{"id":"https://openalex.org/W4403660037","doi":"https://doi.org/10.1108/ijpcc-12-2023-0358","title":"Intrusion detection based on concept drift detection and online incremental learning","display_name":"Intrusion detection based on concept drift detection and online incremental learning","publication_year":2024,"publication_date":"2024-10-21","ids":{"openalex":"https://openalex.org/W4403660037","doi":"https://doi.org/10.1108/ijpcc-12-2023-0358"},"language":"en","primary_location":{"id":"doi:10.1108/ijpcc-12-2023-0358","is_oa":false,"landing_page_url":"https://doi.org/10.1108/ijpcc-12-2023-0358","pdf_url":null,"source":{"id":"https://openalex.org/S172682790","display_name":"International Journal of Pervasive Computing and Communications","issn_l":"1742-7371","issn":["1742-7371","1742-738X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Pervasive Computing and Communications","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083073132","display_name":"Farah Jemili","orcid":"https://orcid.org/0000-0001-7511-1221"},"institutions":[{"id":"https://openalex.org/I8636806","display_name":"University of Sousse","ror":"https://ror.org/00dmpgj58","country_code":"TN","type":"education","lineage":["https://openalex.org/I8636806"]}],"countries":["TN"],"is_corresponding":true,"raw_author_name":"Farah Jemili","raw_affiliation_strings":["LR17ES05, University of Sousse ISITCom, Mars Research Laboratory, , Sousse,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LR17ES05, University of Sousse ISITCom, Mars Research Laboratory, , Sousse,","institution_ids":["https://openalex.org/I8636806"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080526743","display_name":"Khaled Jouini","orcid":"https://orcid.org/0000-0001-5049-4238"},"institutions":[{"id":"https://openalex.org/I8636806","display_name":"University of Sousse","ror":"https://ror.org/00dmpgj58","country_code":"TN","type":"education","lineage":["https://openalex.org/I8636806"]}],"countries":["TN"],"is_corresponding":false,"raw_author_name":"Khaled Jouini","raw_affiliation_strings":["LR17ES05, University of Sousse ISITCom, Mars Research Laboratory, , Sousse,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LR17ES05, University of Sousse ISITCom, Mars Research Laboratory, , Sousse,","institution_ids":["https://openalex.org/I8636806"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5085758758","display_name":"Ouajdi Korbaa","orcid":"https://orcid.org/0000-0003-4462-1805"},"institutions":[{"id":"https://openalex.org/I8636806","display_name":"University of Sousse","ror":"https://ror.org/00dmpgj58","country_code":"TN","type":"education","lineage":["https://openalex.org/I8636806"]}],"countries":["TN"],"is_corresponding":false,"raw_author_name":"Ouajdi Korbaa","raw_affiliation_strings":["LR17ES05, University of Sousse ISITCom, Mars Research Laboratory, , Sousse,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LR17ES05, University of Sousse ISITCom, Mars Research Laboratory, , Sousse,","institution_ids":["https://openalex.org/I8636806"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5083073132"],"corresponding_institution_ids":["https://openalex.org/I8636806"],"apc_list":null,"apc_paid":null,"fwci":4.0731,"has_fulltext":false,"cited_by_count":19,"citation_normalized_percentile":{"value":0.94425599,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"21","issue":"1","first_page":"81","last_page":"115"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8857744932174683},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6162087321281433},{"id":"https://openalex.org/keywords/concept-drift","display_name":"Concept drift","score":0.5254884362220764},{"id":"https://openalex.org/keywords/online-learning","display_name":"Online learning","score":0.509914755821228},{"id":"https://openalex.org/keywords/incremental-learning","display_name":"Incremental learning","score":0.4878099262714386},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4293132424354553},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.34994828701019287},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.20422038435935974}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8857744932174683},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6162087321281433},{"id":"https://openalex.org/C60777511","wikidata":"https://www.wikidata.org/wiki/Q3045002","display_name":"Concept drift","level":3,"score":0.5254884362220764},{"id":"https://openalex.org/C2986087404","wikidata":"https://www.wikidata.org/wiki/Q15946010","display_name":"Online learning","level":2,"score":0.509914755821228},{"id":"https://openalex.org/C2780735816","wikidata":"https://www.wikidata.org/wiki/Q28324931","display_name":"Incremental