{"id":"https://openalex.org/W4414229918","doi":"https://doi.org/10.1109/tnsm.2025.3609854","title":"A Unified Framework for Hybrid Network Intrusion Detection","display_name":"A Unified Framework for Hybrid Network Intrusion Detection","publication_year":2025,"publication_date":"2025-09-16","ids":{"openalex":"https://openalex.org/W4414229918","doi":"https://doi.org/10.1109/tnsm.2025.3609854"},"language":"en","primary_location":{"id":"doi:10.1109/tnsm.2025.3609854","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2025.3609854","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Yan Wang","orcid":"https://orcid.org/0009-0000-3912-5378"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yan Wang","raw_affiliation_strings":["School of Computer Science and Engineering (School of Cyber Security), University of Electronic Science and Technology of China, Chengdu, Sichuan, China","School of Computer Science and Engineering School of Cyber Security, University of Electronic Science and Technology of China, Chengdu, Sichuan, China"],"raw_orcid":"https://orcid.org/0009-0000-3912-5378","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering (School of Cyber Security), University of Electronic Science and Technology of China, Chengdu, Sichuan, China","institution_ids":["https://openalex.org/I150229711"]},{"raw_affiliation_string":"School of Computer Science and Engineering School of Cyber Security, University of Electronic Science and Technology of China, Chengdu, Sichuan, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101425388","display_name":"Sheng Cao","orcid":"https://orcid.org/0000-0002-0929-9067"},"institutions":[{"id":"https://openalex.org/I4210131342","display_name":"Yibin University","ror":"https://ror.org/03w8m2977","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210131342"]},{"id":"https://openalex.org/I64852412","display_name":"Sichuan University of Science and Engineering","ror":"https://ror.org/053fzma23","country_code":"CN","type":"education","lineage":["https://openalex.org/I64852412"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sheng Cao","raw_affiliation_strings":["School of Computer Science and Engineering (School of Cyber Security), the Yibin Park, the Sichuan–Chongqing Co-construction Key Laboratory of Digital Economy Intelligence and Security, and the Blockchain Storage and Trade Engineering Center of Sichuan province, University of Electronic Science and Technology of China, Chengdu, Sichuan, China","School of Computer Science and Engineering School of Cyber Security, Yibin Park, China"],"raw_orcid":"https://orcid.org/0000-0002-0929-9067","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering (School of Cyber Security), the Yibin Park, the Sichuan–Chongqing Co-construction Key Laboratory of Digital Economy Intelligence and Security, and the Blockchain Storage and Trade Engineering Center of Sichuan province, University of Electronic Science and Technology of China, Chengdu, Sichuan, China","institution_ids":["https://openalex.org/I64852412"]},{"raw_affiliation_string":"School of Computer Science and Engineering School of Cyber Security, Yibin Park, China","institution_ids":["https://openalex.org/I4210131342"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034762138","display_name":"Jingwei Li","orcid":"https://orcid.org/0000-0001-8457-0454"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jingwei Li","raw_affiliation_strings":["School of Computer Science and Engineering (School of Cyber Security), University of Electronic Science and Technology of China, Chengdu, Sichuan, China","School of Computer Science and Engineering School of Cyber Security, University of Electronic Science and Technology of China, Chengdu, Sichuan, China"],"raw_orcid":"https://orcid.org/0000-0001-8457-0454","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering (School of Cyber Security), University of Electronic Science and Technology of China, Chengdu, Sichuan, China","institution_ids":["https://openalex.org/I150229711"]},{"raw_affiliation_string":"School of Computer Science and Engineering School of Cyber Security, University of Electronic Science and Technology of China, Chengdu, Sichuan, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100780268","display_name":"Xiaosong Zhang","orcid":"https://orcid.org/0000-0001-9886-1412"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]},{"id":"https://openalex.org/I4210137766","display_name":"Institute for Advanced