{"id":"https://openalex.org/W7119495337","doi":"https://doi.org/10.1016/j.jnlest.2026.100345","title":"ZeroDefense: An adaptive hybrid fusion-based intrusion detection system for zero-day threat detection in IoT networks","display_name":"ZeroDefense: An adaptive hybrid fusion-based intrusion detection system for zero-day threat detection in IoT networks","publication_year":2026,"publication_date":"2026-01-09","ids":{"openalex":"https://openalex.org/W7119495337","doi":"https://doi.org/10.1016/j.jnlest.2026.100345"},"language":"en","primary_location":{"id":"doi:10.1016/j.jnlest.2026.100345","doi":"https://doi.org/10.1016/j.jnlest.2026.100345","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jnlest.2026.100345","pdf_url":null,"source":{"id":"https://openalex.org/S2736981714","display_name":"Journal of Electronic Science and Technology","issn_l":"1674-862X","issn":["1674-862X","2666-223X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Electronic Science and Technology","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1016/j.jnlest.2026.100345","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064648510","display_name":"Abubakar Wakili","orcid":"https://orcid.org/0000-0003-3561-8911","observed_orcids":["https://orcid.org/0000-0003-3561-8911"]},"institutions":[{"id":"https://openalex.org/I4210139255","display_name":"Euro-Mediterranean University of Fes","ror":"https://ror.org/03s9x8b85","country_code":"MA","type":"education","lineage":["https://openalex.org/I4210139255"]}],"countries":["MA"],"is_corresponding":true,"raw_author_name":"Abubakar Wakili","raw_affiliation_strings":["School of Digital Engineering and Artificial Intelligence, Euromed University of Fez, Fez, 30030, Morocco"],"raw_orcid":"https://orcid.org/0000-0003-3561-8911","affiliations":[{"raw_affiliation_string":"School of Digital Engineering and Artificial Intelligence, Euromed University of Fez, Fez, 30030, Morocco","institution_ids":["https://openalex.org/I4210139255"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5045908544","display_name":"Sara Bakkali","orcid":"https://orcid.org/0000-0002-4700-6755","observed_orcids":["https://orcid.org/0000-0002-4700-6755"]},"institutions":[{"id":"https://openalex.org/I4210139255","display_name":"Euro-Mediterranean University of Fes","ror":"https://ror.org/03s9x8b85","country_code":"MA","type":"education","lineage":["https://openalex.org/I4210139255"]}],"countries":["MA"],"is_corresponding":true,"raw_author_name":"Sara Bakkali","raw_affiliation_strings":["School of Digital Engineering and Artificial Intelligence, Euromed University of Fez, Fez, 30030, Morocco"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Digital Engineering and Artificial Intelligence, Euromed University of Fez, Fez, 30030, Morocco","institution_ids":["https://openalex.org/I4210139255"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5045908544","https://openalex.org/A5064648510"],"corresponding_institution_ids":["https://openalex.org/I4210139255"],"apc_list":{"value":0,"currency":"USD","value_usd":0},"apc_paid":null,"fwci":29.1863,"has_fulltext":false,"cited_by_count":7,"citation_normalized_percentile":{"value":0.99546115,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"24","issue":"1","first_page":"100345","last_page":"100345"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/unknown-attack-detection","display_name":"unknown attack detection","score":0.8629999756813049},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.781000018119812},{"id":"https://openalex.org/keywords/iot-security","display_name":"Internet of Things security","score":0.925000011920929},{"id":"https://openalex.org/keywords/hybrid-intrusion-detection-system","display_name":"hybrid intrusion detection","score":0.8019999861717224},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.7760000228881836},{"id":"https://openalex.org/keywords/isolation-forest","display_name":"Isolation Forest","score":0.753000020980835},{"id":"https://openalex.org/keywords/autoencoder","display_name":"autoencoder","score":0.9549999833106995},{"id":"https://openalex.org/keywords/local-outlier-factor","display_name":"local outlier factor","score":0.9959999918937683},{"id":"https://openalex.org/keywords/tabnet","display_name":"TabNet","score":0.7630000114440918},{"id":"https://openalex.org/keywords/attack-classification","display_name":"attack classification","score":0.7049999833106995},{"id":"https://openalex.org/keywords/edge-deployment","display_name":"edge deployment","score":0.6830000281333923},{"id":"https://openalex.org/keywords/ciciot2023-dataset","display_name":"CICIoT2023","score":0.9139999747276306}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.754800021648407},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7075999975204468},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6517999768257141},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.4560000002384186},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.44920000433921814},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.4429999887943268},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4408999979496002},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.42500001192092896},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39649999141693115},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3831000030040741},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3714999854564667},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.3319999873638153},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.33000001311302185},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.30820000171661377},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2985000014305115},{"id":"https://openalex.org/C152124472","wikidata":"https://www.wikidata.org/wiki/Q1204361","display_name":"Redundancy (engineering)","level":2,"score":0.2937999963760376},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.2924000024795532},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.2773999869823456},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.2648000121116638},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.25850000977516174},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.2533000111579895},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2526000142097473}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.jnlest.2026.100345","doi":"https://doi.org/10.1016/j.jnlest.2026.100345","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jnlest.2026.100345","pdf_url":null,"source":{"id":"https://openalex.org/S2736981714","display_name":"Journal of Electronic Science and Technology","issn_l":"1674-862X","issn":["1674-862X","2666-223X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Electronic Science and Technology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.jnlest.2026.100345","doi":"https://doi.org/10.1016/j.jnlest.2026.100345","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jnlest.2026.100345","pdf_url":null,"source":{"id":"https://openalex.org/S2736981714","display_name":"Journal of Electronic Science and Technology","issn_l":"1674-862X","issn":["1674-862X","2666-223X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Electronic Science and Technology","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.5378999710083008}],"sustainable_development_goals_aurora":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.5146048665046692}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W2065890363","https://openalex.org/W2115629999","https://openalex.org/W2144182447","https://openalex.org/W2148143831","https://openalex.org/W2295598076","https://openalex.org/W2911964244","https://openalex.org/W3129061468","https://openalex.org/W3174086521","https://openalex.org/W4221118747","https://openalex.org/W4309939034","https://openalex.org/W4382281941","https://openalex.org/W4401436749","https://openalex.org/W4404756091","https://openalex.org/W4406096916","https://openalex.org/W4409191127","https://openalex.org/W4410059811","https://openalex.org/W4410926456","https://openalex.org/W4411020820","https://openalex.org/W7084082164","https://openalex.org/W7084144894"],"related_works":[],"abstract_inverted_index":{"Zero-day":[0],"attacks":[1,47],"present":[2],"a":[3,85,131,175,181,232],"critical":[4],"cybersecurity":[5],"challenge":[6],"for":[7,72,165,205,240],"Internet":[8],"of":[9,17,45,57,75,89,210],"things":[10],"(IoT":[11],")":[12],"infrastructures,":[13],"where":[14],"the":[15,54,138,194],"inability":[16],"signature-based":[18],"intrusion":[19],"detection":[20,74,98],"systems":[21],"(IDSs)":[22],"to":[23,41],"recognize":[24],"novel":[25],"threat":[26],"behaviors":[27],"compromises":[28],"both":[29],"system":[30],"reliability":[31],"and":[32,78,93,103,123,129,157,180,201,235],"operational":[33],"continuity.":[34],"Existing":[35],"hybrid":[36],"IDS":[37,70],"solutions":[38],"often":[39],"struggle":[40],"balance":[42],"accurate":[43],"classification":[44,110,164],"known":[46,76,206],"with":[48,219],"reliable":[49,140],"anomaly":[50,97,153,171],"detection,":[51],"particularly":[52],"under":[53],"computational":[55],"constraints":[56],"IoT":[58,189,242],"environments.":[59],"To":[60],"address":[61],"this":[62],"gap,":[63],"we":[64],"introduce":[65],"ZeroDefense,":[66],"an":[67,170],"adaptive":[68],"fusion-based":[69],"designed":[71],"simultaneous":[73],"intrusions":[77],"emerging":[79],"zero-day":[80,217],"threats.":[81],"The":[82],"framework":[83],"employs":[84],"four-layer":[86],"architecture":[87],"consisting":[88],"i)":[90],"feature":[91],"standardization":[92],"class":[94],"balancing,":[95],"ii)":[96],"using":[99],"isolation":[100],"forest,":[101,113],"autoencoder,":[102],"local":[104],"outlier":[105],"factor,":[106],"iii)":[107],"fine-grained":[108],"attack":[109,167],"via":[111],"random":[112],"extreme":[114],"gradient":[115,119],"boosting":[116,120],"(XGBoost),":[117],"light":[118],"machine":[121],"(LightGBM),":[122],"attentive":[124],"interpretable":[125],"tabular":[126],"learning":[127],"(TabNet),":[128],"iv)":[130],"confidence-aware":[132],"fusion":[133,178],"engine":[134],"that":[135,229],"adaptively":[136],"selects":[137],"most":[139],"decision":[141,173],"path.":[142],"Suspicious":[143],"or":[144],"previously":[145],"unseen":[146],"traffic":[147,211],"is":[148,212],"isolated":[149],"early":[150],"through":[151,162],"fused":[152],"scoring,":[154],"while":[155,208],"benign":[156],"known-malicious":[158],"flows":[159],"are":[160],"processed":[161],"supervised":[163],"precise":[166],"labeling.":[168],"With":[169],"cascaded":[172],"pipeline,":[174],"dynamic":[176],"confidence-driven":[177],"mechanism,":[179],"deployment-conscious":[182],"design,":[183],"ZeroDefense":[184,230],"enables":[185],"real-time":[186],"inference":[187,220],"on":[188,193],"edge":[190],"gateways.":[191],"Evaluation":[192],"CICIoT2023":[195],"benchmark":[196],"demonstrates":[197],"99.94%":[198],"overall":[199],"accuracy":[200],"95.64%":[202],"macro-average":[203],"F1-score":[204],"attacks,":[207],"5.76%":[209],"successfully":[213],"flagged":[214],"as":[215],"potential":[216],"activity,":[218],"latency":[221],"maintained":[222],"below":[223],"100":[224],"ms/flow.":[225],"These":[226],"results":[227],"indicate":[228],"offers":[231],"scalable,":[233],"resilient,":[234],"practically":[236],"deployable":[237],"defence":[238],"capability":[239],"modern":[241],"infrastructures.":[243]},"counts_by_year":[{"year":2026,"cited_by_count":7}],"updated_date":"2026-10-13T10:08:12.033832","created_date":"2026-01-09T00:00:00"}