{"id":"https://openalex.org/W4414809575","doi":"https://doi.org/10.1007/978-3-032-05461-6_23","title":"Learning Fast to\u00a0Detect Slow: A Few-Shot Neural Approach to\u00a0Slow DoS Attack Detection","display_name":"Learning Fast to\u00a0Detect Slow: A Few-Shot Neural Approach to\u00a0Slow DoS Attack Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414809575","doi":"https://doi.org/10.1007/978-3-032-05461-6_23"},"language":"en","primary_location":{"id":"doi:10.1007/978-3-032-05461-6_23","is_oa":true,"landing_page_url":"https://doi.org/10.1007/978-3-032-05461-6_23","pdf_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-05461-6_23.pdf","source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-05461-6_23.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5070572385","display_name":"Francesco Scala","orcid":"https://orcid.org/0009-0007-5224-0910"},"institutions":[{"id":"https://openalex.org/I3005160176","display_name":"Institute for High Performance Computing and Networking","ror":"https://ror.org/04r5fge26","country_code":"IT","type":"facility","lineage":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Francesco Scala","raw_affiliation_strings":["Institute of High Performance Computing and Networking (ICAR-CNR), Via P. Bucci, 87036, Rende, CS, Italy"],"raw_orcid":"https://orcid.org/0009-0007-5224-0910","affiliations":[{"raw_affiliation_string":"Institute of High Performance Computing and Networking (ICAR-CNR), Via P. Bucci, 87036, Rende, CS, Italy","institution_ids":["https://openalex.org/I3005160176"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025844977","display_name":"Massimo Guarascio","orcid":"https://orcid.org/0000-0001-7711-9833"},"institutions":[{"id":"https://openalex.org/I3005160176","display_name":"Institute for High Performance Computing and Networking","ror":"https://ror.org/04r5fge26","country_code":"IT","type":"facility","lineage":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Massimo Guarascio","raw_affiliation_strings":["Institute of High Performance Computing and Networking (ICAR-CNR), Via P. Bucci, 87036, Rende, CS, Italy"],"raw_orcid":"https://orcid.org/0000-0001-7711-9833","affiliations":[{"raw_affiliation_string":"Institute of High Performance Computing and Networking (ICAR-CNR), Via P. Bucci, 87036, Rende, CS, Italy","institution_ids":["https://openalex.org/I3005160176"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119841007","display_name":"Carlo Parrotta","orcid":null},"institutions":[{"id":"https://openalex.org/I45204951","display_name":"University of Calabria","ror":"https://ror.org/02rc97e94","country_code":"IT","type":"education","lineage":["https://openalex.org/I45204951"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Carlo Parrotta","raw_affiliation_strings":["Department Computer Engineering, Modeling, Electronics, and Systems Engineering (DIMES), University of Calabria, 87036, Rende, CS, Italy"],"raw_orcid":"https://orcid.org/0009-0006-1371-4872","affiliations":[{"raw_affiliation_string":"Department Computer Engineering, Modeling, Electronics, and Systems Engineering (DIMES), University of Calabria, 87036, Rende, CS, Italy","institution_ids":["https://openalex.org/I45204951"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5051833173","display_name":"Luigi Pontieri","orcid":"https://orcid.org/0000-0003-4513-0362"},"institutions":[{"id":"https://openalex.org/I3005160176","display_name":"Institute for High Performance Computing and Networking","ror":"https://ror.org/04r5fge26","country_code":"IT","type":"facility","lineage":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Luigi Pontieri","raw_affiliation_strings":["Institute of High Performance Computing and Networking (ICAR-CNR), Via P. Bucci, 87036, Rende, CS, Italy"],"raw_orcid":"https://orcid.org/0000-0003-4513-0362","affiliations":[{"raw_affiliation_string":"Institute of High Performance Computing and Networking (ICAR-CNR), Via P. Bucci, 87036, Rende, CS, Italy","institution_ids":["https://openalex.org/I3005160176"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5070572385"],"corresponding_institution_ids":["https://openalex.org/I3005160176"],"apc_list":{"value":5000,"currency":"EUR","value_usd":5392},"apc_paid":{"value":5000,"currency":"EUR","value_usd":5392},"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"347","last_page":"362"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9894999861717224,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6894999742507935},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6438999772071838},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.614300012588501},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5860000252723694},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.48249998688697815},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.4810999929904938},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.4526999890804291},{"id":"https://openalex.org/keywords/supervised-learning","display_name":"Supervised