{"id":"https://openalex.org/W4417017027","doi":"https://doi.org/10.1093/jigpal/jzaf020","title":"A systematic literature review of unsupervised learning algorithms for anomalous traffic detection based on flows","display_name":"A systematic literature review of unsupervised learning algorithms for anomalous traffic detection based on flows","publication_year":2025,"publication_date":"2025-04-24","ids":{"openalex":"https://openalex.org/W4417017027","doi":"https://doi.org/10.1093/jigpal/jzaf020"},"language":"en","primary_location":{"id":"doi:10.1093/jigpal/jzaf020","is_oa":true,"landing_page_url":"https://doi.org/10.1093/jigpal/jzaf020","pdf_url":"https://academic.oup.com/jigpal/article-pdf/34/1/jzaf020/65735847/jzaf020.pdf","source":{"id":"https://openalex.org/S2734381524","display_name":"Logic Journal of IGPL","issn_l":"1367-0751","issn":["1367-0751","1368-9894"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Logic Journal of the IGPL","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://academic.oup.com/jigpal/article-pdf/34/1/jzaf020/65735847/jzaf020.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114642262","display_name":"Alberto Miguel-Diez","orcid":null},"institutions":[{"id":"https://openalex.org/I8833935","display_name":"Universidad de Le\u00f3n","ror":"https://ror.org/02tzt0b78","country_code":"ES","type":"education","lineage":["https://openalex.org/I8833935"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Alberto Miguel-Diez","raw_affiliation_strings":["Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain","institution_ids":["https://openalex.org/I8833935"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101976879","display_name":"Adri\u00e1n Campazas","orcid":"https://orcid.org/0000-0001-8237-5962"},"institutions":[{"id":"https://openalex.org/I8833935","display_name":"Universidad de Le\u00f3n","ror":"https://ror.org/02tzt0b78","country_code":"ES","type":"education","lineage":["https://openalex.org/I8833935"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Adri\u00e1n Campazas-Vega","raw_affiliation_strings":["Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain","institution_ids":["https://openalex.org/I8833935"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022343009","display_name":"Claudia \u00c1lvarez-Aparicio","orcid":"https://orcid.org/0000-0002-7465-8054"},"institutions":[{"id":"https://openalex.org/I8833935","display_name":"Universidad de Le\u00f3n","ror":"https://ror.org/02tzt0b78","country_code":"ES","type":"education","lineage":["https://openalex.org/I8833935"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Claudia \u00c1lvarez-Aparicio","raw_affiliation_strings":["Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain","institution_ids":["https://openalex.org/I8833935"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048351291","display_name":"Gonzalo Esteban","orcid":"https://orcid.org/0000-0003-3645-164X"},"institutions":[{"id":"https://openalex.org/I8833935","display_name":"Universidad de Le\u00f3n","ror":"https://ror.org/02tzt0b78","country_code":"ES","type":"education","lineage":["https://openalex.org/I8833935"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Gonzalo Esteban-Costales","raw_affiliation_strings":["Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain","institution_ids":["https://openalex.org/I8833935"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5031255947","display_name":"\u00c1ngel Manuel Guerrero\u2010Higueras","orcid":"https://orcid.org/0000-0001-8277-0700"},"institutions":[{"id":"https://openalex.org/I8833935","display_name":"Universidad de Le\u00f3n","ror":"https://ror.org/02tzt0b78","country_code":"ES","type":"education","lineage":["https://openalex.org/I8833935"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"\u00c1ngel Manuel Guerrero-Higueras","raw_affiliation_strings":["Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Robotics Group, University of Le\u00f3n, Campus de Vegazana S/N , 24071 