{"id":"https://openalex.org/W4415974717","doi":"https://doi.org/10.1016/j.procs.2025.09.255","title":"Comprehensive Comparison of Streaming Clustering-Based IDS: Evaluation Across Clustering Families with a Novel Ensemble Classifier","display_name":"Comprehensive Comparison of Streaming Clustering-Based IDS: Evaluation Across Clustering Families with a Novel Ensemble Classifier","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4415974717","doi":"https://doi.org/10.1016/j.procs.2025.09.255"},"language":"en","primary_location":{"id":"doi:10.1016/j.procs.2025.09.255","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.255","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1016/j.procs.2025.09.255","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5115522503","display_name":"Bilel Saghrouchni","orcid":null},"institutions":[{"id":"https://openalex.org/I48430043","display_name":"Institut National des Sciences Appliqu\u00e9es de Lyon","ror":"https://ror.org/050jn9y42","country_code":"FR","type":"education","lineage":["https://openalex.org/I203339264","https://openalex.org/I48430043"]},{"id":"https://openalex.org/I145996665","display_name":"International Society for Optics and Photonics","ror":"https://ror.org/045k5vt03","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I145996665"]}],"countries":["FR","US"],"is_corresponding":true,"raw_author_name":"Bilel Saghrouchni","raw_affiliation_strings":["INSA Lyon, INRIA, CITI, UR3720, 69621 Villeurbanne, France","SPIE ICS, Bron 69029, France"],"affiliations":[{"raw_affiliation_string":"INSA Lyon, INRIA, CITI, UR3720, 69621 Villeurbanne, France","institution_ids":["https://openalex.org/I48430043"]},{"raw_affiliation_string":"SPIE ICS, Bron 69029, France","institution_ids":["https://openalex.org/I145996665"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064809968","display_name":"Fr\u00e9d\u00e9ric Le Mou\u00ebl","orcid":"https://orcid.org/0000-0002-7323-4057"},"institutions":[{"id":"https://openalex.org/I48430043","display_name":"Institut National des Sciences Appliqu\u00e9es de Lyon","ror":"https://ror.org/050jn9y42","country_code":"FR","type":"education","lineage":["https://openalex.org/I203339264","https://openalex.org/I48430043"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Fr\u00e9d\u00e9ric Le Mou\u00ebl","raw_affiliation_strings":["INSA Lyon, INRIA, CITI, UR3720, 69621 Villeurbanne, France"],"affiliations":[{"raw_affiliation_string":"INSA Lyon, INRIA, CITI, UR3720, 69621 Villeurbanne, France","institution_ids":["https://openalex.org/I48430043"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016563743","display_name":"Bogdan Szanto","orcid":null},"institutions":[{"id":"https://openalex.org/I145996665","display_name":"International Society for Optics and Photonics","ror":"https://ror.org/045k5vt03","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I145996665"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bogdan Szanto","raw_affiliation_strings":["SPIE ICS, Bron 69029, France"],"affiliations":[{"raw_affiliation_string":"SPIE ICS, Bron 69029, France","institution_ids":["https://openalex.org/I145996665"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5115522503"],"corresponding_institution_ids":["https://openalex.org/I145996665","https://openalex.org/I48430043"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.40667135,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"270","issue":null,"first_page":"1341","last_page":"1350"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9580000042915344,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9580000042915344,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10637","display_name":"Advanced Clustering Algorithms Research","score":0.00559999980032444,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.005100000184029341,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.8532999753952026},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6538000106811523},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.536300003528595},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.5166000127792358},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.4875999987125397},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.45179998874664307},{"id":"https://openalex.org/keywords/cluster","display_name":"Cluster (spacecraft)","score":0.44909998774528503},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.37689998745918274},{"id":"https://openalex.org/keywords/consensus-clustering","display_name":"Consensus clustering","score":0.374099999666214}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8967000246047974},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.8532999753952026},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6690000295639038},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6538000106811523},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.536300003528595},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.5166000127792358},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4893999993801117},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4875999987125397},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.45179998874664307},{"id":"https://openalex.org/C164866538","wikidata":"https://www.wikidata.org/wiki/Q367351","display_name":"Cluster (spacecraft)","level":2,"score":0.44909998774528503},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.44350001215934753},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.37689998745918274},{"id":"https://openalex.org/C186767784","wikidata":"https://www.wikidata.org/wiki/Q5162841","display_name":"Consensus