{"id":"https://openalex.org/W4401508524","doi":"https://doi.org/10.1109/infocom52122.2024.10621157","title":"Genos: General In-Network Unsupervised Intrusion Detection by Rule Extraction","display_name":"Genos: General In-Network Unsupervised Intrusion Detection by Rule Extraction","publication_year":2024,"publication_date":"2024-05-20","ids":{"openalex":"https://openalex.org/W4401508524","doi":"https://doi.org/10.1109/infocom52122.2024.10621157"},"language":"en","primary_location":{"id":"doi:10.1109/infocom52122.2024.10621157","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infocom52122.2024.10621157","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE INFOCOM 2024 - IEEE Conference on Computer Communications","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100713350","display_name":"Ruoyu Li","orcid":"https://orcid.org/0000-0003-0754-2817"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ruoyu Li","raw_affiliation_strings":["Tsinghua University,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100404176","display_name":"Qing Li","orcid":"https://orcid.org/0000-0003-3370-471X"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qing Li","raw_affiliation_strings":["Peng Cheng Laboratory,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peng Cheng Laboratory,China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100433544","display_name":"Yu Zhang","orcid":"https://orcid.org/0000-0002-3952-670X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Zhang","raw_affiliation_strings":["Tsinghua University,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University,China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100643332","display_name":"Dan Zhao","orcid":"https://orcid.org/0000-0002-8436-4228"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dan Zhao","raw_affiliation_strings":["Peng Cheng Laboratory,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peng Cheng Laboratory,China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101600503","display_name":"Xi Xiao","orcid":"https://orcid.org/0000-0003-1521-9542"},"institutions":[{"id":"https://openalex.org/I4210114105","display_name":"Tsinghua\u2013Berkeley Shenzhen Institute","ror":"https://ror.org/02hhwwz98","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210114105","https://openalex.org/I95457486","https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xi Xiao","raw_affiliation_strings":["Tsinghua Shenzhen International Graduate School,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua Shenzhen International Graduate School,China","institution_ids":["https://openalex.org/I4210114105"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101626204","display_name":"Yong Jiang","orcid":"https://orcid.org/0000-0002-4260-1395"},"institutions":[{"id":"https://openalex.org/I4210114105","display_name":"Tsinghua\u2013Berkeley Shenzhen Institute","ror":"https://ror.org/02hhwwz98","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210114105","https://openalex.org/I95457486","https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yong Jiang","raw_affiliation_strings":["Tsinghua Shenzhen International Graduate School,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua Shenzhen International Graduate School,China","institution_ids":["https://openalex.org/I4210114105"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.8099,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":{"value":0.91089504,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"561","last_page":"570"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7444647550582886},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7258871793746948},{"id":"https://openalex.org/keywords/extraction","display_name":"Extraction (chemistry)","score":0.5935510396957397},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5089840888977051},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.4319838285446167},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4122503101825714},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3779531419277191},{"id":"https://openalex.org/keywords/chromatography","display_name":"Chromatography","score":0.12811174988746643},{"id":"https://openalex.org/keywords/geology","display_name":"Geology","score":0.0860491394996643},{"id":"https://openalex.org/keywords/chemistry","display_name":"Chemistry","score":0.07336682081222534}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7444647550582886},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7258871793746948},{"id":"https://openalex.org/C4725764","wikidata":"https://www.wikidata.org/wiki/Q844704","display_name":"Extraction (chemistry)","level":2,"score":0.5935510396957397},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5089840888977051},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.4319838285446167},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4122503101825714},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3779531419277191},{"id":"https://openalex.org/C43617362","wikidata":"https://www.wikidata.org/wiki/Q170050","display_name":"Chromatography","level":1,"score":0.12811174988746643},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0860491394996643},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.07336682081222534},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/infocom52122.2024.10621157","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infocom52122.2024.10621157","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE INFOCOM 2024 - IEEE Conference on Computer Communications","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Climate action","id":"https://metadata.un.org/sdg/13","score":0.4699999988079071}],"awards":[],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":57,"referenced_works":["https://openalex.org/W1547466200","https://openalex.org/W1594031697","https://openalex.org/W1645738616","https://openalex.org/W1994926493","https://openalex.org/W2118022153","https://openalex.org/W2516809705","https://openalex.org/W2617799811","https://openalex.org/W2744693751","https://openalex.org/W2747329762","https://openalex.org/W2773722012","https://openalex.org/W2783777339","https://openalex.org/W2788403449","https://openalex.org/W2789828921","https://openalex.org/W2890991187","https://openalex.org/W2963197901","https://openalex.org/W2973368506","https://openalex.org/W2983123278","https://openalex.org/W2988337058","https://openalex.org/W3008207353","https://openalex.org/W3047562633","https://openalex.org/W3047608117","https://openalex.org/W3080078525","https://openalex.org/W3109366475","https://openalex.org/W3124792046","https://openalex.org/W3128341305","https://openalex.org/W3133726397","https://openalex.org/W3136284412","https://openalex.org/W3153512259","https://openalex.org/W3164964481","https://openalex.org/W3173170122","https://openalex.org/W3193293525","https://openalex.org/W3200583622","https://openalex.org/W3209791287","https://openalex.org/W4280588222","https://openalex.org/W4283207618","https://openalex.org/W4287553671","https://openalex.org/W4290990900","https://openalex.org/W4290991662","https://openalex.org/W4290994985","https://openalex.org/W4295023660","https://openalex.org/W4296962561","https://openalex.org/W4297821991","https://openalex.org/W4308632271","https://openalex.org/W4324007233","https://openalex.org/W6636995944","https://openalex.org/W6640425456","https://openalex.org/W6738898614","https://openalex.org/W6745861399","https://openalex.org/W6747717762","https://openalex.org/W6768046412","https://openalex.org/W6776440900","https://openalex.org/W6780405429","https://openalex.org/W6781689429","https://openalex.org/W6781796011","https://openalex.org/W6787144186","https://openalex.org/W6795076093","https://openalex.org/W6838761101"],"related_works":["https://openalex.org/W2357468538","https://openalex.org/W1577110157","https://openalex.org/W2355007334","https://openalex.org/W2906422846","https://openalex.org/W2390009783","https://openalex.org/W2364419519","https://openalex.org/W2133389611","https://openalex.org/W2360767377","https://openalex.org/W2017948608","https://openalex.org/W2360951146"],"abstract_inverted_index":{"Anomaly-based":[0],"network":[1,151],"intrusion":[2],"detection":[3],"systems":[4],"(A-NIDS)":[5],"use":[6],"unsupervised":[7,65],"models":[8],"to":[9,35,51,119,133,149,163],"detect":[10],"unforeseen":[11],"attacks.":[12],"However,":[13],"existing":[14],"A-NIDS":[15,66],"solutions":[16],"suffer":[17],"from":[18],"low":[19],"throughput,":[20,193],"lack":[21],"of":[22,39,72,190],"interpretability,":[23,195],"and":[24,79,89,184,196],"high":[25],"maintenance":[26,175],"costs.":[27,176],"Recent":[28],"in-network":[29,43,62],"intelligence":[30],"(INI)":[31],"exploits":[32],"programmable":[33],"switches":[34],"offer":[36],"line-rate":[37],"deployment":[38],"NIDS.":[40],"Nevertheless,":[41],"current":[42],"NIDS":[44],"are":[45,87],"either":[46],"model-specific":[47],"or":[48],"only":[49,167],"apply":[50],"supervised":[52],"models.":[53],"In":[54,108],"this":[55],"paper,":[56],"we":[57,99,112],"propose":[58,114],"Genos,":[59],"a":[60,73,76,80,101,115,128,179],"general":[61],"framework":[63],"for":[64,104],"by":[67,146,166],"rule":[68,106],"extraction,":[69],"which":[70],"consists":[71],"Model":[74,77,81,110,142,158],"Compiler,":[75,111],"Interpreter,":[78],"Debugger.":[82],"Specifically,":[83],"observing":[84],"benign":[85],"data":[86],"multi-modal":[88],"usually":[90],"located":[91],"in":[92,95,138,153],"multiple":[93],"subspaces":[94],"the":[96,109,121,135,155],"feature":[97,122],"space,":[98],"utilize":[100],"divide-and-conquer":[102],"approach":[103],"model-agnostic":[105],"extraction.":[107],"first":[113],"tree-based":[116],"clustering":[117],"algorithm":[118],"partition":[120],"space":[123],"into":[124],"subspaces,":[125,172],"then":[126],"design":[127],"decision":[129],"boundary":[130],"estimation":[131],"mechanism":[132],"approximate":[134],"source":[136],"model":[137],"each":[139],"subspace.":[140],"The":[141,157],"Interpreter":[143],"interprets":[144],"predictions":[145],"important":[147],"attributes":[148],"aid":[150],"operators":[152],"understanding":[154],"predictions.":[156],"Debugger":[159],"conducts":[160],"incremental":[161],"updating":[162,198],"rectify":[164],"errors":[165],"fine-tuning":[168],"rules":[169],"on":[170],"affected":[171],"thus":[173],"reducing":[174],"We":[177],"implement":[178],"prototype":[180],"using":[181],"physical":[182],"hardware,":[183],"experiments":[185],"demonstrate":[186],"its":[187],"superior":[188],"performance":[189],"100":[191],"Gbps":[192],"great":[194],"trivial":[197],"overhead.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}