{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,5]],"date-time":"2024-09-05T17:54:00Z","timestamp":1725558840790},"reference-count":36,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2022,3,19]],"date-time":"2022-03-19T00:00:00Z","timestamp":1647648000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,3,19]],"date-time":"2022-03-19T00:00:00Z","timestamp":1647648000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Software Qual J"],"published-print":{"date-parts":[[2022,12]]},"DOI":"10.1007\/s11219-022-09587-0","type":"journal-article","created":{"date-parts":[[2022,3,19]],"date-time":"2022-03-19T05:02:57Z","timestamp":1647666177000},"page":"955-981","update-policy":"http:\/\/dx.doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":21,"title":["Transferability of machine learning models learned from public intrusion detection datasets: the CICIDS2017 case study"],"prefix":"10.1007","volume":"30","author":[{"ORCID":"http:\/\/orcid.org\/0000-0002-5025-7969","authenticated-orcid":false,"given":"Marta","family":"Catillo","sequence":"first","affiliation":[]},{"given":"Andrea","family":"Del Vecchio","sequence":"additional","affiliation":[]},{"given":"Antonio","family":"Pecchia","sequence":"additional","affiliation":[]},{"given":"Umberto","family":"Villano","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,3,19]]},"reference":[{"key":"9587_CR1","doi-asserted-by":"crossref","unstructured":"Ahmad, Z., Shahid Khan, A., Wai Shiang, C., Abdullah, J., & Ahmad, F. (2021). Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32, e4150.","DOI":"10.1002\/ett.4150"},{"key":"9587_CR2","doi-asserted-by":"crossref","unstructured":"Ahmim, A., Maglaras, L., Ferrag, M.\u00a0A., Derdour, M., & Janicke, H. (2019). A novel hierarchical intrusion detection system based on decision tree and rules-based models. In Proc. International Conference on Distributed Computing in Sensor Systems (pp. 228\u2013233). IEEE.","DOI":"10.1109\/DCOSS.2019.00059"},{"key":"9587_CR3","doi-asserted-by":"crossref","unstructured":"Ali, O., & Cotae, P. (2018). Towards DoS\/DDoS attack detection using artificial neural networks. In Proc. Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (pp. 229\u2013234). IEEE.","DOI":"10.1109\/UEMCON.2018.8796637"},{"key":"9587_CR4","unstructured":"Beer, F., Hofer, T., Karimi, D., & B\u00fchler, U. (2017). A new attack composition for network security. In 10. DFN-Forum Kommunikationstechnologien (pp. 11\u201320). Gesellschaft fur Informatik e.V."},{"key":"9587_CR5","doi-asserted-by":"crossref","unstructured":"Bowen, T., Poylisher, A., Serban, C., Chadha, R., Jason Chiang, C., & Marvel, L.\u00a0M. (2016). Enabling reproducible cyber research - Four labeled datasets. In Proc. Military Communications Conference (pp. 539\u2013544). IEEE.","DOI":"10.1109\/MILCOM.2016.7795383"},{"key":"9587_CR6","doi-asserted-by":"crossref","unstructured":"Catillo, M., Del Vecchio, A., Ocone, L., Pecchia, A., & Villano, U. (2021a). USB-IDS-1: A public multilayer dataset of labeled network flows for IDS evaluation. In Proc. International Conference on Dependable Systems and Networks Workshops (pp. 1\u20136). IEEE.","DOI":"10.1109\/DSN-W52860.2021.00012"},{"key":"9587_CR7","doi-asserted-by":"crossref","unstructured":"Catillo, M., Del\u00a0Vecchio, A., Pecchia, A., & Villano, U. (2021b). A critique on the use of machine learning on public datasets for intrusion detection. In A.\u00a0C.\u00a0R. Paiva, A.\u00a0R. Cavalli, P.\u00a0Ventura\u00a0Martins, & R.\u00a0P\u00e9rez-Castillo (Eds.), Quality of information and communications technology (pp. 253\u2013266). Springer.","DOI":"10.1007\/978-3-030-85347-1_19"},{"key":"9587_CR8","doi-asserted-by":"publisher","first-page":"102341","DOI":"10.1016\/j.cose.2021.102341","volume":"108","author":"M Catillo","year":"2021","unstructured":"Catillo, M., Pecchia, A., Rak, M., & Villano, U. (2021). Demystifying the role of public intrusion datasets: A replication study of DoS network traffic data. Computers & Security, 108, 102341.","journal-title":"Computers & Security"},{"key":"9587_CR9","doi-asserted-by":"crossref","unstructured":"Catillo, M., Pecchia, A., & Villano, U. (2022). AutoLog: Anomaly detection by deep autoencoding of system logs. Expert Systems with Applications, 191, 116263.","DOI":"10.1016\/j.eswa.2021.116263"},{"key":"9587_CR10","doi-asserted-by":"crossref","unstructured":"Engelen, G., Rimmer, V., & Joosen, W. (2021). Troubleshooting an intrusion detection dataset: The CICIDS2017 case study. In Proc. Security and Privacy Workshops (pp. 7\u201312). IEEE.","DOI":"10.1109\/SPW53761.2021.00009"},{"key":"9587_CR11","first-page":"1574749","volume":"2019","author":"F Filho","year":"2019","unstructured":"Filho, F., Silveira, F., Junior, A., Vargas-Solar, G., & Silveira, L. (2019). Smart detection: An online approach