{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T13:28:44Z","timestamp":1772112524919,"version":"3.50.1"},"reference-count":44,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2025,6,1]],"date-time":"2025-06-01T00:00:00Z","timestamp":1748736000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2025,6,1]],"date-time":"2025-06-01T00:00:00Z","timestamp":1748736000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2025,4,29]],"date-time":"2025-04-29T00:00:00Z","timestamp":1745884800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2025,6]]},"DOI":"10.1016\/j.comnet.2025.111276","type":"journal-article","created":{"date-parts":[[2025,4,28]],"date-time":"2025-04-28T15:24:18Z","timestamp":1745853858000},"page":"111276","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":8,"special_numbering":"C","title":["Histogram-based network traffic representation for anomaly detection through PCA"],"prefix":"10.1016","volume":"265","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5642-3430","authenticated-orcid":false,"given":"Sara","family":"Baldoni","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0846-5879","authenticated-orcid":false,"given":"Federica","family":"Battisti","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.comnet.2025.111276_b1","doi-asserted-by":"crossref","first-page":"965","DOI":"10.1109\/TIFS.2022.3233777","article-title":"Intrusion detection scheme with dimensionality reduction in next generation networks","volume":"18","author":"Sood","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2025.111276_b2","series-title":"2024 Data Breach Investigations Report","author":"Hylender","year":"2024"},{"key":"10.1016\/j.comnet.2025.111276_b3","series-title":"Iran-based cyber actors enabling ransomware attacks on US organizations","author":"CISA","year":"2024"},{"key":"10.1016\/j.comnet.2025.111276_b4","doi-asserted-by":"crossref","first-page":"2157","DOI":"10.1109\/TIFS.2021.3050605","article-title":"Random partitioning forest for point-wise and collective anomaly detection\u2014Application to network intrusion detection","volume":"16","author":"Marteau","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2025.111276_b5","doi-asserted-by":"crossref","first-page":"3540","DOI":"10.1109\/TIFS.2020.2991876","article-title":"A method of few-shot network intrusion detection based on meta-learning framework","volume":"15","author":"Xu","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2025.111276_b6","series-title":"IEEE INFOCOM 2023 - IEEE Conference on Computer Communications","first-page":"1","article-title":"Federated PCA on grassmann manifold for anomaly detection in IoT networks","author":"Nguyen","year":"2023"},{"key":"10.1016\/j.comnet.2025.111276_b7","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2020.102688","article-title":"A network intrusion detection method based on semantic re-encoding and deep learning","volume":"164","author":"Wu","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"issue":"12","key":"10.1016\/j.comnet.2025.111276_b8","doi-asserted-by":"crossref","DOI":"10.3390\/fi16120470","article-title":"Characterising payload entropy in packet flows\u2014Baseline entropy analysis for network anomaly detection","volume":"16","author":"Kenyon","year":"2024","journal-title":"Futur. Internet"},{"key":"10.1016\/j.comnet.2025.111276_b9","doi-asserted-by":"crossref","first-page":"2703","DOI":"10.1109\/TIFS.2022.3191493","article-title":"Wrongdoing monitor: A graph-based behavioral anomaly detection in cyber security","volume":"17","author":"Wang","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2025.111276_b10","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2021.103079","article-title":"A fast all-packets-based DDoS attack detection approach based on network graph and graph kernel","volume":"185","author":"Liu","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.comnet.2025.111276_b11","series-title":"2020 IEEE Sixth International Conference on Big Data Computing Service and Applications, BigDataService","first-page":"165","article-title":"Unsupervised learning for network flow based anomaly detection in the era of deep learning","author":"Kabir","year":"2020"},{"key":"10.1016\/j.comnet.2025.111276_b12","doi-asserted-by":"crossref","first-page":"136805","DOI":"10.1109\/ACCESS.2024.3458903","article-title":"Enhancing network traffic anomaly detection: Leveraging temporal correlation index in a hybrid framework","volume":"12","author":"Nasreen Fathima","year":"2024","journal-title":"IEEE Access"},{"key":"10.1016\/j.comnet.2025.111276_b13","article-title":"Anomaly detection in NetFlow network traffic using supervised machine learning algorithms","volume":"33","author":"Fosi\u0107","year":"2023","journal-title":"J. Ind. Inf. Integr."