{"id":"https://openalex.org/W4283813601","doi":"https://doi.org/10.1007/s40747-022-00809-3","title":"Multi-layer stacking ensemble learners for low footprint network intrusion detection","display_name":"Multi-layer stacking ensemble learners for low footprint network intrusion detection","publication_year":2022,"publication_date":"2022-07-05","ids":{"openalex":"https://openalex.org/W4283813601","doi":"https://doi.org/10.1007/s40747-022-00809-3"},"language":"en","primary_location":{"id":"doi:10.1007/s40747-022-00809-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s40747-022-00809-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s40747-022-00809-3.pdf","source":{"id":"https://openalex.org/S3035462843","display_name":"Complex & Intelligent Systems","issn_l":"2198-6053","issn":["2198-6053","2199-4536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Complex & Intelligent Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://link.springer.com/content/pdf/10.1007/s40747-022-00809-3.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5007600196","display_name":"Saeed Shafieian","orcid":"https://orcid.org/0000-0001-8069-0918"},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Saeed Shafieian","raw_affiliation_strings":["School of Computing, Queen\u2019s University, Kingston, Canada","School of Computing, Queen's University, Kingston, Canada"],"affiliations":[{"raw_affiliation_string":"School of Computing, Queen\u2019s University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]},{"raw_affiliation_string":"School of Computing, Queen's University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005563986","display_name":"Mohammad Zulkernine","orcid":"https://orcid.org/0000-0003-1697-4101"},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mohammad Zulkernine","raw_affiliation_strings":["School of Computing, Queen\u2019s University, Kingston, Canada","School of Computing, Queen's University, Kingston, Canada"],"affiliations":[{"raw_affiliation_string":"School of Computing, Queen\u2019s University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]},{"raw_affiliation_string":"School of Computing, Queen's University, Kingston, Canada","institution_ids":["https://openalex.org/I204722609"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5007600196"],"corresponding_institution_ids":["https://openalex.org/I204722609"],"apc_list":{"value":1320,"currency":"GBP","value_usd":1619},"apc_paid":{"value":1320,"currency":"GBP","value_usd":1619},"fwci":6.7082,"has_fulltext":true,"cited_by_count":50,"citation_normalized_percentile":{"value":0.97249953,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":"9","issue":"4","first_page":"3787","last_page":"3799"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"Ensemble learning","score":0.7613893747329712},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7613716721534729},{"id":"https://openalex.org/keywords/boosting","display_name":"Boosting (machine learning)","score":0.6824703812599182},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6491560935974121},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6412268877029419},{"id":"https://openalex.org/keywords/stacking","display_name":"Stacking","score":0.6295126080513},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5999345183372498},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.59645015001297},{"id":"https://openalex.org/keywords/footprint","display_name":"Footprint","score":0.5075267553329468},{"id":"https://openalex.org/keywords/memory-footprint","display_name":"Memory footprint","score":0.4881649613380432},{"id":"https://openalex.org/keywords/ensemble-forecasting","display_name":"Ensemble forecasting","score":0.47403836250305176},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.45684492588043213},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.43114978075027466},{"id":"https://openalex.org/keywords/adaboost","display_name":"AdaBoost","score":0.43064790964126587},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.42385923862457275},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.35303735733032227},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.2724899649620056}],"concepts":[{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.7613893747329712},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7613716721534729},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.6824703812599182},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6491560935974121},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6412268877029419},{"id":"https://openalex.org/C33347731","wikidata":"https://www.wikidata.org/wiki/Q285210","display_name":"Stacking","level":2,"score":0.6295126080513},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5999345183372498},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.59645015001297},{"id":"https://openalex.org/C132943942","wikidata":"https://www.wikidata.org/wiki/Q2562511","display_name":"Footprint","level":2,"score":0.5075267553329468},{"id":"https://openalex.org/C74912251","wikidata":"https://www.wikidata.org/wiki/Q6815727","display_name":"Memory footprint","level":2,"score":0.4881649613380432},{"id":"https://openalex.org/C119898033","wikidata":"https://www.wikidata.org/wiki/Q3433888","display_name":"Ensemble