{"id":"https://openalex.org/W4416082591","doi":"https://doi.org/10.1109/access.2026.3688204","title":"Time Matters: Temporal NetFlow Features for ML-Based Network Intrusion Detection","display_name":"Time Matters: Temporal NetFlow Features for ML-Based Network Intrusion Detection","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W4416082591","doi":"https://doi.org/10.1109/access.2026.3688204"},"language":"en","primary_location":{"id":"doi:10.1109/access.2026.3688204","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3688204","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref","datacite","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3688204","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5119619903","display_name":"Majed Luay","orcid":null},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Majed Luay","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia"],"raw_orcid":"https://orcid.org/0009-0002-2103-3023","affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016369735","display_name":"Siamak Layeghy","orcid":"https://orcid.org/0000-0002-1229-2368"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Siamak Layeghy","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia"],"raw_orcid":"https://orcid.org/0000-0002-1229-2368","affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063995150","display_name":"Seyedehfaezeh Hosseininoorbin","orcid":null},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Niloufar Noorbin","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047926199","display_name":"Mohanad Sarhan","orcid":"https://orcid.org/0000-0001-8597-6042"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Mohanad Sarhan","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Gayan Kulatilleke","orcid":"https://orcid.org/0000-0002-0965-3994"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Gayan Kulatilleke","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia"],"raw_orcid":"https://orcid.org/0000-0002-0965-3994","affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia","institution_ids":["https://openalex.org/I165143802"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089327837","display_name":"Nour Moustafa","orcid":"https://orcid.org/0000-0001-6127-9349"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Nour Moustafa","raw_affiliation_strings":["School of Engineering and Information Technology, University of New South Wales, Sydney, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0001-6127-9349","affiliations":[{"raw_affiliation_string":"School of Engineering and Information Technology, University of New South Wales, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078468070","display_name":"Marius Portmann","orcid":"https://orcid.org/0000-0003-1852-3961"},"institutions":[{"id":"https://openalex.org/I165143802","display_name":"The University of Queensland","ror":"https://ror.org/00rqy9422","country_code":"AU","type":"education","lineage":["https://openalex.org/I165143802"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Marius Portmann","raw_affiliation_strings":["School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia"],"raw_orcid":"https://orcid.org/0000-0003-1852-3961","affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Computer Science, University of Queensland, Brisbane, QLD, Australia","institution_ids":["https://openalex.org/I165143802"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":65.8092,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.9980527,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"14","issue":null,"first_page":"66899","last_page":"66913"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.914900004863739,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.914900004863739,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.016899999231100082,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.014299999922513962,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.9839000105857849},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.593500018119812},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4212999939918518},{"id":"https://openalex.org/keywords/data-set","display_name":"Data set","score":0.3646000027656555},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.32510000467300415},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.3239000141620636}],"concepts":[{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.9839000105857849},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7404000163078308},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6298999786376953},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.593500018119812},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4212999939918518},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.3646000027656555},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.32510000467300415},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.3239000141620636},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.2833999991416931},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C32946077","wikidata":"https://www.wikidata.org/wiki/Q618079","display_name":"Network analysis","level":2,"score":0.28299999237060547},{"id":"https://openalex.org/C2779843651","wikidata":"https://www.wikidata.org/wiki/Q7390335","display_name":"SIGNAL (programming language)","level":2,"score":0.2799000144004822},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26589998602867126},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.258899986743927}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1109/access.2026.3688204","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3688204","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2503.04404","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2503.04404","pdf_url":"https://arxiv.org/pdf/2503.04404","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:arXiv.org:2503.04404","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2503.04404","pdf_url":"https://arxiv.org/pdf/2503.04404","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:doaj.org/article:32b8d3e29c374759a9804ca134862ea2","is_oa":true,"landing_page_url":"https://doaj.org/article/32b8d3e29c374759a9804ca134862ea2","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 14, Pp 66899-66913 (2026)","raw_type":"article"},{"id":"doi:10.48550/arxiv.2503.04404","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2503.04404","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3688204","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3688204","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"This":[0,51,102],"paper":[1],"investigates":[2],"the":[3,24,40,88,111,132],"temporal":[4,28,49,70,75,81,103],"analysis":[5,82,104],"of":[6,27,64,83,90,99],"NetFlow":[7,43,65,84,100],"datasets":[8,44,66,85],"for":[9,45,139],"machine":[10],"learning":[11],"(ML)-based":[12],"network":[13],"intrusion":[14],"detection":[15],"systems":[16],"(NIDS).":[17],"Although":[18],"many":[19,146],"previous":[20],"studies":[21],"have":[22,148],"highlighted":[23],"critical":[25],"role":[26],"features,":[29,76],"such":[30],"as":[31],"inter-packet":[32],"arrival":[33],"time":[34,94,122,133],"and":[35,58,95,125],"flow":[36],"length/duration,":[37],"in":[38,110],"NIDS,":[39],"currently":[41],"available":[42,61],"NIDS":[46],"lack":[47],"these":[48,69,74],"features.":[50,101],"study":[52],"addresses":[53],"this":[54],"gap":[55],"by":[56,86],"creating":[57],"making":[59],"publicly":[60],"a":[62,79],"set":[63],"that":[67,145],"incorporate":[68],"features":[71,92],"[1].":[72],"With":[73],"we":[77],"provide":[78],"comprehensive":[80],"examining":[87],"distribution":[89],"various":[91,140],"over":[93],"presenting":[96],"time-series":[97],"representations":[98],"has":[105],"not":[106],"been":[107],"previously":[108],"provided":[109],"existing":[112],"literature.":[113],"We":[114],"also":[115],"borrowed":[116],"an":[117],"idea":[118],"from":[119],"signal":[120,135],"processing,":[121],"frequency":[123,134],"analysis,":[124],"tested":[126],"it":[127],"to":[128,156],"see":[129],"how":[130],"different":[131],"presentations":[136],"(TFSPs)":[137],"are":[138],"attacks.":[141],"The":[142],"results":[143],"indicate":[144],"attacks":[147],"unique":[149],"patterns,":[150],"which":[151],"could":[152],"help":[153],"ML":[154],"models":[155],"identify":[157],"them":[158],"more":[159],"easily.":[160]},"counts_by_year":[{"year":2026,"cited_by_count":7}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}