{"id":"https:\/\/openalex.org\/W2150692548","doi":"https:\/\/doi.org\/10.1109\/ares.2009.113","title":"Server-Side Prediction of Source IP Addresses Using Density Estimation","display_name":"Server-Side Prediction of Source IP Addresses Using Density Estimation","publication_year":2009,"publication_date":"2009-01-01","ids":{"openalex":"https:\/\/openalex.org\/W2150692548","doi":"https:\/\/doi.org\/10.1109\/ares.2009.113","mag":"2150692548"},"language":"en","primary_location":{"id":"doi:10.1109\/ares.2009.113","is_oa":false,"landing_page_url":"https:\/\/doi.org\/10.1109\/ares.2009.113","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https:\/\/openalex.org\/A5105652760","display_name":"Markus Goldstein","orcid":"https:\/\/orcid.org\/0000-0003-2631-6882"},"institutions":[{"id":"https:\/\/openalex.org\/I33256026","display_name":"German Research Centre for Artificial Intelligence","ror":"https:\/\/ror.org\/01ayc5b57","country_code":"DE","type":"funder","lineage":["https:\/\/openalex.org\/I33256026"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Markus Goldstein","raw_affiliation_strings":["Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany","institution_ids":["https:\/\/openalex.org\/I33256026"]}]},{"author_position":"middle","author":{"id":"https:\/\/openalex.org\/A5004866032","display_name":"Matthias Reif","orcid":null},"institutions":[{"id":"https:\/\/openalex.org\/I33256026","display_name":"German Research Centre for Artificial Intelligence","ror":"https:\/\/ror.org\/01ayc5b57","country_code":"DE","type":"funder","lineage":["https:\/\/openalex.org\/I33256026"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Matthias Reif","raw_affiliation_strings":["Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany","institution_ids":["https:\/\/openalex.org\/I33256026"]}]},{"author_position":"middle","author":{"id":"https:\/\/openalex.org\/A5033758720","display_name":"Armin Stahl","orcid":null},"institutions":[{"id":"https:\/\/openalex.org\/I33256026","display_name":"German Research Centre for Artificial Intelligence","ror":"https:\/\/ror.org\/01ayc5b57","country_code":"DE","type":"funder","lineage":["https:\/\/openalex.org\/I33256026"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Armin Stahl","raw_affiliation_strings":["Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany","institution_ids":["https:\/\/openalex.org\/I33256026"]}]},{"author_position":"last","author":{"id":"https:\/\/openalex.org\/A5088840119","display_name":"Thomas M. Breuel","orcid":null},"institutions":[{"id":"https:\/\/openalex.org\/I153267046","display_name":"University of Kaiserslautern","ror":"https:\/\/ror.org\/04zrf7b53","country_code":"DE","type":"education","lineage":["https:\/\/openalex.org\/I153267046"]},{"id":"https:\/\/openalex.org\/I33256026","display_name":"German Research Centre for Artificial Intelligence","ror":"https:\/\/ror.org\/01ayc5b57","country_code":"DE","type":"funder","lineage":["https:\/\/openalex.org\/I33256026"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Thomas Breuel","raw_affiliation_strings":["Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany","Research Group Image Understanding and Pattern Recognition (IUPR), Technical University of Kaiserslautern, Kaiserslautern, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Group Image Understanding and Pattern Recognition (IUPR), German Research Center for Artificial Intelligence, Kaiserslautern, Germany","institution_ids":["https:\/\/openalex.org\/I33256026"]},{"raw_affiliation_string":"Research Group Image Understanding and Pattern Recognition (IUPR), Technical University of Kaiserslautern, Kaiserslautern, Germany","institution_ids":["https:\/\/openalex.org\/I153267046"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.2703,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.49724841,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"82","last_page":"89"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https:\/\/openalex.org\/T10400","display_name":"Network Security and Intrusion Detection","score":1,"subfield":{"id":"https:\/\/openalex.org\/subfields\/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https:\/\/openalex.org\/fields\/17","display_name":"Computer Science"},"domain":{"id":"https:\/\/openalex.org\/domains\/3","display_name":"Physical Sciences"}},"topics":[{"id":"https:\/\/openalex.org\/T10400","display_name":"Network