{"id":"https://openalex.org/W7118178964","doi":"https://doi.org/10.1109/access.2025.3650576","title":"Concept Drift Analysis Based on Isolation Forest for Effectively Detecting Network Attack in IoT Scenarios","display_name":"Concept Drift Analysis Based on Isolation Forest for Effectively Detecting Network Attack in IoT Scenarios","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7118178964","doi":"https://doi.org/10.1109/access.2025.3650576"},"language":null,"primary_location":{"id":"doi:10.1109/access.2025.3650576","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3650576","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3650576","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5059971093","display_name":"Renjie Chu","orcid":"https://orcid.org/0000-0002-6446-7465"},"institutions":[{"id":"https://openalex.org/I5343935","display_name":"Guilin University of Electronic Technology","ror":"https://ror.org/05arjae42","country_code":"CN","type":"education","lineage":["https://openalex.org/I5343935"]},{"id":"https://openalex.org/I3129996945","display_name":"Guilin University of Aerospace Technology","ror":"https://ror.org/00h1gc758","country_code":"CN","type":"education","lineage":["https://openalex.org/I3129996945"]},{"id":"https://openalex.org/I176134282","display_name":"Guilin Medical University","ror":"https://ror.org/000prga03","country_code":"CN","type":"education","lineage":["https://openalex.org/I176134282"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Renjie Chu","raw_affiliation_strings":["School of Information Engineering, Guilin University, Guilin, China"],"affiliations":[{"raw_affiliation_string":"School of Information Engineering, Guilin University, Guilin, China","institution_ids":["https://openalex.org/I5343935","https://openalex.org/I3129996945","https://openalex.org/I176134282"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121916978","display_name":"Mengzhen Luo","orcid":null},"institutions":[{"id":"https://openalex.org/I176134282","display_name":"Guilin Medical University","ror":"https://ror.org/000prga03","country_code":"CN","type":"education","lineage":["https://openalex.org/I176134282"]},{"id":"https://openalex.org/I3129996945","display_name":"Guilin University of Aerospace Technology","ror":"https://ror.org/00h1gc758","country_code":"CN","type":"education","lineage":["https://openalex.org/I3129996945"]},{"id":"https://openalex.org/I5343935","display_name":"Guilin University of Electronic Technology","ror":"https://ror.org/05arjae42","country_code":"CN","type":"education","lineage":["https://openalex.org/I5343935"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mengzhen Luo","raw_affiliation_strings":["School of Information Engineering, Guilin University, Guilin, China"],"affiliations":[{"raw_affiliation_string":"School of Information Engineering, Guilin University, Guilin, China","institution_ids":["https://openalex.org/I5343935","https://openalex.org/I3129996945","https://openalex.org/I176134282"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121971131","display_name":"Lei Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I38706770","display_name":"Guilin University of Technology","ror":"https://ror.org/03z391397","country_code":"CN","type":"education","lineage":["https://openalex.org/I38706770"]},{"id":"https://openalex.org/I5343935","display_name":"Guilin University of Electronic Technology","ror":"https://ror.org/05arjae42","country_code":"CN","type":"education","lineage":["https://openalex.org/I5343935"]},{"id":"https://openalex.org/I3129996945","display_name":"Guilin University of Aerospace Technology","ror":"https://ror.org/00h1gc758","country_code":"CN","type":"education","lineage":["https://openalex.org/I3129996945"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lei Yang","raw_affiliation_strings":["School of Finance and Law, Guilin University, Guilin, China"],"affiliations":[{"raw_affiliation_string":"School of Finance and Law, Guilin University, Guilin, China","institution_ids":["https://openalex.org/I3129996945","https://openalex.org/I5343935","https://openalex.org/I38706770"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121922646","display_name":"Jianming Xiao","orcid":null},"institutions":[{"id":"https://openalex.org/I5343935","display_name":"Guilin University of Electronic Technology","ror":"https://ror.org/05arjae42","country_code":"CN","type":"education","lineage":["https://openalex.org/I5343935"]},{"id":"https://openalex.org/I3129996945","display_name":"Guilin University of Aerospace Technology","ror":"https://ror.org/00h1gc758","country_code":"CN","type":"education","lineage":["https://openalex.org/I3129996945"]},{"id":"https://openalex.org/I176134282","display_name":"Guilin Medical