learning","level":2,"score":0.4878099262714386},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4293132424354553},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.34994828701019287},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.20422038435935974},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1108/ijpcc-12-2023-0358","is_oa":false,"landing_page_url":"https://doi.org/10.1108/ijpcc-12-2023-0358","pdf_url":null,"source":{"id":"https://openalex.org/S172682790","display_name":"International Journal of Pervasive Computing and Communications","issn_l":"1742-7371","issn":["1742-7371","1742-738X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319811","host_organization_name":"Emerald Publishing Limited","host_organization_lineage":["https://openalex.org/P4310319811"],"host_organization_lineage_names":["Emerald Publishing Limited"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Pervasive Computing and Communications","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Life in Land","id":"https://metadata.un.org/sdg/15","score":0.6800000071525574}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W2614904885","https://openalex.org/W2777138789","https://openalex.org/W2797182919","https://openalex.org/W2906602321","https://openalex.org/W2948779977","https://openalex.org/W2958489519","https://openalex.org/W3014732532","https://openalex.org/W3025204993","https://openalex.org/W3035311645","https://openalex.org/W3046492501","https://openalex.org/W3089338075","https://openalex.org/W3093621053","https://openalex.org/W3112855875","https://openalex.org/W3119833552","https://openalex.org/W3152913067","https://openalex.org/W3154450391","https://openalex.org/W3195241156","https://openalex.org/W3201558779","https://openalex.org/W3214905027","https://openalex.org/W4206928688","https://openalex.org/W4226125749","https://openalex.org/W4285327525","https://openalex.org/W4288070309","https://openalex.org/W4294442638","https://openalex.org/W4295923812","https://openalex.org/W4296498605","https://openalex.org/W4296500957","https://openalex.org/W4297099939","https://openalex.org/W4306643055","https://openalex.org/W4311628428","https://openalex.org/W4361766994","https://openalex.org/W4377194846","https://openalex.org/W4378071425","https://openalex.org/W4381303564"],"related_works":["https://openalex.org/W2740428142","https://openalex.org/W3091433184","https://openalex.org/W4385763953","https://openalex.org/W4281623741","https://openalex.org/W2111524978","https://openalex.org/W2117528262","https://openalex.org/W4287201692","https://openalex.org/W4303857004","https://openalex.org/W2026660007","https://openalex.org/W3174499835"],"abstract_inverted_index":{"Purpose":[0],"The":[1,32,54,75,86,99,120,162,200,224,258,281,346,352,393,446,477,536,573],"primary":[2],"purpose":[3],"of":[4,37,126,202,233,267,403,418,519,560,619],"this":[5],"paper":[6,33,76,243],"is":[7,56,505],"to":[8,48,57,81,123,218,298,335,396,423,454,543,577],"introduce":[9],"the":[10,35,51,83,124,133,143,167,219,227,242,245,264,292,337,415,435,508,511,517,561,614],"drift":[11,26,151,308,362,548],"detection":[12,61,152,198,309,359,363,463,545,549],"method-online":[13],"random":[14,283,333],"forest":[15,293],"(DDM-ORF)":[16],"model":[17,169,190,538],"for":[18,23,29,104,238,253,316,357,385,410,499,570,583,625],"intrusion":[19,60,181,254,358,412,462,485,544,620],"detection,":[20,621],"combining":[21,547],"DDM":[22,268],"detecting":[24,147,269],"concept":[25,150,279,307,361],"and":[27,39,69,97,115,130,140,153,196,206,230,276,311,327,364,372,378,400,438,473,482,501,522,530,550,567,581,600,609,617],"ORF":[28],"incremental":[30,155,282,366,552],"learning.":[31,553],"addresses":[34],"challenges":[36,588],"dynamic":[38,566],"nonstationary":[40,251,391,591],"data,":[41],"offering":[42,564],"a":[43,186,369,495,540,565,596],"solution":[44],"that":[45,166],"continuously":[46],"adapts":[47],"changes":[49,272],"in":[50,62,132,146,180,194,248,273,340,389,440,480,488,507,515,532,557,589],"data":[52,135,252,342,387,398,523,585,598],"distribution.":[53],"goal":[55],"provide":[58],"effective":[59,461],"real-world":[63,239,411],"scenarios,":[64],"demonstrated":[65],"through":[66,149,360],"comprehensive":[67,138],"experiments":[68],"evaluations":[70],"using":[71,107],"Apache":[72,102,214,376,607],"Spark.":[73],"Design/methodology/approach":[74],"uses":[77],"an":[78,460],"experimental":[79],"approach":[80,542],"evaluate":[82],"DDM-ORF":[84,168,354,447,537,562],"model.":[85],"design":[87,139],"involves":[88],"assessing":[89],"classification":[90,172,406],"performance":[91,193],"metrics,":[92],"including":[93,263],"accuracy,":[94,176],"precision,":[95],"recall":[96],"F-measure.":[98],"methodology":[100,141],"integrates":[101],"Spark":[103,215,377,608],"distributed":[105],"computing,":[106],"metrics":[108],"such":