{"id":"https://openalex.org/W4385009227","doi":"https://doi.org/10.1145/3580305.3599238","title":"3D-IDS: Doubly Disentangled Dynamic Intrusion Detection","display_name":"3D-IDS: Doubly Disentangled Dynamic Intrusion Detection","publication_year":2023,"publication_date":"2023-08-04","ids":{"openalex":"https://openalex.org/W4385009227","doi":"https://doi.org/10.1145/3580305.3599238"},"language":"en","primary_location":{"id":"doi:10.1145/3580305.3599238","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3580305.3599238","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2307.11079","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5004185978","display_name":"Chenyang Qiu","orcid":"https://orcid.org/0000-0003-2332-8386"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chenyang Qiu","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-2332-8386","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108463861","display_name":"Y. M. Geng","orcid":"https://orcid.org/0009-0003-5690-1000"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yingsheng Geng","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0003-5690-1000","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103041212","display_name":"Junrui Lu","orcid":"https://orcid.org/0009-0000-2720-6840"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junrui Lu","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0000-2720-6840","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024601900","display_name":"Kaida Chen","orcid":"https://orcid.org/0009-0009-2948-5527"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaida Chen","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0009-2948-5527","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103249811","display_name":"Shitong Zhu","orcid":"https://orcid.org/0009-0000-7034-4202"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shitong Zhu","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0000-7034-4202","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102824207","display_name":"Ya Su","orcid":"https://orcid.org/0009-0003-4110-4500"},"institutions":[{"id":"https://openalex.org/I2250955327","display_name":"Huawei Technologies (China)","ror":"https://ror.org/00cmhce21","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250955327"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ya Su","raw_affiliation_strings":["HUAWEI Technologies Co., Ltd., Beijing, China"],"raw_orcid":"https://orcid.org/0009-0003-4110-4500","affiliations":[{"raw_affiliation_string":"HUAWEI Technologies Co., Ltd., Beijing, China","institution_ids":["https://openalex.org/I2250955327"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020360628","display_name":"Guoshun Nan","orcid":"https://orcid.org/0000-0002-1987-2736"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guoshun Nan","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-1987-2736","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100440851","display_name":"Can Zhang","orcid":"https://orcid.org/0009-0002-2554-3151"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Can Zhang","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0002-2554-3151","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011916209","display_name":"Junsong Fu","orcid":"https://orcid.org/0000-0002-2445-1987"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junsong Fu","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2445-1987","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018587643","display_name":"Qimei Cui","orcid":"https://orcid.org/0000-0003-1720-220X"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qimei Cui","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-1720-220X","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100624765","display_name":"Xiaofeng Tao","orcid":"https://orcid.org/0000-0001-9518-1622"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaofeng Tao","raw_affiliation_strings":["Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-9518-1622","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":15,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1965","last_page":"1977"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9890000224113464,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8500221371650696},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.630678653717041},{"id":"https://openalex.org/keywords/parameterized-complexity","display_name":"Parameterized complexity","score":0.5436612367630005},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5086873173713684},{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.4845108389854431},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4716692864894867},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4158773422241211},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.324335515499115},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.17385458946228027},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.17069843411445618}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8500221371650696},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.630678653717041},{"id":"https://openalex.org/C165464430","wikidata":"https://www.wikidata.org/wiki/Q1570441","display_name":"Parameterized complexity","level":2,"score":0.5436612367630005},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5086873173713684},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.4845108389854431},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4716692864894867},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4158773422241211},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.324335515499115},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.17385458946228027},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.17069843411445618},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3580305.3599238","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3580305.3599238","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2307.11079","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2307.11079","pdf_url":"https://arxiv.org/pdf/2307.11079","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2307.11079","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2307.11079","pdf_url":"https://arxiv.org/pdf/2307.11079","