Study","ror":"https://ror.org/03xg85719","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210137766"]}],"countries":["CN","DE"],"is_corresponding":false,"raw_author_name":"Xiaosong Zhang","raw_affiliation_strings":["School of Computer Science and Engineering (School of Cyber Security) and the Shenzhen Institute for Advanced Study, University of Electronic Science and Technology of China, Chengdu, Sichuan, China","School of Computer Science and Engineering School of Cyber Security and Shenzhen Institute for Advanced Study, China"],"raw_orcid":"https://orcid.org/0000-0001-9886-1412","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering (School of Cyber Security) and the Shenzhen Institute for Advanced Study, University of Electronic Science and Technology of China, Chengdu, Sichuan, China","institution_ids":["https://openalex.org/I150229711","https://openalex.org/I4210137766"]},{"raw_affiliation_string":"School of Computer Science and Engineering School of Cyber Security and Shenzhen Institute for Advanced Study, China","institution_ids":["https://openalex.org/I4210137766"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.3733,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.84006926,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":"22","issue":"6","first_page":"5328","last_page":"5347"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9811999797821045,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9611999988555908,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7113999724388123},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6682999730110168},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.6510999798774719},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.5842000246047974},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.49559998512268066},{"id":"https://openalex.org/keywords/cascade","display_name":"Cascade","score":0.43309998512268066},{"id":"https://openalex.org/keywords/misuse-detection","display_name":"Misuse detection","score":0.40400001406669617},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.3582000136375427}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8712999820709229},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7113999724388123},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6682999730110168},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.6510999798774719},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.5842000246047974},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.49559998512268066},{"id":"https://openalex.org/C34146451","wikidata":"https://www.wikidata.org/wiki/Q5048094","display_name":"Cascade","level":2,"score":0.43309998512268066},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.40860000252723694},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.40400001406669617},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38659998774528503},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3684999942779541},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3582000136375427},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.350600004196167},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3479999899864197},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3179999887943268},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.31470000743865967},{"id":"https://openalex.org/C2780980858","wikidata":"https://www.wikidata.org/wiki/Q110022","display_name":"Dual (grammatical number)","level":2,"score":0.30979999899864197},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.30379998683929443},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2980000078678131},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.2849999964237213},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.28130000829696655},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.265500009059906},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.25279998779296875}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2025.3609854","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2025.3609854","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1594973751","display_name":null,"funder_award_id":"U2336204","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G1669507345","display_name":null,"funder_award_id":"2024NSFSC0004","funder_id":"https://openalex.org/F4320333335","funder_display_name":"Sichuan Province Science and Technology Support Program"},{"id":"https://openalex.org/G7904947715","display_name":null,"funder_award_id":"2023ZHJY0006","funder_id":"https://openalex.org/F4320336596","funder_display_name":"Key Research and Development Program of Sichuan