{"id":"https://openalex.org/W4409140393","doi":"https://doi.org/10.1007/s10489-025-06422-4","title":"Advanced IDS: a comparative study of datasets and machine learning algorithms for network flow-based intrusion detection systems","display_name":"Advanced IDS: a comparative study of datasets and machine learning algorithms for network flow-based intrusion detection systems","publication_year":2025,"publication_date":"2025-04-01","ids":{"openalex":"https://openalex.org/W4409140393","doi":"https://doi.org/10.1007/s10489-025-06422-4"},"language":"en","primary_location":{"id":"doi:10.1007/s10489-025-06422-4","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10489-025-06422-4","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10489-025-06422-4.pdf","source":{"id":"https://openalex.org/S74726891","display_name":"Applied Intelligence","issn_l":"0924-669X","issn":["0924-669X","1573-7497"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Intelligence","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10489-025-06422-4.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109515352","display_name":"Julio Cesar Mungu\u00eda Mondrag\u00f3n","orcid":"https://orcid.org/0000-0001-6203-5450"},"institutions":[{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX"],"is_corresponding":true,"raw_author_name":"Jose Carlos Mondragon","raw_affiliation_strings":["Tecnologico de Monterrey, School of Engineering and Sciences, Nuevo Le\u00f3n, Nuevo Le\u00f3n, 64849, Mexico"],"raw_orcid":"https://orcid.org/0000-0001-6203-5450","affiliations":[{"raw_affiliation_string":"Tecnologico de Monterrey, School of Engineering and Sciences, Nuevo Le\u00f3n, Nuevo Le\u00f3n, 64849, Mexico","institution_ids":["https://openalex.org/I98461037"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043554078","display_name":"Paula Branco","orcid":"https://orcid.org/0000-0002-9917-3694"},"institutions":[{"id":"https://openalex.org/I153718931","display_name":"University of Ottawa","ror":"https://ror.org/03c4mmv16","country_code":"CA","type":"education","lineage":["https://openalex.org/I153718931"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Paula Branco","raw_affiliation_strings":["University of Ottawa, 800 King Edward Avenue, Ottawa, Ontario, K1N6N5, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Ottawa, 800 King Edward Avenue, Ottawa, Ontario, K1N6N5, Canada","institution_ids":["https://openalex.org/I153718931"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007509079","display_name":"Guy-Vincent Jourdan","orcid":"https://orcid.org/0000-0001-6067-6545"},"institutions":[{"id":"https://openalex.org/I153718931","display_name":"University of Ottawa","ror":"https://ror.org/03c4mmv16","country_code":"CA","type":"education","lineage":["https://openalex.org/I153718931"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Guy-Vincent Jourdan","raw_affiliation_strings":["University of Ottawa, 800 King Edward Avenue, Ottawa, Ontario, K1N6N5, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Ottawa, 800 King Edward Avenue, Ottawa, Ontario, K1N6N5, Canada","institution_ids":["https://openalex.org/I153718931"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041843953","display_name":"Andres E. Gutierrez-Rodr\u00edguez","orcid":"https://orcid.org/0000-0003-4178-1635"},"institutions":[{"id":"https://openalex.org/I152909475","display_name":"Universidad Regiomontana","ror":"https://ror.org/04s65rw96","country_code":"MX","type":"education","lineage":["https://openalex.org/I152909475"]},{"id":"https://openalex.org/I4210136895","display_name":"Institute for the Future","ror":"https://ror.org/049tcsg76","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210136895"]},{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX","US"],"is_corresponding":false,"raw_author_name":"Andres Eduardo Gutierrez-Rodriguez","raw_affiliation_strings":["Department, MAHLE Shared Services, Monterrey, Nuevo Le\u00f3n, 64650, Mexico","Tecnologico de Monterrey, Institute for the Future of Education, Nuevo Le\u00f3n, Nuevo Le\u00f3n, 64849, Mexico"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department, MAHLE Shared Services, Monterrey, Nuevo Le\u00f3n, 64650, Mexico","institution_ids":["https://openalex.org/I152909475"]},{"raw_affiliation_string":"Tecnologico de Monterrey, Institute for the Future of Education, Nuevo Le\u00f3n, Nuevo Le\u00f3n, 64849, Mexico","institution_ids":["https://openalex.org/I4210136895","https://openalex.org/I98461037"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5019495793","display_name":"Rajesh Roshan Biswal","orcid":"https://orcid.org/0000-0001-6053-3384"},"institutions":[{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Rajesh Roshan