{"id":"https://openalex.org/W4409641154","doi":"https://doi.org/10.1109/jiot.2025.3562675","title":"Anomaly Detection in Internet of Things System Calls Using a Centroid-Based Vector-Space Model","display_name":"Anomaly Detection in Internet of Things System Calls Using a Centroid-Based Vector-Space Model","publication_year":2025,"publication_date":"2025-04-21","ids":{"openalex":"https://openalex.org/W4409641154","doi":"https://doi.org/10.1109/jiot.2025.3562675"},"language":"en","primary_location":{"id":"doi:10.1109/jiot.2025.3562675","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3562675","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073259222","display_name":"Nouman Shamim","orcid":"https://orcid.org/0000-0002-5640-1159"},"institutions":[{"id":"https://openalex.org/I134276161","display_name":"Pakistan Institute of Engineering and Applied Sciences","ror":"https://ror.org/04d4mbk19","country_code":"PK","type":"education","lineage":["https://openalex.org/I134276161"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Nouman Shamim","raw_affiliation_strings":["Department of Computer & Information Sciences, Pakistan Institute of Engineering and Applied Sciences, Islamabad, Pakistan","Pakistan Institute of Engineering and Applied Sciences, Nilore Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0000-0002-5640-1159","affiliations":[{"raw_affiliation_string":"Department of Computer & Information Sciences, Pakistan Institute of Engineering and Applied Sciences, Islamabad, Pakistan","institution_ids":["https://openalex.org/I134276161"]},{"raw_affiliation_string":"Pakistan Institute of Engineering and Applied Sciences, Nilore Islamabad, Pakistan","institution_ids":["https://openalex.org/I134276161"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088597454","display_name":"Muhammad Asim","orcid":"https://orcid.org/0000-0002-2894-7891"},"institutions":[{"id":"https://openalex.org/I201384688","display_name":"National University of Computer and Emerging Sciences","ror":"https://ror.org/003eyb898","country_code":"PK","type":"education","lineage":["https://openalex.org/I201384688"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Muhammad Asim","raw_affiliation_strings":["Department of Computer Science, National University of Computer and Emerging Sciences, Islamabad, Pakistan","National University of Computer and Emerging Sciences, Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0000-0002-2894-7891","affiliations":[{"raw_affiliation_string":"Department of Computer Science, National University of Computer and Emerging Sciences, Islamabad, Pakistan","institution_ids":["https://openalex.org/I201384688"]},{"raw_affiliation_string":"National University of Computer and Emerging Sciences, Islamabad, Pakistan","institution_ids":["https://openalex.org/I201384688"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062247805","display_name":"Ali Ismail Awad","orcid":"https://orcid.org/0000-0002-3800-0757"},"institutions":[{"id":"https://openalex.org/I201726411","display_name":"United Arab Emirates University","ror":"https://ror.org/01km6p862","country_code":"AE","type":"education","lineage":["https://openalex.org/I201726411"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Ali Ismail Awad","raw_affiliation_strings":["College of Information Technology, United Arab Emirates University, Al Ain, UAE","College of Information Technology, United Arab Emirates University, Al Ain, United Arab Emirates"],"raw_orcid":"https://orcid.org/0000-0002-3800-0757","affiliations":[{"raw_affiliation_string":"College of Information Technology, United Arab Emirates University, Al Ain, UAE","institution_ids":["https://openalex.org/I201726411"]},{"raw_affiliation_string":"College of Information Technology, United Arab Emirates University, Al Ain, United Arab Emirates","institution_ids":["https://openalex.org/I201726411"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072011650","display_name":"Muhammad Khurram Khan","orcid":"https://orcid.org/0000-0001-6636-0533"},"institutions":[{"id":"https://openalex.org/I28022161","display_name":"King Saud University","ror":"https://ror.org/02f81g417","country_code":"SA","type":"education","lineage":["https://openalex.org/I28022161"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Muhammad Khurram Khan","raw_affiliation_strings":["Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-6636-0533","affiliations":[{"raw_affiliation_string":"Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I28022161"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.584,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.95314799,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"12","issue":"14","first_page":"26868","last_page":"26881"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9539999961853027,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9539999961853027,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9344000220298767,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7137561440467834},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.701328694820404},{"id":"https://openalex.org/keywords/centroid","display_name":"Centroid","score":0.6438031196594238},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5185164213180542},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.43846747279167175},{"id":"https://openalex.org/keywords/space","display_name":"Space (punctuation)","score":0.41756346821784973},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4040777087211609},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3560328483581543},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3550165891647339},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.18272796273231506}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7137561440467834},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.701328694820404},{"id":"https://openalex.org/C146599234","wikidata":"https://www.wikidata.org/wiki/Q511093","display_name":"Centroid","level":2,"score":0.6438031196594238},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5185164213180542},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.43846747279167175},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.41756346821784973},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4040777087211609},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3560328483581543},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3550165891647339},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.18272796273231506},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2025.3562675","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3562675","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3442647037","display_name":null,"funder_award_id":"RSP2025R12","funder_id":"https://openalex.org/F4320321145","funder_display_name":"King