Security and Intrusion Detection","score":1,"subfield":{"id":"https:\/\/openalex.org\/subfields\/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https:\/\/openalex.org\/fields\/17","display_name":"Computer Science"},"domain":{"id":"https:\/\/openalex.org\/domains\/3","display_name":"Physical Sciences"}},{"id":"https:\/\/openalex.org\/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9995999932289124,"subfield":{"id":"https:\/\/openalex.org\/subfields\/1702","display_name":"Artificial Intelligence"},"field":{"id":"https:\/\/openalex.org\/fields\/17","display_name":"Computer Science"},"domain":{"id":"https:\/\/openalex.org\/domains\/3","display_name":"Physical Sciences"}},{"id":"https:\/\/openalex.org\/T12326","display_name":"Network Packet Processing and Optimization","score":0.9987999796867371,"subfield":{"id":"https:\/\/openalex.org\/subfields\/1708","display_name":"Hardware and Architecture"},"field":{"id":"https:\/\/openalex.org\/fields\/17","display_name":"Computer Science"},"domain":{"id":"https:\/\/openalex.org\/domains\/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https:\/\/openalex.org\/keywords\/computer-science","display_name":"Computer science","score":0.8012358546257019},{"id":"https:\/\/openalex.org\/keywords\/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7320852279663086},{"id":"https:\/\/openalex.org\/keywords\/smoothing","display_name":"Smoothing","score":0.6055660247802734},{"id":"https:\/\/openalex.org\/keywords\/cluster-analysis","display_name":"Cluster analysis","score":0.5912370085716248},{"id":"https:\/\/openalex.org\/keywords\/data-mining","display_name":"Data mining","score":0.5455353856086731},{"id":"https:\/\/openalex.org\/keywords\/kernel-density-estimation","display_name":"Kernel density estimation","score":0.5143926739692688},{"id":"https:\/\/openalex.org\/keywords\/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.46700820326805115},{"id":"https:\/\/openalex.org\/keywords\/heuristic","display_name":"Heuristic","score":0.44460833072662354},{"id":"https:\/\/openalex.org\/keywords\/machine-learning","display_name":"Machine learning","score":0.30820757150650024},{"id":"https:\/\/openalex.org\/keywords\/artificial-intelligence","display_name":"Artificial intelligence","score":0.26564377546310425},{"id":"https:\/\/openalex.org\/keywords\/the-internet","display_name":"The Internet","score":0.25672295689582825},{"id":"https:\/\/openalex.org\/keywords\/estimator","display_name":"Estimator","score":0.19089853763580322}],"concepts":[{"id":"https:\/\/openalex.org\/C41008148","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q21198","display_name":"Computer science","level":0,"score":0.8012358546257019},{"id":"https:\/\/openalex.org\/C38822068","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7320852279663086},{"id":"https:\/\/openalex.org\/C3770464","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q775963","display_name":"Smoothing","level":2,"score":0.6055660247802734},{"id":"https:\/\/openalex.org\/C73555534","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q622825","display_name":"Cluster analysis","level":2,"score":0.5912370085716248},{"id":"https:\/\/openalex.org\/C124101348","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q172491","display_name":"Data mining","level":1,"score":0.5455353856086731},{"id":"https:\/\/openalex.org\/C71134354","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q458825","display_name":"Kernel density estimation","level":3,"score":0.5143926739692688},{"id":"https:\/\/openalex.org\/C77052588","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.46700820326805115},{"id":"https:\/\/openalex.org\/C173801870","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q201413","display_name":"Heuristic","level":2,"score":0.44460833072662354},{"id":"https:\/\/openalex.org\/C119857082","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q2539","display_name":"Machine learning","level":1,"score":0.30820757150650024},{"id":"https:\/\/openalex.org\/C154945302","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26564377546310425},{"id":"https:\/\/openalex.org\/C110875604","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q75","display_name":"The