{"id":"https://openalex.org/W2772317693","doi":"https://doi.org/10.1109/access.2017.2780250","title":"HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection","display_name":"HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection","publication_year":2017,"publication_date":"2017-12-11","ids":{"openalex":"https://openalex.org/W2772317693","doi":"https://doi.org/10.1109/access.2017.2780250","mag":"2772317693"},"language":"en","primary_location":{"id":"doi:10.1109/access.2017.2780250","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2017.2780250","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2017.2780250","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100391911","display_name":"Wei Wang","orcid":"https://orcid.org/0000-0002-2336-0135"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wei Wang","raw_affiliation_strings":["Department of Automation, University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-2336-0135","affiliations":[{"raw_affiliation_string":"Department of Automation, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076001747","display_name":"Yiqiang Sheng","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210099069","display_name":"Institute of Acoustics","ror":"https://ror.org/00v8rqv75","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yiqiang Sheng","raw_affiliation_strings":["National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-8452-2492","affiliations":[{"raw_affiliation_string":"National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101790108","display_name":"Jinlin Wang","orcid":"https://orcid.org/0000-0003-1113-5835"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210099069","display_name":"Institute of Acoustics","ror":"https://ror.org/00v8rqv75","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinlin Wang","raw_affiliation_strings":["National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090995962","display_name":"Xuewen Zeng","orcid":"https://orcid.org/0000-0002-9906-114X"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210099069","display_name":"Institute of Acoustics","ror":"https://ror.org/00v8rqv75","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuewen Zeng","raw_affiliation_strings":["National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102971699","display_name":"Xiaozhou Ye","orcid":"https://orcid.org/0000-0001-5668-9941"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210099069","display_name":"Institute of Acoustics","ror":"https://ror.org/00v8rqv75","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaozhou Ye","raw_affiliation_strings":["National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Network New Media Engineering Research Center, Institute of Acoustics, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210099069"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101669174","display_name":"Yongzhong Huang","orcid":"https://orcid.org/0000-0002-1620-3107"},"institutions":[{"id":"https://openalex.org/I5343935","display_name":"Guilin University of Electronic Technology","ror":"https://ror.org/05arjae42","country_code":"CN","type":"education","lineage":["https://openalex.org/I5343935"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yongzhong Huang","raw_affiliation_strings":["Guilin University of Electronic Technology, Guilin, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Guilin University of Electronic Technology, Guilin, China","institution_ids":["https://openalex.org/I5343935"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027268630","display_name":"Ming Zhu","orcid":"https://orcid.org/0000-0001-5007-3919"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ming Zhu","raw_affiliation_strings":["Department of Automation, University of Science and Technology of China, Hefei, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Automation, University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2075,"currency":"USD","value_usd":2075},"apc_paid":{"value":2075,"currency":"USD","value_usd":2075},"fwci":32.0298,"has_fulltext":false,"cited_by_count":664,"citation_normalized_percentile":{"value":0.99746455,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"6","issue":null,"first_page":"1792","last_page":"1806"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8769052028656006},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7615034580230713},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6693981885910034},{"id":"https://openalex.org/keywords/convolutional-neural-network","display_name":"Convolutional neural network","score":0.6236051917076111},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.591854989528656},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5754925012588501},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.559044599533081},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.4744050204753876},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.46940767765045166},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.45950835943222046},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4464159905910492},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.43067294359207153},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.41949212551116943}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8769052028656006},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7615034580230713},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6693981885910034},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.6236051917076111},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.591854989528656},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5754925012588501},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.559044599533081},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.4744050204753876},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.46940767765045166},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.45950835943222046},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4464159905910492},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.43067294359207153},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.41949212551116943},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2017.2780250","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2017.2780250","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:51eea1ce553f4b5b9c60b170281838b5","is_oa":true,"landing_page_url":"https://doaj.org/article/51eea1ce553f4b5b9c60b170281838b5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 