{"id":"https://openalex.org/W4360978672","doi":"https://doi.org/10.1007/s10207-023-00676-0","title":"From zero-shot machine learning to zero-day attack detection","display_name":"From zero-shot machine learning to zero-day attack detection","publication_year":2023,"publication_date":"2023-03-15","ids":{"openalex":"https://openalex.org/W4360978672","doi":"https://doi.org/10.1007/s10207-023-00676-0"},"language":"en","primary_location":{"id":"doi:10.1007/s10207-023-00676-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-023-00676-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-023-00676-0.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10207-023-00676-0.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5047926199","display_name":"Mohanad Sarhan","orcid":"https://orcid.org/0000-0001-8597-6042"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":true,"raw_author_name":"Mohanad Sarhan","raw_affiliation_strings":["University of Queensland, Brisbane, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Queensland, Brisbane, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016369735","display_name":"Siamak Layeghy","orcid":"https://orcid.org/0000-0002-1229-2368"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Siamak Layeghy","raw_affiliation_strings":["University of Queensland, Brisbane, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Queensland, Brisbane, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017810911","display_name":"Marcus Gallagher","orcid":"https://orcid.org/0000-0002-6694-9572"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Marcus Gallagher","raw_affiliation_strings":["University of Queensland, Brisbane, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Queensland, Brisbane, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078468070","display_name":"Marius Portmann","orcid":"https://orcid.org/0000-0003-1852-3961"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Marius Portmann","raw_affiliation_strings":["University of Queensland, Brisbane, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Queensland, Brisbane, Australia","institution_ids":["https://openalex.org/I165143802"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5047926199"],"corresponding_institution_ids":["https://openalex.org/I165143802"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":13.5925,"has_fulltext":true,"cited_by_count":102,"citation_normalized_percentile":{"value":0.99364177,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"22","issue":"4","first_page":"947","last_page":"959"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/zero","display_name":"Zero (linguistics)","score":0.7517686486244202},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6909604072570801},{"id":"https://openalex.org/keywords/zero-knowledge-proof","display_name":"Zero-knowledge proof","score":0.6464307904243469},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.5510143637657166},{"id":"https://openalex.org/keywords/shot","display_name":"Shot (pellet)","score":0.5356763005256653},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.452575147151947},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3933188319206238},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3554331064224243}],"concepts":[{"id":"https://openalex.org/C2780813799","wikidata":"https://www.wikidata.org/wiki/Q3274237","display_name":"Zero (linguistics)","level":2,"score":0.7517686486244202},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6909604072570801},{"id":"https://openalex.org/C176329583","wikidata":"https://www.wikidata.org/wiki/Q191943","display_name":"Zero-knowledge proof","level":3,"score":0.6464307904243469},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.5510143637657166},{"id":"https://openalex.org/C2778344882","wikidata":"https://www.wikidata.org/wiki/Q278938","display_name":"Shot (pellet)","level":2,"score":0.5356763005256653},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.452575147151947},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3933188319206238},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3554331064224243},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C178790620","wikidata":"https://www.wikidata.org/wiki/Q11351","display_name":"Organic chemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s10207-023-00676-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-023-00676-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-023-00676-0.