for DoS\/DDoS attack detection using machine learning. Security and Communication Networks, 2019, 1574749.","journal-title":"Security and Communication Networks"},{"key":"9587_CR12","doi-asserted-by":"crossref","unstructured":"Kayac\u0131k, H. G., & Zincir-Heywood, N. (2005). Analysis of three intrusion detection system benchmark datasets using machine learning algorithms. In P. Kantor, G. Muresan, F. Roberts, D. D. Zeng, F. Y. Wang, H. Chen, & R. C. Merkle (Eds.), Intelligence and security informatics (pp. 362\u2013367). Springer.","DOI":"10.1007\/11427995_29"},{"key":"9587_CR13","doi-asserted-by":"crossref","unstructured":"Kenyon, A., Deka, L., & Elizondo, D. (2020). Are public intrusion datasets fit for purpose characterising the state of the art in intrusion event datasets. Computers & Security, 99, 102022.","DOI":"10.1016\/j.cose.2020.102022"},{"key":"9587_CR14","doi-asserted-by":"publisher","first-page":"371","DOI":"10.1016\/j.icte.2020.12.006","volume":"7","author":"D Kshirsagar","year":"2021","unstructured":"Kshirsagar, D., & Kumar, S. (2021). An efficient feature reduction method for the detection of DoS attack. ICT Express, 7, 371\u2013375.","journal-title":"ICT Express"},{"key":"9587_CR15","doi-asserted-by":"publisher","first-page":"165607","DOI":"10.1109\/ACCESS.2019.2953095","volume":"7","author":"J Lee","year":"2019","unstructured":"Lee, J., Kim, J., Kim, I., & Han, K. (2019). Cyber threat detection based on artificial neural networks using event profiles. IEEE Access, 7, 165607\u2013165626.","journal-title":"IEEE Access"},{"key":"9587_CR16","unstructured":"Li, X., & Ye, N. (2003). Decision tree classifiers for computer intrusion detection. In Real-time system security (p. 77-93). Nova Science Publishers, Inc."},{"key":"9587_CR17","doi-asserted-by":"publisher","first-page":"4396","DOI":"10.3390\/app9204396","volume":"9","author":"H Liu","year":"2019","unstructured":"Liu, H., & Lang, B. (2019). Machine learning and deep learning methods for intrusion detection systems: A survey. Applied Sciences, 9, 4396.","journal-title":"Applied Sciences"},{"key":"9587_CR18","doi-asserted-by":"publisher","first-page":"411","DOI":"10.1016\/j.cose.2017.11.004","volume":"73","author":"G Maci\u00e1-Fern\u00e1ndez","year":"2017","unstructured":"Maci\u00e1-Fern\u00e1ndez, G., Camacho, J., Mag\u00e1n-Carri\u00f3n, R., Garc\u00eda-Teodoro, P., & Ther\u00f3n, R. (2017). UGR\u201916: A new dataset for the evaluation of cyclostationarity-based network IDSs. Computer & Security, 73, 411\u2013424.","journal-title":"Computer & Security"},{"key":"9587_CR19","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1145\/382912.382923","volume":"3","author":"J McHugh","year":"2000","unstructured":"McHugh, J. (2000). Testing Intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory. ACM Transactions on Information and System Security, 3, 262\u2013294.","journal-title":"ACM Transactions on Information and System Security"},{"key":"9587_CR20","doi-asserted-by":"crossref","unstructured":"Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In Proc. Military Communications and Information Systems Conference (pp. 1\u20136). IEEE.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"9587_CR21","doi-asserted-by":"crossref","unstructured":"Nguyen, S., Nguyen, V., Choi, J., & Kim, K. (2018). Design and implementation of intrusion detection system using convolutional neural network for DoS detection. In Proc. International Conference on Machine Learning and Soft Computing (p. 34-38). ACM.","DOI":"10.1145\/3184066.3184089"},{"key":"9587_CR22","doi-asserted-by":"publisher","first-page":"1345","DOI":"10.1109\/TKDE.2009.191","volume":"22","author":"SJ Pan","year":"2010","unstructured":"Pan, S. J., & Yang, Q. (2010). A survey on transfer learning. IEEE Transactions on Knowledge and Data Engineering, 22, 1345\u20131359.","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"9587_CR23","doi-asserted-by":"publisher","first-page":"78434","DOI":"10.1109\/ACCESS.2019.2922737","volume":"7","author":"X Qu","year":"2019","unstructured":"Qu, X., Yang, L., Guo, K., Ma, L., Feng, T., Ren, S., & Sun, M. (2019). Statistics-enhanced direct batch growth self-organizing mapping for efficient DoS attack detection. IEEE Access, 7, 78434\u201378441.","journal-title":"IEEE Access"},{"key":"9587_CR24","first-page":"48","volume":"51","author":"PAA Resende","year":"2018","unstructured":"Resende, P. A. A., & Drummond, A. C. (2018). A survey of random forest based methods for intrusion detection systems. ACM Computing Surveys, 51, 48.","journal-title":"ACM Computing Surveys"},{"key":"9587_CR25","doi-asserted-by":"publisher","first-page":"147","DOI":"10.1016\/j.cose.2019.06.005","volume":"86","author":"M Ring","year":"2019","unstructured":"Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Hotho, A. (2019). A survey of network-based intrusion detection data sets. Computer & Security, 86, 147\u2013167.","journal-title":"Computer & Security"},{"key":"9587_CR26","doi-asserted-by":"crossref","unstructured":"Sacramento, L., Medeiros, I., Bota, J., & Correia, M. (2018). FlowHacker: Detecting unknown network attacks in big traffic data using network flows. In Proc. International Conference On Trust, Security And Privacy In Computing And Communications \/ International Conference On Big Data Science And Engineering (pp. 567\u2013572). IEEE.","DOI":"10.1109\/TrustCom\/BigDataSE.2018.00086"},{"key":"9587_CR27","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.