{"id":"https://openalex.org/W4409473988","doi":"https://doi.org/10.1109/access.2025.3561105","title":"A Survey of Data Stream-Based Intrusion Detection Systems","display_name":"A Survey of Data Stream-Based Intrusion Detection Systems","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4409473988","doi":"https://doi.org/10.1109/access.2025.3561105"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3561105","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3561105","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3561105","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5066354978","display_name":"Rodrigo Sanches Miani","orcid":"https://orcid.org/0000-0002-8176-8040"},"institutions":[{"id":"https://openalex.org/I80850581","display_name":"Universidade Federal de Uberl\u00e2ndia","ror":"https://ror.org/04x3wvr31","country_code":"BR","type":"education","lineage":["https://openalex.org/I80850581"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Rodrigo Sanches Miani","raw_affiliation_strings":["Faculty of Computing, Federal University of Uberlândia, Uberlândia, Brazil","Faculty of Computing, Federal University of Uberlandia, Brazil"],"raw_orcid":"https://orcid.org/0000-0002-8176-8040","affiliations":[{"raw_affiliation_string":"Faculty of Computing, Federal University of Uberlândia, Uberlândia, Brazil","institution_ids":["https://openalex.org/I80850581"]},{"raw_affiliation_string":"Faculty of Computing, Federal University of Uberlandia, Brazil","institution_ids":["https://openalex.org/I80850581"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035497493","display_name":"Gustavo D. G. Bernardo","orcid":null},"institutions":[{"id":"https://openalex.org/I80850581","display_name":"Universidade Federal de Uberl\u00e2ndia","ror":"https://ror.org/04x3wvr31","country_code":"BR","type":"education","lineage":["https://openalex.org/I80850581"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Gustavo Di Giovanni Bernardo","raw_affiliation_strings":["Faculty of Computing, Federal University of Uberlândia, Uberlândia, Brazil","Faculty of Computing, Federal University of Uberlandia, Brazil"],"raw_orcid":"https://orcid.org/0009-0000-6945-7955","affiliations":[{"raw_affiliation_string":"Faculty of Computing, Federal University of Uberlândia, Uberlândia, Brazil","institution_ids":["https://openalex.org/I80850581"]},{"raw_affiliation_string":"Faculty of Computing, Federal University of Uberlandia, Brazil","institution_ids":["https://openalex.org/I80850581"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030016983","display_name":"Guilherme Weigert Cassales","orcid":"https://orcid.org/0000-0003-4029-2047"},"institutions":[{"id":"https://openalex.org/I52179390","display_name":"University of Waikato","ror":"https://ror.org/013fsnh78","country_code":"NZ","type":"education","lineage":["https://openalex.org/I52179390"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Guilherme Weigert Cassales","raw_affiliation_strings":["AI Institute, University of Waikato, Hamilton, New Zealand","AI Institute, University of Waikato, New Zealand"],"raw_orcid":"https://orcid.org/0000-0003-4029-2047","affiliations":[{"raw_affiliation_string":"AI Institute, University of Waikato, Hamilton, New Zealand","institution_ids":["https://openalex.org/I52179390"]},{"raw_affiliation_string":"AI Institute, University of Waikato, New Zealand","institution_ids":["https://openalex.org/I52179390"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058580588","display_name":"Hermes Senger","orcid":"https://orcid.org/0000-0003-1273-9809"},"institutions":[{"id":"https://openalex.org/I177909021","display_name":"Universidade Federal de S\u00e3o Carlos","ror":"https://ror.org/00qdc6m37","country_code":"BR","type":"education","lineage":["https://openalex.org/I177909021"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Hermes Senger","raw_affiliation_strings":["Department of Computer Science, Federal University of São Carlos, São Carlos, Brazil","Department of Computer Science, Federal University of Sao Carlos, Brazil"],"raw_orcid":"https://orcid.org/0000-0003-1273-9809","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Federal University of São Carlos, São Carlos, Brazil","institution_ids":["https://openalex.org/I177909021"]},{"raw_affiliation_string":"Department of Computer Science, Federal University of Sao Carlos, Brazil","institution_ids":["https://openalex.org/I177909021"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042178956","display_name":"Elaine R. Faria","orcid":"https://orcid.org/0000-0001-5242-9026"},"institutions":[{"id":"https://openalex.org/I80850581","display_name":"Universidade Federal de Uberl\u00e2ndia","ror":"https://ror.org/04x3wvr31","country_code":"BR","type":"education","lineage":["https://openalex.org/I80850581"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Elaine