{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,4,24]],"date-time":"2024-04-24T05:50:53Z","timestamp":1713937853362},"reference-count":33,"publisher":"Wiley","issue":"20","license":[{"start":{"date-parts":[[2019,5,21]],"date-time":"2019-05-21T00:00:00Z","timestamp":1558396800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"funder":[{"DOI":"10.13039\/501100003593","name":"Conselho Nacional de Desenvolvimento Cient\u00edfico e Tecnol\u00f3gico","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100003593","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002322","name":"Coordena\u00e7\u00e3o de Aperfei\u00e7oamento de Pessoal de N\u00edvel Superior","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002322","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004586","name":"Funda\u00e7\u00e3o Carlos Chagas Filho de Amparo \u00e0 Pesquisa do Estado do Rio de Janeiro","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004586","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001807","name":"Funda\u00e7\u00e3o de Amparo \u00e0 Pesquisa do Estado de S\u00e3o Paulo","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001807","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Concurrency and Computation"],"published-print":{"date-parts":[[2019,10,25]]},"abstract":"Summary<\/jats:title>The late detection of security threats causes a significant increase in the risk of irreparable damages and restricts any defense attempt. In this paper, we propose a sCA<\/jats:bold>lable TR<\/jats:bold>Affic C<\/jats:bold>lassifier and A<\/jats:bold>nalyzer (CATRACA). CATRACA works as an efficient online Intrusion Detection and Prevention System implemented as a Virtualized Network Function. CATRACA is based on Apache Spark, a Big Data Streaming processing system, and it is deployed over the Open Platform for Network Functions Virtualization (OPNFV), providing an accurate real\u2010time threat\u2010detection service. The system presents a friendly graphical interface that provides real\u2010time visualization of the traffic and the attacks that occur in the network. Our prototype can differentiate normal traffic from denial of service (DoS) attacks and vulnerability probes over 95% accuracy under three different datasets. Moreover, CATRACA handles streaming data under concept drift detection with more than 85% of accuracy.<\/jats:p>","DOI":"10.1002\/cpe.5344","type":"journal-article","created":{"date-parts":[[2019,5,22]],"date-time":"2019-05-22T03:07:32Z","timestamp":1558494452000},"update-policy":"http:\/\/dx.doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":18,"title":["Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data"],"prefix":"10.1002","volume":"31","author":[{"ORCID":"http:\/\/orcid.org\/0000-0002-4170-4341","authenticated-orcid":false,"given":"Martin","family":"Andreoni Lopez","sequence":"first","affiliation":[{"name":"Universidade Federal do Rio de Janeiro \u2010 GTA\/COPPE\/UFRJ Rio de Janeiro Brazil"},{"name":"Sorbonne Universit\u00e9, CNRS Laboratoire d'Informatique de Paris 6 Paris France"}]},{"given":"Diogo M. F.","family":"Mattos","sequence":"additional","affiliation":[{"name":"Universidade Federal do Rio de Janeiro \u2010 GTA\/COPPE\/UFRJ Rio de Janeiro Brazil"},{"name":"Universidade Federal Fluminense \u2010 TET\/PPGEET\/UFF Niter\u00f3i Brazil"}]},{"given":"Otto Carlos M. B.","family":"Duarte","sequence":"additional","affiliation":[{"name":"Universidade Federal do Rio de Janeiro \u2010 GTA\/COPPE\/UFRJ Rio de Janeiro Brazil"}]},{"given":"Guy","family":"Pujolle","sequence":"additional","affiliation":[{"name":"Sorbonne Universit\u00e9, CNRS Laboratoire d'Informatique de Paris 6 Paris France"}]}],"member":"311","published-online":{"date-parts":[[2019,5,21]]},"reference":[{"key":"e_1_2_7_2_1","doi-asserted-by":"crossref","unstructured":"B\u00e4rA FinamoreA CasasP GolabL MelliaM.Large\u2010scale network traffic monitoring with DBStream a system for rolling big data analysis. Paper presented at: IEEE International Conference on Big Data;2014;Washington DC.","DOI":"10.1109\/BigData.2014.7004227"},{"key":"e_1_2_7_3_1","doi-asserted-by":"crossref","unstructured":"HuP LiH FuH CanseverD MohapatraP.Dynamic defense strategy against advanced persistent threat with insiders. Paper presented at: 2015 IEEE Conference on Computer Communications (INFOCOM) IEEE;2015;Kowloon Hong Kong.","DOI":"10.1109\/INFOCOM.2015.7218444"},{"key":"e_1_2_7_4_1","unstructured":"Verizon Enterprise.Data Breach Investigations Report.www.verizonenterprise.com\/resources\/reports\/rp_DBIR_2016_Report_en_xg.pdf.2016."