An empirical evaluation of entropy-based traffic anomaly detection

By George Nychis, Vyas Sekar, D. Andersen, Hyong S. Kim, Hui Zhang. ACM/SIGCOMM Internet Measurement Conference, 2008

350 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking (2010, methodology): “MAWI has enabled researchers to study Internet traffic characteristics [7, 16, 19], anomaly detectors [ 11 , 14], and traffic classifiers [10].”
Event labeling combining ensemble detectors and background knowledge (2014, neutral): “The first group of methods relies on the creation of artificial and simulated data [31,38,42,44] so that both normal and abnormal instances are generated via simulation.”
DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions (2017, background): “OpenFlow switches are then dynamically reconﬁgured based on the detected attacks in real time is more successful in getting the ﬁne grained patterns that typical volume-based trafﬁc analysis cannot capture [38– 40].”
Artificial intelligence based anomaly detection of energy consumption in buildings: A review, current trends and new perspectives (2021, background): “for anomaly detection represent another clustering category, in which a little effort has been devoted to thoroughly comprehend the detection force of using entropy-based analysis, such as [36, 37].”