{"id":"https://openalex.org/W7155502871","doi":"https://doi.org/10.1109/ojcoms.2026.3683927","title":"NetBurst-X: A Burst-Informed Learning Framework for Detecting Microbursts and Data Exfiltration in NetFlow","display_name":"NetBurst-X: A Burst-Informed Learning Framework for Detecting Microbursts and Data Exfiltration in NetFlow","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7155502871","doi":"https://doi.org/10.1109/ojcoms.2026.3683927"},"language":"en","primary_location":{"id":"doi:10.1109/ojcoms.2026.3683927","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2026.3683927","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/ojcoms.2026.3683927","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5122906722","display_name":"Mohammed Saad Javeed","orcid":null},"institutions":[{"id":"https://openalex.org/I165075387","display_name":"Trine University","ror":"https://ror.org/038e0dv78","country_code":"US","type":"education","lineage":["https://openalex.org/I165075387"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mohammed Saad Javeed","raw_affiliation_strings":["Department of Information Science, Trine University, Angola, MI, USA"],"raw_orcid":"https://orcid.org/0009-0008-3399-3287","affiliations":[{"raw_affiliation_string":"Department of Information Science, Trine University, Angola, MI, USA","institution_ids":["https://openalex.org/I165075387"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5117490410","display_name":"Jannatul Maua","orcid":null},"institutions":[{"id":"https://openalex.org/I4210147955","display_name":"Bangladesh University of Business and Technology","ror":"https://ror.org/0400am365","country_code":"BD","type":"education","lineage":["https://openalex.org/I4210147955"]}],"countries":["BD"],"is_corresponding":false,"raw_author_name":"Jannatul Maua","raw_affiliation_strings":["Department of Computer Science and Engineering, Bangladesh University of Business and Technology, Dhaka, Bangladesh"],"raw_orcid":"https://orcid.org/0009-0006-1130-6621","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Bangladesh University of Business and Technology, Dhaka, Bangladesh","institution_ids":["https://openalex.org/I4210147955"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071208302","display_name":"M. F. Mridha","orcid":"https://orcid.org/0000-0001-5738-1631"},"institutions":[{"id":"https://openalex.org/I103434671","display_name":"American International University-Bangladesh","ror":"https://ror.org/02j8ga255","country_code":"BD","type":"education","lineage":["https://openalex.org/I103434671"]}],"countries":["BD"],"is_corresponding":false,"raw_author_name":"M. F. Mridha","raw_affiliation_strings":["American International University–Bangladesh (AIUB), Dhaka, Bangladesh"],"raw_orcid":"https://orcid.org/0000-0001-5738-1631","affiliations":[{"raw_affiliation_string":"American International University–Bangladesh (AIUB), Dhaka, Bangladesh","institution_ids":["https://openalex.org/I103434671"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134503740","display_name":"Jie Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I141591182","display_name":"University of Aizu","ror":"https://ror.org/02pg0e883","country_code":"JP","type":"education","lineage":["https://openalex.org/I141591182"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Jie Huang","raw_affiliation_strings":["School of Computer Science and Engineering, The University of Aizu, Aizuwakamatsu, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, The University of Aizu, Aizuwakamatsu, Japan","institution_ids":["https://openalex.org/I141591182"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005221038","display_name":"Jungpil Shin","orcid":"https://orcid.org/0000-0002-7476-2468"},"institutions":[{"id":"https://openalex.org/I141591182","display_name":"University of Aizu","ror":"https://ror.org/02pg0e883","country_code":"JP","type":"education","lineage":["https://openalex.org/I141591182"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Jungpil Shin","raw_affiliation_strings":["School of Computer Science and Engineering, The University of Aizu, Aizuwakamatsu, Japan"],"raw_orcid":"https://orcid.org/0000-0002-7476-2468","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, The University of Aizu, Aizuwakamatsu, Japan","institution_ids":["https://openalex.org/I141591182"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1750,"currency":"USD","value_usd":1750},"apc_paid":{"value":1750,"currency":"USD","value_usd":1750},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.62479822,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"7","issue":null,"first_page":"4022","last_page":"4035"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.21250000596046448,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.21250000596046448,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.14720000326633453,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.09300000220537186,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.5235999822616577},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3555999994277954},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.31700000166893005},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.30000001192092896},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