{"id":"https://openalex.org/W7131277809","doi":"https://doi.org/10.1109/tnse.2026.3664905","title":"Enhancing Intrusion Detection via Interpretable Inter-Flow Spatio-Temporal Graphs and Intra-Flow Features","display_name":"Enhancing Intrusion Detection via Interpretable Inter-Flow Spatio-Temporal Graphs and Intra-Flow Features","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7131277809","doi":"https://doi.org/10.1109/tnse.2026.3664905"},"language":null,"primary_location":{"id":"doi:10.1109/tnse.2026.3664905","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2026.3664905","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126671086","display_name":"Xiaowei Zhao","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaowei Zhao","raw_affiliation_strings":["Department of Electronic Engineering, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-0362-4551","affiliations":[{"raw_affiliation_string":"Department of Electronic Engineering, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049069235","display_name":"Mingshu He","orcid":"https://orcid.org/0000-0002-2896-4595"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mingshu He","raw_affiliation_strings":["Department of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2896-4595","affiliations":[{"raw_affiliation_string":"Department of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108077541","display_name":"Liu Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I114234892","display_name":"Beijing Union University","ror":"https://ror.org/01hg31662","country_code":"CN","type":"education","lineage":["https://openalex.org/I114234892"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liu Yang","raw_affiliation_strings":["College of Robotics, Beijing Union University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Robotics, Beijing Union University, Beijing, China","institution_ids":["https://openalex.org/I114234892"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126737894","display_name":"Jianjin Zhao","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianjin Zhao","raw_affiliation_strings":["Department of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-5362-3445","affiliations":[{"raw_affiliation_string":"Department of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5115596576","display_name":"Xiaojuan Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaojuan Wang","raw_affiliation_strings":["Department of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-3490-963X","affiliations":[{"raw_affiliation_string":"Department of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.16494057,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":null,"first_page":"7118","last_page":"7137"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.614799976348877,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.614799976348877,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.09939999878406525,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.02250000089406967,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7303000092506409},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5960999727249146},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.4381999969482422},{"id":"https://openalex.org/keywords/limiting","display_name":"Limiting","score":0.3903000056743622},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.35589998960494995},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.35030001401901245},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3476000130176544},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.3443000018596649},{"id":"https://openalex.org/keywords/object-detection","display_name":"Object detection","score":0.34360000491142273}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7565000057220459},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7303000092506409},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5960999727249146},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5507000088691711},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5321000218391418},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4381999969482422},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.40070000290870667},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.3903000056743622},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.35589998960494995},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.35030001401901245},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3476000130176544},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3443000018596649},{"id":"https://openalex.org/C2776151529","wikidata":"https://www.wikidata.org/wiki/Q3045304","display_name":"Object detection","level":3,"score":0.34360000491142273},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.3434999883174896},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.3407000005245209},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.33379998803138733},{"id":"https://openalex.org/C71139939","wikidata":"https://www.wikidata.org/wiki/Q910194","display_name":"Modal","level":2,"score":0.3264999985694885},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.3140999972820282},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.31349998712539673},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.2987000048160553},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2971000075340271},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.29089999198913574},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.2858000099658966},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.28220000863075256},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.2782999873161316},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.27799999713897705},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.2687000036239624},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.2678999900817871},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.266400009393692},{"id":"https://openalex.org/C75553542","wikidata":"https://www.wikidata.org/wiki/Q178161","display_name":"A priori and a posteriori","level":2,"score":0.2603999972343445},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.25049999356269836}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnse.2026.3664905","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2026.3664905","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.5394496917724609,"id":"https://metadata.un.org/sdg/13","display_name":"Climate