learning","score":0.45010000467300415},{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.4388999938964844}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8939999938011169},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6894999742507935},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6601999998092651},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6438999772071838},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.614300012588501},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6086000204086304},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5860000252723694},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.48249998688697815},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.4810999929904938},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4526999890804291},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.45010000467300415},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.4388999938964844},{"id":"https://openalex.org/C168725872","wikidata":"https://www.wikidata.org/wiki/Q991663","display_name":"Sophistication","level":2,"score":0.4172999858856201},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.3919999897480011},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.38600000739097595},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.3723999857902527},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.358599990606308},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.30970001220703125},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.29760000109672546},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.2906999886035919},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.27630001306533813},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.2711000144481659},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.26179999113082886},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.260699987411499},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.2603999972343445},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.2540999948978424}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/978-3-032-05461-6_23","is_oa":true,"landing_page_url":"https://doi.org/10.1007/978-3-032-05461-6_23","pdf_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-05461-6_23.pdf","source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"}],"best_oa_location":{"id":"doi:10.1007/978-3-032-05461-6_23","is_oa":true,"landing_page_url":"https://doi.org/10.1007/978-3-032-05461-6_23","pdf_url":"https://link.springer.com/content/pdf/10.1007/978-3-032-05461-6_23.pdf","source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4414809575.pdf"},"referenced_works_count":26,"referenced_works":["https://openalex.org/W2156204309","https://openalex.org/W2789828921","https://openalex.org/W2807786182","https://openalex.org/W2942104252","https://openalex.org/W2963351448","https://openalex.org/W3011040471","https://openalex.org/W3011090343","https://openalex.org/W3013210424","https://openalex.org/W3093410479","https://openalex.org/W3117041256","https://openalex.org/W3131088496","https://openalex.org/W3134108515","https://openalex.org/W3161599138","https://openalex.org/W3174223893","https://openalex.org/W3196223475","https://openalex.org/W3214897310","https://openalex.org/W4213412303","https://openalex.org/W4225162169","https://openalex.org/W4253802431","https://openalex.org/W4318615495","https://openalex.org/W4366308451","https://openalex.org/W4366462802","https://openalex.org/W4380715201","https://openalex.org/W4398186423","https://openalex.org/W4408712376","https://openalex.org/W6963643661"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"The":[1,101],"increasing":[2],"frequency":[3],"and":[4,11,70,91,144,163],"sophistication":[5],"of":[6,8,14,73,165],"Denial":[7,13],"Service":[9,15],"(DoS)":[10],"Distributed":[12],"(DDoS)":[16],"attacks,":[17,37],"pose":[18],"significant":[19],"challenges":[20,64],"to":[21,94,122,138,150],"modern":[22],"cybersecurity":[23],"systems.":[24],"These":[25,117],"threats":[26],"are":[27,120],"further":[28],"complicated":[29],"by":[30,63],"stealthy":[31],"variants":[32],"such":[33],"as":[34],"slow":[35],"DoS":[36,172],"which":[38],"often":[39],"evade":[40],"timely":[41],"detection.":[42],"While":[43],"Deep":[44],"Learning":[45],"(DL)-based":[46],"Intrusion":[47],"Detection":[48],"Systems":[49],"(IDSs)":[50],"have":[51],"shown":[52],"promise":[53],"in":[54,127,169],"analyzing":[55],"complex":[56],"network":[57,108],"traffic,":[58,109],"their":[59],"effectiveness":[60,162],"is":[61],"hindered":[62],"like":[65],"limited":[66],"labeled":[67],"data,":[68],"noise,":[69],"the":[71,111,132,161,166],"presence":[72],"Out-of-Distribution":[74],"(OOD)":[75],"samples.":[76],"This":[77],"paper":[78],"proposes":[79],"a":[80],"hybrid":[81],"DL-based":[82],"IDS":[83],"framework":[84],"(":[85],"ENE4":[86],")":[87],"that":[88],"integrates":[89],"unsupervised":[90,102],"supervised":[92,112],"components":[93],"improve":[95],"detection":[96,125],"performance":[97],"under":[98],"label-scarce":[99],"conditions.":[100],"module":[103],"extracts":[104],"task-independent":[105],"features":[106,119],"from":[107,141],"while":[110],"one":[113],"learns":[114],"task-specific":[115],"representations.":[116],"complementary":[118],"fused":[121],"enable":[123],"robust":[124],"even":[126],"few-shot":[128],"learning":[129],"settings.":[130],"Additionally,":[131],"model":[133],"incorporates":[134],"an":[135],"adaptation":[136],"mechanism":[137],"leverage":[139],"knowledge":[140],"more":[142],"frequent":[143],"related":[145],"attack":[146],"types,":[147],"enhancing":[148],"generalization":[149],"rare":[151],"patterns.":[152],"Experimental":[153],"results":[154],"on":[155],"two":[156],"standard":[157],"benchmark":[158],"datasets":[159],"demonstrate":[160],"robustness":[164],"proposed":[167],"approach":[168],"detecting":[170],"evasive":[171],"attacks.":[173]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}