Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Network Anomaly Detection: Flow-based or Packet-based Approach?   One of the most critical tasks for network administrator is to ensure system
uptime and availability. For the network security, anomaly detection systems,
along with firewalls and intrusion prevention systems are the must-have tools.
So far in the field of network anomaly detection, people are working on two
different approaches. One is flow-based; usually rely on network elements to
make so-called flow information available for analysis. The second approach is
packet-based; which directly analyzes the data packet information for the
detection of anomalies. This paper describes the main differences between the
two approaches through an in-depth analysis. We try to answer the question of
when and why an approach is better than the other. The answer is critical for
network administrators to make their choices in deploying a defending system,
securing the network and ensuring business continuity.

22
The categories of this paper are: chao-dyn
17
The categories of this paper are: q-fin
2
The categories of this paper are: math
11
The categories of this paper are: hep-lat
37
The categories of this paper are: supr-con
33
The categories of this paper are: plasm-ph
35
The categories of this paper are: mtrl-th
12
The categories of this paper are: nucl-th
18
The categories of this paper are: econ
3
The categories of this paper are: physics
23
The categories of this paper are: solv-int
30
The categories of this paper are: q-alg
32
The categories of this paper are: atom-ph
26
The categories of this paper are: bayes-an
19
The categories of this paper are: eess
16
The categories of this paper are: stat