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s10207-023-00676-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-023-00676-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-023-00676-0.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.4300000071525574,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320320984","display_name":"University of Queensland","ror":"https://ror.org/00rqy9422"}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4360978672.pdf"},"referenced_works_count":31,"referenced_works":["https://openalex.org/W33506368","https://openalex.org/W1494192115","https://openalex.org/W1530215515","https://openalex.org/W1679074130","https://openalex.org/W1812927916","https://openalex.org/W1975415766","https://openalex.org/W1985987493","https://openalex.org/W2046163812","https://openalex.org/W2065890363","https://openalex.org/W2093931563","https://openalex.org/W2118023920","https://openalex.org/W2142889610","https://openalex.org/W2296509296","https://openalex.org/W2342408547","https://openalex.org/W2596142952","https://openalex.org/W2761152885","https://openalex.org/W2861867928","https://openalex.org/W2897620540","https://openalex.org/W2911964244","https://openalex.org/W2922140331","https://openalex.org/W2922628727","https://openalex.org/W2945867651","https://openalex.org/W2962688977","https://openalex.org/W2970501769","https://openalex.org/W2996563683","https://openalex.org/W2998670004","https://openalex.org/W3092771185","https://openalex.org/W3097159718","https://openalex.org/W3105682467","https://openalex.org/W3172875390","https://openalex.org/W4205646471"],"related_works":["https://openalex.org/W2074502265","https://openalex.org/W4214877189","https://openalex.org/W1870614684","https://openalex.org/W2773965352","https://openalex.org/W2381179799","https://openalex.org/W2980279061","https://openalex.org/W2334685461","https://openalex.org/W194387157","https://openalex.org/W2000850689","https://openalex.org/W2952570804"],"abstract_inverted_index":{"Abstract":[0],"Machine":[1],"learning":[2,88,105,108,161],"(ML)":[3],"models":[4,109,130,176],"have":[5,214],"proved":[6],"efficient":[7],"in":[8,32,37,72,97,163,193,200],"classifying":[9],"data":[10,24,47,112,181],"samples":[11,25,48],"into":[12],"their":[13,76],"respective":[14],"categories.":[15],"The":[16,167,183],"standard":[17],"ML":[18,175],"evaluation":[19,146],"methodology":[20,89],"assumes":[21],"that":[22,68,117,186,208],"test":[23],"are":[26,69,198],"derived":[27],"from":[28],"pre-observed":[29],"classes":[30,52],"used":[31,71],"the":[33,79,92,103,107,126,129,132,157,160,227],"training":[34,73],"phase.":[35],"However,":[36],"applications":[38],"such":[39],"as":[40,65,142,150,203],"Network":[41],"Intrusion":[42],"Detection":[43,152],"Systems":[44],"(NIDSs),":[45],"obtaining":[46],"of":[49,94,159],"all":[50],"attack":[51,62,100,190,229],"to":[53,75,90,114,139,155],"be":[54],"observed":[55],"is":[56,148,170],"challenging.":[57],"ML-based":[58,95,196],"NIDSs":[59,96,197],"face":[60],"new":[61,145],"traffic":[63],"known":[64,120,135],"zero-day":[66,99,137,189],"attacks":[67,121,138,209],"not":[70],"due":[74],"non-existence":[77],"at":[78],"time.":[80],"Therefore,":[81],"this":[82,194],"paper":[83],"proposes":[84],"a":[85,211,215,221],"novel":[86],"zero-shot":[87],"evaluate":[91],"performance":[93],"recognising":[98],"scenarios.":[101],"In":[102,125],"attribute":[104],"stage,":[106,128],"map":[110],"network":[111],"features":[113],"semantic":[115],"attributes":[116],"distinguish":[118],"between":[119,134],"and":[122,136,177,220],"benign":[123],"behaviour.":[124],"inference":[127],"construct":[131],"relationships":[133],"detect":[140],"them":[141,202],"malicious.":[143,204],"A":[144],"metric":[147],"defined":[149],"Zero-day":[151],"Rate":[153],"(Z-DR)":[154],"measure":[156],"effectiveness":[158],"model":[162],"detecting":[164,201],"unknown":[165],"attacks.":[166],"proposed":[168],"framework":[169],"evaluated":[171],"using":[172],"two":[173,178],"key":[174],"modern":[179],"NIDS":[180],"sets.":[182],"results":[184],"demonstrate":[185],"for":[187],"certain":[188],"groups":[191],"discovered":[192],"paper,":[195],"ineffective":[199],"Further":[205],"analysis":[206],"shows":[207],"with":[210],"low":[212],"Z-DR":[213],"significantly":[216],"distinct":[217],"feature":[218],"distribution":[219],"higher":[222],"Wasserstein":[223],"Distance":[224],"range":[225],"than":[226],"other":[228],"classes.":[230]},"counts_by_year":[{"year":2026,"cited_by_count":17},{"year":2025,"cited_by_count":54},{"year":2024,"cited_by_count":18},{"year":2023,"cited_by_count":13}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}