{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,21]],"date-time":"2026-04-21T17:28:20Z","timestamp":1776792500623,"version":"3.51.2"},"reference-count":27,"publisher":"SAGE Publications","issue":"11","license":[{"start":{"date-parts":[[2018,11,1]],"date-time":"2018-11-01T00:00:00Z","timestamp":1541030400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"funder":[{"name":"the Science and Technology Program of Guangxi","award":["No. AB17195045"],"award-info":[{"award-number":["No. AB17195045"]}]},{"name":"the Open Projects of State Key Laboratory of Integrated Service Networks (ISN) of Xidian University","award":["No. ISN19-13"],"award-info":[{"award-number":["No. ISN19-13"]}]},{"DOI":"10.13039\/501100001809","name":"the National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["No. 61363006"],"award-info":[{"award-number":["No. 61363006"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"the National Natural Science Foundation of Guangxi","award":["No.2016GXNSFAA380098"],"award-info":[{"award-number":["No.2016GXNSFAA380098"]}]}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Distributed Sensor Networks"],"published-print":{"date-parts":[[2018,11]]},"abstract":"<jats:p> With the rapid development of large-scale complex networks and proliferation of various social network applications, the amount of network traffic data generated is increasing tremendously, and efficient anomaly detection on those massive network traffic data is crucial to many network applications, such as malware detection, load balancing, network intrusion detection. Although there are many methods around for network traffic anomaly detection, they are all designed for single machine, failing to deal with the case that the network traffic data are so large that it is prohibitive for a single computer to store and process the data. To solve these problems, we propose a parallel algorithm based on Isolation Forest and Spark for network traffic anomaly detection. We combine the advantages of Isolation Forest algorithm in network traffic anomaly detection and big data processing capability of Spark technology. Meanwhile, we apply the idea of parallelization to the process of modeling and evaluation. In the calculation process, by assigning tasks to multiple compute nodes, Isolation Forest and Spark can efficiently perform anomaly detection and evaluation process. By this way, we can also solve the problem of computation bottleneck on single machine. Extensive experiments on real world datasets show that our Isolation Forest and Spark is efficient and scales well for anomaly detection on large network traffic data. <\/jats:p>","DOI":"10.1177\/1550147718814471","type":"journal-article","created":{"date-parts":[[2018,11,27]],"date-time":"2018-11-27T12:56:37Z","timestamp":1543323397000},"page":"155014771881447","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":59,"title":["A parallel algorithm for network traffic anomaly detection based on Isolation Forest"],"prefix":"10.1177","volume":"14","author":[{"given":"Xiaoling","family":"Tao","sequence":"first","affiliation":[{"name":"Guangxi Colleges and Universities Key Laboratory of Cloud Computing and Complex Systems, Guilin University of Electronic Technology, Guilin, China"},{"name":"State Key Laboratory of Integrated Service Networks (ISN), Xidian University, Xi\u2019an, China"},{"name":"Guangxi Cooperative Innovation Center of Cloud Computing and Big Data, Guilin University of Electronic Technology, Guilin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4043-8165","authenticated-orcid":false,"given":"Yang","family":"Peng","sequence":"additional","affiliation":[{"name":"Guangxi Colleges and Universities Key Laboratory of Cloud Computing and Complex Systems, Guilin University of Electronic Technology, Guilin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Feng","family":"Zhao","sequence":"additional","affiliation":[{"name":"Guangxi Colleges and Universities Key Laboratory of Cloud Computing and Complex Systems, Guilin University of Electronic Technology, Guilin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Peichao","family":"Zhao","sequence":"additional","affiliation":[{"name":"Guangxi Colleges and Universities Key Laboratory of Cloud Computing and Complex Systems, Guilin University of Electronic Technology, Guilin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yong","family":"Wang","sequence":"additional","affiliation":[{"name":"Guangxi Colleges and Universities Key Laboratory of Cloud Computing and Complex Systems, Guilin University of Electronic Technology, Guilin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2018,11,27]]},"reference":[{"key":"bibr1-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2018.2830307."},{"key":"bibr2-1550147718814471","first-page":"577","volume":"15","author":"Cai Z","year":"2018","journal-title":"IEEE T Depend Secure"},{"key":"bibr3-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1007\/978-94-015-3994-4"},{"key":"bibr4-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"key":"bibr5-1550147718814471","first-page":"157","volume-title":"Fourth international conference on advances in computing and communications","author":"Paul B"},{"key":"bibr6-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-01604-7_42"},{"key":"bibr7-1550147718814471","first-page":"4373","volume-title":"IEEE international conference on communications (ICC)","author":"Salem O"},{"key":"bibr8-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2015.10.009"},{"key":"bibr9-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1587\/transcom.2016EBP3239"},{"key":"bibr10-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2014.09.083"},{"key":"bibr11-1550147718814471","doi-asserted-by":"publisher","DOI":"10.3390\/e17042367"},{"key":"bibr12-1550147718814471","first-page":"208","volume-title":"IEEE intelligent vehicles symposium","author":"Yu G"},{"key":"bibr13-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1016\/j.physa.2016.12.069"},{"key":"bibr14-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2016.2537781"},{"key":"bibr15-1550147718814471","first-page":"3548","volume-title":"IEEE international conference on systems, man and cybernetics","author":"Celenk M"},{"key":"bibr16-1550147718814471","first-page":"1","volume-title":"Proceedings of IEEE Southeastcon","author":"Han J"},{"key":"bibr17-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1155\/2016\/9653230."},{"key":"bibr18-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1002\/ett.2619"},{"key":"bibr19-1550147718814471","first-page":"1420","volume-title":"IEEE conference on computer communications","author":"Huang Q"},{"key":"bibr20-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.10.010"},{"key":"bibr21-1550147718814471","first-page":"644","volume-title":"18th international conference on advanced communication technology (ICACT)","author":"Duong NH"},{"key":"bibr22-1550147718814471","first-page":"387","volume-title":"3rd international conference on recent advances in information technology (RAIT)","author":"Kumari R"},{"key":"bibr23-1550147718814471","first-page":"176","volume-title":"Proceedings from the sixth annual IEEE SMC information assurance workshop","author":"Shon T"},{"key":"bibr25-1550147718814471","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-012-1263-0"},{"key":"bibr26-1550147718814471","first-page":"413","volume-title":"Eighth IEEE international conference on data mining","author":"Liu FT"},{"key":"bibr27-1550147718814471","first-page":"18","volume":"25","author":"Moustafa N","year":"2016","journal-title":"Inform Secur J"},{"key":"bibr28-1550147718814471","first-page":"1","volume-title":"Military communications and information systems conference (MilCIS)","author":"Moustafa N"}],"container-title":["International Journal of Distributed Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/1550147718814471","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/1550147718814471","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/1550147718814471","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,12,7]],"date-time":"2020-12-07T04:31:27Z","timestamp":1607315487000},"score":1,"resource":{"primary":{"URL":"http:\/\/journals.sagepub.com\/doi\/10.1177\/1550147718814471"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,11]]},"references-count":27,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2018,11]]}},"alternative-id":["10.1177\/1550147718814471"],"URL":"https:\/\/doi.org\/10.1177\/1550147718814471","relation":{},"ISSN":["1550-1477","1550-1477"],"issn-type":[{"value":"1550-1477","type":"print"},{"value":"1550-1477","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,11]]}}}