{"id":"https://openalex.org/W4415124740","doi":"https://doi.org/10.1109/icmlt65785.2025.11193310","title":"Temporal-XAI: An Attention-Based Explainable Framework for DoS Attack Detection with Temporal Pattern Analysis","display_name":"Temporal-XAI: An Attention-Based Explainable Framework for DoS Attack Detection with Temporal Pattern Analysis","publication_year":2025,"publication_date":"2025-05-23","ids":{"openalex":"https://openalex.org/W4415124740","doi":"https://doi.org/10.1109/icmlt65785.2025.11193310"},"language":"en","primary_location":{"id":"doi:10.1109/icmlt65785.2025.11193310","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icmlt65785.2025.11193310","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 10th International Conference on Machine Learning Technologies (ICMLT)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5119975485","display_name":"Ogidan Toluwaleke","orcid":null},"institutions":[{"id":"https://openalex.org/I4210095748","display_name":"Maruho (United Kingdom)","ror":"https://ror.org/00b4wbs75","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210095748","https://openalex.org/I4210157255"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ogidan Toluwaleke","raw_affiliation_strings":["Vuhosi UK,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vuhosi UK,London,UK","institution_ids":["https://openalex.org/I4210095748"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119975488","display_name":"David Uno","orcid":null},"institutions":[{"id":"https://openalex.org/I4210085995","display_name":"Reading Museum","ror":"https://ror.org/00akavp61","country_code":"GB","type":"nonprofit","lineage":["https://openalex.org/I4210085995"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"David Uno","raw_affiliation_strings":["Readrly Limited,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Readrly Limited,London,UK","institution_ids":["https://openalex.org/I4210085995"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5118908781","display_name":"Ifeoluwa Emmanuel Olagbaju","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ifeoluwa Emmanuel Olagbaju","raw_affiliation_strings":["Independent Researcher,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Independent Researcher,London,UK","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5118738229","display_name":"Oluwole Fagbohun","orcid":null},"institutions":[{"id":"https://openalex.org/I4210148685","display_name":"Carbon180","ror":"https://ror.org/04q6az286","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210148685"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Oluwole Fagbohun","raw_affiliation_strings":["Carbonnote,Maryland,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carbonnote,Maryland,USA","institution_ids":["https://openalex.org/I4210148685"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119975489","display_name":"PraiseGod Erema Ayodele","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"PraiseGod Erema Ayodele","raw_affiliation_strings":["Independent Researcher,Bristol,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Independent Researcher,Bristol,UK","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115909615","display_name":"Ernest Effiong Offiong","orcid":null},"institutions":[{"id":"https://openalex.org/I4210095748","display_name":"Maruho (United Kingdom)","ror":"https://ror.org/00b4wbs75","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210095748","https://openalex.org/I4210157255"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ernest Effiong Offiong","raw_affiliation_strings":["Vuhosi Limited,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vuhosi Limited,UK","institution_ids":["https://openalex.org/I4210095748"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119975490","display_name":"Onyekachukwu Ojumah","orcid":null},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Onyekachukwu Ojumah","raw_affiliation_strings":["Independent Researcher,Huddersfield,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Independent Researcher,Huddersfield,UK","institution_ids":["https://openalex.org/I133837150"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5118944898","display_name":"Temitope Kadri","orcid":null},"institutions":[{"id":"https://openalex.org/I4210085995","display_name":"Reading Museum","ror":"https://ror.org/00akavp61","country_code":"GB","type":"nonprofit","lineage":["https://openalex.org/I4210085995"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Temitope Kadri","raw_affiliation_strings":["Readrly Limited,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Readrly Limited,London,UK","institution_ids":["https://openalex.org/I4210085995"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119975491","display_name":"Folasayo Agunbiade","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Folasayo Agunbiade","raw_affiliation_strings":["Independent Researcher,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Independent Researcher,London,UK","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119975486","display_name":"Gold E. O. Okpa","orcid":null},"institutions":[{"id":"https://openalex.org/I73417466","display_name":"Coventry University","ror":"https://ror.org/01tgmhj36","country_code":"GB","type":"education","lineage":["https://openalex.org/I73417466"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Gold E. O. Okpa","raw_affiliation_strings":["Independent Researcher,Coventry,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Independent Researcher,Coventry,UK","institution_ids":["https://openalex.org/I73417466"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5098735456","display_name":"Prisca Amajuoyi","orcid":null},"institutions":[{"id":"https://openalex.org/I63072094","display_name":"University of Portsmouth","ror":"https://ror.org/03ykbk197","country_code":"GB","type":"education","lineage":["https://openalex.org/I63072094"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Prisca Chinazor Amajuoyi","raw_affiliation_strings":["IIBA,Portsmouth,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IIBA,Portsmouth,UK","institution_ids":["https://openalex.org/I63072094"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5119975487","display_name":"Ekechi Chizoba Cynthia","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ekechi Chizoba Cynthia","raw_affiliation_strings":["Independent Researcher,Glasgow,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Independent