},{"key":"10.1016\/j.comnet.2025.111276_b14","series-title":"International Conference on Flexible Query Answering Systems","first-page":"194","article-title":"Exploring hidden anomalies in UGR\u201916 network dataset with kitsune","author":"Medina-Arco","year":"2023"},{"key":"10.1016\/j.comnet.2025.111276_b15","series-title":"Proceedings of the 16th ACM Symposium on QoS and Security for Wireless and Mobile Networks","first-page":"37","article-title":"Network anomaly detection using LSTM based autoencoder","author":"Said Elsayed","year":"2020"},{"key":"10.1016\/j.comnet.2025.111276_b16","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2019.107049","article-title":"HELAD: A novel network anomaly detection model based on heterogeneous ensemble learning","volume":"169","author":"Zhong","year":"2020","journal-title":"Comput. Netw."},{"issue":"11","key":"10.1016\/j.comnet.2025.111276_b17","doi-asserted-by":"crossref","first-page":"5291","DOI":"10.1007\/s13042-024-02237-w","article-title":"Unsupervised anomaly detection approach for cyberattack identification","volume":"15","author":"Segurola-Gil","year":"2024","journal-title":"Int. J. Mach. Learn. Cybern."},{"key":"10.1016\/j.comnet.2025.111276_b18","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2021.103106","article-title":"Prepare for trouble and make it double! Supervised \u2013 unsupervised stacking for anomaly-based intrusion detection","volume":"189","author":"Zoppi","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.comnet.2025.111276_b19","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2020\/4586875","article-title":"A stacking ensemble for network intrusion detection using heterogeneous datasets","volume":"2020","author":"Rajagopal","year":"2020","journal-title":"Secur. Commun. Networks"},{"key":"10.1016\/j.comnet.2025.111276_b20","doi-asserted-by":"crossref","first-page":"1525","DOI":"10.1109\/TIFS.2019.2943236","article-title":"Deep learning hierarchical representation from heterogeneous flow-level communication data","volume":"15","author":"Shao","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2025.111276_b21","doi-asserted-by":"crossref","first-page":"30387","DOI":"10.1109\/ACCESS.2020.2973023","article-title":"An unsupervised deep learning model for early network traffic anomaly detection","volume":"8","author":"Hwang","year":"2020","journal-title":"IEEE Access"},{"issue":"1","key":"10.1016\/j.comnet.2025.111276_b22","article-title":"A multi-information fusion anomaly detection model based on convolutional neural networks and AutoEncoder","volume":"14","author":"Zhao","year":"2024","journal-title":"Sci. Rep."},{"key":"10.1016\/j.comnet.2025.111276_b23","article-title":"Network intrusion detection through stacking dilated convolutional autoencoders","volume":"2017","author":"Yu","year":"2017","journal-title":"Secur. Commun. Networks"},{"key":"10.1016\/j.comnet.2025.111276_b24","doi-asserted-by":"crossref","first-page":"116216","DOI":"10.1109\/ACCESS.2020.3004699","article-title":"CBFS: A clustering-based feature selection mechanism for network anomaly detection","volume":"8","author":"Mao","year":"2020","journal-title":"IEEE Access"},{"key":"10.1016\/j.comnet.2025.111276_b25","doi-asserted-by":"crossref","first-page":"1127","DOI":"10.1007\/s10994-020-05870-y","article-title":"Detecting anomalous packets in network transfers: Investigations using PCA, autoencoder and isolation forest in TCP","volume":"109","author":"Kiran","year":"2020","journal-title":"Mach. Learn."},{"key":"10.1016\/j.comnet.2025.111276_b26","series-title":"2020 7th International Conference on Electrical Engineering, Computer Sciences and Informatics","first-page":"114","article-title":"Features extraction on IoT intrusion detection system using principal components analysis (PCA)","author":"Sharipuddin","year":"2020"},{"issue":"8","key":"10.1016\/j.comnet.2025.111276_b27","doi-asserted-by":"crossref","first-page":"2179","DOI":"10.1109\/TIFS.2019.2894358","article-title":"Semi-supervised multivariate statistical network monitoring for learning security threats","volume":"14","author":"Camacho","year":"2019","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2025.111276_b28","series-title":"Evo* 2023 \u2013 late-breaking abstracts volume","author":"Mora","year":"2024"},{"key":"10.1016\/j.comnet.2025.111276_b29","series-title":"International Work-Conference on Artificial Neural Networks","first-page":"55","article-title":"Optimizing an IDS (intrusion detection system) by means of advanced metaheuristics","author":"Mora","year":"2023"},{"issue":"5","key":"10.1016\/j.comnet.2025.111276_b30","doi-asserted-by":"crossref","DOI":"10.3390\/app10051775","article-title":"Towards a reliable comparison and evaluation of network intrusion detection systems based on machine learning approaches","volume":"10","author":"Mag\u00e1n-Carri\u00f3n","year":"2020","journal-title":"Appl. Sci."