{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,5]],"date-time":"2025-12-05T12:18:16Z","timestamp":1764937096663,"version":"3.40.5"},"reference-count":49,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2019,7,30]],"date-time":"2019-07-30T00:00:00Z","timestamp":1564444800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2019,7,30]],"date-time":"2019-07-30T00:00:00Z","timestamp":1564444800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Big Data"],"published-print":{"date-parts":[[2019,12]]},"DOI":"10.1186\/s40537-019-0230-3","type":"journal-article","created":{"date-parts":[[2019,7,30]],"date-time":"2019-07-30T12:03:04Z","timestamp":1564488184000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":28,"title":["Impact of class distribution on the detection of slow HTTP DoS attacks using Big Data"],"prefix":"10.1186","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4630-9364","authenticated-orcid":false,"given":"Chad L.","family":"Calvert","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Taghi M.","family":"Khoshgoftaar","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,7,30]]},"reference":[{"key":"230_CR1","unstructured":"Columbus L. Roundup Of cloud computing forecasts and market estimates, 2018. \n                              https:\/\/www.forbes.com\/sites\/louiscolumbus\/2018\/09\/23\/roundup-of-cloud-computing-forecasts-and-market-estimates-2018\/#427f5980507b\n                              \n                           . Accessed 20 March 2019."},{"key":"230_CR2","unstructured":"Security response: the continued rise of DDoS attacks. Technical report. 2014. \n                              http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/media\/security_response\/whitepapers\/the-continued-rise-of-ddos-attacks.pdf\n                              \n                           . Accessed 22 Feb 2019."},{"key":"230_CR3","doi-asserted-by":"crossref","unstructured":"Liu Y, Zhang H, Yang Y. A dos attack situation assessment method based on qos. In: Proceedings of 2011 international conference on computer science and network technology, IEEE, 2011. pp. 1041\u20135.","DOI":"10.1109\/ICCSNT.2011.6182139"},{"key":"230_CR4","unstructured":"Modi H. NETSCOUT threat intelligence report. Technical report. 2018. \n                              https:\/\/www.netscout.com\/sites\/default\/files\/2019-02\/SECR_001_EN-1901%20-%20NETSCOUT%20Threat%20Intelligence%20Report%202H%202018.pdf\n                              \n                           . Accessed 20 March 2019."},{"key":"230_CR5","doi-asserted-by":"crossref","unstructured":"Durcekova V, Schwartz L, Shahmehri N. Sophisticated denial of service attacks aimed at application layer. In: 2012 ELEKTRO, IEEE, 2012. pp. 55\u201360.","DOI":"10.1109\/ELEKTRO.2012.6225571"},{"key":"230_CR6","doi-asserted-by":"crossref","unstructured":"Yevsieieva O, Helalat SM. Analysis of the impact of the slow http dos and ddos attacks on the cloud environment. In: 2017 4th international scientific-practical conference problems of infocommunications. Science and technology (PIC SI&T), IEEE, 2017. pp. 519\u201323.","DOI":"10.1109\/INFOCOMMST.2017.8246453"},{"key":"230_CR7","doi-asserted-by":"crossref","unstructured":"Hirakaw T, Ogura K, Bista BB, Takata T. A defense method against distributed slow http dos attack. In: 2016 19th international conference on network-based information systems (NBiS)), IEEE, 2016. pp. 519\u201323.","DOI":"10.1109\/NBiS.2016.58"},{"key":"230_CR8","unstructured":"Marquette S. Types of DDoS attacks 2017. \n                              https:\/\/www.esecurityplanet.com\/network-security\/types-of-ddos-attacks.html\n                              \n                           . Accessed 22 Feb 2019."},{"key":"230_CR9","unstructured":"Arellano P. Making decisions with data\u2014still looking for a needle in the Big Data Haystack? 2017. \n                              https:\/\/www.birst.com\/blog\/making-decisions-data-still-looking-needle-big-data-haystack\/\n                              \n                           . Accessed 5 Apr 2019."