From intrusion detection to attacker attribution: A comprehensive survey of unsupervised methods
Open accessAbstract
Over the last five years there has been an increase in the frequency and diversity of network attacks. This holds true, as more and more organizations admit compromises on a daily basis. Many misuse and anomaly based intrusion detection systems (IDSs) that rely on either signatures, supervised or statistical methods have been proposed in the literature, but their trustworthiness is debatable. Moreover, as this paper uncovers, the current IDSs are based on obsolete attack classes that do not reflect the current attack trends. For these reasons, this paper provides a comprehensive overview of unsupervised and hybrid methods for intrusion detection, discussing their potential in the domain. We also present and highlight the importance of feature engineering techniques that have been proposed for intrusion detection. Furthermore, we discuss that current IDSs should evolve from simple detection to correlation and attribution. We descant how IDS data could be used to reconstruct and correlate attacks to identify attackers, with the use of advanced data analytics techniques. Finally, we argue how the present IDS attack classes can be extended to match the modern attacks and propose three new classes regarding the outgoing network communication.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Many existing IDS signatures are based on obsolete attack classes that do not map to modern attacks.
“It has been found that many existing IDS signatures are based on obsolete attack classes that do not map to modern attacks.”
From Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. (2023) · cites this paper as [78]
In “IDS attack classes,” the paper says the four traditional classes are no longer sufficient as attacks evolve. In “Detection Mechanism Classification,” it separately describes signatures as patterns of known attacks whose databases need updating. It does not say that IDS signatures are based on those obsolete classes, so the claim conflates two related limitations. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
A fast and elitist multiobjective genetic algorithm: NSGA-II
Deb, K., Pratap, A., Agarwal, S., & Meyarivan, T. (2002) · IEEE Transactions on Evolutionary Computation · doi:10.1109/4235.996017 · Cited by 50,053 · see citing works
An introduction to ROC analysis
Fawcett, T. (2006) · Pattern Recognition Letters · doi:10.1016/j.patrec.2005.10.010 · Cited by 21,879 · see citing works
Chandola, V., Banerjee, A., & Kumar, V. (2009) · ACM Computing Surveys · doi:10.1145/1541880.1541882 · Cited by 11,687 · see citing works
Survey of Clustering Algorithms
Xu, R., & Wunsch, D. C. (2005) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2005.845141 · Cited by 6,223 · see citing works
Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation
Powers, D. M. W. (2020) · arXiv · doi:10.48550/arxiv.2010.16061 · Cited by 5,440 · see citing works
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · see citing works
A survey on feature selection methods
Chandrashekar, G., & Sahin, F. (2014) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2013.11.024 · Cited by 5,189 · see citing works
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332 · see citing works
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,094 · see citing works
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636 · see citing works
Anomaly-based network intrusion detection: Techniques, systems and challenges
García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009) · Computers & Security · doi:10.1016/j.cose.2008.08.003 · Cited by 2,085 · see citing works
Intrusion detection system: A comprehensive review
Liao, H.-J., Lin, C. R., Lin, Y.-C., & Tung, K.-Y. (2012) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2012.09.004 · Cited by 1,640 · see citing works
Network Anomaly Detection: Methods, Systems and Tools
Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.052213.00046 · Cited by 1,358 · see citing works
Toward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345 · see citing works
Data Mining Approaches for Intrusion Detection