action"}],"awards":[{"id":"https://openalex.org/G3904271281","display_name":null,"funder_award_id":"2025KYQD17(BUPT)","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"},{"id":"https://openalex.org/G6027343793","display_name":null,"funder_award_id":"62227805","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6856271369","display_name":null,"funder_award_id":"62502042","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7212251950","display_name":null,"funder_award_id":"62402053","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":73,"referenced_works":["https://openalex.org/W1832693441","https://openalex.org/W2743678626","https://openalex.org/W2789828921","https://openalex.org/W2892556724","https://openalex.org/W2919493784","https://openalex.org/W2953409786","https://openalex.org/W2962703433","https://openalex.org/W2963403784","https://openalex.org/W2974442408","https://openalex.org/W2978116268","https://openalex.org/W2982682021","https://openalex.org/W2996900869","https://openalex.org/W3005097670","https://openalex.org/W3010591882","https://openalex.org/W3017387519","https://openalex.org/W3027747421","https://openalex.org/W3032638893","https://openalex.org/W3048832564","https://openalex.org/W3094686023","https://openalex.org/W3107875173","https://openalex.org/W3116203245","https://openalex.org/W3173170122","https://openalex.org/W3177145331","https://openalex.org/W3186172578","https://openalex.org/W3197150995","https://openalex.org/W3211991114","https://openalex.org/W4226248369","https://openalex.org/W4281623355","https://openalex.org/W4283829196","https://openalex.org/W4285326675","https://openalex.org/W4285810007","https://openalex.org/W4285819445","https://openalex.org/W4288057716","https://openalex.org/W4290874972","https://openalex.org/W4290927694","https://openalex.org/W4296473472","https://openalex.org/W4312401453","https://openalex.org/W4312451223","https://openalex.org/W4312893735","https://openalex.org/W4313396690","https://openalex.org/W4319994093","https://openalex.org/W4377294972","https://openalex.org/W4378417956","https://openalex.org/W4382239858","https://openalex.org/W4383503723","https://openalex.org/W4385245566","https://openalex.org/W4385444612","https://openalex.org/W4386694208","https://openalex.org/W4387108014","https://openalex.org/W4387682066","https://openalex.org/W4388624483","https://openalex.org/W4390346493","https://openalex.org/W4391341774","https://openalex.org/W4391594416","https://openalex.org/W4394566648","https://openalex.org/W4399800581","https://openalex.org/W4401507702","https://openalex.org/W4402035331","https://openalex.org/W4403331669","https://openalex.org/W4403674664","https://openalex.org/W4403937334","https://openalex.org/W4405531485","https://openalex.org/W4407627398","https://openalex.org/W4408222463","https://openalex.org/W4409777845","https://openalex.org/W4410037145","https://openalex.org/W4410255674","https://openalex.org/W4410417702","https://openalex.org/W4410487932","https://openalex.org/W4411345181","https://openalex.org/W4411849800","https://openalex.org/W4413358968","https://openalex.org/W4414463352"],"related_works":[],"abstract_inverted_index":{"The":[0,58,165],"performance":[1,139],"of":[2,13,61,67,104,128,142,172,198],"network":[3],"intrusion":[4,48,210],"detection":[5,49,138,187,211],"systems":[6],"(IDS)":[7],"critically":[8],"depends":[9],"on":[10,22,158],"the":[11,65,79,90,108,137,148],"completeness":[12],"traffic":[14],"feature":[15],"representation.":[16,118],"Existing":[17],"methods":[18],"predominantly":[19],"focus":[20],"either":[21],"intra-flow":[23,56,99],"features":[24,100,111],"(e.g.,":[25],"packet":[26],"length":[27],"sequences)":[28],"or":[29],"single-dimensional":[30],"inter-flow":[31,52,91,132,183,199],"relationships,":[32,133],"limiting":[33],"optimal":[34],"classification.":[35],"To":[36],"address":[37],"this":[38,85],"restriction,":[39],"we":[40],"propose":[41],"IF<inline-formula":[42,150,177],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[43,151,178],"xmlns:xlink=\"http://www.w3.org/1999/xlink\"><tex-math":[44,152,179],"notation=\"LaTeX\">$^{2}$</tex-math></inline-formula>-STG":[45,153],"to":[46,114],"enhance":[47],"via":[50],"interpretable":[51],"spatio-temporal":[53,200],"graphs":[54],"and":[55,130,140],"features.":[57,201],"key":[59],"innovation":[60],"our":[62],"scheme":[63],"is":[64],"construction":[66],"an":[68],"Inter-flow":[69],"Spatio-Temporal":[70],"relationship":[71],"Graph":[72],"(ISTG),":[73],"with":[74],"two-dimensional":[75],"edges":[76],"explicitly":[77],"quantifying":[78],"correlation":[80],"strength":[81],"between":[82],"flows.":[83,106],"On":[84],"basis,":[86],"a":[87,95,116],"GNN":[88],"learns":[89],"context.":[92],"In":[93],"parallel,":[94],"CNN":[96],"extracts":[97],"fine-grained":[98],"from":[101],"raw":[102],"bytes":[103],"individual":[105],"Finally,":[107],"two":[109],"modal":[110],"are":[112],"fused":[113],"acquire":[115],"comprehensive":[117],"This":[119,202],"representation":[120],"can":[121],"effectively":[122],"capture":[123],"both":[124],"intrinsic":[125],"behavior":[126],"patterns":[127],"flows":[129],"contextual":[131],"thereby":[134],"significantly":[135],"enhancing":[136],"robustness":[141],"model.":[143],"Experimental":[144],"results":[145],"show":[146],"that":[147],"proposed":[149],"achieves":[154],"over":[155],"99%":[156],"accuracy":[157,188],"three":[159],"real-world":[160],"datasets,":[161,194],"outperforming":[162],"existing":[163],"approaches.":[164],"constructed":[166],"ISTG":[167],"provides":[168],"explicit":[169],"visual":[170],"interpretation":[171],"flow":[173],"dependencies.":[174],"More":[175],"importantly,":[176],"notation=\"LaTeX\">$^{2}$</tex-math></inline-formula>-STG-Inter,":[180],"using":[181],"only":[182],"features,":[184],"maintains":[185],"97.78%":[186],"in":[189],"cross-dataset":[190],"tests":[191],"involving":[192],"time-disparate":[193],"validating":[195],"superior":[196],"generalization":[197],"advantage":[203],"renders":[204],"it":[205],"particularly":[206],"promising":[207],"for":[208],"practical":[209],"applications.":[212]},"counts_by_year":[],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2026-02-25T00:00:00"}