{"id":"https://openalex.org/W7163195621","doi":"https://doi.org/10.1038/s41598-026-55073-z","title":"GraphDL: A visibility graph-based structural representation framework for flow-based cyber-attack detection","display_name":"GraphDL: A visibility graph-based structural representation framework for flow-based cyber-attack detection","publication_year":2026,"publication_date":"2026-06-02","ids":{"openalex":"https://openalex.org/W7163195621","doi":"https://doi.org/10.1038/s41598-026-55073-z","pmid":"https://pubmed.ncbi.nlm.nih.gov/42230696","pmcid":"https://www.ncbi.nlm.nih.gov/pmc/articles/13578295"},"language":"en","primary_location":{"id":"doi:10.1038/s41598-026-55073-z","doi":"https://doi.org/10.1038/s41598-026-55073-z","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-55073-z","pdf_url":"https://www.nature.com/articles/s41598-026-55073-z_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.nature.com/articles/s41598-026-55073-z_reference.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120179740","display_name":"Ali Melih Kanca","orcid":"https://orcid.org/0000-0003-3271-7463","observed_orcids":["https://orcid.org/0000-0003-3271-7463"]},"institutions":[{"id":"https://openalex.org/I173761726","display_name":"Karab\u00fck University","ror":"https://ror.org/04wy7gp54","country_code":"TR","type":"education","lineage":["https://openalex.org/I173761726"]}],"countries":["TR"],"is_corresponding":true,"raw_author_name":"Ali Melih Kanca","raw_affiliation_strings":["Department of Computer Engineering, Faculty of Engineering, Karabuk University, Karab\u00fck, T\u00fcrkiye, Turkey. melihkanca@karabuk.edu.tr"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Faculty of Engineering, Karabuk University, Karab\u00fck, T\u00fcrkiye, Turkey. melihkanca@karabuk.edu.tr","institution_ids":["https://openalex.org/I173761726"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042155028","display_name":"\u0130lker T\u00fcrker","orcid":"https://orcid.org/0000-0001-7577-4658","observed_orcids":["https://orcid.org/0000-0001-7577-4658"]},"institutions":[{"id":"https://openalex.org/I173761726","display_name":"Karab\u00fck University","ror":"https://ror.org/04wy7gp54","country_code":"TR","type":"education","lineage":["https://openalex.org/I173761726"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"\u0130lker T\u00fcrker","raw_affiliation_strings":["Department of Computer Engineering, Faculty of Engineering, Karabuk University, Karab\u00fck, T\u00fcrkiye, Turkey"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Faculty of Engineering, Karabuk University, Karab\u00fck, T\u00fcrkiye, Turkey","institution_ids":["https://openalex.org/I173761726"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5120179740"],"corresponding_institution_ids":["https://openalex.org/I173761726"],"apc_list":{"value":2690,"currency":"USD","value_usd":2690},"apc_paid":{"value":2690,"currency":"USD","value_usd":2690},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.35231718,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"16","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0015999999595806003,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/network-intrusion-detection","display_name":"network intrusion detection","score":0.7409999966621399},{"id":"https://openalex.org/keywords/cyberattack-detection","display_name":"cyberattack detection","score":0.8690000176429749},{"id":"https://openalex.org/keywords/network-flow-data","display_name":"network flow data","score":0.6470000147819519},{"id":"https://openalex.org/keywords/visibility-graph","display_name":"visibility graph","score":0.8429999947547913},{"id":"https://openalex.org/keywords/cnn-based-classification","display_name":"CNN-based classification","score":0.6050000190734863},{"id":"https://openalex.org/keywords/cse-cic-ids2018","display_name":"CSE-CIC-IDS2018","score":0.9100000262260437},{"id":"https://openalex.org/keywords/traffic-behavior-modeling","display_name":"traffic behavior modeling","score":0.5889999866485596}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7943000197410583},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6244999766349792},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5378000140190125},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.5008999705314636},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4659000039100647},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.46160000562667847},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.45899999141693115},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4214000105857849},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.4074999988079071},{"id":"https://openalex.org/C173362246","wikidata":"https://www.wikidata.org/wiki/Q8216024","display_name":"Visibility graph","level":3,"score":0.4052000045776367},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.37790000438690186},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.3734000027179718},{"id":"https://openalex.org/C102392041","wikidata":"https://www.wikidata.org/wiki/Q592860","display_name":"Sliding window protocol","level":3,"score":0.3601999878883362},{"id":"https://openalex.org/C47432892","wikidata":"https://www.wikidata.org/wiki/Q831390","display_name":"Wavelet","level":2,"score":0.3325999975204468},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3321000039577484},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.3249000012874603},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.3107999861240387},{"id":"https://openalex.org/C115051666","wikidata":"https://www.wikidata.org/wiki/Q6522493","display_name":"Ranging","level":2,"score":0.30329999327659607},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29089999198913574},{"id":"https://openalex.org/C116409475","wikidata":"https://www.wikidata.org/wiki/Q1385056","display_name":"External