},{"issue":"1","key":"230_CR10","doi-asserted-by":"publisher","first-page":"42","DOI":"10.1186\/s40537-018-0151-6","volume":"5","author":"JL Leevy","year":"2018","unstructured":"Leevy JL, Khoshgoftaar TM, Bauder RA, Seliya N. A survey on addressing high-class imbalance in big data. J Big Data. 2018;5(1):42.","journal-title":"J Big Data"},{"key":"230_CR11","doi-asserted-by":"crossref","unstructured":"Prusa J, Khoshgoftaar TM, Dittman DJ, Napolitano A. Using random undersampling to alleviate class imbalance on tweet sentiment data. In: 2015 IEEE international conference on information reuse and integration, IEEE, 2015. pp. 197\u2013202.","DOI":"10.1109\/IRI.2015.39"},{"key":"230_CR12","unstructured":"Dai D, Hua S. Random under-sampling ensemble methods for highly imbalanced rare disease classification. In: International conference on data mining 2016, CSREA, 2016. pp. 54\u20138."},{"key":"230_CR13","doi-asserted-by":"crossref","unstructured":"Kumar G. Denial of service attacks\u2014an updated perspective. In: Systems science & control engineering, 2016. pp. 285\u201394.","DOI":"10.1080\/21642583.2016.1241193"},{"key":"230_CR14","unstructured":"LOIC SLOW. \n                              https:\/\/sourceforge.net\/projects\/loicslow\/\n                              \n                           . Accessed 5 Mar 2019."},{"key":"230_CR15","unstructured":"R.U.D.Y. \n                              https:\/\/sourceforge.net\/projects\/r-u-dead-yet\/\n                              \n                           . Accessed 5 Mar 2019."},{"key":"230_CR16","unstructured":"OWASP Switchblade. \n                              https:\/\/www.owasp.org\/index.php\/OWASP_HTTP_Post_Tool\n                              \n                           . Accessed 5 Mar 2019."},{"key":"230_CR17","unstructured":"SlowHTTPTest. \n                              http:\/\/www.r00tsec.com\/2012\/01\/slowhttptest-application-layer-dos.html\n                              \n                           . Accessed 10 Mar 2019."},{"key":"230_CR18","unstructured":"Slowloris.pl. \n                              https:\/\/github.com\/llaera\/slowloris.pl\n                              \n                           . Accessed 10 Mar 2019."},{"key":"230_CR19","unstructured":"Slowloris.py. \n                              https:\/\/github.com\/gkbrk\/slowloris\n                              \n                           . Accessed 8 Mar 2019."},{"key":"230_CR20","unstructured":"PyLoris. \n                              https:\/\/sourceforge.net\/projects\/pyloris\/\n                              \n                           . Accessed 8 Mar 2019."},{"key":"230_CR21","doi-asserted-by":"crossref","unstructured":"Roy S, DeLoach J, Herndon N, Cargea D, Ou X, Ranganath VP, Lit H, Guevara N. Experimental study with real-world data for android app security analysis using machine learning. In: Proceedings of the 31st annual computer security applications conference, ACM, 2015. pp. 81\u201390.","DOI":"10.1145\/2818000.2818038"},{"key":"230_CR22","doi-asserted-by":"crossref","unstructured":"Bauder R, Khoshgoftaar TM. The effects of varying class distribution on learner behavior for medicare fraud detection with imbalanced big data. In: Health Information Science and Systes 2018. Berlin: Springer; 2018. pp. 1\u201314.","DOI":"10.1007\/s13755-018-0051-3"},{"key":"230_CR23","doi-asserted-by":"crossref","unstructured":"Rio Sd, Benitex JM, Herrer F. Analysis of data preprocessing increasing the oversampling ratio for extremely imbalanced big data classification. In: 2015 IEEE Trustcom\/BigDataSE\/ISPA, IEEE; 2015. pp. 180\u20135.","DOI":"10.1109\/Trustcom.2015.579"},{"key":"230_CR24","unstructured":"\u201cEcBDL\u201d14 Big Data Competition. \n                              http:\/\/cruncher.ncl.ac.uk\/bdcomp\/\n                              \n                           . Accessed 10 Apr 2019."