{"id":"https://openalex.org/W7225625779","doi":"https://doi.org/10.1007/s11416-026-00692-3","title":"Operationally calibrated open-world zero-day intrusion detection using hybrid conformal abstention","display_name":"Operationally calibrated open-world zero-day intrusion detection using hybrid conformal abstention","publication_year":2026,"publication_date":"2026-11-09","ids":{"openalex":"https://openalex.org/W7225625779","doi":"https://doi.org/10.1007/s11416-026-00692-3"},"language":"en","primary_location":{"id":"doi:10.1007/s11416-026-00692-3","doi":"https://doi.org/10.1007/s11416-026-00692-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-026-00692-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00692-3.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-c","jufo-1","poland-70","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00692-3.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102709354","display_name":"Muhammad Zeeshan Younas","orcid":"https://orcid.org/0000-0002-5245-9812","observed_orcids":["https://orcid.org/0000-0002-5245-9812"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Muhammad Zeeshan Younas","raw_affiliation_strings":["Dallas, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Dallas, USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5102709354"],"corresponding_institution_ids":[],"apc_list":{"value":3290,"currency":"USD","value_usd":3290},"apc_paid":{"value":3290,"currency":"USD","value_usd":3290},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/open-world-learning","display_name":"open-world learning","score":0.6779999732971191},{"id":"https://openalex.org/keywords/conformal-prediction","display_name":"conformal prediction","score":0.871999979019165},{"id":"https://openalex.org/keywords/uncertainty-estimation","display_name":"uncertainty estimation","score":0.7170000076293945},{"id":"https://openalex.org/keywords/novelty-detection","display_name":"novelty detection","score":0.8500000238418579},{"id":"https://openalex.org/keywords/isolation-forest","display_name":"Isolation Forest","score":0.6980000138282776},{"id":"https://openalex.org/keywords/denial-of-service-attacks","display_name":"denial-of-service attacks","score":0.6269999742507935},{"id":"https://openalex.org/keywords/botnet-detection","display_name":"botnet detection","score":0.574999988079071}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.8435999751091003},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7807000279426575},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.5636000037193298},{"id":"https://openalex.org/C188441871","wikidata":"https://www.wikidata.org/wiki/Q7554146","display_name":"Softmax function","level":3,"score":0.4950000047683716},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4771000146865845},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.45989999175071716},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.4449999928474426},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.44369998574256897},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.4163999855518341},{"id":"https://openalex.org/C98214594","wikidata":"https://www.wikidata.org/wiki/Q850275","display_name":"Conformal map","level":2,"score":0.40470001101493835},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.38670000433921814},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.38440001010894775},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.37229999899864197},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.33489999175071716},{"id":"https://openalex.org/C31691690","wikidata":"https://www.wikidata.org/wiki/Q1753979","display_name":"Timeout","level":2,"score":0.33480000495910645},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.31360000371932983},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.3111000061035156},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2897999882698059},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2874999940395355},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.2838999927043915},{"id":"https://openalex.org/C2778738651","wikidata":"https://www.wikidata.org/wiki/Q16546687","display_name":"Novelty","level":2,"score":0.2816999852657318},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.2632000148296356}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s11416-026-00692-3","doi":"https://doi.org/10.1007/s11416-026-00692-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-026-00692-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00692-3.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-c","jufo-1","poland-70","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s11416-026-00692-3","doi":"https://doi.org/10.1007/s11416-026-00692-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-026-00692-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00692-3.