{"id":"https://openalex.org/W4387951913","doi":"https://doi.org/10.1109/tsc.2023.3327822","title":"Rule-Based Detection of Anomalous Patterns in Device Behavior for Explainable IoT Security","display_name":"Rule-Based Detection of Anomalous Patterns in Device Behavior for Explainable IoT Security","publication_year":2023,"publication_date":"2023-10-26","ids":{"openalex":"https://openalex.org/W4387951913","doi":"https://doi.org/10.1109/tsc.2023.3327822"},"language":"en","primary_location":{"id":"doi:10.1109/tsc.2023.3327822","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tsc.2023.3327822","pdf_url":null,"source":{"id":"https://openalex.org/S204223317","display_name":"IEEE Transactions on Services Computing","issn_l":"1939-1374","issn":["1939-1374","2372-0204"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Services Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076708603","display_name":"Gianni Costa","orcid":"https://orcid.org/0000-0003-2267-9280"},"institutions":[{"id":"https://openalex.org/I4210155236","display_name":"National Research Council","ror":"https://ror.org/04zaypm56","country_code":"IT","type":"funder","lineage":["https://openalex.org/I4210155236"]},{"id":"https://openalex.org/I3005160176","display_name":"Institute for High Performance Computing and Networking","ror":"https://ror.org/04r5fge26","country_code":"IT","type":"facility","lineage":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Gianni Costa","raw_affiliation_strings":["Institute for High Performance Computing and Networking, National Research Council, Rende, Italy"],"affiliations":[{"raw_affiliation_string":"Institute for High Performance Computing and Networking, National Research Council, Rende, Italy","institution_ids":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049657219","display_name":"Agostino Forestiero","orcid":"https://orcid.org/0000-0002-3025-7689"},"institutions":[{"id":"https://openalex.org/I3005160176","display_name":"Institute for High Performance Computing and Networking","ror":"https://ror.org/04r5fge26","country_code":"IT","type":"facility","lineage":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]},{"id":"https://openalex.org/I4210155236","display_name":"National Research Council","ror":"https://ror.org/04zaypm56","country_code":"IT","type":"funder","lineage":["https://openalex.org/I4210155236"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Agostino Forestiero","raw_affiliation_strings":["Institute for High Performance Computing and Networking, National Research Council, Rende, Italy"],"affiliations":[{"raw_affiliation_string":"Institute for High Performance Computing and Networking, National Research Council, Rende, Italy","institution_ids":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078466922","display_name":"Riccardo Ortale","orcid":"https://orcid.org/0000-0002-1763-9121"},"institutions":[{"id":"https://openalex.org/I3005160176","display_name":"Institute for High Performance Computing and Networking","ror":"https://ror.org/04r5fge26","country_code":"IT","type":"facility","lineage":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]},{"id":"https://openalex.org/I4210155236","display_name":"National Research Council","ror":"https://ror.org/04zaypm56","country_code":"IT","type":"funder","lineage":["https://openalex.org/I4210155236"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Riccardo Ortale","raw_affiliation_strings":["Institute for High Performance Computing and Networking, National Research Council, Rende, Italy"],"affiliations":[{"raw_affiliation_string":"Institute for High Performance Computing and Networking, National Research Council, Rende, Italy","institution_ids":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5076708603"],"corresponding_institution_ids":["https://openalex.org/I3005160176","https://openalex.org/I4210155236"],"apc_list":null,"apc_paid":null,"fwci":1.5916,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":{"value":0.86869944,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"16","issue":"6","first_page":"4514","last_page":"4525"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9904999732971191,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8425048589706421},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5610005855560303},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.36059021949768066},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3277962803840637}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8425048589706421},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5610005855560303},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36059021949768066},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3277962803840637}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tsc.2023.3327822","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tsc.2023.3327822","pdf_url":null,"source":{"id":"https://openalex.org/S204223317","display_name":"IEEE