Biswal","raw_affiliation_strings":["Tecnologico de Monterrey, School of Engineering and Sciences, Nuevo Le\u00f3n, Nuevo Le\u00f3n, 64849, Mexico"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tecnologico de Monterrey, School of Engineering and Sciences, Nuevo Le\u00f3n, Nuevo Le\u00f3n, 64849, Mexico","institution_ids":["https://openalex.org/I98461037"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5109515352"],"corresponding_institution_ids":["https://openalex.org/I98461037"],"apc_list":{"value":2990,"currency":"USD","value_usd":2990},"apc_paid":{"value":2990,"currency":"USD","value_usd":2990},"fwci":13.0125,"has_fulltext":true,"cited_by_count":19,"citation_normalized_percentile":{"value":0.98880147,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"55","issue":"7","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9940999746322632,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.9369268417358398},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7617521286010742},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5073959231376648},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.45116427540779114},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4448525607585907},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.396428644657135}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9369268417358398},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7617521286010742},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5073959231376648},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.45116427540779114},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4448525607585907},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.396428644657135}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s10489-025-06422-4","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10489-025-06422-4","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10489-025-06422-4.pdf","source":{"id":"https://openalex.org/S74726891","display_name":"Applied Intelligence","issn_l":"0924-669X","issn":["0924-669X","1573-7497"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Intelligence","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s10489-025-06422-4","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10489-025-06422-4","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10489-025-06422-4.pdf","source":{"id":"https://openalex.org/S74726891","display_name":"Applied Intelligence","issn_l":"0924-669X","issn":["0924-669X","1573-7497"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4068743904","display_name":null,"funder_award_id":"FR97683","funder_id":"https://openalex.org/F4320322675","funder_display_name":"Mitacs"}],"funders":[{"id":"https://openalex.org/F4320322675","display_name":"Mitacs","ror":"https://ror.org/00cjrc276"}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4409140393.pdf"},"referenced_works_count":85,"referenced_works":["https://openalex.org/W40890042","https://openalex.org/W1981738628","https://openalex.org/W2019669975","https://openalex.org/W2031163547","https://openalex.org/W2040333627","https://openalex.org/W2077488147","https://openalex.org/W2099940443","https://openalex.org/W2100495367","https://openalex.org/W2116341502","https://openalex.org/W2296509296","https://openalex.org/W2597441556","https://openalex.org/W2744511114","https://openalex.org/W2768411980","https://openalex.org/W2770942607","https://openalex.org/W2789828921","https://openalex.org/W2912083425","https://openalex.org/W2922140331","https://openalex.org/W2924689635","https://openalex.org/W2963446712","https://openalex.org/W2973862992","https://openalex.org/W2979563069","https://openalex.org/W2981025625","https://openalex.org/W2982682021","https://openalex.org/W3001683812","https://openalex.org/W3024012711","https://openalex.org/W3034863102","https://openalex.org/W3042933481","https://openalex.org/W3048377462","https://openalex.org/W3084346886","https://openalex.org/W3093410479","https://openalex.org/W3097933861","https://openalex.org/W3104788983","https://openalex.org/W3119693685","https://openalex.org/W3122623847","https://openalex.org/W3134351459","https://openalex.org/W3134726903","https://openalex.org/W3156636935","https://openalex.org/W3163315201","https://openalex.org/W3180062783","https://openalex.org/W3186172578","https://openalex.org/W3190728076","https://openalex.org/W3196382900","https://openalex.org/W3202760407","https://openalex.org/W3205985117","https://openalex.org/W3208773001","https://openalex.org/W3209498073","https://openalex.org/W3211805421","https://openalex.org/W4220846496","https://openalex.org/W4220969123","https://openalex.org/W4226056551","https://openalex.org/W4229003780","