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-c","jufo-1","poland-70","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320318036","display_name":"Southern Methodist University","ror":"https://ror.org/042tdr378"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225625779.pdf","grobid_xml":"https://content.openalex.org/works/W7225625779.grobid-xml"},"referenced_works_count":31,"referenced_works":["https://openalex.org/W2099940443","https://openalex.org/W2119880843","https://openalex.org/W2151764894","https://openalex.org/W2272331516","https://openalex.org/W2282821441","https://openalex.org/W2296509296","https://openalex.org/W2296719434","https://openalex.org/W2311417940","https://openalex.org/W2514278201","https://openalex.org/W2531327146","https://openalex.org/W2767414122","https://openalex.org/W2898761242","https://openalex.org/W2901114541","https://openalex.org/W2911964244","https://openalex.org/W3000503630","https://openalex.org/W3126686773","https://openalex.org/W3145542169","https://openalex.org/W4205334018","https://openalex.org/W4384787750","https://openalex.org/W4396855777","https://openalex.org/W4402437224","https://openalex.org/W4404691697","https://openalex.org/W4410405915","https://openalex.org/W4410548472","https://openalex.org/W4411548020","https://openalex.org/W4415747387","https://openalex.org/W4417199959","https://openalex.org/W7125954607","https://openalex.org/W7130697836","https://openalex.org/W7153199326","https://openalex.org/W7153436317"],"related_works":["https://openalex.org/W7131790316","https://openalex.org/W7164342204","https://openalex.org/W7172025201","https://openalex.org/W7213988104","https://openalex.org/W4416872788","https://openalex.org/W7221626022","https://openalex.org/W7123339320","https://openalex.org/W7153199326","https://openalex.org/W7134191489","https://openalex.org/W7224961817"],"abstract_inverted_index":{"Abstract":[0],"Network":[1],"intrusion":[2,50,207],"detection":[3,51,185,192,208],"systems":[4],"are":[5,95],"often":[6],"evaluated":[7],"under":[8,116,209],"closed-world":[9],"assumptions,":[10],"where":[11],"every":[12],"attack":[13,35,56,130],"family":[14],"observed":[15],"during":[16,21],"testing":[17],"is":[18,147],"already":[19],"represented":[20],"training.":[22],"This":[23,43],"setting":[24],"can":[25],"overstate":[26],"deployment":[27],"readiness":[28],"because":[29],"operational":[30,210],"environments":[31],"routinely":[32],"encounter":[33],"unseen":[34],"variants,":[36],"evolving":[37],"tactics,":[38],"and":[39,69,89,173,196,213],"uncertain":[40],"traffic":[41,108],"patterns.":[42],"paper":[44],"proposes":[45],"an":[46],"operationally":[47],"calibrated":[48],"open-world":[49],"framework":[52],"for":[53,186,193],"flow-based":[54],"zero-day":[55,142,206],"detection.":[57,163,180],"The":[58],"proposed":[59],"method,":[60],"Hybrid":[61],"Tail-Calibrated":[62],"Conformal":[63],"Abstention":[64],"(HTCCA),":[65],"integrates":[66],"complementary":[67],"uncertainty":[68],"novelty":[70],"indicators,":[71],"including":[72],"predictive":[73],"entropy,":[74],"margin":[75],"uncertainty,":[76,80],"maximum":[77],"softmax":[78],"probability":[79],"prototype":[81],"distance,":[82],"Isolation":[83],"Forest":[84],"score,":[85],"PCA":[86],"reconstruction":[87],"error,":[88],"extreme-value":[90],"tail":[91],"modeling.":[92],"These":[93,199],"scores":[94],"used":[96],"in":[97],"a":[98,103,117,153],"two-stage":[99],"decision":[100],"process.":[101],"First,":[102],"benign-calibrated":[104],"UNKNOWN":[105,172],"gate":[106],"identifies":[107],"that":[109,145],"deviates":[110],"from":[111],"the":[112,148,166,202],"known":[113,129],"operating":[114],"space":[115],"fixed":[118],"false-positive-rate":[119],"budget.":[120],"Second,":[121],"class-conditional":[122],"conformal":[123],"prediction":[124],"assigns":[125],"retained":[126],"samples":[127],"to":[128,136],"families":[131],"or":[132],"routes":[133],"ambiguous":[134],"cases":[135],"REVIEW.":[137],"Experimental":[138],"evaluation":[139],"using":[140],"leave-one-family-out":[141],"protocols":[143],"shows":[144,183],"entropy":[146],"strongest":[149],"single-score":[150],"baseline":[151],"at":[152],"1%":[154],"target":[155],"benign":[156],"false-positive":[157,211],"rate,":[158],"achieving":[159],"19.6%":[160],"mean":[161,178],"UNKNOWN-only":[162],"HTCCA-Conformal":[164],"improves":[165],"broader":[167],"unknown-alert":[168,179],"pathway":[169],"by":[170],"combining":[171],"REVIEW":[174],"decisions,":[175],"reaching":[176],"30.6%":[177],"Family-wise":[181],"analysis":[182],"stronger":[184],"high-volume":[187],"denial-of-service":[188],"patterns":[189],"but":[190],"weaker":[191],"Botnet,":[194],"WebAttack,":[195],"BruteForce":[197],"traffic.":[198],"findings":[200],"highlight":[201],"importance":[203],"of":[204],"evaluating":[205],"constraints":[212],"analyst-centered":[214],"triage":[215],"settings.":[216]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-10T00:00:00"}