{"id":"https://openalex.org/W4412939887","doi":"https://doi.org/10.1109/tpami.2025.3595671","title":"Disentangled Dynamic Intrusion Detection","display_name":"Disentangled Dynamic Intrusion Detection","publication_year":2025,"publication_date":"2025-08-04","ids":{"openalex":"https://openalex.org/W4412939887","doi":"https://doi.org/10.1109/tpami.2025.3595671","pmid":"https://pubmed.ncbi.nlm.nih.gov/40758519"},"language":"en","primary_location":{"id":"doi:10.1109/tpami.2025.3595671","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tpami.2025.3595671","pdf_url":null,"source":{"id":"https://openalex.org/S199944782","display_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","issn_l":"0162-8828","issn":["0162-8828","1939-3539","2160-9292"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","pubmed"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Chenyang Qiu","orcid":"https://orcid.org/0000-0003-2332-8386"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Chenyang Qiu","raw_affiliation_strings":["National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China"],"affiliations":[{"raw_affiliation_string":"National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020360628","display_name":"Guoshun Nan","orcid":"https://orcid.org/0000-0002-1987-2736"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guoshun Nan","raw_affiliation_strings":["National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China"],"affiliations":[{"raw_affiliation_string":"National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054462623","display_name":"Hongrui Xia","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongrui Xia","raw_affiliation_strings":["National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China"],"affiliations":[{"raw_affiliation_string":"National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083852847","display_name":"Zheng-Yu Weng","orcid":"https://orcid.org/0000-0003-1581-3920"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheng Weng","raw_affiliation_strings":["National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China"],"affiliations":[{"raw_affiliation_string":"National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100634477","display_name":"Xueting Wang","orcid":"https://orcid.org/0000-0002-1005-3072"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xueting Wang","raw_affiliation_strings":["National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China"],"affiliations":[{"raw_affiliation_string":"National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047030842","display_name":"Meng Shen","orcid":"https://orcid.org/0000-0002-1867-0972"},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Meng Shen","raw_affiliation_strings":["Beijing Institute of Technology, Beijing, China"],"affiliations":[{"raw_affiliation_string":"Beijing Institute of Technology, Beijing, China","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xiaofeng Tao","orcid":"https://orcid.org/0000-0001-9518-1622"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaofeng Tao","raw_affiliation_strings":["National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China"],"affiliations":[{"raw_affiliation_string":"National Engineering Research Center for Mobile Network Technologies, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100361857","display_name":"Jun Liu","orcid":"https://orcid.org/0000-0002-4365-4165"},"institutions":[{"id":"https://openalex.org/I67415387","display_name":"Lancaster University","ror":"https://ror.org/04f2nsd36","country_code":"GB","type":"education","lineage":["https://openalex.org/I67415387"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Jun Liu","raw_affiliation_strings":["School of Computing and Communications, Lancaster University, Lancaster, U.K","School of Computing and Communications, Lancaster University, United Kingdom"],"affiliations":[{"raw_affiliation_string":"School of Computing and Communications, Lancaster University, Lancaster, U.K","institution_ids":["https://openalex.org/I67415387"]},{"raw_affiliation_string":"School of Computing and Communications, Lancaster University, United