University","ror":"https://ror.org/000prga03","country_code":"CN","type":"education","lineage":["https://openalex.org/I176134282"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianming Xiao","raw_affiliation_strings":["School of Information Engineering, Guilin University, Guilin, China"],"affiliations":[{"raw_affiliation_string":"School of Information Engineering, Guilin University, Guilin, China","institution_ids":["https://openalex.org/I5343935","https://openalex.org/I3129996945","https://openalex.org/I176134282"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5121948477","display_name":"Yuanyuan Liao","orcid":null},"institutions":[{"id":"https://openalex.org/I3129996945","display_name":"Guilin University of Aerospace Technology","ror":"https://ror.org/00h1gc758","country_code":"CN","type":"education","lineage":["https://openalex.org/I3129996945"]},{"id":"https://openalex.org/I5343935","display_name":"Guilin University of Electronic Technology","ror":"https://ror.org/05arjae42","country_code":"CN","type":"education","lineage":["https://openalex.org/I5343935"]},{"id":"https://openalex.org/I176134282","display_name":"Guilin Medical University","ror":"https://ror.org/000prga03","country_code":"CN","type":"education","lineage":["https://openalex.org/I176134282"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuanyuan Liao","raw_affiliation_strings":["School of Information Engineering, Guilin University, Guilin, China"],"affiliations":[{"raw_affiliation_string":"School of Information Engineering, Guilin University, Guilin, China","institution_ids":["https://openalex.org/I5343935","https://openalex.org/I3129996945","https://openalex.org/I176134282"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5059971093"],"corresponding_institution_ids":["https://openalex.org/I176134282","https://openalex.org/I3129996945","https://openalex.org/I5343935"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.05377078,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":null,"first_page":"3245","last_page":"3258"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.8259000182151794},{"id":"https://openalex.org/keywords/concept-drift","display_name":"Concept drift","score":0.8072999715805054},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7735000252723694},{"id":"https://openalex.org/keywords/isolation","display_name":"Isolation (microbiology)","score":0.5465999841690063},{"id":"https://openalex.org/keywords/false-positives-and-false-negatives","display_name":"False positives and false negatives","score":0.5321000218391418},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.5083000063896179},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"Data stream mining","score":0.4406999945640564},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.43369999527931213},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4309999942779541}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8450999855995178},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.8259000182151794},{"id":"https://openalex.org/C60777511","wikidata":"https://www.wikidata.org/wiki/Q3045002","display_name":"Concept drift","level":3,"score":0.8072999715805054},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7735000252723694},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5835999846458435},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.5465999841690063},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.5321000218391418},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.5083000063896179},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.4406999945640564},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.43369999527931213},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4309999942779541},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.42649999260902405},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.4219000041484833},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.3928000032901764},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3589000105857849},{"id":"https://openalex.org/C2778484313","wikidata":"https://www.wikidata.org/wiki/Q1172540","display_name":"Data stream","level":2,"score":0.3578000068664551},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32690000534057617},{"id":"https://openalex.org/C160920958","wikidata":"https://www.wikidata.org/wiki/Q7662746","display_name":"Synthetic data","level":2,"score":0.311599999666214},{"id":"https://openalex.org/C24590314","wikidata":"https://www.wikidata.org/wiki/Q336038","display_name":"Wireless sensor network","level":2,"score":0.3012999892234802},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3012000024318695},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.29600000381469727},{"id":"https://openalex.org/C2776151529","wikidata":"https://www.wikidata.org/wiki/Q3045304","display_name":"Object