{"id":"https://openalex.org/W4415974307","doi":"https://doi.org/10.1016/j.procs.2025.09.526","title":"Adaptive Diffusion Markov-Enhanced GCN with LLM Explanations for IoT Attack Detection","display_name":"Adaptive Diffusion Markov-Enhanced GCN with LLM Explanations for IoT Attack Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4415974307","doi":"https://doi.org/10.1016/j.procs.2025.09.526"},"language":"en","primary_location":{"id":"doi:10.1016/j.procs.2025.09.526","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.526","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1016/j.procs.2025.09.526","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019842034","display_name":"Safa Ben Atitallah","orcid":"https://orcid.org/0000-0003-0796-3507"},"institutions":[{"id":"https://openalex.org/I83259278","display_name":"Manouba University","ror":"https://ror.org/0503ejf32","country_code":"TN","type":"education","lineage":["https://openalex.org/I83259278"]},{"id":"https://openalex.org/I142024983","display_name":"Prince Sultan University","ror":"https://ror.org/053mqrf26","country_code":"SA","type":"education","lineage":["https://openalex.org/I142024983"]}],"countries":["SA","TN"],"is_corresponding":true,"raw_author_name":"Safa Ben Atitallah","raw_affiliation_strings":["RIADI Laboratory, University of Manouba, Manouba, Tunisia","Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia"],"affiliations":[{"raw_affiliation_string":"RIADI Laboratory, University of Manouba, Manouba, Tunisia","institution_ids":["https://openalex.org/I83259278"]},{"raw_affiliation_string":"Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia","institution_ids":["https://openalex.org/I142024983"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074460563","display_name":"Maha Driss","orcid":"https://orcid.org/0000-0001-8236-8746"},"institutions":[{"id":"https://openalex.org/I142024983","display_name":"Prince Sultan University","ror":"https://ror.org/053mqrf26","country_code":"SA","type":"education","lineage":["https://openalex.org/I142024983"]},{"id":"https://openalex.org/I83259278","display_name":"Manouba University","ror":"https://ror.org/0503ejf32","country_code":"TN","type":"education","lineage":["https://openalex.org/I83259278"]}],"countries":["SA","TN"],"is_corresponding":false,"raw_author_name":"Maha Driss","raw_affiliation_strings":["RIADI Laboratory, University of Manouba, Manouba, Tunisia","Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia"],"affiliations":[{"raw_affiliation_string":"RIADI Laboratory, University of Manouba, Manouba, Tunisia","institution_ids":["https://openalex.org/I83259278"]},{"raw_affiliation_string":"Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia","institution_ids":["https://openalex.org/I142024983"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120285282","display_name":"Arwa Alsehibani","orcid":null},"institutions":[{"id":"https://openalex.org/I142024983","display_name":"Prince Sultan University","ror":"https://ror.org/053mqrf26","country_code":"SA","type":"education","lineage":["https://openalex.org/I142024983"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Arwa Alsehibani","raw_affiliation_strings":["Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia"],"affiliations":[{"raw_affiliation_string":"Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia","institution_ids":["https://openalex.org/I142024983"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042123158","display_name":"Wadii Boulila","orcid":"https://orcid.org/0000-0003-2133-0757"},"institutions":[{"id":"https://openalex.org/I83259278","display_name":"Manouba University","ror":"https://ror.org/0503ejf32","country_code":"TN","type":"education","lineage":["https://openalex.org/I83259278"]},{"id":"https://openalex.org/I142024983","display_name":"Prince Sultan University","ror":"https://ror.org/053mqrf26","country_code":"SA","type":"education","lineage":["https://openalex.org/I142024983"]}],"countries":["SA","TN"],"is_corresponding":false,"raw_author_name":"Wadii Boulila","raw_affiliation_strings":["RIADI Laboratory, University of Manouba, Manouba, Tunisia","Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia"],"affiliations":[{"raw_affiliation_string":"RIADI Laboratory, University of Manouba, Manouba, Tunisia","institution_ids":["https://openalex.org/I83259278"]},{"raw_affiliation_string":"Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 11586, Saudi Arabia","institution_ids":["https://openalex.org/I142024983"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5019842034"],"corresponding_institution_ids":["https://openalex.org/I142024983","https://openalex.org/I83259278"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.17057206,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"270","issue":null,"first_page":"4014","last_page":"4023"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.33980000019073486,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.33980000019073486,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.17520000040531158,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.10109999775886536,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/transparency","display_name":"Transparency (behavior)","score":0.6442999839782715},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.6035000085830688},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5343999862670898},{"id":"https://openalex.org/keywords/clarity","display_name":"CLARITY","score":0.44269999861717224},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4339999854564667},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4081999957561493},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.390500009059906},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.38830000162124634}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9222000241279602},{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.6442999839782715},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.6035000085830688},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5343999862670898},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4715999960899353},{"id":"https://openalex.org/C2777146004","wikidata":"https://www.wikidata.org/wiki/Q14949826","display_name":"CLARITY","level":2,"score":0.44269999861717224},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4377000033855438},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4339999854564667},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4081999957561493},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.390500009059906},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.38830000162124634},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.35839998722076416},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.34929999709129333},{"id":"https://openalex.org/C179799912","wikidata":"https://www.wikidata.org/wiki/Q205084","display_name":"Computational complexity theory","level":2,"score":0.3391000032424927},{"id":"https://openalex.org/C151201525","wikidata":"https://www.wikidata.org/wiki/Q177239","display_name":"Limit (mathematics)","level":2,"score":0.33090001344680786},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.32280001044273376},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.3149000108242035},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.310699999332428},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2955999970436096},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.29030001163482666},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.26969999074935913},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.25679999589920044}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.procs.2025.09.526","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.526","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.procs.2025.09.526","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.526","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320327702","display_name":"Prince Sultan University","ror":"https://ror.org/053mqrf26"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":9,"referenced_works":["https://openalex.org/W3086811561","https://openalex.org/W3164964481","https://openalex.org/W4226319939","https://openalex.org/W4281624731","https://openalex.org/W4293024118","https://openalex.org/W4381850056","https://openalex.org/W4400976116","https://openalex.org/W4402054386","https://openalex.org/W4410255674"],"related_works":[],"abstract_inverted_index":{"The":[0,92,152],"increasing":[1],"complexity":[2,56],"and":[3,57,65,108,115,203],"connectivity":[4],"of":[5,7,161,178,186,197],"Internet":[6],"Things":[8],"(IoT)":[9],"environments":[10],"have":[11,25,42],"made":[12],"them":[13],"targets":[14],"for":[15,189,206],"advanced":[16],"cyber-attacks.":[17],"Recently,":[18],"Deep":[19],"Learning":[20],"(DL)-based":[21],"intrusion":[22],"detection":[23],"systems":[24],"shown":[26],"remarkable":[27],"success":[28],"in":[29,180],"identifying":[30],"malicious":[31],"activities":[32],"within":[33],"IoT":[34,149,209],"traffic.":[35],"In":[36,67,119],"particular,":[37],"Graph":[38],"Neural":[39],"Networks":[40],"(GNNs)":[41],"emerged":[43],"as":[44,199],"effective":[45],"solutions.":[46],"However,":[47],"GNNs":[48],"come":[49],"with":[50,82],"inherent":[51],"challenges,":[52],"including":[53],"high":[54],"computational":[55],"a":[58,72,77,83,96,121,200],"black-box":[59],"nature,":[60],"which":[61,146],"limit":[62],"their":[63],"transparency":[64,185],"interoperability.":[66],"this":[68],"paper,":[69],"we":[70],"introduce":[71],"hybrid":[73],"framework":[74,141],"that":[75,131,156],"combines":[76],"GNN":[78],"model,":[79],"named":[80],"AD-MGCN,":[81],"Large":[84],"Language":[85],"Model":[86],"(LLM)":[87],"to":[88,101],"address":[89],"these":[90],"limitations.":[91],"proposed":[93],"AD-MGCN":[94,157,198],"leverages":[95],"Markov-based":[97],"multi-step":[98],"diffusion":[99],"process":[100],"enhance":[102],"feature":[103],"propagation,":[104],"reduce":[105],"noisy":[106],"edges,":[107],"improve":[109],"classification":[110],"performance":[111],"across":[112],"both":[113],"frequent":[114],"rare":[116],"attack":[117,150],"types.":[118],"addition,":[120],"fine-tuned":[122],"instruction-based":[123],"LLM":[124,171],"(Falcon-7B":[125],"Instruct)":[126],"generates":[127],"natural":[128],"language":[129],"explanations":[130,172],"translate":[132],"model":[133,188],"predictions":[134],"into":[135],"human-understandable":[136],"insights.":[137],"We":[138],"evaluated":[139],"our":[140],"on":[142],"the":[143,165,170,184,187,195],"Edge-IIoTset":[144],"dataset,":[145],"includes":[147],"diverse":[148],"scenarios.":[151],"experimental":[153],"results":[154,193],"show":[155],"achieves":[158],"an":[159,174],"accuracy":[160],"97.38%,":[162],"significantly":[163],"outperforming":[164],"baseline":[166],"GCN":[167],"models.":[168],"Furthermore,":[169],"achieve":[173],"average":[175],"clarity":[176],"score":[177],"4.2/5":[179],"expert":[181],"evaluations,":[182],"improving":[183],"cybersecurity":[190],"analysts.":[191],"These":[192],"demonstrate":[194],"potential":[196],"reliable,":[201],"efficient,":[202],"interpretable":[204],"solution":[205],"securing":[207],"modern":[208],"ecosystems.":[210]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-11-06T00:00:00"}