Province"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320333335","display_name":"Sichuan Province Science and Technology Support Program","ror":null},{"id":"https://openalex.org/F4320336596","display_name":"Key Research and Development Program of Sichuan Province","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":46,"referenced_works":["https://openalex.org/W2066832805","https://openalex.org/W2789828921","https://openalex.org/W2963197901","https://openalex.org/W2963748489","https://openalex.org/W3039274670","https://openalex.org/W3040266635","https://openalex.org/W3131541364","https://openalex.org/W3164321464","https://openalex.org/W3165871547","https://openalex.org/W3171926364","https://openalex.org/W3177795942","https://openalex.org/W3184553632","https://openalex.org/W3186172578","https://openalex.org/W3197983285","https://openalex.org/W3198395019","https://openalex.org/W3205985117","https://openalex.org/W3216768217","https://openalex.org/W4220744793","https://openalex.org/W4280582067","https://openalex.org/W4285184946","https://openalex.org/W4288061885","https://openalex.org/W4293195505","https://openalex.org/W4293811873","https://openalex.org/W4295219739","https://openalex.org/W4297990221","https://openalex.org/W4306760877","https://openalex.org/W4309194643","https://openalex.org/W4309939034","https://openalex.org/W4312433903","https://openalex.org/W4312762894","https://openalex.org/W4313591247","https://openalex.org/W4319079731","https://openalex.org/W4322493038","https://openalex.org/W4322588479","https://openalex.org/W4352976871","https://openalex.org/W4384407578","https://openalex.org/W4385246573","https://openalex.org/W4387068365","https://openalex.org/W4388188747","https://openalex.org/W4388758247","https://openalex.org/W4392683337","https://openalex.org/W4397000408","https://openalex.org/W4399422086","https://openalex.org/W4400391391","https://openalex.org/W4405270955","https://openalex.org/W4407403176"],"related_works":[],"abstract_inverted_index":{"Lately,":[0],"hybrid":[1],"network":[2],"intrusion":[3],"detection":[4,161],"systems":[5],"(HNIDSs)":[6],"have":[7],"progressed":[8],"significantly.":[9],"Through":[10],"the":[11,61,73,103,107,112,128,141,151,154,182,189,192],"cascade":[12],"or":[13],"ensemble":[14],"of":[15,37,153,191],"multiple":[16],"machine":[17],"learning":[18,179],"models,":[19,56],"HNIDS":[20,35],"benefits":[21],"from":[22],"each":[23],"model":[24],"and":[25,43,75,84,162,164,195],"achieves":[26],"better":[27],"performance.":[28],"A":[29],"widely":[30],"adopted":[31],"framework":[32,95,194],"for":[33,160],"designing":[34],"consists":[36],"two":[38,79,123],"models:":[39],"a":[40,93],"misuse":[41,62,74,129],"detector":[42,63,105],"an":[44,166],"anomaly":[45,76,104],"detector.":[46],"However,":[47],"(1)":[48],"benign":[49],"traffic":[50],"must":[51],"be":[52],"analyzed":[53],"by":[54],"both":[55],"reducing":[57],"inference":[58,116],"speed;":[59],"(2)":[60],"performs":[64],"dual":[65],"functionalities,":[66],"leading":[67],"to":[68,126,171,180],"suboptimal":[69],"accuracy;":[70],"(3)":[71],"deploying":[72],"detectors":[77],"on":[78],"devices":[80],"introduces":[81],"substantial":[82],"latency":[83],"restricts":[85],"distributed":[86,147],"deployment.":[87,148],"In":[88],"this":[89],"paper,":[90],"we":[91,101,121,138,157],"propose":[92,165],"unified":[94],"called":[96],"AUF.":[97],"To":[98,118,135,149],"solve":[99,119,136],"(1),":[100],"deploy":[102],"in":[106],"first":[108],"stage":[109],"rather":[110],"than":[111],"second,":[113],"which":[114],"improves":[115],"speed.":[117],"(2),":[120],"employ":[122],"independent":[124],"models":[125,143],"implement":[127,158],"detector\u2019s":[130],"functionality,":[131],"enhancing":[132],"overall":[133],"accuracy.":[134],"(3),":[137],"ensure":[139],"that":[140],"different":[142],"operate":[144],"independently,":[145],"supporting":[146],"demonstrate":[150],"effectiveness":[152,190],"AUF":[155,193],"framework,":[156],"XGBoost":[159],"classification":[163],"adaptive":[167],"k-nearest":[168],"neighborhood-based":[169],"approach":[170],"achieve":[172],"accurate":[173],"discrimination.":[174],"We":[175],"also":[176],"introduce":[177],"zero-shot":[178],"showcase":[181],"framework\u2019s":[183],"customized":[184],"model.":[185],"Extensive":[186],"experiments":[187],"validate":[188],"methods.":[196],"Our":[197],"code":[198],"is":[199],"available":[200],"at":[201],"https://github.com/wangyann2000/A-Unified-Framework-for-Hybrid-Network-Intrusion-Detection.":[202]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}