{"id":"https://openalex.org/W4407574947","doi":"https://doi.org/10.1109/jiot.2025.3542142","title":"Explainable Anomaly-Based Intrusion Detection for Specialized IoT Environments Enabled by Rule Extraction From Autoencoder","display_name":"Explainable Anomaly-Based Intrusion Detection for Specialized IoT Environments Enabled by Rule Extraction From Autoencoder","publication_year":2025,"publication_date":"2025-02-14","ids":{"openalex":"https://openalex.org/W4407574947","doi":"https://doi.org/10.1109/jiot.2025.3542142"},"language":"en","primary_location":{"id":"doi:10.1109/jiot.2025.3542142","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3542142","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101289182","display_name":"Mingrui Fan","orcid":"https://orcid.org/0009-0000-7270-3272"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mingrui Fan","raw_affiliation_strings":["National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0000-7270-3272","affiliations":[{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]},{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062348851","display_name":"Jinxin Zuo","orcid":"https://orcid.org/0000-0002-3341-8580"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinxin Zuo","raw_affiliation_strings":["National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-3341-8580","affiliations":[{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]},{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jiangwen Zhu","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiangwen Zhu","raw_affiliation_strings":["National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]},{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011351180","display_name":"Yueming Lu","orcid":"https://orcid.org/0000-0003-3196-0349"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yueming Lu","raw_affiliation_strings":["National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-3196-0349","affiliations":[{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]},{"raw_affiliation_string":"National Engineering Research Center of Disaster Backup and Recovery, School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I139759216"],"apc_list":null,"apc_paid":null,"fwci":8.4498,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":{"value":0.97475332,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"12","issue":"12","first_page":"19504","last_page":"19521"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.995199978351593,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.995199978351593,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9800000190734863,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9483000040054321,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.8734382390975952},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7833544015884399},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.721531331539154},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.677004337310791},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5065997838973999},{"id":"https://openalex.org/keywords/rule-based-system","display_name":"Rule-based system","score":0.4854493737220764},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.480522483587265},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.46498817205429077},{"id":"https://openalex.org/keywords/extraction","display_name":"Extraction (chemistry)","score":0.4577106833457947},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4159150719642639},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.33597564697265625},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.22743767499923706},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.16871216893196106}],"concepts":[{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.8734382390975952},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7833544015884399},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.721531331539154},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.677004337310791},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5065997838973999},{"id":"https://openalex.org/C149271511","wikidata":"https://www.wikidata.org/wiki/Q1417149","display_name":"Rule-based system","level":2,"score":0.4854493737220764},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.480522483587265},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.46498817205429077},{"id":"https://openalex.org/C4725764","wikidata":"https://www.wikidata.org/wiki/Q844704","display_name":"Extraction (chemistry)","level":2,"score":0.4577106833457947},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4159150719642639},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.33597564697265625},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.22743767499923706},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.16871216893196106},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C43617362","wikidata":"https://www.wikidata.org/wiki/Q170050","display_name":"Chromatography","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2025.3542142","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3542142","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2766082292","display_name":null,"funder_award_id":"2021YFB3101903.","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G7580729943","display_name":null,"funder_award_id":"2021YFB3101903","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W2049058890","https://openalex.org/W2144182447","https://openalex.org/W2282821441","https://openalex.org/W2296509296","https://openalex.org/W2296719434","https://openalex.org/W2574448563","https://openalex.org/W2591712613","https://openalex.org/W2788403449","https://openalex.org/W2804236575","https://openalex.org/W2890991187","https://openalex.org/W2921802966","https://openalex.org/W2948978827","https://openalex.org/W2973454102","https://openalex.org/W3042715689","https://openalex.org/W3080469893","https://openalex.org/W3101981467","https://openalex.org/W3156365820","https://openalex.org/W3162956350","https://openalex.org/W3200583622","https://openalex.org/W4205388843","https://openalex.org/W4226060502","https://openalex.org/W4293093536","https://openalex.org/W4382281941","https://openalex.org/W4385194650","https://openalex.org/W4385624139","https://openalex.org/W4391670369","https://openalex.org/W4400585973","https://openalex.org/W4402035331","https://openalex.org/W6675613107","https://openalex.org/W6734194636","https://openalex.org/W6737947904","https://openalex.org/W6779680364","https://openalex.org/W6787951600","https://openalex.org/W6846006745"],"related_works":["https://openalex.org/W3186512740","https://openalex.org/W4363671829","https://openalex.org/W2780476542","https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2667207928"],"abstract_inverted_index":{"Due":[0],"to":[1,78,151,164],"the":[2,10,24,44,80,99,103,106,113,166,195],"difficulty":[3],"in":[4,17,140],"predefining":[5],"novel":[6],"attack":[7],"patterns":[8],"and":[9,48,59,75,116,149,205],"scarcity":[11],"of":[12,20,26,46,102,130,146,169],"sufficient":[13],"malicious":[14,52],"training":[15],"samples":[16],"specialized":[18],"Internet":[19],"Things":[21],"(IoT)":[22],"scenarios,":[23],"focus":[25],"IoT":[27,208],"intrusion":[28,93],"detection":[29,94,114],"researchers":[30],"has":[31],"shifted":[32],"toward":[33],"anomaly-based":[34,92],"techniques":[35,39],"like":[36],"Autoencoder.":[37],"These":[38],"detect":[40],"attacks":[41],"based":[42,160],"on":[43,51,161],"degree":[45],"deviation":[47],"rely":[49],"minimally":[50],"samples.":[53],"However,":[54],"current":[55],"machine":[56],"learning":[57,61],"(ML)":[58],"deep":[60],"(DL)":[62],"implementations":[63],"lack":[64],"explainability.":[65],"Although":[66],"some":[67],"methods":[68],"provide":[69],"post-hoc":[70],"interpretations,":[71],"they":[72],"are":[73],"limited":[74],"partial,":[76],"failing":[77],"reflect":[79],"entire":[81],"decision-making":[82],"process.":[83],"To":[84],"address":[85],"this":[86],"challenge,":[87],"we":[88,119,156],"investigate":[89],"an":[90,141,158],"explainable":[91],"system":[95],"(IDS)":[96],"that":[97,121,177,194],"translates":[98],"inference":[100,180,203],"process":[101,181,204],"Autoencoder":[104],"into":[105],"high-fidelity":[107],"allow-list":[108,174,197],"rule":[109,175,198],"library,":[110],"thereby":[111],"balancing":[112],"capability":[115],"interpretability.":[117],"First,":[118],"assume":[120],"benign":[122],"traffic":[123],"follows":[124],"a":[125],"complex":[126],"global":[127],"distribution":[128],"composed":[129],"several":[131],"irrelevant":[132],"local":[133,153,171],"distributions.":[134,154],"The":[135,173],"clustering":[136],"algorithm":[137],"is":[138],"performed":[139],"extended":[142],"feature":[143],"space":[144],"consisting":[145],"reconstruction":[147],"loss":[148],"embeddings":[150],"decompose":[152],"Then,":[155],"deploy":[157],"approach":[159],"Gradient":[162],"Ascent":[163],"explore":[165],"boundary":[167,188],"rules":[168],"each":[170],"distribution.":[172],"library":[176,199],"reflects":[178],"Autoencoder\u2019s":[179,202],"can":[182],"be":[183],"constructed":[184],"by":[185],"merging":[186],"these":[187],"rules.":[189],"Comprehensive":[190],"evaluation":[191],"experiments":[192],"demonstrate":[193],"extracted":[196],"accurately":[200],"reproduces":[201],"effectively":[206],"detects":[207],"intrusions.":[209]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":5}],"updated_date":"2025-12-21T01:58:51.020947","created_date":"2025-10-10T00:00:00"}