{"id":"https://openalex.org/W7123339320","doi":"https://doi.org/10.1109/tnsm.2026.3652529","title":"A Novel Contrastive Loss for Zero-Day Network Intrusion Detection","display_name":"A Novel Contrastive Loss for Zero-Day Network Intrusion Detection","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7123339320","doi":"https://doi.org/10.1109/tnsm.2026.3652529"},"language":null,"primary_location":{"id":"doi:10.1109/tnsm.2026.3652529","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3652529","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2601.09902","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5111368944","display_name":"Jack Wilkie","orcid":null},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Jack Wilkie","raw_affiliation_strings":["Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K"],"affiliations":[{"raw_affiliation_string":"Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031720352","display_name":"Hanan Hindy","orcid":"https://orcid.org/0000-0002-5195-8193"},"institutions":[{"id":"https://openalex.org/I107720978","display_name":"Ain Shams University","ror":"https://ror.org/00cb9w016","country_code":"EG","type":"education","lineage":["https://openalex.org/I107720978"]}],"countries":["EG"],"is_corresponding":false,"raw_author_name":"Hanan Hindy","raw_affiliation_strings":["Faculty of Computer and Information Sciences, Ain Shams University, Cairo, Egypt"],"affiliations":[{"raw_affiliation_string":"Faculty of Computer and Information Sciences, Ain Shams University, Cairo, Egypt","institution_ids":["https://openalex.org/I107720978"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103832127","display_name":"Craig W. Michie","orcid":null},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Craig Michie","raw_affiliation_strings":["Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K"],"affiliations":[{"raw_affiliation_string":"Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043208465","display_name":"Christos Tachtatzis","orcid":"https://orcid.org/0000-0001-9150-6805"},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Christos Tachtatzis","raw_affiliation_strings":["Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K"],"affiliations":[{"raw_affiliation_string":"Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086712853","display_name":"James Irvine","orcid":"https://orcid.org/0000-0003-2078-6517"},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"James Irvine","raw_affiliation_strings":["Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K"],"affiliations":[{"raw_affiliation_string":"Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005039825","display_name":"Robert Atkinson","orcid":"https://orcid.org/0000-0002-6206-2229"},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Robert Atkinson","raw_affiliation_strings":["Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K"],"affiliations":[{"raw_affiliation_string":"Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5111368944"],"corresponding_institution_ids":["https://openalex.org/I181647926"],"apc_list":null,"apc_paid":null,"fwci":45.4255,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.9897535,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"23","issue":null,"first_page":"2064","last_page":"2076"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9577999711036682,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9577999711036682,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0038999998942017555,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.0032999999821186066,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7020999789237976},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5683000087738037},{"id":"https://openalex.org/keywords/attack-model","display_name":"Attack model","score":0.48809999227523804},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4357999861240387},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.413100004196167},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.4027000069618225},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.39329999685287476},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3849000036716461}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8740000128746033},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7020999789237976},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5683000087738037},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5392000079154968},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.48809999227523804},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.46880000829696655},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.46630001068115234},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4357999861240387},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.413100004196167},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.4027000069618225},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.39329999685287476},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3849000036716461},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.37450000643730164},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.3714999854564667},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.3422999978065491},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.3278999924659729},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.31349998712539673},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2957000136375427},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.29089999198913574},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.28119999170303345},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.27799999713897705},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.27300000190734863}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/tnsm.2026.3652529","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3652529","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2601.09902","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2601.09902","pdf_url":"https://arxiv.org/pdf/2601.09902","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:strathprints.strath.ac.uk:95296","is_oa":true,"landing_page_url":"https://strathprints.strath.ac.uk/view/author/1125167.html>","pdf_url":"https://strathprints.strath.ac.uk/95296/1/Wilkie-etal-2026-A-novel-contrastive-loss-for-zero-day-network-intrusion-detection.pdf","source":{"id":"https://openalex.org/S4306402226","display_name":"Strathprints: The University of Strathclyde institutional repository (University of Strathclyde)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I181647926","host_organization_name":"University of Strathclyde","host_organization_lineage":["https://openalex.org/I181647926"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2601.09902","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2601.09902","pdf_url":"https://arxiv.org/pdf/2601.09902","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Machine":[0],"learning":[1],"has":[2],"achieved":[3],"state-of-the-art":[4],"results":[5],"in":[6,51,184],"network":[7],"intrusion":[8],"detection;":[9],"however,":[10],"its":[11],"performance":[12,161],"significantly":[13],"degrades":[14],"when":[15],"confronted":[16],"by":[17],"a":[18,22,92,101],"new":[19],"attack":[20,36,79,150,188],"class\u2014":[21],"zero-day":[23,127,155,187],"attack.":[24],"In":[25],"simple":[26],"terms,":[27],"classical":[28],"machine":[29],"learning-based":[30,116],"approaches":[31,117],"are":[32,210],"adept":[33],"at":[34,88],"identifying":[35],"classes":[37,151],"on":[38,69,169],"which":[39,66,106],"they":[40],"have":[41],"been":[42],"previously":[43],"trained,":[44],"but":[45,122],"struggle":[46],"with":[47,72],"those":[48],"not":[49],"included":[50],"their":[52],"training":[53],"data.":[54],"One":[55],"approach":[56,165],"to":[57,62,77,109,119,126,197],"addressing":[58],"this":[59,86,132],"shortcoming":[60],"is":[61,107,166,195],"utilise":[63],"anomaly":[64,130],"detectors":[65],"train":[67],"exclusively":[68],"benign":[70,138,142],"data":[71],"the":[73,89,111,135,154,170,192],"goal":[74],"of":[75,91,113,137],"generalising":[76],"all":[78],"classes\u2014":[80],"both":[81,141],"known":[82,144,185],"and":[83,143,157,186,208,212],"zero-day.":[84],"However,":[85],"comes":[87],"expense":[90],"prohibitively":[93],"high":[94],"false":[95],"positive":[96],"rate.":[97],"This":[98],"work":[99],"proposes":[100],"novel":[102],"contrastive":[103,115],"loss":[104],"function":[105],"able":[108],"maintain":[110],"advantages":[112],"other":[114,148],"(robustness":[118],"imbalanced":[120],"data)":[121],"can":[123],"also":[124],"generalise":[125],"attacks.":[128],"Unlike":[129],"detectors,":[131],"model":[133],"learns":[134],"distributions":[136],"traffic":[139],"using":[140],"malign":[145],"samples,":[146],"i.e.":[147],"well-known":[149],"(not":[152],"including":[153],"class),":[156],"consequently,":[158],"achieves":[159,175],"significant":[160],"improvements.":[162],"The":[163],"proposed":[164,193],"experimentally":[167],"verified":[168],"Lycos2017":[171],"dataset":[172],"where":[173],"it":[174],"an":[176],"AUROC":[177],"improvement":[178],"of.000065":[179],"and.060883":[180],"over":[181,204],"previous":[182],"models":[183],"detection,":[189],"respectively.":[190],"Finally,":[191],"method":[194],"extended":[196],"open-set":[198],"recognition":[199],"achieving":[200],"OpenAUC":[201],"improvements":[202],"of.170883":[203],"existing":[205],"approaches.The":[206],"implementation":[207],"experiments":[209],"open-sourced":[211],"available":[213],"at:":[214],"https://github.com/jackwilkie/CLOSR":[215]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-04-04T16:13:02.066488","created_date":"2026-01-14T00:00:00"}