clustering","level":5,"score":0.374099999666214},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.3736000061035156},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.3472999930381775},{"id":"https://openalex.org/C207968372","wikidata":"https://www.wikidata.org/wiki/Q310401","display_name":"k-means clustering","level":3,"score":0.34549999237060547},{"id":"https://openalex.org/C33704608","wikidata":"https://www.wikidata.org/wiki/Q5014717","display_name":"CURE data clustering algorithm","level":4,"score":0.3310999870300293},{"id":"https://openalex.org/C17212007","wikidata":"https://www.wikidata.org/wiki/Q5511111","display_name":"Fuzzy clustering","level":3,"score":0.3059999942779541},{"id":"https://openalex.org/C193143536","wikidata":"https://www.wikidata.org/wiki/Q5227360","display_name":"Data stream clustering","level":5,"score":0.2957000136375427},{"id":"https://openalex.org/C2777611316","wikidata":"https://www.wikidata.org/wiki/Q39045282","display_name":"Streaming data","level":2,"score":0.2955999970436096},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.2921000123023987},{"id":"https://openalex.org/C184509293","wikidata":"https://www.wikidata.org/wiki/Q5136711","display_name":"Clustering high-dimensional data","level":3,"score":0.2791999876499176},{"id":"https://openalex.org/C94641424","wikidata":"https://www.wikidata.org/wiki/Q5172845","display_name":"Correlation clustering","level":3,"score":0.27390000224113464},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2711000144481659},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.26829999685287476},{"id":"https://openalex.org/C104047586","wikidata":"https://www.wikidata.org/wiki/Q5033439","display_name":"Canopy clustering algorithm","level":4,"score":0.2581000030040741}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.procs.2025.09.255","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.255","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.procs.2025.09.255","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.255","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W1969082358","https://openalex.org/W1977366836","https://openalex.org/W1979347584","https://openalex.org/W1995064042","https://openalex.org/W2033403400","https://openalex.org/W2296509296","https://openalex.org/W2626250024","https://openalex.org/W2766296277","https://openalex.org/W2791095958","https://openalex.org/W2884424765","https://openalex.org/W2939745396","https://openalex.org/W3044439675","https://openalex.org/W3097494778","https://openalex.org/W3110435694","https://openalex.org/W4205088899","https://openalex.org/W4213418104","https://openalex.org/W4231029117","https://openalex.org/W4307139532","https://openalex.org/W4362587694","https://openalex.org/W4402298029","https://openalex.org/W4403605016"],"related_works":[],"abstract_inverted_index":{"Clustering":[0],"is":[1,19],"an":[2,152],"effective":[3,67],"method":[4],"for":[5,22,123,188],"detecting":[6,97],"network":[7,70,100],"intrusions,":[8],"especially":[9,76],"due":[10],"to":[11,73,129,132,150],"its":[12,29,78],"unsupervised":[13],"nature":[14],"and":[15,47,59,94,108,116,183],"fast":[16],"reactivity,":[17],"which":[18],"particularly":[20],"advantageous":[21],"the":[23,66,86,106,159,169],"identification":[24],"of":[25,51,69,88,110,161,164,172,190],"zero-day":[26],"attacks.":[27],"Despite":[28],"potential,":[30],"Intrusion":[31],"Detection":[32],"Systems":[33],"(IDS)":[34],"often":[35],"uses":[36],"clustering":[37,90,141,154],"algorithms":[38,53],"based":[39],"on":[40,104,145,175],"their":[41],"simplicity,":[42],"without":[43],"rigorous":[44],"comparative":[45],"analysis,":[46],"ignores":[48],"important":[49],"limitations":[50],"some":[52],"such":[54],"as":[55],"preset":[56],"cluster":[57,61],"numbers":[58],"inflexible":[60],"shapes.":[62],"These":[63],"shortcomings":[64],"hamper":[65],"use":[68],"traffic":[71],"data":[72,128],"detect":[74],"intrusion,":[75],"given":[77],"dynamic":[79],"nature.":[80],"In":[81],"this":[82],"article,":[83],"we":[84],"evaluate":[85],"effectiveness":[87],"various":[89],"algorithms\u2014specifically":[91],"partitioning,":[92],"hierarchical,":[93],"density-based":[95],"methods\u2014in":[96],"anomalies":[98],"in":[99],"traffic.":[101],"We":[102],"focus":[103],"analyzing":[105],"formation":[107],"characteristics":[109],"anomaly":[111],"clusters":[112],"within":[113],"these":[114],"approaches":[115],"propose":[117],"a":[118,180],"complete":[119],"evaluation":[120],"methodology":[121],"suitable":[122],"intrusion":[124],"detection":[125],"using":[126],"streaming":[127],"be":[130],"closer":[131],"real-world":[133],"scenarios.":[134],"Our":[135],"results":[136],"reveal":[137],"that":[138,156],"no":[139],"single":[140],"algorithm":[142],"universally":[143],"excels":[144],"every":[146],"dataset,":[147],"prompting":[148],"us":[149],"introduce":[151],"ensemble":[153],"approach":[155,174],"brings":[157],"together":[158],"strengths":[160],"different":[162],"classes":[163],"algorithms.":[165],"Preliminary":[166],"tests":[167],"demonstrate":[168],"superior":[170],"performance":[171],"our":[173],"three":[176],"IDS":[177],"datasets":[178],"with":[179],"good":[181],"accuracy":[182],"F1-score":[184],"greater":[185],"than":[186],"0.8":[187],"all":[189],"them.":[191]},"counts_by_year":[],"updated_date":"2026-03-07T16:01:11.037858","created_date":"2025-11-06T00:00:00"}