},{"key":"e_1_2_7_5_1","doi-asserted-by":"crossref","unstructured":"WuK ZhangK FanW EdwardsA YuPS.RS\u2010forest: a rapid density estimator for streaming anomaly detection. Paper presented at: IEEE International Conference on Data Mining (ICDM);2014;Shenzhen China.","DOI":"10.1109\/ICDM.2014.45"},{"key":"e_1_2_7_6_1","doi-asserted-by":"crossref","unstructured":"MayhewM AtighetchiM AdlerA GreenstadtR.Use of machine learning in big data analytics for insider threat detection. Paper presented at: IEEE Military Communications Conference (MILCOM);2015;Tampa FL.","DOI":"10.1109\/MILCOM.2015.7357562"},{"key":"e_1_2_7_7_1","doi-asserted-by":"crossref","unstructured":"ToshniwalA TanejaS ShuklaA et al.Storm@Twitter. In: Proceedings of the 2014 ACM SIGMOD International Conference on Management of Data;2014;Snowbird UT.","DOI":"10.1145\/2588555.2595641"},{"key":"e_1_2_7_8_1","unstructured":"CarboneP F\u00f3raG HaridiS TzoumasK.Lightweight asynchronous snapshots for distributed dataflows. arXiv preprint arXiv:1506.08603.2015."},{"key":"e_1_2_7_9_1","doi-asserted-by":"crossref","unstructured":"FranklinM.The Berkeley data analytics stack: present and future. Paper presented at: IEEE International Conference on Big Data IEEE;2013;Silicon Valley CA.","DOI":"10.1109\/BigData.2013.6691545"},{"key":"e_1_2_7_10_1","doi-asserted-by":"crossref","unstructured":"LopezMA LobatoAGP DuarteOCMB PujolleG.An evaluation of a virtual network function for real\u2010time threat detection using stream processing. Paper presented at: IEEE Fourth International Conference on Mobile and Secure Services (MobiSecServ);2018;Miami Beach FL.","DOI":"10.1109\/MOBISECSERV.2018.8311440"},{"key":"e_1_2_7_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/s12243-016-0506-y"},{"key":"e_1_2_7_12_1","doi-asserted-by":"crossref","unstructured":"DuY LiuJ LiuF ChenL.A real\u2010time anomalies detection system based on streaming technology. Paper presented at: Sixth International Conference on Intelligent Human\u2010Machine Systems and Cybernetics (IHMSC);2014;Hangzhou China.","DOI":"10.1109\/IHMSC.2014.168"},{"key":"e_1_2_7_13_1","doi-asserted-by":"crossref","unstructured":"ZhaoS ChandrashekarM LeeY MedhiD.Real\u2010time network anomaly detection system using machine learning. Paper presented at: 11th International Conference on the Design of Reliable Communication Networks (DRCN);2015;Kansas City MO.","DOI":"10.1109\/DRCN.2015.7149025"},{"key":"e_1_2_7_14_1","doi-asserted-by":"crossref","unstructured":"HeG TanC YuD WuX.A real\u2010time network traffic anomaly detection system based on storm. Paper presented at: 7th International Conference on Intelligent Human\u2010Machine Systems and Cybernetics;2015;Hangzhou China.","DOI":"10.1109\/IHMSC.2015.152"},{"key":"e_1_2_7_15_1","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.3633"},{"key":"e_1_2_7_16_1","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.3955"},{"key":"e_1_2_7_17_1","doi-asserted-by":"crossref","unstructured":"LeeW StolfoSJ MokKW.Mining in a data\u2010flow environment: experience in network intrusion detection. In: Proceedings of the Fifth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining;1999;San Diego CA.","DOI":"10.1145\/312129.312212"},{"key":"e_1_2_7_18_1","volume-title":"Network Security with NetFlow and IPFIX: Big Data Analytics for Information Security","author":"Santos O","year":"2015"},{"key":"e_1_2_7_19_1","unstructured":"Apache Software Foundation.Apache Metron. Apache.2017."