{"id":"https://openalex.org/W4414110927","doi":"https://doi.org/10.1109/tifs.2025.3608666","title":"Toward Open-World Network Intrusion Detection via Open Recognition and Inspection","display_name":"Toward Open-World Network Intrusion Detection via Open Recognition and Inspection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414110927","doi":"https://doi.org/10.1109/tifs.2025.3608666"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3608666","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3608666","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5034996492","display_name":"Lei Du","orcid":"https://orcid.org/0009-0000-4175-1693"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Lei Du","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006545795","display_name":"Yuhan Chai","orcid":"https://orcid.org/0000-0003-4332-0234"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuhan Chai","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102735914","display_name":"Yan Jia","orcid":"https://orcid.org/0000-0002-3199-9844"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]},{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yan Jia","raw_affiliation_strings":["College of Computer Science, National University of Defense Technology, Changsha, China","School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"affiliations":[{"raw_affiliation_string":"College of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]},{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091368858","display_name":"Binxing Fang","orcid":"https://orcid.org/0000-0003-0305-2132"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Binxing Fang","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100324585","display_name":"Hao Li","orcid":"https://orcid.org/0000-0002-9045-561X"},"institutions":[{"id":"https://openalex.org/I4210164386","display_name":"Hebei Science and Technology Department","ror":"https://ror.org/05k812a28","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210164386"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Li","raw_affiliation_strings":["Kunlun Digital Technology Company Ltd., Beijing, China","National Key Laboratory of Advanced Communication Networks, Shijiazhuang, Hebei, China"],"affiliations":[{"raw_affiliation_string":"Kunlun Digital Technology Company Ltd., Beijing, China","institution_ids":[]},{"raw_affiliation_string":"National Key Laboratory of Advanced Communication Networks, Shijiazhuang, Hebei, China","institution_ids":["https://openalex.org/I4210164386"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070856186","display_name":"Zhaoquan Gu","orcid":"https://orcid.org/0000-0001-7546-852X"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhaoquan Gu","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5034996492"],"corresponding_institution_ids":["https://openalex.org/I204983213"],"apc_list":null,"apc_paid":null,"fwci":1.4888,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.86806219,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":"20","issue":null,"first_page":"9832","last_page":"9847"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9948999881744385,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9948999881744385,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9818000197410583,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9276000261306763,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5838000178337097},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.5508999824523926},{"id":"https://openalex.org/keywords/sample","display_name":"Sample (material)","score":0.5080000162124634},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5072000026702881},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.4925999939441681},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.47510001063346863},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.45239999890327454},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.42669999599456787},{"id":"https://openalex.org/keywords/open-set","display_name":"Open set","score":0.38929998874664307}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8356999754905701},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7407000064849854},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5838000178337097},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.5508999824523926},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.5080000162124634},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5072000026702881},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.4925999939441681},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.47510001063346863},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.45239999890327454},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4300999939441681},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.42669999599456787},{"id":"https://openalex.org/C42357961","wikidata":"https://www.wikidata.org/wiki/Q213363","display_name":"Open set","level":2,"score":0.38929998874664307},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3846000134944916},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.36550000309944153},{"id":"https://openalex.org/C75294576","wikidata":"https://www.wikidata.org/wiki/Q5165192","display_name":"Contextual image classification","level":3,"score":0.35030001401901245},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.3431999981403351},{"id":"https://openalex.org/C2776151529","wikidata":"https://www.wikidata.org/wiki/Q3045304","display_name":"Object