Researcher,Glasgow,UK","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.9756,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.87245106,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"439","last_page":"450"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9954000115394592,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9954000115394592,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9664999842643738,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.7858999967575073},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.695900022983551},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6586999893188477},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.5297999978065491},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.4648999869823456},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4593000113964081},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.44859999418258667},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.4359000027179718}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7915999889373779},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.7858999967575073},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.695900022983551},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6586999893188477},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.5297999978065491},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.46709999442100525},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4648999869823456},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4593000113964081},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.44859999418258667},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4359000027179718},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4081999957561493},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3953000009059906},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.385699987411499},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.36550000309944153},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.35420000553131104},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.34689998626708984},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.320499986410141},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.31150001287460327},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.30329999327659607},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.258899986743927},{"id":"https://openalex.org/C2985264313","wikidata":"https://www.wikidata.org/wiki/Q378859","display_name":"Pattern analysis","level":2,"score":0.25609999895095825}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icmlt65785.2025.11193310","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icmlt65785.2025.11193310","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 10th International Conference on Machine Learning Technologies (ICMLT)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W1493911800","https://openalex.org/W1524600321","https://openalex.org/W1744212210","https://openalex.org/W1975115265","https://openalex.org/W2000052611","https://openalex.org/W2001107211","https://openalex.org/W2038819732","https://openalex.org/W2039424734","https://openalex.org/W2099940443","https://openalex.org/W2102830733","https://openalex.org/W2104692292","https://openalex.org/W2115569246","https://openalex.org/W2116065364","https://openalex.org/W2119227347","https://openalex.org/W2120617515","https://openalex.org/W2335999708","https://openalex.org/W2625013748","https://openalex.org/W2762776925","https://openalex.org/W2767094836","https://openalex.org/W2789828921","https://openalex.org/W2887597525","https://openalex.org/W2890991187","https://openalex.org/W2902900716","https://openalex.org/W2902977372","https://openalex.org/W2926701059","https://openalex.org/W2944643572","https://openalex.org/W2962061624","https://openalex.org/W2962703433","https://openalex.org/W2964304846","https://openalex.org/W2998038410","https://openalex.org/W3005097670","https://openalex.org/W3046775891","https://openalex.org/W3096425977","https://openalex.org/W3101178806","https://openalex.org/W3121453273","https://openalex.org/W3197213531","https://openalex.org/W3204683301","https://openalex.org/W4206245037"],"related_works":[],"abstract_inverted_index":{"With":[0],"the":[1,96],"emergence":[2],"of":[3,6,82,99,156],"sophisticated":[4],"Denial":[5],"Service":[7],"(DoS)":[8],"attacks":[9],"targeting":[10],"modern":[11],"networks,":[12],"effective":[13,214],"detection":[14,28,58,196],"mechanisms":[15],"are":[16],"crucial":[17],"for":[18,42,180],"maintaining":[19],"system":[20],"availability":[21],"and":[22,40,62,102,119,145,159,169,211],"security.":[23],"While":[24],"deep":[25],"learning-based":[26],"intrusion":[27],"systems":[29],"have":[30],"shown":[31],"remarkable":[32],"performance,":[33],"their":[34,38],"black-box":[35],"nature":[36,98],"limits":[37],"interpretability":[39],"trustworthiness":[41],"security":[43,181,204],"practitioners.":[44],"This":[45],"paper":[46],"introduces":[47],"Temporal-XAI,":[48],"a":[49,70,121,146,186],"novel":[50],"explainable":[51,165],"AI":[52],"framework":[53,112],"that":[54,88,129],"enhances":[55,200],"DoS":[56],"attack":[57,65,132,208],"by":[59],"explicitly":[60],"modeling":[61],"explaining":[63],"temporal":[64,71,172],"patterns.":[66],"Our":[67],"approach":[68,138,174],"combines":[69],"attention":[72],"mechanism":[73,123],"with":[74,154,189],"feature":[75,92],"importance":[76],"attribution":[77],"to":[78,124,131,163,206],"provide":[79],"multi-level":[80],"explanations":[81],"detected":[83],"attacks.":[84],"Unlike":[85],"existing":[86],"methods":[87,166],"focus":[89],"on":[90,139],"static":[91],"analysis,":[93],"Temporal-XAI":[94,192],"captures":[95],"sequential":[97],"network":[100,117,149],"traffic":[101,105],"explains":[103],"how":[104],"patterns":[106,210],"evolve":[107],"during":[108],"an":[109],"attack.":[110],"The":[111],"extracts":[113],"time-sensitive":[114],"features":[115],"from":[116],"flows":[118],"employs":[120],"self-attention":[122],"identify":[125],"critical":[126],"time":[127],"points":[128],"contribute":[130],"classification":[133],"decisions.":[134],"We":[135],"evaluate":[136],"our":[137,171],"three":[140],"benchmark":[141],"datasets:":[142],"CICIDS-2017,":[143],"NSL-KDD,":[144],"custom":[147],"5G":[148],"dataset,":[150],"demonstrating":[151],"superior":[152],"performance":[153],"F1-scores":[155],"99.3%,":[157],"98.7%,":[158],"97.8%":[160],"respectively.":[161],"Compared":[162],"state-of-the-art":[164],"like":[167],"SHAP":[168],"LIME,":[170],"explanation":[173],"provides":[175],"27%":[176],"more":[177,213],"actionable":[178],"insights":[179],"analysts,":[182],"as":[183],"validated":[184],"through":[185],"user":[187],"study":[188],"cybersecurity":[190],"experts.":[191],"not":[193],"only":[194],"improves":[195],"accuracy":[197],"but":[198],"also":[199],"model":[201],"transparency,":[202],"enabling":[203],"teams":[205],"understand":[207],"progression":[209],"develop":[212],"defense":[215],"mechanisms.":[216]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2025-10-14T00:00:00"}