Transactions on Services Computing","issn_l":"1939-1374","issn":["1939-1374","2372-0204"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Services Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":69,"referenced_works":["https://openalex.org/W1567313600","https://openalex.org/W1604589174","https://openalex.org/W1623342295","https://openalex.org/W1966809779","https://openalex.org/W1971489298","https://openalex.org/W1974054882","https://openalex.org/W2025288138","https://openalex.org/W2060622768","https://openalex.org/W2086834050","https://openalex.org/W2115866740","https://openalex.org/W2117169652","https://openalex.org/W2118938540","https://openalex.org/W2127548576","https://openalex.org/W2132166479","https://openalex.org/W2138061404","https://openalex.org/W2160169104","https://openalex.org/W2167681385","https://openalex.org/W2167883163","https://openalex.org/W2536664292","https://openalex.org/W2559341072","https://openalex.org/W2594475271","https://openalex.org/W2599746129","https://openalex.org/W2765739766","https://openalex.org/W2783216063","https://openalex.org/W2789264396","https://openalex.org/W2798435682","https://openalex.org/W2891503716","https://openalex.org/W2897573886","https://openalex.org/W2902106343","https://openalex.org/W2922826722","https://openalex.org/W2963847595","https://openalex.org/W2981731882","https://openalex.org/W2997855035","https://openalex.org/W3003265726","https://openalex.org/W3004207920","https://openalex.org/W3015177564","https://openalex.org/W3015471529","https://openalex.org/W3101366597","https://openalex.org/W3101981467","https://openalex.org/W3118198986","https://openalex.org/W3121453273","https://openalex.org/W3124373176","https://openalex.org/W3132191748","https://openalex.org/W3134751001","https://openalex.org/W3135345798","https://openalex.org/W3157680283","https://openalex.org/W3197347140","https://openalex.org/W3202183072","https://openalex.org/W3204683301","https://openalex.org/W3208232092","https://openalex.org/W3211639647","https://openalex.org/W4205774955","https://openalex.org/W4210422587","https://openalex.org/W4213009331","https://openalex.org/W4226287023","https://openalex.org/W4242037245","https://openalex.org/W4283170759","https://openalex.org/W4309730097","https://openalex.org/W6628750762","https://openalex.org/W6682837551","https://openalex.org/W6695163837","https://openalex.org/W6734862562","https://openalex.org/W6766027632","https://openalex.org/W6790381653","https://openalex.org/W6792944898","https://openalex.org/W6807620384","https://openalex.org/W6807676046","https://openalex.org/W6808278428","https://openalex.org/W6809710906"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W4245926026","https://openalex.org/W4311097251","https://openalex.org/W2586548817","https://openalex.org/W2390279801","https://openalex.org/W2625093826","https://openalex.org/W4391913857","https://openalex.org/W2358668433"],"abstract_inverted_index":{"The":[0,126],"behavioral":[1,46,67,86],"analysis":[2],"of":[3,26,58,66,77,92,103,109,135],"smart":[4,27,59],"devices":[5,28],"plays":[6],"a":[7,49],"key":[8],"role":[9],"in":[10,23,74,84],"enforcing":[11],"security":[12],"for":[13,43],"IoT":[14,31],"environments.":[15],"In":[16,34],"particular,":[17],"anomalous":[18],"patterns":[19,65,87],"can":[20],"be":[21],"targeted":[22],"the":[24,55,75,78,100,104,107,130,136],"behavior":[25,57],"as":[29],"potential":[30],"cybersecurity":[32],"threats.":[33],"this":[35],"article,":[36],"an":[37],"explainable":[38],"machine-learning":[39],"approach":[40],"is":[41,52,72,118],"proposed":[42,137],"dealing":[44],"with":[45],"anomalies.":[47,68],"Essentially,":[48],"rule-based":[50],"classifier":[51,105],"inferred":[53],"from":[54],"observed":[56],"devices,":[60],"to":[61,80,112],"detect":[62],"and":[63,88,96,133],"explain":[64],"Predictive":[69],"association":[70],"modeling":[71],"adopted":[73],"formulation":[76],"classifier,":[79],"achieve":[81],"superior":[82],"effectiveness":[83],"detecting":[85],"ensuring":[89],"clear":[90],"explanations":[91],"both":[93],"these":[94],"latter":[95],"their":[97],"classifications.":[98],"Moreover,":[99],"specifically-conceived":[101],"design":[102],"reduces":[106],"number":[108],"tunable":[110],"parameters":[111],"one.":[113],"An":[114],"extensive":[115],"empirical":[116],"evaluation":[117],"comparatively":[119],"carried":[120],"out":[121],"on":[122],"real-world":[123],"benchmark":[124],"data.":[125],"experimental":[127],"results":[128],"reveal":[129],"effectiveness,":[131],"robustness,":[132],"scalability":[134],"approach.":[138]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":2}],"updated_date":"2026-03-13T16:22:10.518609","created_date":"2025-10-10T00:00:00"}