detection","level":3,"score":0.290800005197525},{"id":"https://openalex.org/C152745839","wikidata":"https://www.wikidata.org/wiki/Q5438153","display_name":"Fault detection and isolation","level":3,"score":0.265500009059906},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.26010000705718994},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.26010000705718994},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2558000087738037},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.25529998540878296}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/access.2025.3650576","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3650576","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3650576","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3650576","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/15","display_name":"Life in Land","score":0.6635170578956604}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":50,"referenced_works":["https://openalex.org/W38774257","https://openalex.org/W202016214","https://openalex.org/W1585854823","https://openalex.org/W1642701485","https://openalex.org/W1660289459","https://openalex.org/W1970978220","https://openalex.org/W1990079212","https://openalex.org/W2026535637","https://openalex.org/W2099419573","https://openalex.org/W2122646361","https://openalex.org/W2139327121","https://openalex.org/W2143991132","https://openalex.org/W2296719434","https://openalex.org/W2310485631","https://openalex.org/W2345132057","https://openalex.org/W2552178666","https://openalex.org/W2588336250","https://openalex.org/W2612063921","https://openalex.org/W2747716660","https://openalex.org/W2789828921","https://openalex.org/W2806697149","https://openalex.org/W2808665150","https://openalex.org/W2884755130","https://openalex.org/W2898017895","https://openalex.org/W2947869719","https://openalex.org/W2964273393","https://openalex.org/W2966742737","https://openalex.org/W2991307025","https://openalex.org/W2991507433","https://openalex.org/W3008956334","https://openalex.org/W3016307237","https://openalex.org/W3035135748","https://openalex.org/W3043530913","https://openalex.org/W3126814045","https://openalex.org/W3159711257","https://openalex.org/W3198054520","https://openalex.org/W4206268729","https://openalex.org/W4220787723","https://openalex.org/W4220851938","https://openalex.org/W4220929382","https://openalex.org/W4241336979","https://openalex.org/W4281719757","https://openalex.org/W4294442638","https://openalex.org/W4404635093","https://openalex.org/W4405631660","https://openalex.org/W4406501583","https://openalex.org/W4407869487","https://openalex.org/W4408094869","https://openalex.org/W4409285319","https://openalex.org/W4412721961"],"related_works":[],"abstract_inverted_index":{"In":[0,133],"the":[1,4,100],"era":[2],"of":[3,6,54,60],"Internet":[5],"Things,":[7],"massive":[8],"network":[9,134],"data":[10,171],"streams":[11],"are":[12],"continuously":[13],"generated,":[14],"with":[15,125,144],"distributions":[16],"that":[17,109],"evolve":[18],"unpredictably":[19],"over":[20],"time.":[21],"This":[22],"dynamic":[23,170],"nature":[24],"poses":[25],"significant":[26],"challenges":[27],"for":[28,165],"effective":[29],"analysis.":[30],"To":[31],"address":[32],"this,":[33],"we":[34],"propose":[35],"a":[36,61,74,78,121,160],"novel":[37],"double-layer":[38],"concept":[39,55,166],"drift":[40,85,118,167],"detection":[41,62,104,115,123,136,149,168],"algorithm":[42],"based":[43],"on":[44,94],"isolation":[45,65],"forest,":[46],"termed":[47],"IF-DLDD,":[48],"designed":[49],"to":[50,82],"identify":[51],"multiple":[52],"types":[53],"drift.":[56],"The":[57,106],"framework":[58],"consists":[59],"layer,":[63,76],"where":[64,77],"forest":[66],"detects":[67],"anomalies":[68],"across":[69,116],"consecutive":[70],"sliding":[71],"windows,":[72],"and":[73,87,99,113,129,148,162],"verification":[75],"T-test":[79],"is":[80],"employed":[81],"precisely":[83],"localize":[84],"points":[86],"reduce":[88],"false":[89,127,146],"alarms.":[90],"We":[91],"evaluate":[92],"IF-DLDD":[93,110,138,158],"both":[95],"noisy":[96],"synthetic":[97],"datasets":[98],"real-world":[101],"CIC-IDS2017":[102],"intrusion":[103,135],"dataset.":[105],"results":[107],"demonstrate":[108],"achieves":[111],"timely":[112],"accurate":[114],"diverse":[117],"types,":[119],"maintaining":[120],"high":[122],"rate":[124],"low":[126],"positives":[128,147],"strong":[130],"noise":[131],"robustness.":[132],"tasks,":[137],"effectively":[139],"identifies":[140],"all":[141],"attack":[142],"drifts":[143],"minimal":[145],"delays":[150],"under":[151],"practical":[152,163],"parameter":[153],"settings.":[154],"These":[155],"findings":[156],"highlight":[157],"as":[159],"promising":[161],"approach":[164],"in":[169],"streams.":[172]},"counts_by_year":[],"updated_date":"2026-01-11T23:08:45.486102","created_date":"2026-01-05T00:00:00"}