Kingdom","institution_ids":["https://openalex.org/I67415387"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":8,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I139759216"],"apc_list":null,"apc_paid":null,"fwci":11.2049,"has_fulltext":true,"cited_by_count":8,"citation_normalized_percentile":{"value":0.98340671,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"47","issue":"11","first_page":"10528","last_page":"10545"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9868000149726868,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9868000149726868,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9745000004768372,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6803060173988342},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6570494771003723},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5334845781326294},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3913632333278656},{"id":"https://openalex.org/keywords/computer-vision","display_name":"Computer vision","score":0.3555309772491455},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.32214146852493286}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6803060173988342},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6570494771003723},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5334845781326294},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3913632333278656},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.3555309772491455},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32214146852493286}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/tpami.2025.3595671","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tpami.2025.3595671","pdf_url":null,"source":{"id":"https://openalex.org/S199944782","display_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","issn_l":"0162-8828","issn":["0162-8828","1939-3539","2160-9292"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","raw_type":"journal-article"},{"id":"pmid:40758519","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/40758519","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE transactions on pattern analysis and machine intelligence","raw_type":null},{"id":"pmh:oai:eprints.lancs.ac.uk:234916","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4306401916","display_name":"Lancaster EPrints (Lancaster University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67415387","host_organization_name":"Lancaster University","host_organization_lineage":["https://openalex.org/I67415387"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":75,"referenced_works":["https://openalex.org/W1480909796","https://openalex.org/W1574447377","https://openalex.org/W2054626033","https://openalex.org/W2099831572","https://openalex.org/W2150134853","https://openalex.org/W2166858086","https://openalex.org/W2282821441","https://openalex.org/W2587847678","https://openalex.org/W2594644573","https://openalex.org/W2604105233","https://openalex.org/W2755038437","https://openalex.org/W2755619129","https://openalex.org/W2787322429","https://openalex.org/W2820900234","https://openalex.org/W2901504064","https://openalex.org/W2912207205","https://openalex.org/W2914767245","https://openalex.org/W2921019731","https://openalex.org/W2951086007","https://openalex.org/W2963943197","https://openalex.org/W2989701968","https://openalex.org/W2996847713","https://openalex.org/W2997686727","https://openalex.org/W2998313947","https://openalex.org/W3003685271","https://openalex.org/W3005097670","https://openalex.org/W3016987480","https://openalex.org/W3021740526","https://openalex.org/W3045601687","https://openalex.org/W3045734364","https://openalex.org/W3086583298","https://openalex.org/W3093410479","https://openalex.org/W3093580248","https://openalex.org/W3096030871","https://openalex.org/W3102359135","https://openalex.org/W3107763055","https://openalex.org/W3119802848","https://openalex.org/W3138819813","https://openalex.org/W3162768636","https://openalex.org/W3162956350","https://openalex.org/W3165838961","https://openalex.org/W3167595471","https://openalex.org/W3181932393","https://openalex.org/W3188650517","https://openalex.org/W3190450813","https://openalex.org/W3190730109","https://openalex.org/W3196585642","https://openalex.org/W3198264701","https://openalex.org/W3205249428","https://openalex.org/W3208773001","https://openalex.org/W4210587242","https://openalex.org/W4211212836","https://openalex.org/W4225697716","https://openalex.org/W4230962939","https://openalex.org/W4244895750","https://openalex.org/W4281384964","https://openalex.org/W4281385944","https://openalex.org/W4289860834","https://openalex.org/W4294068600","https://openalex.org/W4319778765","https://openalex.org/W4376478409","https://openalex.org/W4378805624","https://openalex.org/W4379251290","https://openalex.org/W4382203447","https://openalex.org/W