{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,3]],"date-time":"2026-04-03T21:36:12Z","timestamp":1775252172803,"version":"3.50.1"},"reference-count":27,"publisher":"SAGE Publications","issue":"10","license":[{"start":{"date-parts":[[2018,10,1]],"date-time":"2018-10-01T00:00:00Z","timestamp":1538352000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61379052"],"award-info":[{"award-number":["61379052"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61502513"],"award-info":[{"award-number":["61502513"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program","doi-asserted-by":"crossref","award":["2016YFB1000101"],"award-info":[{"award-number":["2016YFB1000101"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Distributed Sensor Networks"],"published-print":{"date-parts":[[2018,10]]},"abstract":"<jats:p>Due to the increasing arriving rate and complex relationship of behavior data streams, how to detect sequential behavior anomaly in an efficient and accurate manner has become an emerging challenge. However, most of the existing literature simply calculates the anomaly score for segmented sequence, and there is limited work going deep to investigate data stream segment and structural relationship. Moreover, existing studies cannot meet efficiency requirements because of large number of projected subsequences. In this article, we propose EADetection, an efficient and accurate sequential behavior anomaly detection approach over data streams. EADetection adopts time interval and fuzzy logic\u2013based correlation to segment event stream adaptively based on rolling window. Through dynamic projection space\u2013based fast pruning, large number of repeated patterns are reduced to improve detection efficiency. Meanwhile, EADetection calculates the anomaly score by top-k pattern\u2013based abnormal scoring based on directed loop graph\u2013based storage strategy, which ensures the accuracy of detection. Specially, we design and implement a streaming anomaly detection system based on EADetection to perform real-time detection. Extensive experiments confirm that EADetection can achieve real time and improve accuracy, significantly reduces latency by 36.8% and reduces false positive rate by 6.4% compared with existing approach.<\/jats:p>","DOI":"10.1177\/1550147718803303","type":"journal-article","created":{"date-parts":[[2018,10,17]],"date-time":"2018-10-17T05:08:45Z","timestamp":1539752925000},"page":"155014771880330","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":1,"title":["EADetection: An efficient and accurate sequential behavior anomaly detection approach over data streams"],"prefix":"10.1177","volume":"14","author":[{"given":"Li","family":"Cheng","sequence":"first","affiliation":[{"name":"Science and Technology on Parallel and Distributed Laboratory, College of Computer, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yijie","family":"Wang","sequence":"additional","affiliation":[{"name":"Science and Technology on Parallel and Distributed Laboratory, College of Computer, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yong","family":"Zhou","sequence":"additional","affiliation":[{"name":"Science and Technology on Parallel and Distributed Laboratory, College of Computer, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xingkong","family":"Ma","sequence":"additional","affiliation":[{"name":"Science and Technology on Parallel and Distributed Laboratory, College of Computer, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2018,10,17]]},"reference":[{"key":"bibr1-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2012.05.003"},{"key":"bibr4-1550147718803303","author":"Han J","year":"2011","journal-title":"Data mining: concepts and techniques"},{"key":"bibr5-1550147718803303","first-page":"52","volume-title":"IEEE security and privacy workshops","author":"Song Y"},{"key":"bibr6-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-013-0638-6"},{"key":"bibr7-1550147718803303","first-page":"181","volume-title":"International workshop on recent advances in intrusion detection","author":"Salem MB"},{"key":"bibr8-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.08.003"},{"key":"bibr9-1550147718803303","first-page":"470","volume-title":"12th IEEE international conference on networks","volume":"2","author":"Hoang XD"},{"issue":"1","key":"bibr10-1550147718803303","first-page":"42","volume":"23","author":"Hu J","year":"2009","journal-title":"Network"},{"issue":"1","key":"bibr11-1550147718803303","first-page":"185","volume":"2","author":"Chand C","year":"2012","journal-title":"Int J Soft Comput Eng"},{"issue":"5","key":"bibr12-1550147718803303","first-page":"1001","volume":"29","author":"Deypir M","year":"2013","journal-title":"J Inf Sci Eng"},{"key":"bibr13-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1109\/MITP.2009.89"},{"key":"bibr14-1550147718803303","first-page":"1010","volume-title":"SAI intelligent systems conference","author":"Koucham O"},{"issue":"4","key":"bibr15-1550147718803303","first-page":"450","volume-title":"Water Resour Res","volume":"45","author":"Hill DJ","year":"2007"},{"key":"bibr16-1550147718803303","first-page":"1097","volume-title":"12th international conference on computer and information technology","author":"Quan Q"},{"key":"bibr17-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1109\/TCE.2015.7150594"},{"key":"bibr18-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2014.2324594"},{"key":"bibr19-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2013.10.013"},{"key":"bibr20-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.052213.00046"},{"issue":"4","key":"bibr21-1550147718803303","first-page":"127","volume":"4","author":"Agrafiotis I","year":"2014","journal-title":"J Internet Serv Inf Secur"},{"key":"bibr22-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2015.2389952"},{"key":"bibr23-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2016.12.012"},{"key":"bibr24-1550147718803303","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.4302"},{"issue":"1","key":"bibr25-1550147718803303","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1016\/j.jksuci.2012.07.001","volume":"25","author":"Aloysius G","year":"2013","journal-title":"J King Saud Univ: Comp Inf Sci"},{"key":"bibr26-1550147718803303","first-page":"1139","volume-title":"International conference on high performance computing and communications","author":"Li X"},{"key":"bibr27-1550147718803303","first-page":"1846","volume-title":"2017 IEEE 37th international conference on distributed computing systems (ICDCS)","author":"Wang H"},{"key":"bibr29-1550147718803303","volume-title":"Machine learning techniques for the computer security domain of anomaly detection","author":"Lane TD","year":"2000"},{"key":"bibr30-1550147718803303","first-page":"588","volume-title":"Ninth IEEE international conference on data mining","author":"Xu W"}],"container-title":["International Journal of Distributed Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/1550147718803303","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/1550147718803303","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/1550147718803303","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,3]],"date-time":"2026-04-03T20:24:11Z","timestamp":1775247851000},"score":1,"resource":{"primary":{"URL":"http:\/\/journals.sagepub.com\/doi\/10.1177\/1550147718803303"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,10]]},"references-count":27,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2018,10]]}},"alternative-id":["10.1177\/1550147718803303"],"URL":"https:\/\/doi.org\/10.1177\/1550147718803303","relation":{},"ISSN":["1550-1477","1550-1477"],"issn-type":[{"value":"1550-1477","type":"print"},{"value":"1550-1477","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,10]]}}}