6, Pp 1792-1806 (2018)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2017.2780250","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2017.2780250","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1674028588","display_name":null,"funder_award_id":"Y654101601","funder_id":"https://openalex.org/F4320321133","funder_display_name":"Chinese Academy of Sciences"}],"funders":[{"id":"https://openalex.org/F4320321133","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":49,"referenced_works":["https://openalex.org/W34239198","https://openalex.org/W135902891","https://openalex.org/W433644524","https://openalex.org/W1512586648","https://openalex.org/W1598201276","https://openalex.org/W1665214252","https://openalex.org/W1775434803","https://openalex.org/W1991830413","https://openalex.org/W2009058336","https://openalex.org/W2009882563","https://openalex.org/W2031163547","https://openalex.org/W2056243682","https://openalex.org/W2064675550","https://openalex.org/W2066664409","https://openalex.org/W2076384720","https://openalex.org/W2086540457","https://openalex.org/W2099940443","https://openalex.org/W2100734569","https://openalex.org/W2102950057","https://openalex.org/W2103024672","https://openalex.org/W2108318847","https://openalex.org/W2109894153","https://openalex.org/W2118978333","https://openalex.org/W2155926039","https://openalex.org/W2158143121","https://openalex.org/W2163698217","https://openalex.org/W2163922914","https://openalex.org/W2187089797","https://openalex.org/W2187254185","https://openalex.org/W2200832203","https://openalex.org/W2271840356","https://openalex.org/W2281706614","https://openalex.org/W2342408547","https://openalex.org/W2399941526","https://openalex.org/W2469109025","https://openalex.org/W2528827134","https://openalex.org/W2531448500","https://openalex.org/W2554704889","https://openalex.org/W2594748684","https://openalex.org/W2606697812","https://openalex.org/W2743678626","https://openalex.org/W2962949934","https://openalex.org/W2963042536","https://openalex.org/W6601402213","https://openalex.org/W6605567061","https://openalex.org/W6637242042","https://openalex.org/W6683951458","https://openalex.org/W6687883403","https://openalex.org/W6695719683"],"related_works":["https://openalex.org/W4375867731","https://openalex.org/W2357468538","https://openalex.org/W1577110157","https://openalex.org/W2355007334","https://openalex.org/W2388326001","https://openalex.org/W2998914036","https://openalex.org/W4226493464","https://openalex.org/W3133861977","https://openalex.org/W2951211570","https://openalex.org/W3103566983"],"abstract_inverted_index":{"The":[0,130,150,159,176],"development":[1],"of":[2,17,41,73,110,133,172,189],"an":[3,42,63],"anomaly-based":[4],"intrusion":[5,18,99],"detection":[6,100,191],"system":[7,101],"(IDS)":[8],"is":[9,44,61,136],"a":[10,52,74,91],"primary":[11],"research":[12,65],"direction":[13],"in":[14,187,200],"the":[15,39,71,95,106,139,157,170,173,181],"field":[16],"detection.":[19],"An":[20],"IDS":[21,43,93],"learns":[22,105,121],"normal":[23],"and":[24,31,35,50,119,162,193,204],"anomalous":[25],"behavior":[26],"by":[27,138],"analyzing":[28],"network":[29,59,111],"traffic":[30,60,112,153],"can":[32,56],"detect":[33],"unknown":[34],"new":[36],"attacks.":[37],"However,":[38],"performance":[40,171],"highly":[45],"dependent":[46],"on":[47],"feature":[48,53,134,145,202],"design,":[49],"designing":[51],"set":[54],"that":[55,180],"accurately":[57],"characterize":[58],"still":[62],"ongoing":[64],"issue.":[66],"Anomaly-based":[67],"IDSs":[68],"also":[69],"have":[70],"problem":[72],"high":[75],"false":[76],"alarm":[77],"rate":[78],"(FAR),":[79],"which":[80,103,195],"seriously":[81],"restricts":[82],"their":[83],"practical":[84],"applications.":[85],"In":[86],"this":[87],"paper,":[88],"we":[89],"propose":[90],"novel":[92],"called":[94],"hierarchical":[96],"spatial-temporal":[97],"features-based":[98],"(HAST-IDS),":[102],"first":[104],"low-level":[107],"spatial":[108],"features":[109,124,154],"using":[113,125],"deep":[114,140],"convolutional":[115],"neural":[116,141],"networks":[117,142],"(CNNs)":[118],"then":[120],"high-level":[122],"temporal":[123],"long":[126],"short-term":[127],"memory":[128],"networks.":[129],"entire":[131],"process":[132],"learning":[135,203],"completed":[137],"automatically;":[143],"no":[144],"engineering":[146],"techniques":[147],"are":[148,166],"required.":[149],"automatically":[151],"learned":[152],"effectively":[155],"reduce":[156],"FAR.":[158],"standard":[160],"DARPA1998":[161],"ISCX2012":[163],"data":[164],"sets":[165],"used":[167],"to":[168],"evaluate":[169],"proposed":[174],"system.":[175],"experimental":[177],"results":[178],"show":[179],"HAST-IDS":[182],"outperforms":[183],"other":[184],"published":[185],"approaches":[186],"terms":[188],"accuracy,":[190],"rate,":[192],"FAR,":[194],"successfully":[196],"demonstrates":[197],"its":[198],"effectiveness":[199],"both":[201],"FAR":[205],"reduction.":[206]},"counts_by_year":[{"year":2026,"cited_by_count":41},{"year":2025,"cited_by_count":84},{"year":2024,"cited_by_count":81},{"year":2023,"cited_by_count":95},{"year":2022,"cited_by_count":94},{"year":2021,"cited_by_count":114},{"year":2020,"cited_by_count":85},{"year":2019,"cited_by_count":57},{"year":2018,"cited_by_count":13}],"updated_date":"2026-08-27T14:10:00.468798","created_date":"2025-10-10T00:00:00"}