{"id":"https://openalex.org/W4401071932","doi":"https://doi.org/10.1109/tifs.2024.3434647","title":"Human-in-the-Loop Cyber Intrusion Detection Using Active Learning","display_name":"Human-in-the-Loop Cyber Intrusion Detection Using Active Learning","publication_year":2024,"publication_date":"2024-01-01","ids":{"openalex":"https://openalex.org/W4401071932","doi":"https://doi.org/10.1109/tifs.2024.3434647"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2024.3434647","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3434647","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/tifs.2024.3434647","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077076300","display_name":"Yeongwoo Kim","orcid":"https://orcid.org/0009-0002-6228-9332"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Yeongwoo Kim","raw_affiliation_strings":["Division of Network and Systems Engineering, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0009-0002-6228-9332","affiliations":[{"raw_affiliation_string":"Division of Network and Systems Engineering, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086721943","display_name":"Gy\u00f6rgy D\u00e1n","orcid":"https://orcid.org/0000-0002-4876-0223"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Gy\u00f6rgy D\u00e1n","raw_affiliation_strings":["Division of Network and Systems Engineering, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-4876-0223","affiliations":[{"raw_affiliation_string":"Division of Network and Systems Engineering, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5081500464","display_name":"Quanyan Zhu","orcid":"https://orcid.org/0000-0002-0008-2953"},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Quanyan Zhu","raw_affiliation_strings":["Department of Electrical and Computer Engineering, New York University, New York, NY, USA"],"raw_orcid":"https://orcid.org/0000-0002-0008-2953","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, New York University, New York, NY, USA","institution_ids":["https://openalex.org/I57206974"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":{"value":1381,"currency":"EUR","value_usd":1489},"fwci":2.0966,"has_fulltext":false,"cited_by_count":10,"citation_normalized_percentile":{"value":0.86975533,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":"19","issue":null,"first_page":"8658","last_page":"8672"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8652990460395813},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7652914524078369},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.6470763683319092},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6273331642150879},{"id":"https://openalex.org/keywords/human-in-the-loop","display_name":"Human-in-the-loop","score":0.6000240445137024},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.578752338886261},{"id":"https://openalex.org/keywords/prioritization","display_name":"Prioritization","score":0.5653908252716064},{"id":"https://openalex.org/keywords/hidden-markov-model","display_name":"Hidden Markov model","score":0.5390869975090027},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5054304599761963},{"id":"https://openalex.org/keywords/alarm","display_name":"ALARM","score":0.4845994710922241},{"id":"https://openalex.org/keywords/false-alarm","display_name":"False alarm","score":0.4820307493209839},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.47412610054016113},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.44740912318229675},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.4416464567184448},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4385470747947693},{"id":"https://openalex.org/keywords/misuse-detection","display_name":"Misuse detection","score":0.43685758113861084},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3091575503349304}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8652990460395813},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7652914524078369},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.6470763683319092},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6273331642150879},{"id":"https://openalex.org/C2780626000","wikidata":"https://www.wikidata.org/wiki/Q5936775","display_name":"Human-in-the-loop","level":2,"score":0.6000240445137024},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.578752338886261},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.5653908252716064},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.5390869975090027},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5054304599761963},{"id":"https://openalex.org/C2779119184","wikidata":"https://www.wikidata.org/wiki/Q294350","display_name":"ALARM","level":2,"score":0.4845994710922241},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.4820307493209839},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.47412610054016113},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.44740912318229675},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.4416464567184448},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4385470747947693},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.43685758113861084},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3091575503349304},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.0},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C146978453","wikidata":"https://www.wikidata.org/wiki/Q3798668","display_name":"Aerospace