@article{journals/expert/RehakPGSBC09,
  author = {Rehák, Martin and Pechoucek, Michal and Grill, Martin and Stiborek, Jan and Bartos, Karel and Celeda, Pavel},
  ee = {http://doi.ieeecomputersociety.org/10.1109/MIS.2009.42},
  interhash = {878f9ec500bf1b485f337afe0abe1801},
  intrahash = {502b8b47f7e3ee930f2d79bde0b29d76},
  journal = {IEEE Intelligent Systems},
  number = 3,
  pages = {16-25},
  title = {Adaptive Multiagent System for Network Traffic Monitoring.},
  url = {http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.149.3921&rep=rep1&type=pdf},
  volume = 24,
  year = 2009
}

@article{dainotti2012extracting,
  abstract = {Unsolicited one-way Internet traffic, also called Internet background radiation (IBR), has been used for years to study malicious activity on the Internet, including worms, DoS attacks, and scanning address space looking for vulnerabilities to exploit. We show how such traffic can also be used to analyze macroscopic Internet events that are unrelated to malware. We examine two phenomena: country-level censorship of Internet communications described in recent work, and natural disasters (two recent earthquakes). We introduce a new metric of local IBR activity based on the number of unique IP addresses per hour contributing to IBR. The advantage of this metric is that it is not affected by bursts of traffic from a few hosts. Although we have only scratched the surface, we are convinced that IBR traffic is an important building block for comprehensive monitoring, analysis, and possibly even detection of events unrelated to the IBR itself. In particular, IBR offers the opportunity to monitor the impact of events such as natural disasters on network infrastructure, and in particular reveals a view of events that is complementary to many existing measurement platforms based on (BGP) control-plane views or targeted active ICMP probing.},
  acmid = {2096154},
  address = {New York, NY, USA},
  author = {Dainotti, Alberto and Amman, Roman and Aben, Emile and Claffy, Kimberly C.},
  doi = {10.1145/2096149.2096154},
  interhash = {7c97d11971a9b652c00e0487bfc79d54},
  intrahash = {dc796731675fad942af97e1bd0c17366},
  issn = {0146-4833},
  journal = {SIGCOMM Computer Communication Review},
  month = jan,
  number = 1,
  numpages = {9},
  pages = {31--39},
  publisher = {ACM},
  title = {Extracting benefit from harm: using malware pollution to analyze the impact of political and geophysical events on the internet},
  url = {http://doi.acm.org/10.1145/2096149.2096154},
  volume = 42,
  year = 2012
}

@inproceedings{meiss2008ranking,
  abstract = {We analyze the traffic-weighted Web host graph obtained from a large sample of real Web users over about seven months. A number of interesting structural properties are revealed by this complex dynamic network, some in line with the well-studied boolean link host graph and others pointing to important differences. We find that while search is directly involved in a surprisingly small fraction of user clicks, it leads to a much larger fraction of all sites visited. The temporal traffic patterns display strong regularities, with a large portion of future requests being statistically predictable by past ones. Given the importance of topological measures such as PageRank in modeling user navigation, as well as their role in ranking sites for Web search, we use the traffic data to validate the PageRank random surfing model. The ranking obtained by the actual frequency with which a site is visited by users differs significantly from that approximated by the uniform surfing/teleportation behavior modeled by PageRank, especially for the most important sites. To interpret this finding, we consider each of the fundamental assumptions underlying PageRank and show how each is violated by actual user behavior},
  address = {New York, NY, USA},
  author = {Meiss, Mark R. and Menczer, Filippo and Fortunato, Santo and Flammini, Alessandro and Vespignani, Alessandro},
  booktitle = {WSDM '08: Proceedings of the international conference on Web search and web data mining},
  doi = {http://doi.acm.org/10.1145/1341531.1341543},
  interhash = {fa73cddce5412036c7aceb46da32b3de},
  intrahash = {7515e498f5a5cf00d23c0c8a92099118},
  isbn = {978-1-59593-927-9},
  location = {Palo Alto, California, USA},
  pages = {65--76},
  publisher = {ACM},
  title = {Ranking web sites with real user traffic},
  url = {http://portal.acm.org/citation.cfm?id=1341543},
  year = 2008
}

@inproceedings{Chietal02,
  author = {Chi, E.H. and Rosien, A. and Heer, J.},
  bibsource = {DBLP, http://dblp.uni-trier.de},
  booktitle = {\cite{webkdd02}},
  interhash = {1b9ed5289bc9d1cccc49b088acdbd218},
  intrahash = {74fc583dc7492a2c51e78b0d7a522fe9},
  pages = {1--15},
  title = {Intelligent discovery and analysis of web user traffic composition},
  year = 2002
}