.258899986743927}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6412000060081482},{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.5235999822616577},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42890000343322754},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3555999994277954},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34209999442100525},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31700000166893005},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.30000001192092896},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.28519999980926514},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2775000035762787},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.258899986743927},{"id":"https://openalex.org/C133462117","wikidata":"https://www.wikidata.org/wiki/Q4929239","display_name":"Data collection","level":2,"score":0.2556999921798706}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/ojcoms.2026.3683927","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2026.3683927","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:a2784a1fe3844e8baf60079b76397073","is_oa":true,"landing_page_url":"https://doaj.org/article/a2784a1fe3844e8baf60079b76397073","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Open Journal of the Communications Society, Vol 7, Pp 4022-4035 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/ojcoms.2026.3683927","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2026.3683927","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W2994839823","https://openalex.org/W3047132966","https://openalex.org/W3102359135","https://openalex.org/W3125745247","https://openalex.org/W3186172578","https://openalex.org/W4206741375","https://openalex.org/W4214699222","https://openalex.org/W4221077261","https://openalex.org/W4286214377","https://openalex.org/W4289655029","https://openalex.org/W4290991406","https://openalex.org/W4292387419","https://openalex.org/W4323262012","https://openalex.org/W4360995354","https://openalex.org/W4366524776","https://openalex.org/W4385336666","https://openalex.org/W4386830046","https://openalex.org/W4388478985","https://openalex.org/W4388948449","https://openalex.org/W4390546166","https://openalex.org/W4391725244","https://openalex.org/W4399422086","https://openalex.org/W4400218606","https://openalex.org/W4400737507","https://openalex.org/W4400976116","https://openalex.org/W4401176811","https://openalex.org/W4401746114","https://openalex.org/W4403243966","https://openalex.org/W4405014478","https://openalex.org/W7127173348","https://openalex.org/W7134036903"],"related_works":[],"abstract_inverted_index":{"Real-time":[0],"anomaly":[1],"detection":[2,13,114,146],"is":[3,173],"a":[4,34,55,120,131],"core":[5],"requirement":[6],"in":[7,102,177],"high-speed":[8,179],"networks,":[9],"yet":[10],"most":[11],"intrusion":[12,199],"systems":[14],"struggle":[15],"with":[16,44,74,140,192],"short-lived":[17],"microbursts":[18],"and":[19,60,63,87,99,107,115,135,147,163],"stealthy":[20],"data":[21,116],"exfiltration,":[22],"especially":[23],"when":[24],"attackers":[25],"hide":[26],"within":[27],"bursty":[28],"traffic.":[29],"This":[30],"paper":[31],"proposes":[32],"NetBurst-X,":[33],"hybrid":[35],"burst\u2013flow":[36],"learning":[37,47],"framework":[38,53,172],"that":[39,91,170],"combines":[40],"burst-aware":[41,189],"traffic":[42,123,190],"statistics":[43],"temporal":[45,193],"deep":[46],"for":[48,111,144,149,175],"NetFlow-based":[49],"security":[50],"analytics.":[51],"The":[52],"introduces":[54],"Burst":[56],"Severity":[57],"Index":[58],"(BSI)":[59],"derives":[61],"ByteRate":[62],"PacketRate":[64],"features":[65],"inside":[66],"dynamic":[67],"sliding":[68],"windows,":[69],"which":[70],"are":[71],"then":[72],"fused":[73],"gated":[75],"recurrent":[76],"unit":[77],"(GRU)":[78],"representations":[79],"of":[80,129,133,138,142,187],"NetFlow":[81],"sequences.":[82],"Experiments":[83],"on":[84],"the":[85,171,185],"NF-UNSW-NB15-V2":[86],"UNSW-NB15":[88],"datasets":[89],"show":[90],"NetBurst-X":[92,125],"outperforms":[93],"Random":[94],"Forest,":[95],"SVM,":[96],"XGBoost,":[97],"BiLSTM,":[98],"CNN-GRU":[100],"baselines":[101],"precision,":[103],"recall,":[104],"F1-score,":[105],"ROC-AUC,":[106],"Matthews":[108],"correlation":[109],"coefficient":[110],"both":[112],"microburst":[113,145],"exfiltration":[117,150],"classification.":[118],"On":[119],"combined":[121],"microburst\u2013exfiltration":[122],"mix,":[124],"achieves":[126],"an":[127,136],"F1-score":[128],"0.950,":[130],"ROC-AUC":[132],"0.973,":[134],"MCC":[137],"0.938,":[139],"F1-scores":[141],"0.963":[143],"0.923":[148],"alone.":[151],"Streaming":[152],"evaluations":[153],"further":[154],"indicate":[155],"low":[156],"inference":[157],"latency":[158],"(27.4":[159],"ms":[160],"per":[161],"batch)":[162],"high":[164],"throughput":[165],"(16":[166],"920":[167],"flows/s),":[168],"demonstrating":[169],"suitable":[174],"deployment":[176],"practical":[178],"network":[180],"environments.":[181],"These":[182],"results":[183],"highlight":[184],"benefit":[186],"combining":[188],"indicators":[191],"flow":[194],"modeling":[195],"to":[196],"improve":[197],"real-time":[198],"detection.":[200]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-04-25T00:00:00"}