https://openalex.org/W4280493558","https://openalex.org/W4281693361","https://openalex.org/W4282047883","https://openalex.org/W4283643189","https://openalex.org/W4284686675","https://openalex.org/W4284965199","https://openalex.org/W4286521379","https://openalex.org/W4293238913","https://openalex.org/W4293569095","https://openalex.org/W4293722527","https://openalex.org/W4295122555","https://openalex.org/W4295916558","https://openalex.org/W4296342837","https://openalex.org/W4296349030","https://openalex.org/W4296922763","https://openalex.org/W4308560866","https://openalex.org/W4309346044","https://openalex.org/W4309693681","https://openalex.org/W4310376617","https://openalex.org/W4311142918","https://openalex.org/W4312866014","https://openalex.org/W4313591247","https://openalex.org/W4318571163","https://openalex.org/W4361010174","https://openalex.org/W4362677817","https://openalex.org/W4376616081","https://openalex.org/W4385973175","https://openalex.org/W4386741428","https://openalex.org/W4391127911","https://openalex.org/W4396707597","https://openalex.org/W6608096903","https://openalex.org/W6888479641","https://openalex.org/W6963469208","https://openalex.org/W6963873055"],"related_works":["https://openalex.org/W2961085424","https://openalex.org/W4306674287","https://openalex.org/W4387369504","https://openalex.org/W4394896187","https://openalex.org/W3170094116","https://openalex.org/W4386462264","https://openalex.org/W3107602296","https://openalex.org/W4364306694","https://openalex.org/W4312192474","https://openalex.org/W4283697347"],"abstract_inverted_index":{"Globally,":[0],"cyberattacks":[1],"are":[2,13,45,80,85,177],"growing":[3],"and":[4,17,88,110,145,148,184,191,196,233,248,254,258],"mutating":[5],"each":[6,227],"month.":[7],"Intelligent":[8],"Intrusion":[9,156],"Network":[10,42,155,160],"Detection":[11,157],"Systems":[12],"developed":[14,87],"to":[15,21,27,47,53,170,187],"analyze":[16],"detect":[18],"anomalous":[19],"traffic":[20],"face":[22],"these":[23,58,136,222],"threats.":[24],"A":[25],"way":[26],"address":[28,135],"this":[29],"is":[30,74,94,122],"by":[31,132],"using":[32,91,216],"network":[33,73,83],"flows,":[34],"an":[35,213],"aggregated":[36],"version":[37],"of":[38,107,112,152,167,207,221,245],"communications":[39],"between":[40,128,194],"devices.":[41],"Flow":[43],"datasets":[44,93,147,169],"used":[46],"train":[48],"Artificial":[49],"Intelligence":[50],"(AI)":[51],"models":[52,59,130,247],"classify":[54],"specific":[55],"attacks.":[56,117],"Training":[57],"requires":[60],"threat":[61],"samples":[62],"usually":[63],"generated":[64],"synthetically":[65],"in":[66],"labs":[67],"as":[68],"capturing":[69],"them":[70],"on":[71,115,159,230,236,251],"operational":[72],"a":[75,96,103,119,125,140,164,181,189],"challenging":[76],"task.":[77],"As":[78],"threats":[79],"fast-evolving,":[81],"new":[82,116,197],"flows":[84],"continuously":[86],"shared.":[89],"However,":[90],"old":[92],"still":[95],"popular":[97],"procedure":[98],"when":[99],"testing":[100],"models,":[101],"hindering":[102],"more":[104],"comprehensive":[105],"characterization":[106],"the":[108,129,217,242,246],"advantages":[109],"opportunities":[111],"recent":[113,144],"solutions":[114],"Moreover,":[118],"standardized":[120],"benchmark":[121,141],"missing":[123],"rendering":[124],"poor":[126],"comparison":[127,193,215],"produced":[131],"algorithms.":[133,223],"To":[134],"gaps,":[137],"we":[138,240],"present":[139],"with":[142,180],"fourteen":[143],"preprocessed":[146],"study":[149],"seven":[150],"categories":[151],"algorithms":[153],"for":[154,172,256],"based":[158],"Flows.":[161],"We":[162,199,210],"provide":[163,234],"centralized":[165],"source":[166],"pre-processed":[168],"researchers":[171],"easy":[173],"download.":[174],"All":[175],"dataset":[176,231],"also":[178],"provided":[179],"train,":[182],"validation":[183],"test":[185],"split":[186],"allow":[188],"straightforward":[190],"fair":[192],"existing":[195],"solutions.":[198,238],"selected":[200],"open":[201],"state-of-the-art":[202],"publicly":[203],"available":[204],"algorithms,":[205],"representatives":[206],"diverse":[208],"approaches.":[209],"carried":[211],"out":[212],"experimental":[214],"Macro":[218],"F1":[219],"score":[220],"Our":[224],"results":[225],"highlight":[226],"model":[228],"operation":[229],"scenarios":[232],"guidance":[235],"competitive":[237],"Finally,":[239],"discuss":[241],"main":[243],"characteristics":[244],"benchmarks,":[249],"focusing":[250],"practical":[252],"implications":[253],"recommendations":[255],"practitioners":[257],"researchers.":[259]},"counts_by_year":[{"year":2026,"cited_by_count":11},{"year":2025,"cited_by_count":8}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}