[109,330],"as":[110,291,331],"processed":[111],"records":[112],"per":[113,118],"second":[114],"input":[116],"rows":[117],"second.":[119],"evaluation":[121,216],"extends":[122,576],"analysis":[125,184],"IP":[127,203],"addresses,":[128,204],"ports":[129,205],"taxonomies":[131,207],"MAWILab":[134],"set.":[136],"This":[137,554],"showcase":[142],"model\u2019s":[144,246,338,394,436,448,478,574],"effectiveness":[145,339,439],"intrusions":[148],"online":[154,365,497,533,551],"learning":[156],"on":[157,286,595],"large-scale,":[158],"heterogeneous":[159,397,584],"data.":[160,572],"Findings":[161],"paper\u2019s":[163],"findings":[164],"reveal":[165],"achieves":[170],"outstanding":[171],"results":[173],"with":[174,604,606],"99.96%":[175],"demonstrating":[177],"its":[178,401,558,578],"efficacy":[179],"detection.":[182,255,413],"Comparative":[183],"against":[185,524],"convolutional":[187],"neural":[188],"network-based":[189],"indicates":[191],"superior":[192],"anomalous":[195],"suspicious":[197],"rates.":[199,223],"exploration":[201],"uncovers":[208],"valuable":[209,623],"insights":[210,624],"into":[211],"attack":[212],"patterns.":[213],"attests":[217],"system\u2019s":[220],"high":[221],"processing":[222,383],"study":[225],"emphasizes":[226],"scalability,":[228,579],"availability":[229],"fault":[231],"tolerance":[232],"DDM-ORF,":[234],"making":[235],"it":[236,408,465],"suitable":[237,409],"scenarios.":[240,392],"Overall,":[241],"establishes":[244],"proficiency":[247],"handling":[249],"dynamic,":[250,390,590],"Research":[256],"limitations/implications":[257],"research":[259,320],"acknowledges":[260],"certain":[261],"limitations,":[262],"potential":[265,490],"challenge":[266],"only":[270],"frequency":[271],"class":[274],"labels":[275],"not":[277],"complex":[278],"drifts.":[280],"forest\u2019s":[284],"reliance":[285],"memory":[287,317,328],"may":[288,322],"pose":[289],"constraints":[290],"size":[294],"increases,":[295],"potentially":[296],"leading":[297],"overfitting.":[299],"Addressing":[300],"these":[301],"limitations":[302],"could":[303],"involve":[304],"exploring":[305],"alternative":[306],"algorithms":[310,324],"implementing":[312],"ensemble":[313],"pruning":[314],"techniques":[315],"efficiency.":[318],"Further":[319],"avenues":[321],"investigate":[323],"balancing":[325],"accuracy":[326,479],"usage,":[329],"compressed":[332],"forests,":[334],"enhance":[336],"evolving":[341,571],"environments.":[343,592],"Practical":[344],"implications":[345,349,433,445,450],"study\u2019s":[347],"practical":[348,432],"are":[350,451],"noteworthy.":[351],"proposed":[353],"model,":[355],"designed":[356],"learning,":[367],"offers":[368],"scalable,":[370],"available":[371],"fault-tolerant":[373],"solution.":[374],"Leveraging":[375],"Microsoft":[379,419,610],"Azure":[380,420,611],"Cloud":[381,421],"enhances":[382,613],"capabilities":[384],"large":[386],"sets":[388,399],"applicability":[395],"achievement":[402],"high-accuracy":[404],"multi-class":[405,601],"make":[407],"Moreover,":[414],"auto-scaling":[416],"features":[417],"contribute":[422],"adaptability,":[424],"ensuring":[425],"efficient":[426],"resource":[427],"utilization":[428,559],"without":[429],"downtime.":[430],"These":[431],"underscore":[434],"relevance":[437],"diverse":[441],"operational":[442],"contexts.":[443],"Social":[444],"social":[449,512],"significant,":[452],"contributing":[453],"enhanced":[455],"cybersecurity":[456,504],"measures.":[457],"By":[458],"providing":[459,622],"system,":[464],"helps":[466],"safeguard":[467],"digital":[468,509,627],"ecosystems,":[469],"preserving":[470],"user":[471],"privacy":[472],"securing":[474,626],"sensitive":[475],"information.":[476],"identifying":[481],"classifying":[483],"various":[484],"attempts":[486],"aids":[487],"mitigating":[489],"cyber":[491],"threats,":[492],"thereby":[493],"fostering":[494],"safer":[496],"environment":[498],"individuals":[500],"organizations.":[502],"As":[503],"paramount":[506],"age,":[510],"impact":[513],"lies":[514,556],"fortifying":[516],"resilience":[518],"networks,":[520],"systems":[521],"malicious":[525],"activities,":[526],"ultimately":[527],"promoting":[528],"trust":[529],"reliability":[531],"interactions.":[534],"Originality/value":[535],"introduces":[539],"novel":[541],"by":[546],"originality":[555],"algorithm,":[563],"adaptive":[568],"system":[569],"contribution":[575],"fault-tolerance":[580],"suitability":[582],"sets,":[586],"addressing":[587],"Its":[593],"application":[594,618],"large-scale":[597],"set":[599],"classification,":[602],"along":[603],"integration":[605],"Cloud,":[612],"field\u2019s":[615],"understanding":[616],"infrastructures.":[628]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":9}],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2025-10-10T00:00:00"}