A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
Round 1
Reviewer 1 Report
The paper proposed by athors entitled “A network traffic abnormal detection method: Sketch-based Profile Evolution”
After reading and analyzing of the work. The paper requires more improvements. Hence, I invite the authors to more revise their paper taking into consideration suggestions and revisions mentioned bellow:
1. The abstract should integrate clearly the problem statement, motivations and summary of obtained results.
2. The proposed is presented in understandable way. Although, the introduction should be enhanced by containing an explanation on how it motivates the proposed model.
3. The figures must be clear and well designed.
4. A comparison table of ML and EL algorithms (Table 1) must be enriched by adding other parameters to show efficiently the classification of those algorithms.
5. The Literature review is quiet and must be enriched by adding other recent works that highlight the anomaly detection of network traffic from outlier detection. You are invited to add the suggested recent contributions bellow:
§ FSCB-IDS: Feature Selection and Minority Class Balancing for Attacks Detection in VANET. Applied Sciences Journal. 2023. (https://www.mdpi.com/2357702 )
§ Anomaly detection model based on gradient boosting and decision tree for IoT environments security. Journal of Reliable Intelligent Environment 2022.
6. The comparison table (Table 1) used must integrate various metrics and detailed parameters related to security and anomaly detection.
7. Authors are invited to add an evaluation study of other recent cyber security datasets to better show their efficiency and reliability. Also, the features of the dataset related must be discussed and comprehensive.
8. The conclusion must be enriched and improved by explaining the limits of model and perspectives to enhance it.
9. Poor English. The authors need to proofread the paper to avoid any typos.
From reviewing on this paper, I propose that the paper requires major revisions to be published in Applied Sciences journal.
9. Poor English. The authors need to proofread the paper to avoid any typos.
Author Response
Thanks for your review. Please see the attachment for replies.
Author Response File: 
Author Response.docx
Reviewer 2 Report
1. The definition (in terms of equations) of hash function shown in Fig. 2 is missing.
2. In Sec. 3, there are inconsistencies in the format of symbols and equations.
3. In Sec. 3, the proposed method should be presented in a straightforward way instead of discussing more about the existing literature.
4. Also, there are certain formatting issues in the main text. For example, com-po-nent analysis (PCA), in-depth, re-search, etc.,
5. In Fig. 8, how the degree of consistency effects the anomaly detection in network traffic?
6. What are the abnormal characteristics considered in malicious code?
7. What is X-axis in Fig. 8? Label of axis is expected.
8. Is “SPE” mentioned in the main text and “Spe” mentioned in Fig. 9 are same? If so, the label should be updated in the Fig. 9.
9. On what features of data that the value of
depends?
10. Authors are strongly instructed to read the text carefully and correct the grammatical and formatting errors. For example, Singular value decomposition [50] (Singular Value Decomposition, SVD) is performed on (15).
11. Once the full-form is given, next time onwards, its abbreviation can be used in the main text. For example, the full-form of SVD is mentioned multiple times.
12. The citation style of Reference in the main text should be uniform. For example, [10], [11], [12], etc.,
There are certain grammatical mistakes. Authors are strongly instructed to read the text carefully and correct the grammatical and formatting errors.
Author Response
Thanks for your review. Please see the attachment for replies.
Author Response File: Author Response.docx
Round 2
Reviewer 1 Report
Various suggested revisions are taking into account by athors.