Lee, W., & Stolfo, S. J. (2000) · doi:10.21236/ada401496 · Cited by 1,186 · see citing works
Machine learning in wireless sensor networks: Algorithms, strategies, and applications
Alsheikh, M. A., Lin, S., Niyato, D., & Tan, H.-P. (2014) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2014.2320099 · Cited by 965 · see citing works
A Survey of Intrusion Detection Systems in Wireless Sensor Networks
Bütün, İ., Morgera, S. D., & Sankar, R. T. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.050113.00191 · Cited by 840 · see citing works
Towards a taxonomy of intrusion-detection systems
Debar, H., Daciér, M., & Wespi, A. (1999) · Computer Networks · doi:10.1016/s1389-1286(98)00017-6 · Cited by 835 · see citing works
Intrusion detection with unlabeled data using clustering
Portnoy, L. (2000) · doi:10.7916/d8mp5904 · Cited by 756 · see citing works
A novel hybrid intrusion detection method integrating anomaly detection with misuse detection
Kim, G., Lee, S. M., & Kim, S. (2013) · Expert Systems with Applications · doi:10.1016/j.eswa.2013.08.066 · Cited by 593 · see citing works
Fuzziness based semi-supervised learning approach for intrusion detection system
Ashfaq, R. A. R., Wang, X., Huang, J. Z., Abbas, H., & He, Y. (2016) · Information Sciences · doi:10.1016/j.ins.2016.04.019 · Cited by 554 · see citing works
Depren, O., Topallar, M., Anarım, E., et al. (2005) · Expert Systems with Applications · doi:10.1016/j.eswa.2005.05.002 · Cited by 514 · see citing works
A Survey of Intrusion Detection Systems in Wireless Sensor Networks
Neelankavil, S. W., & Minla, K. S. (2020) · Cited by 506 · see citing works
CANN: An intrusion detection system based on combining cluster centers and nearest neighbors
Lin, W.-C., Ke, S., & Tsai, C. (2015) · Knowledge-Based Systems · doi:10.1016/j.knosys.2015.01.009 · Cited by 494 · see citing works
Mutual information-based feature selection for intrusion detection systems
Amiri, F., Yousefi, M. R., Lucas, C., Shakery, A., & Yazdani, N. (2011) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2011.01.002 · Cited by 473 · see citing works
Device Fingerprinting in Wireless Networks: Challenges and Opportunities
Xu, Q., Zheng, R., Saad, W., & Han, Z. (2015) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2476338 · Cited by 468 · see citing works
An Overview of IP Flow-Based Intrusion Detection
Sperotto, A., Schaffrath, G., Sadre, R., Morariu, C., Pras, A., & Stiller, B. (2010) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2010.032210.00054 · Cited by 467 · see citing works
A novel hybrid KPCA and SVM with GA model for intrusion detection
Kuang, F., Xu, W., & Zhang, S. (2014) · Applied Soft Computing · doi:10.1016/j.asoc.2014.01.028 · Cited by 427 · see citing works
Intrusion detection: a brief history and overview
Kemmerer, R. A., & Vigna, G. (2002) · Computer · doi:10.1109/mc.2002.1012428 · Cited by 387 · see citing works
Next-generation Intrusion Detection Expert System (NIDES)A Summary
Anderson, D. J., Frivold, T., & Valdes, A. (1997) · Cited by 357 · see citing works
Creech, G., & Hu, J. (2013) · IEEE Transactions on Computers · doi:10.1109/tc.2013.13 · Cited by 357 · see citing works
Host-based intrusion detection using dynamic and static behavioral models
Yeung, D., & Ding, Y. (2002) · Pattern Recognition · doi:10.1016/s0031-3203(02)00026-2 · Cited by 350 · see citing works
Taxonomy and Survey of Collaborative Intrusion Detection
Vasilomanolakis, E., Karuppayah, S., Mühlhäuser, M., & Fischer, M. (2015) · ACM Computing Surveys · doi:10.1145/2716260 · Cited by 330 · see citing works
Haystack: an intrusion detection system
Smaha, S. E. (2003) · doi:10.1109/acsac.1988.113412 · Cited by 297 · see citing works
Modeling multistep cyber attacks for scenario recognition
Cheung, S., Lindqvist, U., & Fong, M. W. (2003) · Proceedings DARPA Information Survivability Conference and Exposition · doi:10.1109/discex.2003.1194892 · Cited by 269 · see citing works
Detecting P2P botnets through network behavior analysis and machine learning
Saad, S., Traoré, I., Ghorbani, A. A., Sayed, B., Zhao, D., Lu, W., Felix, J. V., & Hakimian, P. (2011) · Conference on Privacy, Security and Trust · doi:10.1109/pst.2011.5971980 · Cited by 267 · see citing works
Learning Intrusion Detection: Supervised or Unsupervised?