Ribeiro de Faria","raw_affiliation_strings":["Faculty of Computing, Federal University of Uberlândia, Uberlândia, Brazil","Faculty of Computing, Federal University of Uberlandia, Brazil"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Computing, Federal University of Uberlândia, Uberlândia, Brazil","institution_ids":["https://openalex.org/I80850581"]},{"raw_affiliation_string":"Faculty of Computing, Federal University of Uberlandia, Brazil","institution_ids":["https://openalex.org/I80850581"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":3.3242,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.91948486,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"13","issue":null,"first_page":"72953","last_page":"72983"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9592999815940857,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":0.9557999968528748,"subfield":{"id":"https://openalex.org/subfields/2204","display_name":"Biomedical Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6768197417259216},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6617728471755981},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36682185530662537}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6768197417259216},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6617728471755981},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36682185530662537}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2025.3561105","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3561105","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:9a070a2b76e44ad9adca2502d54005b5","is_oa":true,"landing_page_url":"https://doaj.org/article/9a070a2b76e44ad9adca2502d54005b5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 72953-72983 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3561105","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3561105","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5299999713897705,"display_name":"Climate action","id":"https://metadata.un.org/sdg/13"}],"awards":[{"id":"https://openalex.org/G1817404247","display_name":null,"funder_award_id":"2019/26702-8","funder_id":"https://openalex.org/F4320320997","funder_display_name":"Funda\u00e7\u00e3o de Amparo \u00e0 Pesquisa do Estado de S\u00e3o Paulo"},{"id":"https://openalex.org/G4219623954","display_name":null,"funder_award_id":"2023/00566-6","funder_id":"https://openalex.org/F4320320997","funder_display_name":"Funda\u00e7\u00e3o de Amparo \u00e0 Pesquisa do Estado de S\u00e3o Paulo"},{"id":"https://openalex.org/G5013799007","display_name":null,"funder_award_id":"APQ-02196-18","funder_id":"https://openalex.org/F4320322980","funder_display_name":"Funda\u00e7\u00e3o de Amparo \u00e0 Pesquisa do Estado de Minas Gerais"},{"id":"https://openalex.org/G8184654674","display_name":null,"funder_award_id":"APQ-02196-18","funder_id":"https://openalex.org/F4320333159","funder_display_name":"AADE Education and Research Foundation"}],"funders":[{"id":"https://openalex.org/F4320320997","display_name":"Funda\u00e7\u00e3o de Amparo \u00e0 Pesquisa do Estado de S\u00e3o Paulo","ror":"https://ror.org/02ddkpn78"},{"id":"https://openalex.org/F4320322980","display_name":"Funda\u00e7\u00e3o de Amparo \u00e0 Pesquisa do Estado de Minas Gerais","ror":"https://ror.org/00nc55f03"},{"id":"https://openalex.org/F4320333159","display_name":"AADE Education and Research Foundation","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":104,"referenced_works":["https://openalex.org/W134133433","https://openalex.org/W191530780","https://openalex.org/W1196375415","https://openalex.org/W1435507162","https://openalex.org/W1486777205","https://openalex.org/W1509669977","https://openalex.org/W1648214972","https://openalex.org/W1970472324","https://openalex.org/W1970978220","https://openalex.org/W1974640421","https://openalex.org/W1977264295","https://openalex.org/W1977482721","https://openalex.org/W1991796154","https://openalex.org/W1998960312","https://openalex.org/W2044861295","https://openalex.org/W2050090549","https://openalex.org/W2059753337","https://openalex.org/W2073256825","https://openalex.org/W2102712281","https://openalex.org/W2103234848","https://openalex.org/W2105330688","https://openalex.org/W2141254179","https://openalex.org/W2160841769","https://openalex.org/W2166260449","https://openalex.org/W2167101736","https://openalex.org/W2171331105","https://openalex.org/W2219140802","https://openalex.org/W2287498853","https://openalex.org/W2290318923","https://openalex.org/W2334853001","https://openalex.org/W2342408547","https://openalex.org/W2343828539","https://openalex.org/W2463118003","https://openalex.org/W2484086829","https://openalex.org/W2541628903","https://openalex.org/W2588336250","https://openalex.org/W2613480438","https://openalex.org/W2613731841","https://openalex.org/W2620580412","https://openalex.org/W2730281422","https://openalex.org/W2741799308","https://openalex.org/W2752924294","https://openalex.org/W2762176006","https://openalex.org/W2784328258","https://openalex.org/W2794025702","https://openalex.org/W2800833097","https://openalex.org/W2803881474","https://openalex.org/W2899235912","https://openalex.org/W2911671887","https://openalex.org/W2924689635","https://openalex.org/W2948779977","https://openalex.org/W2959717179","https://openalex.org/W2964289795","https://openalex.org/W2973744207","https://openalex.org/W2973817951","https://openalex.org/W2980576170","https://openalex.org/W2987520597","https://openalex.org/W2989114215","https://openalex.org/W2996671455","https://openalex.org/W2999410069","https://openalex.org/W3001683812","https://openalex.org/W3003389249","https://openalex.org/W3025093231","https://openalex.org/W3032284425","https://openalex.org/W3033213260","https://openalex.org/W3035735617","https://openalex.org/W3043187969","https://openalex.org/W3046346562","https://openalex.org/W3047132966","https://openalex.org/W3084110275","https://openalex.org/W3087857074","https://openalex.org/W3113329849","https://openalex.org/W3125555237","https://openalex.org/W3126814579","https://openalex.org/W3132109934","https://openalex.org/W3154726827","https://openalex.org/W3168165348","https://openalex.org/W3173515311","https://openalex.org/W3180062783","https://openalex.org/W3205985117","https://openalex.org/W3208097639","https://openalex.org/W3217543726","https://openalex.org/W4200622875","https://openalex.org/W4205088899","https://openalex.org/W4213168906","https://openalex.org/W4214699222","https://openalex.org/W4225472587","https://openalex.org/W4288070309","https://openalex.org/W4294691140","https://openalex.org/W4312889780","https://openalex.org/W4322622028","https://openalex.org/W4361010174","https://openalex.org/W4362639444","https://openalex.org/W4367625736","https://openalex.org/W4377022569","https://openalex.org/W4379514871","https://openalex.org/W4381550190","https://openalex.org/W4386207824","https://openalex.org/W4386227263","https://openalex.org/W4395097051","https://openalex.org/W4405429603","https://openalex.org/W6607406498","https://openalex.org/W6681814599","https://openalex.org/W6787556164"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W2364419519","https://openalex.org/W2360767377","https://openalex.org/W2017948608","https://openalex.org/W2360951146"],"abstract_inverted_index":{"Detecting":[0],"malicious":[1,180],"activities":[2],"in":[3,20,106,178,193],"network":[4],"environments":[5,83],"poses":[6],"a":[7,39,48],"challenge":[8],"that":[9,31,175],"attracts":[10],"significant":[11],"attention":[12],"due":[13],"to":[14,25,126,152],"its":[15],"complexity":[16],"and":[17,70,88,109,119,170,173,190],"importance.":[18],"Advances":[19],"the":[21,26,33,36,78,100,113,120,128,148,153,157,194],"field":[22],"have":[23],"led":[24],"development":[27,63,169],"of":[28,38,50,56,66,81,103,115,122,136,156],"several":[29],"algorithms":[30],"approach":[32],"problem":[34],"under":[35],"view":[37],"data":[40,52,59,61,67,86,124,142,158],"stream":[41,143],"machine":[42,144],"learning":[43,145],"task.":[44,160],"This":[45,131],"task":[46],"involves":[47],"set":[49],"steps:":[51],"collection":[53],"or":[54,64],"choice":[55],"public":[57],"datasets,":[58],"pre-processing,":[60],"reduction,":[62],"application":[65],"mining":[68,159],"techniques,":[69,146],"evaluation":[71],"methodology.":[72],"However,":[73],"these":[74],"steps":[75,155],"must":[76],"address":[77],"inherent":[79],"issues":[80,93],"dynamic":[82],"such":[84],"as":[85],"streams":[87],"intrusion":[89,137],"detection":[90,138],"systems.":[91],"These":[92],"include,":[94],"but":[95],"are":[96],"not":[97],"limited":[98],"to,":[99],"continuous":[101],"influx":[102],"data,":[104],"changes":[105],"both":[107],"normal":[108],"attack":[110,117],"class":[111],"distributions,":[112],"emergence":[114],"new":[116],"types,":[118],"scarcity":[121],"labeled":[123],"examples":[125],"update":[127],"decision":[129],"models.":[130],"survey":[132],"provides":[133],"an":[134],"overview":[135],"systems":[139],"(IDS)":[140],"using":[141],"characterizing":[147],"literature":[149],"approaches":[150],"according":[151],"classic":[154],"In":[161],"addition,":[162],"we":[163,183],"discuss":[164],"recommendations":[165],"for":[166,187],"practical":[167],"IDS":[168],"highlight":[171],"datasets":[172],"tools":[174],"can":[176],"aid":[177],"detecting":[179],"behavior.":[181],"Finally,":[182],"outline":[184],"potential":[185],"avenues":[186],"future":[188],"research":[189],"open":[191],"questions":[192],"field.":[195]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}