},{"issue":"1","key":"230_CR25","doi-asserted-by":"publisher","first-page":"107","DOI":"10.1145\/1327452.1327492","volume":"51","author":"J Dean","year":"2018","unstructured":"Dean J, Ghemawat S. Mapreduce: simplified data processing on large clusters. Commun ACM. 2018;51(1):107\u201313 ACM.","journal-title":"Commun ACM"},{"key":"230_CR26","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1007\/s40747-017-0037-9","volume":"3","author":"A Fernandez","year":"2017","unstructured":"Fernandez A, del Rio S, Chawla NV, Herrera F. An insight into imbalanced big data classification: outcomes and challenges. Comp Intellig Syst. 2017;3:105\u201320 Springer.","journal-title":"Comp Intellig Syst"},{"key":"230_CR27","unstructured":"\u201cRadware\u2019s ddos handbook: The ultimate guide to everything you need to know about ddos attacks. \n                              https:\/\/security.radware.com\/WorkArea\/DownloadAsset.aspx?id=793\n                              \n                           . Accessed 2 Feb 2019."},{"key":"230_CR28","unstructured":"Railgun. \n                              https:\/\/github.com\/rapid7\/metasploit-framework\/wiki\/How-to-use-Railgun-for-Windows-post-exploitation\n                              \n                           . Accessed 8 Mar 2019."},{"key":"230_CR29","unstructured":"Hammer Tor\u2019s. \n                              https:\/\/sourceforge.net\/projects\/torshammer\/\n                              \n                           . Accessed 5 Mar 2019."},{"key":"230_CR30","unstructured":"Koch M. Implementing full packet capture. In: SANS institute information security reading room, SAN6; 2016. pp. 1\u201327."},{"key":"230_CR31","doi-asserted-by":"crossref","unstructured":"Zhenqi W, Xinyu W. Netflow based intrusion detection system. In: 2008 international conference on multiMedia and information technology, IEEE; 2008. pp. 825\u20138.","DOI":"10.1109\/MMIT.2008.213"},{"key":"230_CR32","doi-asserted-by":"crossref","unstructured":"Claise B, Trammell B, Aitken P. Specification of the IP flow information export (IPFIX) protocol for the exchange of flow information. CISCO. Technical report, Cisco (September 2013). \n                              https:\/\/tools.ietf.org\/html\/rfc7011\n                              \n                           . Accessed 15 Mar 2019.","DOI":"10.17487\/rfc7015"},{"key":"230_CR33","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1145\/1656274.1656278","volume":"11","author":"M Hall","year":"2009","unstructured":"Hall M, Frank E, Holmes G, Pfahringer B, Reutemann P, Witten IH. The weka data mining software: an update. SIGKDD Explor Newsl. 2009;11:10\u20138 ACM.","journal-title":"SIGKDD Explor Newsl"},{"key":"230_CR34","unstructured":"Guo G, Wang H, Bell D, Bi Y, Greer K. Knn model-based approach in classification. In: IJCAI workshop on empirical methods in artifcial intelligence, IBM; 2001. pp. 41\u20136"},{"key":"230_CR35","unstructured":"Rish I. An empirical study of the naive bayes classifier. In: On the move to meaningful internet systems 2003: CoopIS, DOA, and ODBASE. OTM 2003. Lecture notes in computer science. Berlin: Springer; 2003. pp. 986\u201396."},{"key":"230_CR36","doi-asserted-by":"crossref","unstructured":"Mubarek AM, Adali E. Multilayer perceptron neural network technique for fraud detection. In: 2017 international conference on computer science and engineering (UBMK), IEEE; 2017. pp. 383\u20137.","DOI":"10.1109\/UBMK.2017.8093417"},{"key":"230_CR37","doi-asserted-by":"publisher","DOI":"10.2200\/S00324ED1V01Y201102AIM010","volume-title":"Learning with support vector machines","author":"C Campbell","year":"2011","unstructured":"Campbell C, Ying Y. Learning with support vector machines. Williston: Morgan & Claypool Publishers; 2011."},{"key":"230_CR38","unstructured":"Kohavi R, Quinian JR. Data mining tasks and methods: classification: decision-tree discovery. In: Handbook of data mining and knowledge discovery. Oxford University Press, Inc; 2002. pp. 267\u201376."