Laskov, P., Düssel, P., Schäfer, C., & Rieck, K. (2005) · Lecture notes in computer science · doi:10.1007/11553595_6 · Cited by 253 · see citing works
Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge
Casas, P., Mazel, J., & Owezarski, P. (2012) · Computer Communications · doi:10.1016/j.comcom.2012.01.016 · Cited by 245 · see citing works
Lazarević, A. M., Kumar, V., & Srivastava, J. (2005) · Springer eBooks · doi:10.1007/0-387-24230-9_2 · Cited by 245 · see citing works
Intrusion detection techniques in cloud environment: A survey
Mishra, P., Pilli, E. S., Varadharajan, V., & Tupakula, U. K. (2016) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2016.10.015 · Cited by 220 · see citing works
A survey of intrusion detection in wireless network applications
Mitchell, R., & Chen, I.-R. (2014) · Computer Communications · doi:10.1016/j.comcom.2014.01.012 · Cited by 206 · see citing works
Traffic data repository at the WIDE project
Cho, K., Mitsuya, K., & Kato, A. (2000) · Cited by 203 · see citing works
A hybrid network intrusion detection technique using random forests
Zhang, J., & Zulkernine, M. (2006) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2006.7 · Cited by 200 · see citing works
Hybrid Intrusion Detection with Weighted Signature Generation over Anomalous Internet Episodes
Hwang, K., Cai, M., Chen, Y., et al. (2007) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2007.9 · Cited by 187 · see citing works
De-La-Hoz-Franco, E., de la Hoz, E., Ortíz, A., Ortega, J., & Martínez-Álvarez, A. (2014) · Knowledge-Based Systems · doi:10.1016/j.knosys.2014.08.013 · Cited by 186 · see citing works
Machine Learning for Wireless Networks with Artificial Intelligence: A Tutorial on Neural NetworksPreprint
Chen, M., Challita, U., Saad, W., Yin, C., & Debbah, M. A. (2017) · arXiv (Cornell University) · Cited by 184 · see citing works
A simple and efficient hidden Markov model scheme for host-based anomaly intrusion detection
Hu, J., Yu, X., Qiu, D., & Chen, H. (2009) · IEEE Network · doi:10.1109/mnet.2009.4804323 · Cited by 181 · see citing works
Correlation of Intrusion Symptoms: An Application of Chronicles
Morin, B., & Debar, H. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45248-5_6 · Cited by 180 · see citing works
The Big Four - What We Did Wrong in Advanced Persistent Threat Detection?
Virvilis, N., & Gritzalis, D. A. (2013) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2013.32 · Cited by 179 · see citing works
A hybrid network intrusion detection framework based on random forests and weighted k-means
Elbasiony, R. M., Sallam, E. A., Eltobely, T. E., et al. (2013) · Ain Shams Engineering Journal · doi:10.1016/j.asej.2013.01.003 · Cited by 176 · see citing works
An improved NSGA-III algorithm for feature selection used in intrusion detection
Zhu, Y., Liang, J., Chen, J., & Ming, Z. (2016) · Knowledge-Based Systems · doi:10.1016/j.knosys.2016.10.030 · Cited by 174 · see citing works
The Darknet and the Future of Content DistributionPreprint
Biddle, P., ENGLAND, P. J., Peinado, M., et al. (2003) · RePEc: Research Papers in Economics · Cited by 170 · see citing works
Operational experiences with high-volume network intrusion detection
Dreger, H., Feldmann, A., Paxson, V., et al. (2004) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/1030083.1030086 · Cited by 163 · see citing works
As the net churns: Fast-flux botnet observations
Nazario, J., & Holz, T. (2008) · International Conference on Malicious and Unwanted Software · doi:10.1109/malware.2008.4690854 · Cited by 156 · see citing works
Correlating Intrusion Events and Building Attack Scenarios Through Attack Graph Distances
Noel, S., Robertson, E., & Jajodia, S. (2005) · Annual Computer Security Applications Conference · doi:10.1109/csac.2004.11 · Cited by 144 · see citing works
Host-based intrusion detection using self-organizing maps
Lichodzijewski, P., Zincir-Heywood, N., & Heywood, M. I. (2003) · doi:10.1109/ijcnn.2002.1007776 · Cited by 143 · see citing works