\u00a0H., & Ghorbani., A.\u00a0A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. In Proc. International Conference on Information Systems Security and Privacy (pp. 108\u2013116). SciTePress.","DOI":"10.5220\/0006639801080116"},{"key":"9587_CR28","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1016\/j.icte.2018.04.003","volume":"4","author":"A Shenfield","year":"2018","unstructured":"Shenfield, A., Day, D., & Ayesh, A. (2018). Intelligent intrusion detection systems using artificial neural networks. ICT Express, 4, 95\u201399.","journal-title":"ICT Express"},{"key":"9587_CR29","doi-asserted-by":"crossref","unstructured":"Silva, J. V.\u00a0V., Lopez, M.\u00a0A., & Mattos, D. M.\u00a0F. (2020). Attackers are not stealthy: Statistical analysis of the well-known and infamous KDD network security dataset. In Proc. Conference on Cloud and Internet of Things (pp. 1\u20138). IEEE.","DOI":"10.1109\/CIoT50422.2020.9244289"},{"key":"9587_CR30","doi-asserted-by":"crossref","unstructured":"Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. In Proc. Symposium on Security and Privacy (pp. 305\u2013316). IEEE.","DOI":"10.1109\/SP.2010.25"},{"key":"9587_CR31","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A.\u00a0A. (2009). A detailed analysis of the KDD CUP 99 data set. In Proc. Symposium on Computational Intelligence for Security and Defense Applications (pp. 1\u20136). IEEE.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"9587_CR32","first-page":"516","volume":"40","author":"M Tavallaee","year":"2010","unstructured":"Tavallaee, M., Stakhanova, N., & Ghorbani, A. A. (2010). Toward credible evaluation of anomaly-based intrusion-detection methods. IEEE Transactions on Systems, Man, and Cybernetics. Part C (Applications and Reviews), 40, 516\u2013524.","journal-title":"Part C (Applications and Reviews)"},{"key":"9587_CR33","doi-asserted-by":"crossref","unstructured":"Verkerken, M., D\u2019hooge, L., Wauters, T., Volckaert, B., & De Turck, F. (2021). Towards model generalization for intrusion detection: Unsupervised machine learning techniques. Journal of Network and Systems Management, 30, 12.","DOI":"10.1007\/s10922-021-09615-7"},{"key":"9587_CR34","doi-asserted-by":"publisher","first-page":"200","DOI":"10.1016\/j.comnet.2017.08.013","volume":"127","author":"EK Viegas","year":"2017","unstructured":"Viegas, E. K., Santin, A. O., & Oliveira, L. S. (2017). Toward a reliable anomaly-based intrusion detection in real-world environments. Computer Networks, 127, 200\u2013216.","journal-title":"Computer Networks"},{"key":"9587_CR35","doi-asserted-by":"crossref","unstructured":"Wankhede, S., & Kshirsagar, D. (2018). DoS attack detection using machine learning and neural network. In Proc. International Conference on Computing Communication Control and Automation (pp. 1\u20135). IEEE.","DOI":"10.1109\/ICCUBEA.2018.8697702"},{"key":"9587_CR36","doi-asserted-by":"crossref","unstructured":"Wohlin, C., Runeson, P., H\u00f6st, M., Ohlsson, M.\u00a0C., Regnell, B., & Wessl\u00e9n, A. (2000). Experimentation in software engineering: An introduction. Kluwer Academic.","DOI":"10.1007\/978-1-4615-4625-2"}],"container-title":["Software Quality Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11219-022-09587-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11219-022-09587-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11219-022-09587-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,11,24]],"date-time":"2022-11-24T14:53:23Z","timestamp":1669301603000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11219-022-09587-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,3,19]]},"references-count":36,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2022,12]]}},"alternative-id":["9587"],"URL":"https:\/\/doi.org\/10.1007\/s11219-022-09587-0","relation":{},"ISSN":["0963-9314","1573-1367"],"issn-type":[{"value":"0963-9314","type":"print"},{"value":"1573-1367","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,3,19]]},"assertion":[{"value":"15 February 2022","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 March 2022","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}