{"id":"https://openalex.org/W7225757747","doi":"https://doi.org/10.21203/rs.3.rs-11454054/v1","title":"AE-DSP: An Explainable Intrusion Detection Framework for Zero-Day Attacks Based on SHAP Contribution-Space Modeling","display_name":"AE-DSP: An Explainable Intrusion Detection Framework for Zero-Day Attacks Based on SHAP Contribution-Space Modeling","publication_year":2026,"publication_date":"2026-11-10","ids":{"openalex":"https://openalex.org/W7225757747","doi":"https://doi.org/10.21203/rs.3.rs-11454054/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-11454054/v1","doi":"https://doi.org/10.21203/rs.3.rs-11454054/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11454054/v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.21203/rs.3.rs-11454054/v1","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5161417515","display_name":"Yifan Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I43337087","display_name":"Hebei University","ror":"https://ror.org/01p884a79","country_code":"CN","type":"education","lineage":["https://openalex.org/I43337087"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifan Liu","raw_affiliation_strings":["Hebei University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hebei University","institution_ids":["https://openalex.org/I43337087"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5161368900","display_name":"Zheng Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I43337087","display_name":"Hebei University","ror":"https://ror.org/01p884a79","country_code":"CN","type":"education","lineage":["https://openalex.org/I43337087"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheng Liu","raw_affiliation_strings":["Hebei University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hebei University","institution_ids":["https://openalex.org/I43337087"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068140556","display_name":"Wenlei Chai","orcid":"https://orcid.org/0009-0007-6918-4855","observed_orcids":["https://orcid.org/0009-0007-6918-4855"]},"institutions":[{"id":"https://openalex.org/I43337087","display_name":"Hebei University","ror":"https://ror.org/01p884a79","country_code":"CN","type":"education","lineage":["https://openalex.org/I43337087"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenlei Chai","raw_affiliation_strings":["Hebei University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hebei University","institution_ids":["https://openalex.org/I43337087"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5161372076","display_name":"Miaolin Wang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I43337087","display_name":"Hebei University","ror":"https://ror.org/01p884a79","country_code":"CN","type":"education","lineage":["https://openalex.org/I43337087"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Miaolin Wang","raw_affiliation_strings":["Hebei University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hebei University","institution_ids":["https://openalex.org/I43337087"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026467215","display_name":"Junjie Qiu","orcid":"https://orcid.org/0009-0002-3606-9491","observed_orcids":["https://orcid.org/0009-0002-3606-9491"]},"institutions":[{"id":"https://openalex.org/I43337087","display_name":"Hebei University","ror":"https://ror.org/01p884a79","country_code":"CN","type":"education","lineage":["https://openalex.org/I43337087"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junjie Qiu","raw_affiliation_strings":["Hebei University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hebei University","institution_ids":["https://openalex.org/I43337087"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5161404139","display_name":"Yi Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I43337087","display_name":"Hebei University","ror":"https://ror.org/01p884a79","country_code":"CN","type":"education","lineage":["https://openalex.org/I43337087"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yi Liu","raw_affiliation_strings":["Hebei University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hebei University","institution_ids":["https://openalex.org/I43337087"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I43337087"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6549000144004822},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.629800021648407},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.569100022315979},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4343999922275543},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.42969998717308044},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4293999969959259},{"id":"https://openalex.org/C112972136","wikidata":"https://www.wikidata.org/wiki/Q7595718","display_name":"Stability (learning theory)","level":2,"score":0.42579999566078186},{"id":"https://openalex.org/C202269582","wikidata":"https://www.wikidata.org/wiki/Q2644277","display_name":"Complementarity (molecular biology)","level":2,"score":0.40400001406669617},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3257000148296356},{"id":"https://openalex.org/C59594135","wikidata":"https://www.wikidata.org/wiki/Q5249242","display_name":"Decision model","level":2,"score":0.29809999465942383},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.29499998688697815},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.2897000014781952},{"id":"https://openalex.org/C84839998","wikidata":"https://www.wikidata.org/wiki/Q5249245","display_name":"Decision rule","level":2,"score":0.2662999927997589},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2648000121116638},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.26019999384880066},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.25589999556541443},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.25279998779296875}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21203/rs.3.rs-11454054/v1","doi":"https://doi.org/10.21203/rs.3.rs-11454054/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11454054/v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-11454054/v1","doi":"https://doi.org/10.21203/rs.3.rs-11454054/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11454054/v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":26,"referenced_works":["https://openalex.org/W2099940443","https://openalex.org/W2272331516","https://openalex.org/W2296509296","https://openalex.org/W2759431188","https://openalex.org/W2787070805","https://openalex.org/W2789828921","https://openalex.org/W2793294490","https://openalex.org/W3040266635","https://openalex.org/W3048313003","https://openalex.org/W3092771185","https://openalex.org/W3193327991","https://openalex.org/W4210659135","https://openalex.org/W4285248859","https://openalex.org/W4360978672","https://openalex.org/W4382598033","https://openalex.org/W4391069478","https://openalex.org/W4399666315","https://openalex.org/W4400316410","https://openalex.org/W4401529233","https://openalex.org/W4410405915","https://openalex.org/W4411160947","https://openalex.org/W4411548020","https://openalex.org/W4415778534","https://openalex.org/W7133220087","https://openalex.org/W7133704920","https://openalex.org/W7149528417"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"Zero-day":[1],"attack":[2,8],"detection":[3,30,64,116],"is":[4],"challenging":[5],"because":[6],"target":[7],"classes":[9],"are":[10],"unavailable":[11],"during":[12],"training,":[13],"preventing":[14],"models":[15,83],"from":[16,32,70,92],"directly":[17],"learning":[18],"their":[19],"class-conditional":[20],"distributions":[21],"or":[22,40],"decision":[23,75],"boundaries.":[24],"Existing":[25],"methods":[26],"mainly":[27],"construct":[28],"unseen-attack":[29],"criteria":[31],"raw":[33],"traffic":[34,114],"attributes,":[35],"learned":[36],"representations,":[37],"classification":[38],"outputs,":[39],"inter-class":[41],"relationships,":[42],"while":[43],"sample-level":[44],"relationships":[45],"between":[46],"input":[47],"features":[48],"and":[49,97,132,137,147,156,164],"model":[50],"decisions":[51,117],"remain":[52,109],"underexploited.":[53],"To":[54],"address":[55],"this":[56],"limitation,":[57],"we":[58],"propose":[59],"AE-DSP,":[60],"an":[61],"explainable":[62],"intrusion":[63],"framework":[65],"that":[66],"transforms":[67],"SHAP":[68],"contributions":[69],"post-hoc":[71],"explanations":[72],"into":[73],"task-relevant":[74],"evidence.":[76],"Within":[77],"a":[78],"unified":[79],"contribution":[80,95,107],"space,":[81],"AE-DSP":[82,126],"two":[84],"complementary":[85],"forms":[86],"of":[87,129,144,166],"anomaly":[88],"evidence:":[89],"overall":[90],"deviation":[91],"the":[93,112,162,167],"normal":[94],"structure":[96],"dimension-wise":[98],"contribution-deviation":[99],"patterns":[100],"represented":[101],"by":[102],"Deviation":[103],"Semantic":[104],"Prototypes.":[105],"Because":[106],"dimensions":[108],"aligned":[110],"with":[111,139],"original":[113],"features,":[115],"can":[118],"also":[119],"be":[120],"traced":[121],"to":[122],"dominant":[123],"DeltaSHAP":[124],"deviations.":[125],"achieves":[127],"F1-scores":[128],"0.9341,":[130],"0.9250,":[131],"0.9025":[133],"on":[134],"NSL-KDD,":[135],"UNSW-NB15,":[136],"CICIDS2017,":[138],"corresponding":[140],"New":[141],"Recall":[142],"values":[143],"0.9774,":[145],"0.9350,":[146],"0.9251.":[148],"Ablation":[149],"studies,":[150],"random-seed":[151],"stability":[152],"analyses,":[153,155],"parameter-sensitivity":[154],"quantitative":[157],"explainability":[158],"experiments":[159],"further":[160],"demonstrate":[161],"effectiveness":[163],"complementarity":[165],"proposed":[168],"contribution-space":[169],"modeling":[170],"strategy.":[171]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-11T00:00:00"}