unstructured":"FastNetMon. 2023. Rise of carpet bombing attacks. https:\/\/fastnetmon.com\/2023\/10\/24\/rise-of-carpet-bombing-ddos-attacks-and-ways-to-detect-and-defend-against-them-using-fastnetmon-advanced\/."},{"key":"e_1_3_2_1_16_1","unstructured":"FS-ISAC. 2025. DDoS Attackers Increase Targeting of Global Financial Sector According to FS-ISAC and Akamai Report. https:\/\/www.fsisac.com\/newsroom\/ddos-attackers-increase-targeting-of-global-financial-sector-according-to-fsisac-and-akamai-report."},{"key":"e_1_3_2_1_17_1","volume-title":"Proceedings of ACM International Conference on Very Large Data Bases (VLDB). 464--475","author":"Graham Cormode","year":"2003","unstructured":"Cormode Graham, Korn Flip, Muthukrishnan Shanmugavelayutham, and Srivastava Divesh. 2003. Finding hierarchical heavy hitters in data streams. In Proceedings of ACM International Conference on Very Large Data Bases (VLDB). 464--475."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2452376.2452456"},{"key":"e_1_3_2_1_19_1","unstructured":"Hirsi Abdinasir Audah Lukman Salh Adeb. 2024. SDN-DDoS Traffic Dataset. https:\/\/data.mendeley.com\/datasets\/b7vw628825\/1."},{"key":"e_1_3_2_1_20_1","volume-title":"A Comprehensive Analysis of Adversarial Attacks against Spam Filters. arXiv preprint arXiv:2505.03831","author":"Hotoglu Esra","year":"2025","unstructured":"Esra Hotoglu, Sevil Sen, and Burcu Can. 2025. A Comprehensive Analysis of Adversarial Attacks against Spam Filters. arXiv preprint arXiv:2505.03831 (2025)."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCC62609.2024.10942215"},{"key":"e_1_3_2_1_22_1","unstructured":"Itay Raviv. 2023. DDoS Carpet-Bombing -- Coming In Fast And Brutal. https:\/\/www.radware.com\/blog\/ddos-protection\/ddos-carpet-bombing-coming-in-fast-and-brutal\/."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3072295"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3111328"},{"key":"e_1_3_2_1_25_1","unstructured":"Robert J. Jenkins Jr. 1995. Hash Functions for Hash Table Lookup. http:\/\/burtleburtle.net\/bob\/hash\/evahash.html."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.23102"},{"key":"e_1_3_2_1_27_1","volume-title":"Dollm: How large language models understanding network flow data to detect carpet bombing ddos. arXiv preprint arXiv:2405.07638","author":"Li Qingyang","year":"2024","unstructured":"Qingyang Li, Yihang Zhang, Zhidong Jia, Yannan Hu, Lei Zhang, Jianrong Zhang, Yongming Xu, Yong Cui, Zongming Guo, and Xinggong Zhang. 2024. Dollm: How large language models understanding network flow data to detect carpet bombing ddos. arXiv preprint arXiv:2405.07638 (2024)."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2503269"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2021.3108033"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2023.3279665"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.2197\/ipsjjip.32.731"},{"key":"e_1_3_2_1_32_1","volume-title":"Proceedings of Springer International Conference on Database Theory. 398--412","author":"Metwally Ahmed","year":"2005","unstructured":"Ahmed Metwally, Divyakant Agrawal, and Amr El Abbadi. 2005. Efficient computation of frequent and top-k elements in data streams. In Proceedings of Springer International Conference on Database Theory. 398--412."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972924.16"},{"key":"e_1_3_2_1_34_1","unstructured":"Netresec. 2012. Capture files from Mid -Atlantic CCDC. https:\/\/www.netresec.com\/?page=MACCDC."},{"key":"e_1_3_2_1_35_1","unstructured":"Jorge Pacheco Omer Yoachimik. 2025. Targeted by 20.5 million DDoS attacks up 358% year-over-year: Cloudflare's 2025 Q1 DDoS Threat Report. https:\/\/blog.cloudflare.com\/ddos-threat-report-for-2025-q1\/."},{"key":"e_1_3_2_1_36_1","unstructured":"P4 Language Consortium. 2015. P4 Language. https:\/\/p4.org."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE55515.2023.00211"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2022.3198738"},{"key":"e_1_3_2_1_39_1","volume-title":"Spam and phishing","author":"Andrey Kovtun Irina Shimko Roman Dedenok","year":"2024","unstructured":"Roman Dedenok Andrey Kovtun Irina Shimko Anna Lazaricheva Tatyana Kulikova, Olga Svistunova. 2024. Spam and phishing in 2024. https:\/\/securelist.com\/spam-and-phishing-report-2024\/115536\/."},{"key":"e_1_3_2_1_40_1","unstructured":"Terry Young. 2024. Carpet-bombing attacks highlight the need for intelligent and automated ddos protection. https:\/\/www.a10networks.com\/blog\/carpet-bombing-attacks-highlight-the-need-for-intelligent-and-automated-ddos-protection."},{"key":"e_1_3_2_1_41_1","unstructured":"The Measurement and Analysis on the WIDE Internet (MAWI) Working Group. 2000. MAWI Working Group Traffic Archive. http:\/\/mawi.wide.ad.jp\/mawi\/."},{"key":"e_1_3_2_1_42_1","volume-title":"International Conference on Passive and Active Network Measurement. 269--283","author":"Obelheiro Tiago Heinrich Rafael R","year":"2021","unstructured":"Rafael R Obelheiro Tiago Heinrich and Carlos A Maziero. 2021. New kids on the DRDoS block: Characterizing multiprotocol and carpet bombing attacks. In International Conference on Passive and Active Network Measurement. 269--283."},{"key":"e_1_3_2_1_43_1","volume-title":"Proceedings of IEEE International Teletraffic Congress. 1--8.","author":"Truong Patrick","year":"2009","unstructured":"Patrick Truong and Fabrice Guillemin. 2009. Identification of heavyweight address prefix pairs in IP traffic. In Proceedings of IEEE International Teletraffic Congress. 1--8."},{"key":"e_1_3_2_1_44_1","unstructured":"UNSW Canberra at ADFA. 2015. The UNSW-NB15 Dataset. https:\/\/research.unsw.edu.au\/projects\/unsw-nb15-dataset."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"crossref","unstructured":"Haibo Wang Chaoyi Ma Olufemi O Odegbile Shigang Chen and Jih-Kwon Peir. 2021. Randomized error removal for online spread estimation in data streaming. (2021) 1040\u2014-1052.","DOI":"10.14778\/3447689.3447707"},{"key":"e_1_3_2_1_46_1","volume-title":"Modern DDoS Threats and Countermeasures: Insights into Emerging Attacks and Detection Strategies. arXiv preprint arXiv:2502.19996","author":"Wang Jincheng","year":"2025","unstructured":"Jincheng Wang, Le Yu, John Lui, and Xiapu Luo. 2025. Modern DDoS Threats and Countermeasures: Insights into Emerging Attacks and Detection Strategies. arXiv preprint arXiv:2502.19996 (2025)."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2123094"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/78922.78925"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/2745844.2745870"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366699"}],"event":{"name":"WWW '26: The ACM Web Conference 2026","location":"Dubai United Arab Emirates","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2026"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3774904.3792071","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T07:15:54Z","timestamp":1783149354000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3774904.3792071"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":50,"alternative-id":["10.1145\/3774904.3792071","10.1145\/3774904"],"URL":"https:\/\/doi.org\/10.1145\/3774904.3792071","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}