Le\u00f3n, Spain","institution_ids":["https://openalex.org/I8833935"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I8833935"],"apc_list":{"value":4151,"currency":"USD","value_usd":4151},"apc_paid":{"value":4151,"currency":"USD","value_usd":4151},"fwci":4.1858,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.94810761,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"34","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6919999718666077,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6919999718666077,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.13500000536441803,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.013100000098347664,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.7738999724388123},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.7570000290870667},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6593000292778015},{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.47600001096725464},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.44369998574256897},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.37779998779296875}],"concepts":[{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.7738999724388123},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7613000273704529},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.7570000290870667},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6593000292778015},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5745000243186951},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5662999749183655},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5368000268936157},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.47600001096725464},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.44369998574256897},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.37779998779296875},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3021000027656555},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.2987000048160553},{"id":"https://openalex.org/C100253034","wikidata":"https://www.wikidata.org/wiki/Q196372","display_name":"Systematic error","level":2,"score":0.27900001406669617},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2556000053882599},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2547999918460846}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1093/jigpal/jzaf020","is_oa":true,"landing_page_url":"https://doi.org/10.1093/jigpal/jzaf020","pdf_url":"https://academic.oup.com/jigpal/article-pdf/34/1/jzaf020/65735847/jzaf020.pdf","source":{"id":"https://openalex.org/S2734381524","display_name":"Logic Journal of IGPL","issn_l":"1367-0751","issn":["1367-0751","1368-9894"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Logic Journal of the IGPL","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1093/jigpal/jzaf020","is_oa":true,"landing_page_url":"https://doi.org/10.1093/jigpal/jzaf020","pdf_url":"https://academic.oup.com/jigpal/article-pdf/34/1/jzaf020/65735847/jzaf020.pdf","source":{"id":"https://openalex.org/S2734381524","display_name":"Logic Journal of IGPL","issn_l":"1367-0751","issn":["1367-0751","1368-9894"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Logic Journal of the IGPL","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1601111259","display_name":null,"funder_award_id":"PID2021-126592OB-C21","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G2262748287","display_name":null,"funder_award_id":"501100011033","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G2601397997","display_name":null,"funder_award_id":"10.13039/501100011033","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G2863773509","display_name":null,"funder_award_id":"MCIN/AEI/ 10.13039/501100011033","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"},{"id":"https://openalex.org/G300979063","display_name":null,"funder_award_id":"10.13039/501100011033","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G3010178503","display_name":null,"funder_award_id":"PID2021-126592OB-C21","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"},{"id":"https://openalex.org/G3412273058","display_name":null,"funder_award_id":"AEI/ 10.13039/501100011033","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G3480869486","display_name":null,"funder_award_id":"13039","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G3681454997","display_name":null,"funder_award_id":"13039/501100011033","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G4042783231","display_name":null,"funder_award_id":"501100011033","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G410571670","display_name":null,"funder_award_id":"10.13039/501100011033","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"},{"id":"https://openalex.org/G451917667","display_name":null,"funder_award_id":"13039/501100011033","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"},{"id":"https://openalex.org/G5080475149","display_name":null,"funder_award_id":"10.13039","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G5967599077","display_name":null,"funder_award_id":"501100011033","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"},{"id":"https://openalex.org/G7149750178","display_name":null,"funder_award_id":"MCIN/AEI/ 