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.6299999952316284}],"awards":[],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4385009227.pdf","grobid_xml":"https://content.openalex.org/works/W4385009227.grobid-xml"},"referenced_works_count":83,"referenced_works":["https://openalex.org/W317957491","https://openalex.org/W1480909796","https://openalex.org/W2054626033","https://openalex.org/W2099831572","https://openalex.org/W2150134853","https://openalex.org/W2163922914","https://openalex.org/W2166858086","https://openalex.org/W2296509296","https://openalex.org/W2587847678","https://openalex.org/W2594644573","https://openalex.org/W2598265749","https://openalex.org/W2604105233","https://openalex.org/W2753738274","https://openalex.org/W2755038437","https://openalex.org/W2755619129","https://openalex.org/W2786385136","https://openalex.org/W2787322429","https://openalex.org/W2789828921","https://openalex.org/W2807015674","https://openalex.org/W2820900234","https://openalex.org/W2884561390","https://openalex.org/W2904235330","https://openalex.org/W2912207205","https://openalex.org/W2914767245","https://openalex.org/W2921019731","https://openalex.org/W2950095160","https://openalex.org/W2951086007","https://openalex.org/W2951428711","https://openalex.org/W2963351448","https://openalex.org/W2963748489","https://openalex.org/W2982223282","https://openalex.org/W2986385482","https://openalex.org/W2990376402","https://openalex.org/W2996847713","https://openalex.org/W2997686727","https://openalex.org/W2998313947","https://openalex.org/W2998387309","https://openalex.org/W2999639431","https://openalex.org/W3003685271","https://openalex.org/W3005031238","https://openalex.org/W3005097670","https://openalex.org/W3007404067","https://openalex.org/W3016987480","https://openalex.org/W3045601687","https://openalex.org/W3045734364","https://openalex.org/W3085131702","https://openalex.org/W3085955590","https://openalex.org/W3086583298","https://openalex.org/W3087095557","https://openalex.org/W3093410479","https://openalex.org/W3093580248","https://openalex.org/W3102091066","https://openalex.org/W3102359135","https://openalex.org/W3110852602","https://openalex.org/W3119802848","https://openalex.org/W3138819813","https://openalex.org/W3153183116","https://openalex.org/W3153493188","https://openalex.org/W3162956350","https://openalex.org/W3165990540","https://openalex.org/W3167595471","https://openalex.org/W3196585642","https://openalex.org/W3197971679","https://openalex.org/W3198264701","https://openalex.org/W3208773001","https://openalex.org/W3211805421","https://openalex.org/W3216490117","https://openalex.org/W4210587242","https://openalex.org/W4225697716","https://openalex.org/W4226319939","https://openalex.org/W4234837181","https://openalex.org/W4247857566","https://openalex.org/W4281384964","https://openalex.org/W4281385944","https://openalex.org/W4283766095","https://openalex.org/W4285723986","https://openalex.org/W4287115436","https://openalex.org/W4287755062","https://openalex.org/W4293651439","https://openalex.org/W4299365274","https://openalex.org/W4300011764","https://openalex.org/W4307042912","https://openalex.org/W6782808188"],"related_works":["https://openalex.org/W4320031223","https://openalex.org/W4200629851","https://openalex.org/W4281902577","https://openalex.org/W4309417370","https://openalex.org/W3009072493","https://openalex.org/W4386185023","https://openalex.org/W4317672133","https://openalex.org/W3140988292","https://openalex.org/W4386080799","https://openalex.org/W2089079925"],"abstract_inverted_index":{"Network-based":[0],"intrusion":[1],"detection":[2],"system":[3],"(NIDS)":[4],"monitors":[5],"network":[6,170],"traffic":[7,115],"for":[8,43,48,60,66,68,172],"malicious":[9],"activities,":[10],"forming":[11],"the":[12,61,76,98,155,169,204,218],"frontline":[13],"defense":[14],"against":[15],"increasing":[16],"attacks":[17,36,56,187],"over":[18],"information":[19],"infrastructures.":[20],"Although":[21],"promising,":[22],"our":[23,207,213],"quantitative":[24],"analysis":[25],"shows":[26],"that":[27,75,94,166,197,212],"existing":[28],"methods":[29],"perform":[30],"inconsistently":[31],"in":[32,175,188],"declaring":[33],"various":[34,134,186],"unknown":[35,46,192],"(e.g.,":[37,57],"9%":[38],"and":[39,63,73,105,128,194],"35%":[40],"F1":[41,59,65],"respectively":[42],"two":[44],"distinct":[45],"threats":[47,193],"an":[49],"SVM-based":[50],"method)":[51],"or":[52],"detecting":[53],"diverse":[54],"known":[55,195],"31%":[58],"Backdoor":[62],"93%":[64],"DDoS":[67],"a":[69,91,106,118,143,161],"GCN-based":[70],"state-of-the-art":[71],"method),":[72],"reveals":[74],"underlying":[77],"cause":[78],"is":[79],"entangled":[80],"distributions":[81],"of":[82,130,133,206,220],"flow":[83],"features.":[84,157],"This":[85],"motivates":[86],"us":[87],"to":[88,96,146,153],"propose":[89],"3D-IDS,":[90],"novel":[92,162],"method":[93,165],"aims":[95],"tackle":[97],"above":[99],"issues":[100],"through":[101],"two-step":[102,214],"feature":[103,215],"disentanglements":[104,216],"dynamic":[107],"graph":[108,163],"diffusion":[109,164],"scheme.":[110],"Specifically,":[111],"we":[112,159,182],"first":[113],"disentangle":[114],"features":[116,132,138],"by":[117],"non-parameterized":[119],"optimization":[120],"based":[121],"on":[122],"mutual":[123],"information,":[124],"automatically":[125],"differentiating":[126],"tens":[127],"hundreds":[129],"complex":[131],"attacks.":[135],"Such":[136],"differentiated":[137],"will":[139],"be":[140],"fed":[141],"into":[142],"memory":[144],"model":[145],"generate":[147],"representations,":[148],"which":[149],"are":[150,198],"further":[151],"disentangled":[152],"highlight":[154],"attack-specific":[156],"Finally,":[158],"use":[160],"dynamically":[167],"fuses":[168],"topology":[171],"spatial-temporal":[173],"aggregation":[174],"evolving":[176],"data":[177],"streams.":[178],"By":[179],"doing":[180],"so,":[181],"can":[183],"effectively":[184],"identify":[185],"encrypted":[189],"traffics,":[190],"including":[191],"ones":[196],"not":[199],"easily":[200],"detected.":[201],"Experiments":[202],"show":[203],"superiority":[205],"3D-IDS.":[208],"We":[209],"also":[210],"demonstrate":[211],"benefit":[217],"explainability":[219],"NIDS.":[221]},"counts_by_year":[{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}