Saud University"},{"id":"https://openalex.org/G4029212544","display_name":null,"funder_award_id":"12T036","funder_id":"https://openalex.org/F4320323593","funder_display_name":"United Arab Emirates University"}],"funders":[{"id":"https://openalex.org/F4320321145","display_name":"King Saud University","ror":"https://ror.org/02f81g417"},{"id":"https://openalex.org/F4320323593","display_name":"United Arab Emirates University","ror":"https://ror.org/01km6p862"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W1941427975","https://openalex.org/W1981738628","https://openalex.org/W2292109572","https://openalex.org/W2746608747","https://openalex.org/W2773153974","https://openalex.org/W2799941355","https://openalex.org/W2885999345","https://openalex.org/W2902106343","https://openalex.org/W2911921818","https://openalex.org/W2983800303","https://openalex.org/W2999613521","https://openalex.org/W3003685271","https://openalex.org/W3004207920","https://openalex.org/W3015181824","https://openalex.org/W3039539327","https://openalex.org/W3092977967","https://openalex.org/W3096291879","https://openalex.org/W3112343206","https://openalex.org/W3119529645","https://openalex.org/W3192676711","https://openalex.org/W4206180902","https://openalex.org/W4210631110","https://openalex.org/W4229023628","https://openalex.org/W4285818738","https://openalex.org/W4294675939","https://openalex.org/W4312959482","https://openalex.org/W4313648581","https://openalex.org/W4327930458","https://openalex.org/W4384916375","https://openalex.org/W4387546413","https://openalex.org/W4387623705","https://openalex.org/W4388675532","https://openalex.org/W4389506879","https://openalex.org/W6737155448","https://openalex.org/W6784165801"],"related_works":["https://openalex.org/W2381926679","https://openalex.org/W2007009951","https://openalex.org/W2082644203","https://openalex.org/W2350539780","https://openalex.org/W3165040664","https://openalex.org/W4242386713","https://openalex.org/W3122652148","https://openalex.org/W1583866266","https://openalex.org/W2996505764","https://openalex.org/W3088649123"],"abstract_inverted_index":{"Identifying":[0],"attacks":[1],"on":[2,192],"Internet":[3],"of":[4,15,36,57,60,80,93,102,154,175,199,205,217,230,234,239,262],"Things":[5],"(IoT)":[6],"systems":[7],"through":[8],"anomaly":[9,71,113],"detection":[10,114,228],"remains":[11],"a":[12,34,54,61,67,111,126,142,201,227],"critical":[13],"area":[14,209],"research.":[16],"One":[17],"common":[18],"and":[19,90,149,172,182,207,236,253],"effective":[20],"strategy":[21],"in":[22,85],"this":[23,47],"field":[24],"involves":[25],"monitoring":[26,42],"system-related":[27],"data":[28,121],"during":[29],"normal":[30,131,148],"operation":[31],"to":[32,43,129,140],"establish":[33],"baseline":[35],"expected":[37],"behavior,":[38],"followed":[39],"by":[40],"continuous":[41],"identify":[44],"deviations":[45],"from":[46],"baseline.":[48],"System":[49],"call":[50,82,120],"sequences,":[51],"which":[52],"provide":[53],"low-level":[55],"representation":[56],"the":[58,77,91,100,155,164,173,193,211,220,223,260,263],"behavior":[59],"system,":[62],"are":[63],"widely":[64],"regarded":[65],"as":[66,76,247],"valuable":[68],"resource":[69],"for":[70,145],"detection;":[72],"however,":[73],"challenges":[74],"such":[75],"categorical":[78],"nature":[79],"system":[81,119],"data,":[83],"inconsistencies":[84],"sequence":[86],"lengths,":[87],"repeating":[88],"patterns,":[89],"diversity":[92],"activities":[94],"across":[95,160,266],"single-and":[96],"multi-process":[97],"environments":[98],"complicate":[99],"effectiveness":[101,153],"existing":[103,190],"methods.":[104],"To":[105],"address":[106],"these":[107],"challenges,":[108],"we":[109],"propose":[110],"centroid-based":[112],"approach":[115],"that":[116],"transforms":[117],"IoT":[118],"into":[122],"word":[123],"vectors,":[124],"creating":[125],"central":[127],"vector":[128],"represent":[130],"behavior.":[132],"A":[133],"weighted":[134],"vector-space":[135],"model":[136],"is":[137,158],"then":[138],"used":[139],"set":[141],"threshold":[143],"distance":[144],"distinguishing":[146],"between":[147],"malicious":[150],"sequences.":[151],"The":[152,187,241,250],"proposed":[156,264],"method":[157,188,265],"evaluated":[159],"three":[161],"distinct":[162],"datasets:":[163],"Australian":[165],"Defense":[166],"Force":[167],"Academy":[168],"Linux":[169],"Dataset":[170],"(ADFA-LD)":[171],"University":[174],"New":[176],"Mexico":[177],"(UNM)":[178],"datasets,":[179,222],"including":[180],"UNM-Sendmail":[181],"UNM-Line":[183],"Printer":[184],"Remote":[185],"(LPR).":[186],"surpasses":[189],"approaches":[191],"ADFA-LD":[194],"dataset,":[195],"achieving":[196],"an":[197,208,232,237],"accuracy":[198,229],"99.02%,":[200],"false-positive":[202],"rate":[203],"(FPR)":[204],"1.96%,":[206],"under":[210],"receiver":[212],"operating":[213],"characteristic":[214],"curve":[215],"(AUC)":[216],"0.9923.":[218],"For":[219],"UNM":[221],"performance":[224],"metrics":[225],"indicate":[226],"99.7%,":[231],"FPR":[233],"0.28%,":[235],"AUC":[238],"0.9983.":[240],"average":[242],"processing":[243],"time":[244],"was":[245],"measured":[246],"1\u20133":[248],"ms.":[249],"experimental":[251],"results":[252],"subsequent":[254],"analysis":[255],"reveal":[256],"promising":[257],"performance,":[258],"demonstrating":[259],"generalizability":[261],"various":[267],"datasets.":[268]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}