Feature Selection in Clustering Problems
Röth, V., & Lange, T. (2003) · Cited by 140 · see citing works
Automatic network intrusion detection: Current techniques and open issues
Catania, C. A., & Garino, C. G. G. (2012) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2012.05.013 · Cited by 127 · see citing works
Kaspersky security Bulletin 2013
Александровна, Г. М., & Кристиан, Ф. (2014) · Voprosy kiberbezopasnosti · Cited by 124 · see citing works
The Koobface botnet and the rise of social malware
Thomas, K., & Nicol, D. M. (2010) · International Conference on Malicious and Unwanted Software · doi:10.1109/malware.2010.5665793 · Cited by 122 · see citing works
A computer host-based user anomaly detection system using the self-organizing map
Hoglund, A., Hätönen, K., & Sorvari, A. S. (2000) · doi:10.1109/ijcnn.2000.861504 · Cited by 120 · see citing works
A hybrid system for reducing the false alarm rate of anomaly intrusion detection system
Om, H., & Kundu, A. (2012) · 2012 1st International Conference on Recent Advances in Information Technology (RAIT) · doi:10.1109/rait.2012.6194493 · Cited by 113 · see citing works
Building lightweight intrusion detection system using wrapper-based feature selection mechanisms
Li, Y., Wang, J., Tian, Z., et al. (2009) · Computers & Security · doi:10.1016/j.cose.2009.01.001 · Cited by 107 · see citing works
A multi-step outlier-based anomaly detection approach to network-wide traffic
Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2016) · Information Sciences · doi:10.1016/j.ins.2016.02.023 · Cited by 107 · see citing works
Feature selection for optimizing traffic classification
Zhang, H., Lü, G., Qassrawi, M. T., Zhang, Y., & Yu, X. (2012) · Computer Communications · doi:10.1016/j.comcom.2012.04.012 · Cited by 106 · see citing works
Network Traffic Analysis and Intrusion Detection Using Packet Sniffer
Qadeer, M. A., Iqbal, A., Zahid, M., et al. (2010) · International Conference on Communication Software and Networks · doi:10.1109/iccsn.2010.104 · Cited by 105 · see citing works
Architecture of a network monitor
Moore, A. W., Hall, J., Kreibich, C., Harris, E. P., & Pratt, I. (2003) · Cited by 101 · see citing works
Toward a more practical unsupervised anomaly detection system
Song, J., Takakura, H., Okabe, Y., et al. (2011) · Information Sciences · doi:10.1016/j.ins.2011.08.011 · Cited by 97 · see citing works
On the Validation of Traffic Classification Algorithms
Szabó, G., Orincsay, D., Malomsoky, S., & Szabó, I. (2008) · Springer eBooks · doi:10.1007/978-3-540-79232-1_8 · Cited by 94 · see citing works
Decentralized Event Correlation for Intrusion Detection
Krügel, C., Toth, T. A., & Kerer, C. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45861-1_10 · Cited by 90 · see citing works
Toward an efficient and scalable feature selection approach for internet traffic classification
Fahad, A., Tari, Z., Khalil, I., Habib, I., & Alnuweiri, H. (2013) · Computer Networks · doi:10.1016/j.comnet.2013.04.005 · Cited by 89 · see citing works
Evasion Techniques: Sneaking through Your Intrusion Detection/Prevention Systems
Cheng, T.-H., Lin, Y., Lai, Y., et al. (2011) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2011.092311.00082 · Cited by 85 · see citing works
Intrusion detection technique by using k-means, fuzzy neural network and SVM classifiers
Chandrasekhar, A. M., & Raghuveer, K. (2013) · International Conference on Computer Communication and Informatics (ICCCI) · doi:10.1109/iccci.2013.6466310 · Cited by 84 · see citing works
da Costa, K. A. P., Pereira, L. A. M., Nakamura, R. Y. M., et al. (2014) · Information Sciences · doi:10.1016/j.ins.2014.09.025 · Cited by 75 · see citing works
MLH-IDS: A Multi-Level Hybrid Intrusion Detection Method
Gogoi, P., Bhattacharyya, D. K., Borah, B., & Kalita, J. K. (2013) · The Computer Journal · doi:10.1093/comjnl/bxt044 · Cited by 70 · see citing works
MapReduce intrusion detection system based on a particle swarm optimization clustering algorithm