4385009227","https://openalex.org/W4385571676","https://openalex.org/W4385815483","https://openalex.org/W4385976127","https://openalex.org/W4386066404","https://openalex.org/W4392693636","https://openalex.org/W4392947168","https://openalex.org/W4402716375","https://openalex.org/W4404534210","https://openalex.org/W4407468113","https://openalex.org/W4407782777"],"related_works":["https://openalex.org/W2772917594","https://openalex.org/W2036807459","https://openalex.org/W2058170566","https://openalex.org/W2755342338","https://openalex.org/W2166024367","https://openalex.org/W3116076068","https://openalex.org/W2229312674","https://openalex.org/W2951359407","https://openalex.org/W2079911747","https://openalex.org/W1969923398"],"abstract_inverted_index":{"Network-based":[0],"intrusion":[1,54,93,118,244],"detection":[2,94,119,245],"system":[3],"(NIDS)":[4],"monitors":[5],"network":[6,166],"traffic":[7,127,191],"for":[8,36,42,96,168],"malicious":[9],"activities,":[10],"formingthe":[11],"frontline":[12],"defense":[13],"against":[14],"increasing":[15],"attacks":[16,32,258],"over":[17,295],"information":[18,200,207],"infrastructures.":[19],"Although":[20],"promising,":[21],"our":[22,234,279,285],"quantitative":[23],"analysis":[24],"shows":[25,299],"that":[26,75,162,268],"existing":[27],"methods":[28],"perform":[29,50],"inconsistently":[30],"in":[31,52,63,71,171,189,201,226,259,292,301],"(e.g.,":[33,56],"18%":[34],"F1":[35,41],"the":[37,76,122,150,165,176,186,211,216,231,238,276],"MITM":[38],"and":[39,49,65,111,136,208,222,265,298,304],"93%":[40],"DDoS":[43],"by":[44,129],"a":[45,91,104,112,130,157,288],"GCN-based":[46],"state-of-the-art":[47],"method),":[48],"poorly":[51],"few-shot":[53,190,266,283],"detections":[55],"dramatically":[57],"drops":[58,66],"from":[59,67],"91%":[60],"to":[61,69,88,148,184,204,214],"36%":[62],"3D-IDS,":[64],"89%":[68],"20%":[70],"E-GraphSAGE).":[72],"We":[73],"reveal":[74],"underlying":[77],"cause":[78],"is":[79],"entangled":[80,187],"distributions":[81],"of":[82,138,233,278],"flow":[83],"features.":[84,140,152],"This":[85],"motivates":[86],"us":[87],"propose":[89],"DIDS-MFL,":[90,252],"disentangled":[92,147,242],"approach":[95],"various":[97,247,257],"scenarios.":[98,249],"DIDS-MFL":[99,236,286],"involves":[100,179],"two":[101],"key":[102],"components:":[103],"double":[105],"Disentanglement-based":[106],"Intrusion":[107],"Detection":[108],"System":[109],"(DIDS)":[110],"plug-and-play":[113],"Multi-scale":[114],"Few-shot":[115],"Learning-based":[116],"(MFL)":[117],"module.":[120],"Specifically,":[121],"proposed":[123,177,280],"DIDS":[124,154],"first":[125,197,239],"disentangles":[126],"features":[128,143],"non-parameterized":[131],"optimization,":[132],"automatically":[133],"differentiating":[134],"tens":[135],"hundreds":[137],"complex":[139],"Such":[141],"differentiated":[142],"will":[144],"be":[145],"further":[146],"highlight":[149,215],"attack-specific":[151,206,217],"Our":[153],"additionally":[155],"uses":[156],"novel":[158],"graph":[159],"diffusion":[160],"method":[161],"dynamically":[163],"fuses":[164,221],"topology":[167],"spatial-temporal":[169],"aggregation":[170],"evolving":[172],"data":[173],"streams.":[174],"Furthermore,":[175],"MFL":[178,196,220],"an":[180,227],"alternating":[181],"optimization":[182],"framework":[183],"address":[185],"representations":[188],"threats":[192,267],"with":[193,251],"rigorous":[194],"derivation.":[195],"captures":[198],"multi-scale":[199],"latent":[202],"space":[203],"distinguish":[205],"then":[209],"optimizes":[210],"disentanglement":[212],"term":[213],"information.":[218],"Finally,":[219],"alternately":[223],"solves":[224],"them":[225],"end-to-end":[228],"way.":[229],"To":[230],"best":[232],"knowledge,":[235],"takes":[237],"step":[240],"toward":[241],"dynamic":[243],"under":[246],"attack":[248],"Equipped":[250],"administrators":[253],"can":[254],"effectively":[255],"identify":[256],"encrypted":[260],"traffic,":[261],"including":[262],"known,":[263],"unknown,":[264],"are":[269],"not":[270],"easily":[271],"detected.":[272],"Comprehensive":[273],"experiments":[274],"show":[275],"superiority":[277],"DIDS-MFL.":[281],"For":[282],"NIDS,":[284],"achieves":[287],"71.91%":[289],"-125.19%":[290],"improvement":[291],"average":[293],"F1-score":[294],"14":[296],"baselines":[297,303],"versatility":[300],"multiple":[302,305],"tasks.":[306]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":7}],"updated_date":"2026-04-14T08:04:32.555800","created_date":"2025-10-10T00:00:00"}