forecasting","level":2,"score":0.47403836250305176},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.45684492588043213},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.43114978075027466},{"id":"https://openalex.org/C141404830","wikidata":"https://www.wikidata.org/wiki/Q2823869","display_name":"AdaBoost","level":3,"score":0.43064790964126587},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.42385923862457275},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.35303735733032227},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.2724899649620056},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C46141821","wikidata":"https://www.wikidata.org/wiki/Q209402","display_name":"Nuclear magnetic resonance","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s40747-022-00809-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s40747-022-00809-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s40747-022-00809-3.pdf","source":{"id":"https://openalex.org/S3035462843","display_name":"Complex & Intelligent Systems","issn_l":"2198-6053","issn":["2198-6053","2199-4536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Complex & Intelligent Systems","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:32668849632e4aae8df8edfb387aac7f","is_oa":true,"landing_page_url":"https://doaj.org/article/32668849632e4aae8df8edfb387aac7f","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Complex & Intelligent Systems, Vol 9, Iss 4, Pp 3787-3799 (2022)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1007/s40747-022-00809-3","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s40747-022-00809-3","pdf_url":"https://link.springer.com/content/pdf/10.1007/s40747-022-00809-3.pdf","source":{"id":"https://openalex.org/S3035462843","display_name":"Complex & Intelligent Systems","issn_l":"2198-6053","issn":["2198-6053","2199-4536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Complex & Intelligent Systems","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Quality Education","id":"https://metadata.un.org/sdg/4","score":0.6399999856948853}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4283813601.pdf","grobid_xml":"https://content.openalex.org/works/W4283813601.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W1510688672","https://openalex.org/W1985987493","https://openalex.org/W2056132907","https://openalex.org/W2201352233","https://openalex.org/W2295598076","https://openalex.org/W2296509296","https://openalex.org/W2432038293","https://openalex.org/W2552899443","https://openalex.org/W2738194758","https://openalex.org/W2741396778","https://openalex.org/W2791691546","https://openalex.org/W2837167620","https://openalex.org/W2911964244","https://openalex.org/W2947334153","https://openalex.org/W2950250245","https://openalex.org/W2958489519","https://openalex.org/W2963197901","https://openalex.org/W2970940543","https://openalex.org/W2997442262"],"related_works":["https://openalex.org/W4382315444","https://openalex.org/W4233259193","https://openalex.org/W2600353413","https://openalex.org/W2432727369","https://openalex.org/W4390916549","https://openalex.org/W4381298925","https://openalex.org/W2794896638","https://openalex.org/W4285213578","https://openalex.org/W2097856925","https://openalex.org/W4298012357"],"abstract_inverted_index":{"Abstract":[0],"Machine":[1],"learning":[2,31,77],"has":[3],"become":[4],"the":[5,24,50,133,143,187],"standard":[6],"solution":[7],"to":[8,38,81],"problems":[9],"in":[10,41,49,55,84,113,138,161,217],"many":[11],"areas,":[12],"such":[13,101,115],"as":[14,102],"image":[15],"recognition,":[16],"natural":[17],"language":[18],"processing,":[19],"and":[20,70,94,97,110,191,198],"spam":[21],"detection.":[22],"In":[23,62],"area":[25],"of":[26,57,172,196,202],"network":[27,42,51,88,144,159,215,221],"intrusion":[28,52],"detection,":[29],"machine":[30],"techniques":[32,109],"have":[33],"also":[34],"been":[35],"successfully":[36],"used":[37],"detect":[39],"anomalies":[40],"traffic.":[43],"However,":[44],"there":[45],"is":[46],"less":[47],"tolerance":[48],"detection":[53],"domain":[54],"terms":[56],"errors,":[58],"especially":[59],"false":[60],"positives.":[61],"this":[63],"paper,":[64],"we":[65,205],"define":[66],"strict":[67,188],"acceptance":[68,189],"criteria,":[69,190],"show":[71,98,118,206],"that":[72,146,207],"only":[73,181],"very":[74],"few":[75],"ensemble":[76,108,125,173,209],"classifiers":[78],"are":[79,141,156],"able":[80],"meet":[82,186],"them":[83],"detecting":[85,114],"low":[86,219],"footprint":[87,220],"intrusions.":[89,116,222],"We":[90,117],"compare":[91],"bagging,":[92],"boosting,":[93],"stacking":[95,104,124,184],"techniques,":[96],"how":[99,119],"methods":[100],"multi-layer":[103,183],"can":[105,127],"outperform":[106,211],"other":[107],"non-ensemble":[111],"models":[112,174,185,210,216],"different":[120,163,178,212],"variations":[121],"on":[122,132,165,176],"a":[123,129,150,166,199],"model":[126],"play":[128],"significant":[130],"role":[131],"classification":[134],"performance.":[135],"Malicious":[136],"examples":[137,155],"our":[139,208],"dataset":[140],"from":[142,149],"intrusions":[145],"exfiltrate":[147],"data":[148],"target":[151],"machine.":[152],"The":[153],"benign":[154],"captured":[157],"by":[158],"taps":[160],"geographically":[162],"locations":[164],"big":[167],"corporate":[168],"network.":[169],"Among":[170],"hundreds":[171],"based":[175],"seven":[177],"base":[179],"learners,":[180],"three":[182],"achieve":[192],"an":[193],"F1":[194],"score":[195],"0.99,":[197],"false-positive":[200],"rate":[201],"0.001.":[203],"Furthermore,":[204],"deep":[213],"neural":[214],"classifying":[218]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":19},{"year":2024,"cited_by_count":15},{"year":2023,"cited_by_count":12},{"year":2022,"cited_by_count":1}],"updated_date":"2026-04-11T08:14:18.477133","created_date":"2025-10-10T00:00:00"}