Aljarah, I., & Ludwig, S. A. (2013) · IEEE Congress on Evolutionary Computation (CEC) · doi:10.1109/cec.2013.6557670 · Cited by 66 · see citing works
Smartphone sensor data as digital evidence
Mylonas, A., Meletiadis, V., Mitrou, L., & Gritzalis, D. A. (2013) · Computers & Security · doi:10.1016/j.cose.2013.03.007 · Cited by 59 · see citing works
Self-citationBostani, H., & Sheikhan, M. (2016) · Pattern Recognition · doi:10.1016/j.patcog.2016.08.027 · Cited by 57 · see citing works
A differentiated one-class classification method with applications to intrusion detection
Kang, I.-H., Jeong, M. K., & Kong, D. (2011) · Expert Systems with Applications · doi:10.1016/j.eswa.2011.06.033 · Cited by 55 · see citing works
Temporal and spatial distributed event correlation for network security
Jiang, G., & Cybenko, G. V. (2004) · Proceedings of the ... American Control Conference/Proceedings of the American Control Conference · doi:10.23919/acc.2004.1386701 · Cited by 55 · see citing works
Identifying Digital Threats in a Hacker Web Forum
Macdonald, M., Frank, R. W., Mei, J., et al. (2015) · IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM) · doi:10.1145/2808797.2808878 · Cited by 54 · see citing works
Liu, Z., Wang, R., Tao, M., et al. (2015) · Neurocomputing · doi:10.1016/j.neucom.2015.05.089 · Cited by 51 · see citing works
Fahad, A., Tari, Z., Khalil, I., Almalawi, A., & Zomaya, A. Y. (2013) · Future Generation Computer Systems · doi:10.1016/j.future.2013.09.015 · Cited by 50 · see citing works
A graph-based clustering algorithm for anomaly intrusion detection
Zhou, M., Hui, H., & Wang, Q. (2012) · International Conference on Computer Science & Education (ICCSE) · doi:10.1109/iccse.2012.6295306 · Cited by 48 · see citing works
An effective unsupervised network anomaly detection method
Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2012) · International Conference on Advances in Computing, Communications and Informatics (ICACCI) · doi:10.1145/2345396.2345484 · Cited by 48 · see citing works
Applications of Economic and Pricing Models for Wireless Network Security: A Survey
Luong, N. C., Hoang, D. T., Wang, P., Niyato, D. T., & Han, Z. (2017) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2017.2732462 · Cited by 46 · see citing works
Cybercrime: Dissecting the State of Underground Enterprise
Sood, A. K., Bansal, R., & Enbody, R. J. (2013) · IEEE Internet Computing · doi:10.1109/mic.2012.61 · Cited by 44 · see citing works
Intrusion detection in enterprise systems by combining and clustering diverse monitor data
Bohara, A., Thakore, U., & Sanders, W. H. (2016) · doi:10.1145/2898375.2898400 · Cited by 41 · see citing works
Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2011) · doi:10.1145/1947940.1948050 · Cited by 36 · see citing works
Event Correlation for Intrusion Detection Systems
Dwivedi, N., & Tripathi, A. (2015) · doi:10.1109/cict.2015.111 · Cited by 16 · see citing works
Knowledge-independent traffic monitoring: Unsupervised detection of network attacks
Casas, P., Mazel, J., & Owezarski, P. (2012) · IEEE Network · doi:10.1109/mnet.2012.6135851 · Cited by 15 · see citing works
An immune inspired unsupervised intrusion detection system for detection of novel attacks
Jha, M., & Acharya, R. S. (2016) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2016.7745493 · Cited by 15 · see citing works
Neural network based intrusion detection using Bayesian with PCA and KPCA feature extraction
Pattewar, T. M., & Sonawane, H. A. (2015) · doi:10.1109/cgvis.2015.7449898 · Cited by 9 · see citing works
Flagged first, then by citations
Research works printed but not linked: 10
- Caballero, J., Grier, C., Kreibich, C., & Paxson, V. (2011, August). Measuring Pay-per-Install: The Commoditization of Malware Distribution. In Usenix security symposium (p. 15).
- Barbara, D., Couto, J., Jajodia, S., Popyack, L., & Wu, N. (2001). ADAM: Detecting intrusions by data mining. In In Proceedings of the IEEE Workshop on Information Assurance and Security.