engineering","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C159985019","wikidata":"https://www.wikidata.org/wiki/Q181790","display_name":"Composite material","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2024.3434647","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3434647","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/tifs.2024.3434647","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3434647","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6662014941","display_name":null,"funder_award_id":"2022-06725","funder_id":"https://openalex.org/F4320322887","funder_display_name":"The Research Council"}],"funders":[{"id":"https://openalex.org/F4320322887","display_name":"The Research Council","ror":"https://ror.org/03tcppy59"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W13439346","https://openalex.org/W1492251543","https://openalex.org/W1675167203","https://openalex.org/W1995716850","https://openalex.org/W2002644365","https://openalex.org/W2077397896","https://openalex.org/W2099111195","https://openalex.org/W2106188980","https://openalex.org/W2146092999","https://openalex.org/W2146440914","https://openalex.org/W2258515346","https://openalex.org/W2299537556","https://openalex.org/W2304187572","https://openalex.org/W2473965074","https://openalex.org/W2520200210","https://openalex.org/W2522792437","https://openalex.org/W2524056220","https://openalex.org/W2739823785","https://openalex.org/W2755588949","https://openalex.org/W2792721951","https://openalex.org/W2802236629","https://openalex.org/W2888728157","https://openalex.org/W2893240802","https://openalex.org/W2902799529","https://openalex.org/W2903912339","https://openalex.org/W2907590737","https://openalex.org/W2920592693","https://openalex.org/W3217253123","https://openalex.org/W4205463438","https://openalex.org/W4256482217","https://openalex.org/W4309675214","https://openalex.org/W4312495508","https://openalex.org/W4391540746","https://openalex.org/W4402264324","https://openalex.org/W6837924124"],"related_works":["https://openalex.org/W2106474518","https://openalex.org/W2369534771","https://openalex.org/W3036013726","https://openalex.org/W2337148208","https://openalex.org/W2369225823","https://openalex.org/W2111890927","https://openalex.org/W317929111","https://openalex.org/W1600113531","https://openalex.org/W2360933353","https://openalex.org/W4311569631"],"abstract_inverted_index":{"Timely":[0],"detection":[1,31,164,177],"of":[2,70,96,125],"cyber":[3],"attacks":[4],"is":[5,22,46,50],"essential":[6],"for":[7,64],"minimizing":[8,162],"attack":[9,67],"impact,":[10],"but":[11,44],"it":[12,45,49],"requires":[13],"accurate":[14],"real-time":[15],"situational":[16],"awareness":[17],"(SA).":[18],"In":[19,57],"practice,":[20],"SA":[21],"hampered":[23],"by":[24,39,178],"frequent":[25],"false":[26,195],"alerts":[27,38,54,80,84,153],"from":[28],"anomaly-based":[29],"intrusion":[30],"systems":[32],"(IDS),":[33],"causing":[34],"alarm":[35],"fatigue.":[36],"Investigating":[37],"humans":[40],"can":[41],"enhance":[42],"SA,":[43],"resource-intensive":[47],"and":[48,85,98,131,141,158],"often":[51],"unclear":[52],"which":[53,78],"to":[55,92,148,176,180,183],"prioritize.":[56],"this":[58],"paper,":[59],"we":[60,132],"propose":[61,133],"a":[62,103,107,184,190],"framework":[63],"optimizing":[65],"human-in-the-loop":[66],"detection,":[68],"consisting":[69],"three":[71],"key":[72],"components:":[73],"1)":[74],"dynamic":[75],"alert":[76,89,135],"prioritization,":[77],"ranks":[79],"based":[81,109,154],"on":[82,110,155],"previous":[83],"investigations,":[86,160],"2)":[87],"human":[88],"investigation,":[90],"referring":[91],"the":[93,121,150,163,174],"manual":[94],"analysis":[95],"alerts,":[97,112],"3)":[99],"sequential":[100],"hypothesis":[101,108],"testing,":[102],"method":[104],"that":[105,124,169],"confirms":[106],"incoming":[111],"with":[113],"pruned":[114],"hidden":[115],"Markov":[116],"models":[117],"(HMMs).":[118],"We":[119],"formulate":[120],"problem":[122],"as":[123],"active":[126],"learning":[127],"in":[128],"an":[129],"HMM,":[130],"two":[134],"prioritization":[136],"policies,":[137],"namely":[138],"Max":[139,142],"Ratio":[140],"KL.":[143],"The":[144],"proposed":[145,171],"policies":[146,172],"aim":[147],"select":[149],"most":[151],"informative":[152],"historical":[156],"data":[157],"prior":[159],"thereby":[161],"time.":[165],"Simulation":[166],"results":[167],"show":[168],"our":[170],"reduce":[173],"time":[175,193],"up":[179],"79%":[181],"compared":[182],"static":[185],"baseline":[186],"policy,":[187],"while":[188],"maintaining":[189],"target":[191],"mean":[192],"between":[194],"detections":[196],"(MTBFD).":[197]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":1}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}