10.13039/501100011033","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G7266728691","display_name":null,"funder_award_id":"13039/501100011033","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G8909017353","display_name":null,"funder_award_id":"MCIN/AEI/ 10.13039/501100011033","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320327970","display_name":"Instituto Nacional de Ciberseguridad","ror":null},{"id":"https://openalex.org/F4320331769","display_name":"Universidad de Le\u00f3n","ror":null},{"id":"https://openalex.org/F4320335322","display_name":"European Regional Development Fund","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320335598","display_name":"Agencia Estatal de Investigaci\u00f3n","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4417017027.pdf","grobid_xml":"https://content.openalex.org/works/W4417017027.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W40890042","https://openalex.org/W1977401594","https://openalex.org/W2002394060","https://openalex.org/W2031163547","https://openalex.org/W2032647857","https://openalex.org/W2040333627","https://openalex.org/W2053550965","https://openalex.org/W2077488147","https://openalex.org/W2111722073","https://openalex.org/W2133933998","https://openalex.org/W2171331105","https://openalex.org/W2296509296","https://openalex.org/W2569936787","https://openalex.org/W2607918523","https://openalex.org/W2612764117","https://openalex.org/W2621246307","https://openalex.org/W2739052910","https://openalex.org/W2770942607","https://openalex.org/W2789828921","https://openalex.org/W2809097945","https://openalex.org/W2870670057","https://openalex.org/W2910315044","https://openalex.org/W2912119603","https://openalex.org/W2969495950","https://openalex.org/W2973442392","https://openalex.org/W2982682021","https://openalex.org/W3082129402","https://openalex.org/W3091848104","https://openalex.org/W3102359135","https://openalex.org/W3112126031","https://openalex.org/W3202224668","https://openalex.org/W4200593832","https://openalex.org/W4214699222","https://openalex.org/W4241964992","https://openalex.org/W4285048954","https://openalex.org/W4285080445","https://openalex.org/W4294215472","https://openalex.org/W4312092261","https://openalex.org/W4366524776","https://openalex.org/W4392173855"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"The":[1,141],"constant":[2],"increase":[3,80],"of":[4,12,39,77,109,128,137],"devices":[5],"connected":[6],"to":[7,17,23,48,71],"the":[8,37,75,110,123,148,159,163],"Internet,":[9],"and":[10],"therefore":[11],"cyber-attacks,":[13],"makes":[14],"it":[15,45,91,98],"necessary":[16],"analyse":[18],"network":[19,55,120],"traffic":[20,40],"in":[21,34,65,119,139,175],"order":[22],"recognize":[24],"malicious":[25],"activity.":[26],"Traditional":[27],"packet-based":[28],"analysis":[29],"methods":[30],"are":[31],"insufficient":[32],"because":[33],"large":[35],"networks":[36,68],"amount":[38],"is":[41,46,57,84,147],"so":[42],"high":[43],"that":[44,145],"unfeasible":[47],"review":[49,108],"all":[50,162],"communications.":[51],"For":[52],"this":[53,62,83],"reason,":[54],"flows":[56],"a":[58,106],"suitable":[59],"approach":[60],"for":[61,96,116,166],"situation,":[63],"which":[64,97],"future":[66],"5G":[67],"will":[69,79],"have":[70,132,169],"be":[72],"used,":[73],"as":[74],"number":[76],"packets":[78],"dramatically.":[81],"If":[82],"also":[85],"combined":[86],"with":[87,178],"unsupervised":[88,113],"learning":[89,114],"models,":[90],"can":[92],"detect":[93],"new":[94],"threats":[95],"has":[99],"not":[100],"been":[101,133,170],"trained.":[102],"This":[103],"paper":[104],"presents":[105],"systematic":[107],"literature":[111],"on":[112],"algorithms":[115],"detecting":[117],"anomalies":[118],"flows,":[121],"following":[122],"PRISMA":[124],"guideline.":[125],"A":[126],"total":[127],"63":[129],"scientific":[130],"articles":[131],"reviewed,":[134],"analysing":[135],"15":[136],"them":[138],"depth.":[140],"results":[142],"obtained":[143],"show":[144],"autoencoder":[146],"most":[149],"used":[150,165],"option,":[151],"followed":[152],"by":[153],"SVM,":[154],"ALAD,":[155],"or":[156,177],"SOM.":[157],"On":[158],"other":[160],"hand,":[161],"datasets":[164],"anomaly":[167],"detection":[168],"collected,":[171],"including":[172],"some":[173],"specialised":[174],"IoT":[176],"real":[179],"data":[180],"collected":[181],"from":[182],"honeypots.":[183]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1}],"updated_date":"2026-06-26T08:34:08.712188","created_date":"2025-12-05T00:00:00"}