- Pattewar, T. M., & Sonawane, H. A. (2015, November). Neural network based intrusion detection using Bayesian with PCA and KPCA feature extraction. In 2015 IEEE International Conference on Computer Graphics, Vision and Information Security (CGVIS) (pp. 83-88). IEEE.
- Amoli, P. V., Hamalainen, T., David, G., Zolotukhin, M., & Mirzamohammad, M. (2016). Unsupervised Network Intrusion Detection Systems for Zero-Day Fast-Spreading Attacks and Botnets. JDCTA (International Journal of Digital Content Technology and its Applications, Volume 10 Issue 2, 1-13.
- Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2011, February). NADO: network anomaly detection using outlier approach. In Proceedings of the 2011 International Conference on Communication, Computing & Security (pp. 531-536). ACM.
- Hosseinpour, F., Amoli, P. V., Farahnakian, F., Plosila, J., & Hämäläinen, T. (2014). Artificial immune system based intrusion detection: Innate immunity using an unsupervised learning approach. International Journal of Digital Content Technology and its Applications, 8(5), 1.
- ISCX NSL-KDD dataset: http://www.unb.ca/research/iscx/dataset/iscx- NSL-KDD-dataset.html
- Catania, C. A., & Garino, C. G. (2012). Automatic network intrusion detection: Current techniques and open issues. Computers & Electrical Engineering, 38(5), 1062-1072.
- Zhu, B., & Sastry, S. (2010, April). SCADA-specific intrusion detection/prevention systems: a survey and taxonomy. In Proceedings of the 1st Workshop on Secure Control Systems (SCS).
- A. Moore, D. Zuev, M. Crogan, Discriminators for use in flow-based classification, Technical Report, University of Cambridge, Computer Laboratory.
Cited by
Sorted by citations
Moustafa, N., Koroniotis, N., Keshk, M., Zomaya, A. Y., & Tari, Z. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3280465 · Cited by 266 · see citing works
Deep Transfer Learning Based Intrusion Detection System for Electric Vehicular Networks
Mehedi, S. T., Anwar, A., Rahman, Z., & Ahmed, K. (2021) · Sensors · doi:10.3390/s21144736 · Cited by 150 · see citing works
LITNET-2020: An Annotated Real-World Network Flow Dataset for Network Intrusion Detection
Damasevicius, R., Venckauskas, A., Grigaliunas, S., Toldinas, J., Morkevicius, N., Aleliunas, T., & Smuikys, P. (2020) · Electronics · doi:10.3390/electronics9050800 · Cited by 132 · see citing works
Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure.
Riggs, H., Tufail, S., Parvez, I., Tariq, M., Khan, M. A., Amir, A., Vuda, K. V., & Sarwat, A. I. (2023) · Sensors · doi:10.3390/s23084060 · Cited by 124 · see citing works
“Intrusion detection systems can also be deployed as a centralized architecture, decentralized, or distributed [78].”
BackgroundA Novel Lightweight IoT Intrusion Detection Model Based on Self-Knowledge Distillation
Wang, Z., Zhou, R., Yang, S., He, D., & Chan, S. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3533092 · Cited by 38 · see citing works
Hong, A. E., Malinovsky, P. P., & Damodaran, S. K. (2024) · Digital Threats: Research and Practice · doi:10.1145/3604434 · Cited by 11 · see citing works
- Authors
- Nisioti, A., Mylonas, A., Yoo, P. D., & Katos, V.
- Affiliations
- Bournemouth University (GB)
- Cranfield University (GB)
- Venue
- IEEE Communications Surveys & Tutorials
- Published
- 2018
- Volume
- 20
- Issue
- 4
- Pages
- 3369-3388
- ISSN
- 1553-877X (ISSN-L)
- 2373-745X
- OpenAlex
- W2870670057
- Cited by
- 212
- References
- 93
- Citations by year
- 2026: 9 · 2025: 28 · 2024: 31 · 2023: 36 · 2022: 27 · 2021: 38 · 2020: 25 · 2019: 17 · 2018: 1
- FWCI
- 12.54
- Type
- journal article
- Language
- en
- Open access
- Locations
- IEEE Communications Surveys & Tutorials (publishedVersion)
- Bournemouth University Research Online (Bournemouth University) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- intrusion detection, unsupervised learning, anomaly detection, signature-based detection, feature engineering, network security, attack classification, hybrid intrusion detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