},{"key":"230_CR39","doi-asserted-by":"crossref","unstructured":"Khoshgoftaar TM, Golawala M, Van Hulse J. An empirical study of learning from imbalanced data using random forest. In: 19th IEEE international conference on tools with artificial intelligence (ICTAI 2007), IEEE; 2007. pp. 310\u20137.","DOI":"10.1109\/ICTAI.2007.46"},{"key":"230_CR40","doi-asserted-by":"crossref","unstructured":"Choudhury S, Bhowal A. Comparative analysis of machine learning algorithms along with classifiers for network intrusion detection. In: 2015 international conference on smart technologies and management for computing, communication, controls, energy and materials (ICSTM), IEEE; 2015. pp. 89\u201395.","DOI":"10.1109\/ICSTM.2015.7225395"},{"key":"230_CR41","doi-asserted-by":"crossref","unstructured":"Shukla P, Rai R. Ara-mac: Attacker identification using logistic regression. In: 2017 international conference on recent innovations in signal processing and embedded systems (RISE), IEEE; 2017. pp. 124\u20138.","DOI":"10.1109\/RISE.2017.8378138"},{"key":"230_CR42","doi-asserted-by":"crossref","unstructured":"Seliya N, Khoshgoftaar TM, Hulse JV. A study on the relationships of classifier performance metrics. In: 2009 21st IEEE international conference on tools with artificial intelligience, IEEE; 2009. pp. 59\u201366.","DOI":"10.1109\/ICTAI.2009.25"},{"key":"230_CR43","doi-asserted-by":"crossref","unstructured":"Johnson JM, Khoshgoftaar TM. Survey on deep learning with class imbalance. In: Journal of Big Data. 2019. pp. 1\u201354.","DOI":"10.1186\/s40537-019-0192-5"},{"key":"230_CR44","doi-asserted-by":"crossref","unstructured":"Van Hulse J, Khoshgoftaar TM, Napolitano A. Experimental perspectives on learning from imbalanced data. In: Proceedings of the 24th international conference on machine learning, ACM; 2007. pp. 935\u201342.","DOI":"10.1145\/1273496.1273614"},{"key":"230_CR45","doi-asserted-by":"crossref","unstructured":"Chandrakantha L. Learning anova concepts using simulation. In: Proceedings of the 2014 zone 1 conference of the American Society for Engineering Education, IEEE; 2014. pp. 1\u20135.","DOI":"10.1109\/ASEEZone1.2014.6820644"},{"key":"230_CR46","doi-asserted-by":"crossref","unstructured":"Pandis N. Two-way analysis of variance: Part 2. In: American journal of orthodontics and dentofacial orthopedics, AAO; 2016. pp. 137\u20139.","DOI":"10.1016\/j.ajodo.2015.10.007"},{"key":"230_CR47","doi-asserted-by":"publisher","first-page":"99","DOI":"10.2307\/3001913","volume":"5","author":"JW Tukey","year":"1949","unstructured":"Tukey JW. Comparing individual means in the analysis of variance. Biometrics. 1949;5:99\u2013114 International Biometric Society.","journal-title":"Biometrics"},{"key":"230_CR48","unstructured":"Calvert C, Khoshgoftaar TM, Kemp C, Najafabadi MM. Detection of slowloris attacks using netflow traffic. In: 24th ISSAT international conference on reliability and quality in design, ISSAT; 2018. pp. 1\u20136."},{"key":"230_CR49","unstructured":"Calvert C, Kemp C, Khoshgoftaar TM, Najafabadi MM. Detecting slow http post dos attacks using netflow features. In: The 32nd international FLAIRS conference, FLAIRS; 2019. pp. 1\u20134."}],"container-title":["Journal of Big Data"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-019-0230-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1186\/s40537-019-0230-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-019-0230-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,7,28]],"date-time":"2020-07-28T23:09:28Z","timestamp":1595977768000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofbigdata.springeropen.com\/articles\/10.1186\/s40537-019-0230-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,7,30]]},"references-count":49,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2019,12]]}},"alternative-id":["230"],"URL":"https:\/\/doi.org\/10.1186\/s40537-019-0230-3","relation":{},"ISSN":["2196-1115"],"issn-type":[{"type":"electronic","value":"2196-1115"}],"subject":[],"published":{"date-parts":[[2019,7,30]]},"assertion":[{"value":"24 May 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"16 July 2019","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 July 2019","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"Not applicable.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"All authors have consented to the publication of this work.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare that they have no competing interests.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"67"}}