detection","level":3,"score":0.32010000944137573},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3070000112056732},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.3070000112056732},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.30660000443458557},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2732999920845032},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.26840001344680786},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.26409998536109924},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.25859999656677246},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2542000114917755},{"id":"https://openalex.org/C10272871","wikidata":"https://www.wikidata.org/wiki/Q929972","display_name":"Software inspection","level":5,"score":0.2508000135421753}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3608666","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3608666","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":47,"referenced_works":["https://openalex.org/W1917989004","https://openalex.org/W1985987493","https://openalex.org/W2099419573","https://openalex.org/W2119880843","https://openalex.org/W2142889610","https://openalex.org/W2222512263","https://openalex.org/W2518895230","https://openalex.org/W2604589052","https://openalex.org/W2606697812","https://openalex.org/W2767094836","https://openalex.org/W2783398758","https://openalex.org/W2789828921","https://openalex.org/W2901114541","https://openalex.org/W2910711617","https://openalex.org/W2963197901","https://openalex.org/W2963265635","https://openalex.org/W2982673782","https://openalex.org/W3021740526","https://openalex.org/W3099104041","https://openalex.org/W3112311055","https://openalex.org/W3121951581","https://openalex.org/W3122623847","https://openalex.org/W3129218590","https://openalex.org/W3136916314","https://openalex.org/W3147879240","https://openalex.org/W3164964481","https://openalex.org/W3165871547","https://openalex.org/W3180062783","https://openalex.org/W3190895447","https://openalex.org/W3194035167","https://openalex.org/W3206325220","https://openalex.org/W4205270295","https://openalex.org/W4226135488","https://openalex.org/W4231029117","https://openalex.org/W4288061065","https://openalex.org/W4293386228","https://openalex.org/W4313058617","https://openalex.org/W4324007053","https://openalex.org/W4387011098","https://openalex.org/W4388505134","https://openalex.org/W4388624483","https://openalex.org/W4389169163","https://openalex.org/W4390603899","https://openalex.org/W4391558398","https://openalex.org/W4394975949","https://openalex.org/W4401071932","https://openalex.org/W4401508167"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2033914206","https://openalex.org/W2042327336"],"abstract_inverted_index":{"Deep":[0],"learning":[1],"is":[2],"promising":[3],"in":[4,49],"open-world":[5],"network":[6],"intrusion":[7],"detection,":[8],"but":[9],"current":[10],"deep":[11],"learning-based":[12],"methods":[13],"mainly":[14],"focus":[15],"on":[16,179],"open":[17,35,65,89,122,169,218],"recognition":[18,90,170,219],"with":[19,112,121],"properties":[20],"that":[21,199],"may":[22],"not":[23],"always":[24],"hold":[25],"and":[26,38,76,96,152,171,209,220],"significantly":[27],"neglect":[28],"the":[29,118,126,157],"inspection":[30,40,127,138,174,221],"of":[31,129],"unknown":[32,74,106,136,159,172,190,207],"samples,":[33,205,208],"increasing":[34],"space":[36],"risks":[37],"manual":[39],"overhead":[41,128],"for":[42],"deployed":[43],"models.":[44],"To":[45,124],"address":[46],"these":[47],"challenges":[48],"real-world":[50],"environments,":[51],"we":[52,87,134,184],"propose":[53,97],"a":[54,92,98,113,140,145,186],"novel":[55],"system,":[56],"ORI,":[57],"designed":[58],"to":[59,101,156],"tackle":[60],"two":[61],"critical":[62],"tasks:":[63],"1)":[64],"recognition,":[66],"including":[67],"classifying":[68,108],"known":[69,109,203],"class":[70,110,204],"samples":[71,82,104,111,130,149,160,191,212],"while":[72,107],"recognizing":[73],"ones,":[75],"2)":[77],"inspection,":[78],"involving":[79],"further":[80],"inspecting":[81,189],"recognized":[83,131,213],"as":[84,91,105,132,139,150,214],"unknown.":[85],"Specifically,":[86],"reformulate":[88],"binary":[93],"classification":[94],"task":[95],"density-based":[99],"method":[100],"recognize":[102],"low-density":[103],"closed-world":[114],"classifier,":[115],"thereby":[116],"minimizing":[117],"risk":[119],"associated":[120],"spaces.":[123],"reduce":[125],"unknown,":[133,215],"treat":[135],"sample":[137,173],"constrained":[141],"clustering":[142],"task,":[143],"using":[144],"few":[146],"manually":[147],"inspected":[148],"constraints,":[151],"then":[153],"assign":[154],"labels":[155,211],"remaining":[158],"via":[161],"clustering.":[162],"We":[163],"evaluate":[164],"our":[165],"system":[166],"against":[167],"established":[168],"baselines":[175],"through":[176],"extensive":[177],"experiments":[178],"three":[180],"public":[181],"datasets.":[182],"Additionally,":[183],"simulated":[185],"security":[187],"analyst":[188],"labeled":[192],"by":[193],"ORI.":[194],"The":[195],"experimental":[196],"results":[197],"demonstrate":[198],"ORI":[200],"accurately":[201],"classifies":[202],"recognizes":[206],"effectively":[210],"enhancing":[216],"both":[217],"capabilities.":[222]},"counts_by_year":[{"year":2025,"cited_by_count":1}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}