},{"key":"e_1_2_7_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2017.1600972"},{"key":"e_1_2_7_21_1","doi-asserted-by":"crossref","unstructured":"SanzIJ MattosDMF DuarteOCMB.SFCPerf: an automatic performance evaluation framework for service function chaining. Paper presented at: IEEE\/IFIP Network Operations and Management Symposium (NOMS 2018);2018;Taipei Taiwan.","DOI":"10.1109\/NOMS.2018.8406237"},{"key":"e_1_2_7_22_1","doi-asserted-by":"crossref","unstructured":"JeonH LeeB.Network service chaining challenges for VNF outsourcing in network function virtualization. Paper presented at: International Conference on Information and Communication Technology Convergence (ICTC);2015;Jeju Island South Korea.","DOI":"10.1109\/ICTC.2015.7354674"},{"key":"e_1_2_7_23_1","doi-asserted-by":"crossref","unstructured":"LopezMA LobatoAGP DuarteOCMB.A performance comparison of open\u2010source stream processing platforms. Paper presented at: IEEE Global Communications Conference (GLOBECOM);2016;Washington DC.","DOI":"10.1109\/GLOCOM.2016.7841533"},{"key":"e_1_2_7_24_1","doi-asserted-by":"crossref","unstructured":"TavallaeeM BagheriE LuW GhorbaniAA.A detailed analysis of the KDD CUP 99 data set. In: Proceedings of the Second IEEE Symposium on Computational Intelligence for Security and Defence Applications;2009;Ottawa Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"e_1_2_7_25_1","doi-asserted-by":"crossref","unstructured":"LobatoAGP LopezMA SanzIJ C\u00e1rdenasA DuarteOCMB PujolleG.An adaptive real\u2010time architecture for zero\u2010day threat detection. Paper presented at: IEEE International Conference on Communications (ICC);2018;Kansas City MO.","DOI":"10.1109\/ICC.2018.8422622"},{"key":"e_1_2_7_26_1","doi-asserted-by":"crossref","unstructured":"LopezMA SilvaSR AlvarengaID et al.Collecting and characterizing a real broadband access network traffic dataset. Paper presented at: 1st Cyber Security in Networking Conference (CSNet);2017;Rio de Janeiro Brazil.","DOI":"10.1109\/CSNET.2017.8241999"},{"key":"e_1_2_7_27_1","volume-title":"Principal Component Analysis","author":"Jolliffe I","year":"2011"},{"key":"e_1_2_7_28_1","doi-asserted-by":"publisher","DOI":"10.1613\/jair.953"},{"key":"e_1_2_7_29_1","unstructured":"HeH BaiY GarciaEA LiS.ADASYN: adaptive synthetic sampling approach for imbalanced learning. In: Proceedings of the 5th IEEE International Joint Conference on Neural Networks;2008;Hong Kong."},{"key":"e_1_2_7_30_1","doi-asserted-by":"crossref","unstructured":"SommerR PaxsonV.Outside the closed world: on using machine learning for network intrusion detection. Paper presented at: IEEE Symposium on Security and Privacy;2010;Berkeley\/Oakland CA.","DOI":"10.1109\/SP.2010.25"},{"key":"e_1_2_7_31_1","doi-asserted-by":"crossref","unstructured":"ZahediSM LlullQ LeeBC.Amdahl's law in the datacenter era: a market for fair processor allocation. Paper presented at: IEEE International Symposium on High Performance Computer Architecture (HPCA);2018;Vienna Austria.","DOI":"10.1109\/HPCA.2018.00011"},{"key":"e_1_2_7_32_1","unstructured":"JordaneyR SharadK DashSK et al.Transcend: detecting concept drift in malware classification models. In: Proceedings of the 26th USENIX Conference on Security Symposium;2017;Vancouver Canada."},{"key":"e_1_2_7_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2017.04.008"},{"key":"e_1_2_7_34_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-009-0206-2"}],"container-title":["Concurrency and Computation: Practice and Experience"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fcpe.5344","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/cpe.5344","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1002\/cpe.5344","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/cpe.5344","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,9,2]],"date-time":"2023-09-02T12:22:49Z","timestamp":1693657369000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/cpe.5344"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,5,21]]},"references-count":33,"journal-issue":{"issue":"20","published-print":{"date-parts":[[2019,10,25]]}},"alternative-id":["10.1002\/cpe.5344"],"URL":"https:\/\/doi.org\/10.1002\/cpe.5344","archive":["Portico"],"relation":{},"ISSN":["1532-0626","1532-0634"],"issn-type":[{"value":"1532-0626","type":"print"},{"value":"1532-0634","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,5,21]]},"assertion":[{"value":"2018-07-24","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-04-23","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-05-21","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}