Data Representation","level":2,"score":0.28850001096725464},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.28529998660087585},{"id":"https://openalex.org/C5274069","wikidata":"https://www.wikidata.org/wiki/Q2285707","display_name":"Categorical variable","level":2,"score":0.27410000562667847},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.25450000166893005},{"id":"https://openalex.org/C104122410","wikidata":"https://www.wikidata.org/wiki/Q1416406","display_name":"Network model","level":2,"score":0.25440001487731934}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1038/s41598-026-55073-z","doi":"https://doi.org/10.1038/s41598-026-55073-z","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-55073-z","pdf_url":"https://www.nature.com/articles/s41598-026-55073-z_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},{"id":"pmid:42230696","doi":null,"is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/42230696","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific reports","raw_type":"Journal Article"},{"id":"pmh:oai:pubmedcentral.nih.gov:13578295","doi":null,"is_oa":true,"landing_page_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC13578295/pdf/41598_2026_Article_55073.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Sci Rep","raw_type":"Text"},{"id":"pmh:oai:doaj.org/article:a8b0ab5d2fd34f409aa0795bb2adfdfe","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/a8b0ab5d2fd34f409aa0795bb2adfdfe","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Scientific Reports, Vol 16, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1038/s41598-026-55073-z","doi":"https://doi.org/10.1038/s41598-026-55073-z","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-55073-z","pdf_url":"https://www.nature.com/articles/s41598-026-55073-z_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7163195621.pdf","grobid_xml":"https://content.openalex.org/works/W7163195621.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7210280731","https://openalex.org/W6894092587","https://openalex.org/W7127155469","https://openalex.org/W7131277809","https://openalex.org/W7128516660","https://openalex.org/W2907111600","https://openalex.org/W7162538532","https://openalex.org/W4285810007","https://openalex.org/W7163536400","https://openalex.org/W4416213584"],"abstract_inverted_index":{"In":[0,26,45,61,170],"modern":[1],"network":[2,35,65],"environments,":[3],"the":[4,13,62,105,137,151,176,185,193,204,216,233,236,243],"increasing":[5],"diversity":[6],"and":[7,30,78,99,144,162,168,228,242,251],"volume":[8],"of":[9,21,195],"cyber-attacks":[10],"have":[11],"highlighted":[12],"need":[14],"for":[15,41,57,85,128,225,269],"advanced":[16],"intrusion":[17,129,272],"detection":[18,273],"approaches":[19],"capable":[20],"modeling":[22,226,267],"complex":[23],"traffic":[24,36,87,230],"behaviors.":[25,231],"particular,":[27],"capturing":[28],"temporal":[29,71,142,227],"structural":[31,50,111,239,266],"dependencies":[32],"within":[33],"flow-based":[34,58],"remains":[37],"a":[38,48,74,121,181,264],"significant":[39],"challenge":[40],"conventional":[42],"feature-based":[43],"methods.":[44],"this":[46],"study,":[47],"graph-based":[49,197,260],"representation":[51,224,240],"framework":[52,133,179,219],"named":[53],"GraphDL":[54,178,218],"is":[55,134],"proposed":[56,63,132,152,177,217],"cyber-attack":[59],"detection.":[60,130],"approach,":[64],"flow":[66,187],"data":[67],"are":[68,83,102,117],"segmented":[69],"into":[70],"frames":[72],"using":[73,120,184],"sliding":[75],"window":[76,143],"mechanism,":[77],"Natural":[79],"Visibility":[80],"Graphs":[81],"(NVGs)":[82],"constructed":[84],"each":[86],"feature.":[88],"Various":[89],"graph-theoretical":[90],"metrics,":[91],"including":[92],"degree":[93],"centrality,":[94,96,98],"closeness":[95],"betweenness":[97],"clustering":[100],"coefficient,":[101],"extracted":[103],"from":[104,158],"generated":[106],"visibility":[107,196,248,259],"graphs":[108],"to":[109,160,191],"construct":[110],"feature":[112,145],"representations.":[113,198],"These":[114],"graph-derived":[115],"descriptors":[116],"subsequently":[118],"processed":[119],"Convolutional":[122],"Neural":[123],"Network":[124],"(CNN)-based":[125],"classification":[126],"architecture":[127],"The":[131,199,255],"evaluated":[135],"on":[136],"CICIDS2018":[138],"dataset":[139],"under":[140],"different":[141],"configurations.":[146],"Experimental":[147],"results":[148,200],"demonstrate":[149],"that":[150,202,258],"approach":[153,268],"achieves":[154],"Accuracy":[155],"values":[156,165],"ranging":[157],"75.81%":[159],"96.73%":[161],"weighted":[163],"F1-score":[164],"between":[166,238],"72.32%":[167],"96.65%.":[169],"addition,":[171],"an":[172,221],"ablation":[173],"study":[174,234],"comparing":[175],"with":[180,211],"Raw-CNN":[182,205],"baseline":[183,206],"original":[186],"features":[188],"was":[189],"conducted":[190],"analyze":[192],"contribution":[194],"indicate":[201],"although":[203],"provides":[207],"strong":[208],"predictive":[209],"performance":[210],"substantially":[212],"lower":[213],"computational":[214,244],"cost,":[215],"offers":[220],"alternative":[222],"graph-oriented":[223,271],"nonlinear":[229],"Furthermore,":[232],"analyzes":[235],"trade-off":[237],"capability":[241],"overhead":[245],"introduced":[246],"by":[247],"graph":[249,252],"construction":[250],"metric":[253],"extraction.":[254],"findings":[256],"suggest":[257],"representations":[261],"may":[262],"provide":[263],"feasible":[265],"future":[270],"research.":[274]},"counts_by_year":[],"updated_date":"2026-10-29T09:56:32.521200","created_date":"2026-06-03T00:00:00"}