},{"issue":"3","key":"10.1016\/j.comnet.2025.111276_b31","doi-asserted-by":"crossref","first-page":"1217","DOI":"10.1109\/TNET.2021.3138536","article-title":"Leveraging a probabilistic PCA model to understand the multivariate statistical network monitoring framework for network security anomaly detection","volume":"30","author":"P\u00e9rez-Bueno","year":"2022","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"10.1016\/j.comnet.2025.111276_b32","doi-asserted-by":"crossref","first-page":"206","DOI":"10.1016\/j.comcom.2022.10.024","article-title":"Network traffic anomaly detection method based on multi-scale residual classifier","volume":"198","author":"Duan","year":"2023","journal-title":"Comput. Commun."},{"key":"10.1016\/j.comnet.2025.111276_b33","doi-asserted-by":"crossref","first-page":"90603","DOI":"10.1109\/ACCESS.2021.3090957","article-title":"Unsupervised algorithms to detect zero-day attacks: Strategy and application","volume":"9","author":"Zoppi","year":"2021","journal-title":"IEEE Access"},{"key":"10.1016\/j.comnet.2025.111276_b34","doi-asserted-by":"crossref","first-page":"175","DOI":"10.1016\/j.comcom.2022.11.001","article-title":"A review of machine learning-based zero-day attack detection: Challenges and future directions","volume":"198","author":"Guo","year":"2023","journal-title":"Comput. Commun."},{"key":"10.1016\/j.comnet.2025.111276_b35","series-title":"Kitsune: An ensemble of autoencoders for online network intrusion detection","author":"Mirsky","year":"2018"},{"key":"10.1016\/j.comnet.2025.111276_b36","series-title":"2014 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS","first-page":"500","article-title":"Tackling the big data 4 vs for anomaly detection","author":"Camacho","year":"2014"},{"issue":"10","key":"10.1016\/j.comnet.2025.111276_b37","doi-asserted-by":"crossref","first-page":"8658","DOI":"10.1109\/JIOT.2023.3245153","article-title":"Feature engineering and machine learning framework for DDoS attack detection in the standardized Internet of Things","volume":"10","author":"Kamaldeep","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.comnet.2025.111276_b38","doi-asserted-by":"crossref","DOI":"10.3389\/frsip.2021.814129","article-title":"Analysis of a 2D representation for CPS anomaly detection in a context-based security framework","volume":"1","author":"Baldoni","year":"2022","journal-title":"Front. Signal Process."},{"key":"10.1016\/j.comnet.2025.111276_b39","doi-asserted-by":"crossref","first-page":"411","DOI":"10.1016\/j.cose.2017.11.004","article-title":"UGR \u201816: A new dataset for the evaluation of cyclostationarity-based network IDSs","volume":"73","author":"Maci\u00e1-Fern\u00e1ndez","year":"2018","journal-title":"Comput. Secur."},{"issue":"1","key":"10.1016\/j.comnet.2025.111276_b40","doi-asserted-by":"crossref","first-page":"73","DOI":"10.1002\/widm.2","article-title":"Robust statistics for outlier detection","volume":"1","author":"Rousseeuw","year":"2011","journal-title":"WIREs Data Min. Knowl. Discov."},{"key":"10.1016\/j.comnet.2025.111276_b41","series-title":"Military Communications and Information Systems Conference, MilCIS","first-page":"1","article-title":"UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)","author":"Moustafa","year":"2015"},{"key":"10.1016\/j.comnet.2025.111276_b42","series-title":"Proceedings of the 4th International Conference on Information Systems Security and Privacy, ICISSP, INSTICC","first-page":"108","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","author":"Sharafaldin","year":"2018"},{"key":"10.1016\/j.comnet.2025.111276_b43","series-title":"Itrust datasets","author":"iTrust, Centre for Research in Cyber Security, Singapore University of Technology and Design","year":"2021"},{"key":"10.1016\/j.comnet.2025.111276_b44","series-title":"Advances in Artificial Intelligence","first-page":"508","article-title":"A scheme for generating a dataset for anomalous activity detection in IoT networks","author":"Ullah","year":"2020"}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128625002440?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128625002440?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,5,9]],"date-time":"2025-05-09T21:51:34Z","timestamp":1746827494000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128625002440"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6]]},"references-count":44,"alternative-id":["S1389128625002440"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2025.111276","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2025,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Histogram-based network traffic representation for anomaly detection through PCA","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2025.111276","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2025 The Authors. Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"111276"}}