Internet","level":2,"score":0.25672295689582825},{"id":"https:\/\/openalex.org\/C185429906","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q1130160","display_name":"Estimator","level":2,"score":0.19089853763580322},{"id":"https:\/\/openalex.org\/C136764020","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q466","display_name":"World Wide Web","level":1,"score":0},{"id":"https:\/\/openalex.org\/C31972630","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q844240","display_name":"Computer vision","level":1,"score":0},{"id":"https:\/\/openalex.org\/C105795698","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q12483","display_name":"Statistics","level":1,"score":0},{"id":"https:\/\/openalex.org\/C33923547","wikidata":"https:\/\/www.wikidata.org\/wiki\/Q395","display_name":"Mathematics","level":0,"score":0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109\/ares.2009.113","is_oa":false,"landing_page_url":"https:\/\/doi.org\/10.1109\/ares.2009.113","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https:\/\/openalex.org\/W1249592992","https:\/\/openalex.org\/W1480376833","https:\/\/openalex.org\/W1526572178","https:\/\/openalex.org\/W1805704774","https:\/\/openalex.org\/W1977556410","https:\/\/openalex.org\/W1985382559","https:\/\/openalex.org\/W2052322644","https:\/\/openalex.org\/W2111548386","https:\/\/openalex.org\/W2130984574","https:\/\/openalex.org\/W2140753976","https:\/\/openalex.org\/W2156442470","https:\/\/openalex.org\/W4248384603","https:\/\/openalex.org\/W6638227319"],"related_works":["https:\/\/openalex.org\/W4386482731","https:\/\/openalex.org\/W2765763546","https:\/\/openalex.org\/W4385302085","https:\/\/openalex.org\/W2360429410","https:\/\/openalex.org\/W4390188535","https:\/\/openalex.org\/W4256682929","https:\/\/openalex.org\/W335511927","https:\/\/openalex.org\/W2471811227","https:\/\/openalex.org\/W2217591390","https:\/\/openalex.org\/W2157496457"],"abstract_inverted_index":{"Source":[0],"IP":[1,37,45,67,112,148],"addresses":[2,38,149],"are":[3,75],"often":[4],"used":[5,77],"as":[6,81,115,117],"a":[7,53,82,96,105,118,136,182],"major":[8],"feature":[9],"for":[10,39,110,193],"user":[11],"modeling":[12],"in":[13,17],"computer":[14],"networks.":[15],"Particularly":[16],"the":[18,43,124,154,157,200],"field":[19],"of":[20,23,35,56,66,143,156],"distributed":[21],"denial":[22],"service":[24],"(DDoS)":[25],"attack":[26],"detection":[27,184],"and":[28,91,150,164],"mitigation":[29,168,202],"traffic":[30],"models":[31,74,94],"make":[32],"extensive":[33],"use":[34],"source":[36,111,147],"detecting":[40],"anomalies.":[41],"Typically":[42],"real":[44,139],"address":[46],"distribution":[47],"is":[48,173,186],"strongly":[49],"undersampled":[50],"due":[51],"to":[52,152],"small":[54],"amount":[55],"observations.":[57],"Density":[58],"estimation":[59,114],"overcomes":[60],"this":[61,87],"shortage":[62],"by":[63],"taking":[64],"advantage":[65],"neighborhood":[68],"relations.":[69],"In":[70,86,101],"many":[71],"cases":[72],"simple":[73],"implicitly":[76],"or":[78],"chosen":[79],"intuitively":[80],"network":[83],"based":[84],"heuristic.":[85],"paper":[88],"we":[89,103,131],"review":[90],"formalize":[92],"existing":[93],"including":[95],"hierarchical":[97],"clustering":[98,108],"approach":[99,122],"first.":[100],"addition,":[102],"present":[104],"modified":[106],"k-means":[107,178],"algorithm":[109],"density":[113],"well":[116],"statistical":[119,189],"motivated":[120],"smoothing":[121,190],"using":[123],"Nadaraya-Watson":[125],"kernel-weighted":[126],"average.":[127],"For":[128],"performance":[129],"evaluation":[130],"apply":[132],"all":[133],"methods":[134],"on":[135],"90":[137],"days":[138],"world":[140],"dataset":[141],"consisting":[142],"1.3":[144],"million":[145],"different":[146],"try":[151],"predict":[153],"users":[155],"following":[158],"next":[159],"10":[160],"days.":[161],"ROC":[162],"curves":[163],"an":[165],"example":[166],"DDoS":[167,201],"scenario":[169],"show":[170],"that":[171],"there":[172],"no":[174],"uniformly":[175],"better":[176,192],"approach:":[177],"performs":[179],"best":[180],"when":[181],"high":[183],"rate":[185,197],"needed":[187],"whereas":[188],"works":[191],"low":[194],"false":[195],"alarm":[196],"requirements":[198],"like":[199],"scenario.":[203]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2020,"cited_by_count":2},{"year":2018,"cited_by_count":1},{"year":2014,"cited_by_count":1},{"year":2012,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}