{"id":"https://openalex.org/W2920949764","doi":"https://doi.org/10.1109/cns.2019.8802833","title":"GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection","display_name":"GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection","publication_year":2019,"publication_date":"2019-06-01","ids":{"openalex":"https://openalex.org/W2920949764","doi":"https://doi.org/10.1109/cns.2019.8802833","mag":"2920949764"},"language":"en","primary_location":{"id":"doi:10.1109/cns.2019.8802833","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns.2019.8802833","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/1903.06661","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5003654479","display_name":"Quoc Phong Nguyen","orcid":"https://orcid.org/0000-0002-0183-2525"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Quoc Phong Nguyen","raw_affiliation_strings":["National University of Singapore","National University of Singapore,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore","institution_ids":["https://openalex.org/I165932596"]},{"raw_affiliation_string":"National University of Singapore,","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041793725","display_name":"Kar Wai Lim","orcid":"https://orcid.org/0000-0003-0979-1956"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Kar Wai Lim","raw_affiliation_strings":["National University of Singapore","National University of Singapore,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore","institution_ids":["https://openalex.org/I165932596"]},{"raw_affiliation_string":"National University of Singapore,","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012540529","display_name":"Dinil Mon Divakaran","orcid":"https://orcid.org/0000-0001-8706-432X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dinil Mon Divakaran","raw_affiliation_strings":["Trustwave"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Trustwave","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110628584","display_name":"Kian Hsiang Low","orcid":null},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Kian Hsiang Low","raw_affiliation_strings":["National University of Singapore","National University of Singapore,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore","institution_ids":["https://openalex.org/I165932596"]},{"raw_affiliation_string":"National University of Singapore,","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101428727","display_name":"Mun Choon Chan","orcid":"https://orcid.org/0000-0002-6563-275X"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Mun Choon Chan","raw_affiliation_strings":["National University of Singapore","National University of Singapore,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore","institution_ids":["https://openalex.org/I165932596"]},{"raw_affiliation_string":"National University of Singapore,","institution_ids":["https://openalex.org/I165932596"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":12,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"91","last_page":"99"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.8890203237533569},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7812371253967285},{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.7379475235939026},{"id":"https://openalex.org/keywords/gee","display_name":"Gee","score":0.6604219675064087},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5960354804992676},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5439159870147705},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5185592770576477},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.445162296295166},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4261711537837982},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3957256078720093},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3673241436481476},{"id":"https://openalex.org/keywords/generalized-estimating-equation","display_name":"Generalized estimating equation","score":0.3151085376739502}],"concepts":[{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.8890203237533569},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7812371253967285},{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.7379475235939026},{"id":"https://openalex.org/C53084192","wikidata":"https://www.wikidata.org/wiki/Q1485121","display_name":"Gee","level":3,"score":0.6604219675064087},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5960354804992676},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5439159870147705},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5185592770576477},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.445162296295166},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4261711537837982},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3957256078720093},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3673241436481476},{"id":"https://openalex.org/C27403532","wikidata":"https://www.wikidata.org/wiki/Q5532474","display_name":"Generalized estimating equation","level":2,"score":0.3151085376739502},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/cns.2019.8802833","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns.2019.8802833","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE Conference on Communications and Network Security (CNS)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:1903.06661","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1903.06661","pdf_url":"https://arxiv.org/pdf/1903.06661","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"mag:2920949764","is_oa":true,"landing_page_url":"https://arxiv.org/abs/1903.06661","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"arXiv (Cornell University)","raw_type":null},{"id":"doi:10.48550/arxiv.1903.06661","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.1903.06661","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:1903.06661","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1903.06661","pdf_url":"https://arxiv.org/pdf/1903.06661","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320320698","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49"},{"id":"https://openalex.org/F4320327962","display_name":"Singapore Telecommunications Limited","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2920949764.pdf","grobid_xml":"https://content.openalex.org/works/W2920949764.grobid-xml"},"referenced_works_count":48,"referenced_works":["https://openalex.org/W1806891645","https://openalex.org/W1985987493","https://openalex.org/W2016258134","https://openalex.org/W2031163547","https://openalex.org/W2057331964","https://openalex.org/W2061272711","https://openalex.org/W2077488147","https://openalex.org/W2114996745","https://openalex.org/W2120664731","https://openalex.org/W2121511513","https://openalex.org/W2136420282","https://openalex.org/W2140437701","https://openalex.org/W2144936818","https://openalex.org/W2152800262","https://openalex.org/W2155915275","https://openalex.org/W2169623711","https://openalex.org/W2181347294","https://openalex.org/W2188365844","https://openalex.org/W2225156818","https://openalex.org/W2296509296","https://openalex.org/W2528827134","https://openalex.org/W2560162835","https://openalex.org/W2770942607","https://openalex.org/W2775542991","https://openalex.org/W2783741806","https://openalex.org/W2787957674","https://openalex.org/W2805595195","https://openalex.org/W2951004968","https://openalex.org/W2953384591","https://openalex.org/W2962727772","https://openalex.org/W2963197901","https://openalex.org/W2963364041","https://openalex.org/W2964121744","https://openalex.org/W3009746682","https://openalex.org/W3101380508","https://openalex.org/W3153872861","https://openalex.org/W3161677312","https://openalex.org/W4239856175","https://openalex.org/W4253269957","https://openalex.org/W6620707391","https://openalex.org/W6631190155","https://openalex.org/W6638908295","https://openalex.org/W6685777803","https://openalex.org/W6687045409","https://openalex.org/W6713134421","https://openalex.org/W6743493502","https://openalex.org/W6746084291","https://openalex.org/W7016021835"],"related_works":["https://openalex.org/W2969495950","https://openalex.org/W2890235427","https://openalex.org/W2997837095","https://openalex.org/W2949225703","https://openalex.org/W2328654303","https://openalex.org/W3019763923","https://openalex.org/W2164210932","https://openalex.org/W3120618416","https://openalex.org/W3169450514","https://openalex.org/W3038599144","https://openalex.org/W3007518527","https://openalex.org/W2998409251","https://openalex.org/W2980237165","https://openalex.org/W3171105608","https://openalex.org/W2903757699","https://openalex.org/W3202464393","https://openalex.org/W2906498146","https://openalex.org/W3203144025","https://openalex.org/W3087287207","https://openalex.org/W605583246"],"abstract_inverted_index":{"This":[0],"paper":[1],"looks":[2],"into":[3],"the":[4,33,69,118],"problem":[5],"of":[6,40,93,115,141],"detecting":[7,84,104,129],"network":[8,89],"anomalies":[9,87,131],"by":[10],"analyzing":[11],"NetFlow":[12],"records.":[13],"While":[14],"many":[15],"previous":[16],"works":[17],"have":[18,32],"used":[19],"statistical":[20],"models":[21],"and":[22,45,78,85,106],"machine":[23],"learning":[24],"techniques":[25],"in":[26,68,88,128],"a":[27,81],"supervised":[28],"way,":[29],"such":[30],"solutions":[31,55],"limitations":[34],"that":[35,123,137],"they":[36],"require":[37],"large":[38],"amount":[39],"labeled":[41],"data":[42],"for":[43,83,103,111],"training":[44],"are":[46,138],"unlikely":[47],"to":[48,63],"detect":[49],"zero-day":[50],"attacks.":[51,144],"Existing":[52],"anomaly":[53],"detection":[54],"also":[56],"do":[57],"not":[58],"provide":[59],"an":[60,99],"easy":[61],"way":[62],"explain":[64],"or":[65],"identify":[66],"attacks":[67],"anomalous":[70],"traffic.":[71,90],"To":[72],"address":[73],"these":[74,142],"limitations,":[75],"we":[76],"develop":[77],"present":[79],"GEE,":[80],"framework":[82],"explaining":[86,112],"GEE":[91,116],"comprises":[92],"two":[94],"components:":[95],"(i)Variational":[96],"Autoencoder":[97],"(VAE)-":[98],"unsupervised":[100],"deep-learning":[101],"technique":[102,110],"anomalies,":[105],"(ii)a":[107],"gradient-based":[108],"fingerprinting":[109],"anomalies.":[113],"Evaluation":[114],"on":[117],"recent":[119],"UGR":[120],"dataset":[121],"demonstrates":[122],"our":[124],"approach":[125],"is":[126],"effective":[127],"different":[130],"as":[132,134],"well":[133],"identifying":[135],"fingerprints":[136],"good":[139],"representations":[140],"various":[143]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":6},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}